texts:
Disclaimer: this is actually a coding challenge therefore I am expressly not looking for complete solutions.

The way the cipher works is as follows:

Start with ABCDEFGHIJKLMNOPQRSTUVWXYZ and a keyword KEYWORD. We construct our first alphabet by shuffling the above around each letter of the keyword in turn. I.e.:

First letter K, alphabet becomes LMNOPQRSTUVWXYZKABCDEFGHIJ

Second letter E, alphabet becomes FGHIJELMNOPQRSTUVWXYZKABCD

etc. etc. until we get the initial cipher alphabet: YFGHIJELMNRPQDSTUVOXWZKABC

In order to encrypt we then use this alphabet and for each letter in the plain text perform the same shuffling operation as in the inception stage around the plaintext letter (so if the first letter of the plaintext is F you would get J as the first ciphertext letter and your new alphabet would be GHIJELMNRPQDSTUVOXWZKABCFY

How would I go about solving this? I'm thinking known plaintext attack since I most likely know the beginning of the plaintext and also know that there are only a finite amount of possible words in the solution.

Further research led me to an obscure cipher Chaoscipher which goes in that direction.

Edit: longer example (also uses keyword as keyword):

doyouthinkthereisanotherwaytosolvethiscipher

becomes

HFUTLNAQYWHBWBEBTIEXWSZFGZQPINTQGHKDSVVVPXNM

Second edit: python code to test it

class ScrabbleCipher:
    def __init__(self, keyword):
        self.alpha = string.ascii_uppercase
        self.keyword = keyword.upper()
        self.initialAlpha()

    def initialAlpha(self):
        for i in self.keyword:
            self.shuffle(i)
        self.initial = self.alpha

    def shuffle(self, letter):
        try:
            tg = self.alpha.index(letter)
        except Exception as e:
            print letter
        self.alpha = self.alpha[tg+1:] + letter + self.alpha[:tg]

    def encrypt(self, plaintext):
        self.alpha = self.initial
        plaintext = plaintext.upper()
        ciphertext = ''
        for i in plaintext:
            pos = string.ascii_uppercase.index(i)
            ciphertext += self.alpha[pos]
            self.shuffle(i)
        return ciphertext

    def decrypt(self, ciphertext):
        ciphertext = self.sani(ciphertext)
        self.alpha = self.initial
        plaintext = ''
        for i in ciphertext:
            pos = self.alpha.index(i)
            corLet = string.ascii_uppercase[pos]
            plaintext += corLet
            self.shuffle(corLet)
        return plaintext


texts: What goals is homomorphic encryption aiming to solve?

texts:
As I understand from this article about homomorphic encryption, it
mainly aims to enhance the security of cloud computing. We should be able to encrypt data and send it to the cloud. After it is send, we should be able to make computation on the encrypted data and the result of this computation is an encrypted data too. If we decrypt the result of our computation, then we should get back the plain text version of the result.

The question is, why we assume it enhances the cloud computing? We could just encrypt data, send it to cloud. When we need to make computation, query these data to our computers and decrypt it, make computation, then send it back to the cloud if needed.


texts: Is AES without T-Tables nor S-Box resistant to side-channel?

texts:
T-Tables and S-Boxes are prone to side-channel attacks, is an implementation without any lookup tables resistant to side-channel ? In this answer, https://crypto.stackexchange.com/a/63520/80926, the author says that secret-dependent if statements, loops and mathematical operations like multiplications may not be constant time, can they make a side-channel attack possible ? ( On an implementation without any llokup tables ).
If they can, what can we do to have a side-channel resistant implemnetation of AES ? Because it seems that it is much slower than a regular implementation.
Is bitsliced the only solution for a device without AES-NI ?


texts: What is the recommended format/notation for crypto design?

texts:
Is there a recommended format or formal notation for documenting the combination of symmetric and asymmetric encryption, key derivation and other algorithms (and their inputs and outputs) that I think meet the needs of the software I'm contributing to the design of?

At the moment we're blithely using statements like "Encrypt with AES, reusing K1 with a fresh IV" - but of course that statement misses out details such as mode of operation, that I would certainly realise later, but wouldn't have initially written down in the design.

My goal is to document the design in a way that can be understood by other developers (with maybe a similar or better skill level), and to show all the system states, the movements between them and the encrypted/signed/etc messages that cause that - and perhaps eventually to use in a request for outside review.

As background, I have done a single undergrad cryptography course - I imagine this is the kind of thing covered later on, or in a more focussed degree?


texts: What can be said about the order of short Weierstrass curves with $a=1$ and $b=0$?

texts:
I am looking at a elliptic curves of the form $E:y^2=x^3+x$, i.e. short Weierstrass curves wtih $a=1$ and $b=0$, defined over a field $\mathbb{F}_p$ with $p$ being a safe prime. Somewhat interestingly, this is kind of an inverse Koblitz curve (where $a=0$ and $b\ne0$).
Because $b=0$, the case of $x=0$ will always be a valid point of order 2 at $(0, 0)$.

As far as I can tell, such a curve has a necessary cofactor $h=2\cdot2$, but I can't seem to find the reason for another point of order 2.
Are there other things that can be said about the curve's order?

The reason this is of interest is because older Windows product key systems used curves of this particular form.


texts:
Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA leaks information about the private key that would not otherwise become available?

Please clearly distinguish between attacks on the algorithm itself and side channel attacks. This question is not about the security of unpadded RSA signatures themselves.


texts: Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?

texts:
This question, while related, doesn't answer the security aspect I have in mind. I understand that signatures make it impossible for the tokens to be modified. But if I want the JWS token content to be non-visible, I keep hearing people mention JWE. But is there a security reason why I shouldn't be encrypting them myself?

If I take the JWT, encrypt it with AES-256-CBC (I prefer CBC over GCM because I don't want to fall into equal IV attacks), then MAC it with some hashing function like SHA-512 (HMAC-SHA512), convert both the ciphertext and the MAC to base-64, and put them in a printable string. Am I vulnerable to some security attacks if I use the outcome to authenticate users on a web application? Or is just "not nice"?

Looking at the RFC of JWE, I see there's a similar example. But given I'm not an expert in cryptography, I'm not sure whether I'm missing something.


texts:
Consider the following the following RSA public key $pk = (N, e) = (1457, 1307)$.

(a) Knowing that $187^2 \equiv 1 \pmod {1457}$ find the factorization of $N$.

(b) Given the factorization of $N$ computed above, use the CRT to decrypt the following ciphertext
$c = E_{pk}(m) = 3$.

For part a) I am not sure which property of modular arithmetic can be used? I know $187$  has a multiplicative inverse $187$. I also know the Euler function. But I think I am missing how to calculate $\phi$ from this information.


texts: Why do authors say conflicting things regarding leak-free stages in their paper?

texts:
In this paper the last sentence of the first paragraph in the abstract states:

  We assume a (necessary) “leak-free” preprocessing stage.

But then later on in section 1.4 they say

  Another interesting open question is to construct a leakage- resilient
  MPC protocol without assuming any leak-free stages,

Why do they say the leak-free stage is necessary but then later on they say it's an interesting open question ? When they say it's necessary doesn't that imply there is no open question (i.e. not debatable) ?

Is there any research done on leak-free stageS?


texts: The number of keys generated in TLS 1.2?

texts:
In section 6.3.  Key Calculation in the standard documentation here, I see the following:

  The master secret is expanded into a sequence of secure bytes, which
  is then split to a client write MAC key, a server write MAC key, a
  client write encryption key, and a server write encryption key.

  To generate the key material, compute

  key_block = PRF(SecurityParameters.master_secret,
                  "key expansion",
                  SecurityParameters.server_random +
                  SecurityParameters.client_random);

  until enough output has been generated.  Then, the key_block is
  partitioned as follows:

  client_write_MAC_key[SecurityParameters.mac_key_length]
  server_write_MAC_key[SecurityParameters.mac_key_length]
  client_write_key[SecurityParameters.enc_key_length]
  server_write_key[SecurityParameters.enc_key_length]
  client_write_IV[SecurityParameters.fixed_iv_length]
  server_write_IV[SecurityParameters.fixed_iv_length]

Correct me if I am wrong please, does this mean:

$ms$, $kc_{mac}$, $ks_{mac}$, $kc$, $ks$ = $kdf (ms, nonce_s, nonce_c)$ ??

My questions:

Does that means the kdf generates "actually" 6 keys, but in fact they are 4 keys?
Does that means, the Finished messages are encrypted with the MAC keys and the data are encrypted with another key?
Is the client_write key different from the server_write key? shouldn't they generate a share secret? shouldn't the application data encrypted with share symmetric key? why does the standard make two keys?


texts: Probability that length of shortest nonzero vector is less than a number

texts:
Let $\Lambda\subset \mathbb{Z}^n$ be an $n-$ dimensional lattice with determinant $d$. We know that the probability that a uniformly random integer vector $x$ is a point in $\Lambda$ is given by $\dfrac{1}{d}$. Denote $\lambda_1$ be the length of the shortest nonzero vector in $\Lambda$ and we know by Minkowski that if the $n-$dimensional ball $B:=B_R(\mathbf{0}$) has the property that $\textbf{vol}(B)\geq 2^n\cdot d$, then $B$ contains a nonzero lattice point in $\Lambda$ and also that $\lambda_1\leq \sqrt{n}d^{1/n}$.
Now, suppose that $\Lambda$ is a uniformly random chosen $n-$dimensional lattice with determinant $d$ and let $\delta\in (0,1)$. I want to get a nice upper bound for $$\Pr[\lambda_1(\Lambda)\leq\delta\sqrt{n}d^{1 / n}]$$, in other words, would like to make it as negligible as it can be with the proper choice of $\delta$.
My attempt is that $\Pr[\lambda_1(\Lambda)\leq\delta\sqrt{n}d^{1 / n}]$ is equal to $\Pr[\text{at least one nonzero vector in } \Lambda \text{ has norm }\leq \delta\sqrt{n}d^{1 / n}]$. If I take $R=\delta\sqrt{n}d^{1 / n}$, then the above probability is equivalent to $\Pr[\exists\mathbf{0}\neq\mathbf{x}\in\Lambda \cap B_R(\mathbf{0})]$. So this seems that I have to use a union bound, that is, $\Pr[\exists\mathbf{0}\neq\mathbf{x}\in\Lambda \cap B_R(\mathbf{0})]\leq \displaystyle\sum \Pr[\mathbf{x}\in\Lambda \cap B_R(\mathbf{0})]$, where the sum is over all nonzero integer vectors $\mathbf{x}\in\mathbb{Z}^n$.
So my questions are:

Is the above inequality that I did using the union bound correct? Are the description of events I made correct?
If the answers to my first question are in the affirmative, how do I calculate $\displaystyle\sum \Pr[\mathbf{x}\in\Lambda \cap B_R(\mathbf{0})]$? Is it equal to $\dfrac{\textbf{vol}(B_R(\mathbf{0}))}{d}$?


texts: How does one use AES block cipher modes of operation?

texts:
This is the sequel to my previous question about AES block cipher modes of operation.

(See: AES block cipher modes of operation)

Now, here is my real problem. I have to use a block cipher with 8 bit input block size. As you say, I think that every clock cycle I receive 128 bits of information. With the 8 bit component, I have to make a structure of 16 of these components to encrypt the 128 bit information. How many round cycles does a structure like this need to encrypt the whole 128 bits. I assume the answer is 16*10, when I choose a mode which can't be parallelized (like OFB or CFB), and just 10, when I use parallelized modes (CTR). But, in the next clock cycle, I'll receive another 128 bit of information (a new message?).

The structure which encrypts the first 128 bits, after how many round cycles can it start to encrypt a new message?
If I want to encrypt continuous information, to encrypt every 128 bit of information I receive per cycle, do I have to make as many structures, like this one described above, as round cycles of the first structure?
If I use for example CFB or OFB mode, which need an IV, I have to generate a new IV every new message (every 128 bits). Am I right?


texts: Must the ciphertext be longer than the key for symmetric encryption?

texts: I am planning to encrypt the different fields of a database independently, using a symmetric encryption scheme (probably 3DES). Since some of the fields are as small as an integer, may that be problematic?


texts:
I have a hardware engine for SHA256 which can process 64K of data, but the input data size I am getting is around 1MB. What should I do to process 1MB size.

What should be my input after 1st 64KB and what will be my IV (initial vector)?
Can anyone provide any idea?


texts: Is Mathematics or Computer Science more important for a career in cryptography

texts:
I'm a Mathematics Major, and I currently enjoy the mathematical aspects of cryptography. I intend to pursue a career in cryptography research.

https://www.csit.gov.sg/join-us/job-opportunities/job-detail/cryptologist

However, although I'm comfortable with the mathematical aspects of it, I lack sufficient training in computer science and computer programming. Therefore, I'm trying to pick up programming and computer science skills at the moment. Are programming skills/computer science important for cryptography? (With respect to the job listed above)

And if so, which computer science topics are most relevant to cryptography? Are topics in data structures necessary for cryptography research? And lastly, how good do my programming skills need to be in order to pursue a career in cryptography? (Such as in the job listed above)


texts: openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

texts:
after creating CSR using openSSL with secp256r1 curve
inspecting the file using openssl asn1parse -i -in ecTest.csr
the size of the signature is 73 bytes, why?
I think the ASN.1 of the signature is
ECDSA-Sig-Value ::= SEQUENCE { r  INTEGER, s  INTEGER }

and for secp256r1 that r and s are 32 bytes each which means
   1+1    +  1+1+32   +  1+1+32  = 70bytes
SEQUENCE     INTEGER     INTEGER


texts: Efficient algorithm for finding Sophie Germain primes

texts:
What's the industry standard for an efficient finding large Sophie Germain primes?

As a part of request handling in my application, I need to generate Paillier key.

My current approach is to generate a pseudorandom probably prime number q backed up by Miller-Rabin test, then setting p = 2q + 1 and checking if p is also prime with Miller-Rabin and Baillie-PSW. This is repeated until p is prime.

loop {
  q <- randomPrime(nbits - 1) // generates probably prime number,
                              // performs Miller-Rabin tests on the result
  p = 2q + 1
  return if isPrime(p)  //applying the Miller-Rabin & Baillie-PSW tests
}

For nbits = 1024 one loop step takes about 100ms on my laptop. Not that bad, but in order to find desired p and q I need to execute several loop steps. The best result so far was 156 retries  (~16s), the worst one was 1616 retries (~160s).

It's a way above required latency so I wonder what's considered the correct approach nowadays.


texts: Why can you use shorter keys with elliptic curve Diffie Hellman key exchange?

texts: I am a layperson interested in how cryptography works. I would like to know why you can use shorter keys with elliptic curve Diffie-Hellman (ECDH) than with the discrete log DH key exchange. Both have to be large enough to withstand brute force attacks. So I assume there must be some attacks that you can use to try and crack the DLP that can't be used on ECDH and that would force you to chose a longer key for it to be safe. Thank you in advance for your help.


texts: Interpretation of advanced composition theorem of differential privacy

texts:
In "The Algorithmic Foundations of Differential Privacy" book, Advanced Decomposition Theorem (Thm 3.20) is stated as follows:

For all "$\epsilon, \delta, \delta' \geq 0$, the class of
($\epsilon,\delta$)-differentially private mechanisms satisfies
($\epsilon',k\delta+\delta'$)-differential privacy under $k$-fold
adaptive composition for:
$\epsilon'=\sqrt{2k\ln{(1/\delta')}}\epsilon +k\epsilon(\exp(\epsilon)-1)$

I have two questions related to this theorem:

If the all private mechanism of interest are $(\epsilon,0)$-differentially private, and in my understanding $\delta'$ is a tuning parameter, can't we have $\delta'=0$? Isn't that theorem a better composition than the basic decomposition in which $\epsilon$'s and $\delta$'s adds up? In the basic decomposition theorem, if all the mechanisms are $(\epsilon,0)$-differentially private, then we can have $(k\epsilon,0)$-differentially private composition.
On page 52 of the same book (just after Example 3.7), it is said that:

So how many queries can we answer with non-trivial accuracy? On a
database of size $n$ let us say the accuracy is non-trivial if the
error is of order $o(n)$. Theorem 3.20 says that for fixed values of
$\epsilon$ and $\delta$, it is possible to answer close to $n^2$
counting queries with non-trivial accuracy. Similarly, one can answer
close to n queries while still having noise $o(\sqrt{n})$ — that is,
noise less than the sampling error.

I didn't understand how Theorem 3.20 says that. How do we measure the error here, and how the theorem is used to conclude this?


texts: Any functioning system for interactive proof?

texts:
My problem is to outsource an array of data and ask the prover to sort the data.

I am wonder if there is any working system out there that support interactive proof for the above computation? Or if none, any particular protocol that may be efficient enough and implementable for the problem of verifiable sorting?


texts: Deriving HMAC key and cipher key from passphrase?

texts:
I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file cumulatively.

My main question is how to derive both an HMAC key and my AES key from an input passphrase. I'm currently taking the SHA-512 hash of the input passphrase, passing that to bcrypt/PBKDF2 with a salt and high rounds, and then using the SHA-256 hash to supply my AES cipher password. For deriving an HMAC key in addition to my cipher key, I was thinking of doing one of the following things:

SHA-512 the output from the strong hash method and split the result in half, using the first half as the cipher passphrase and the second half as the HMAC passphrase.
Store an additional salt in my header, and after generating the passphrase using SHA-256 after the strong hash, run the result through SHA-256 again with the salt for the HMAC passphrase.
Same as #2, but without a salt.

Which of these ways is the best way to generate a HMAC password in addition to my cipher password from the same input passphrase?


texts: Text messaging application - AES with or without message authentication

texts:
I want my application to have confidentiality and integrity.

Let's say I have managed to securely share an AES key between two parties in my messaging application.

The applications communicate by sending XML messages. The XML has two tags, one for the actual text message and one for the timestamp the message was sent. This is in order make sure a replay attack cannot take place.

The XML message is encrypted with the AES algorithm and then it is sent to the recipient.

Should in this scenario add message authentication? Since the key is only known by the two parties, it should be enough to provide both confidentiality and integrity.

The worst case scenario I can think of, is someone sending a random stream of characters which will be decrypted successfully in a well formed XML message with a correct timestamp, since in any other case the message will be ignored by the receiver.


texts: How much data does a session/data key typically encrypt?

texts:
I believe the masker key, $MK$, of a block cipher might be used for several years and is used only to encrypt $\textit{key encrypting keys}$, which in turn are used only to encrypt $\textit{data keys}$. These data keys are the ones actually used in cryptographic computations and are often also called $\textit{session keys}$. They have short lifetimes and may be used only for a single session. My questions are:

What is a 'single session'?
How much data might the same session key be used for (max or min?)
How long would a session key be used for?

I know answers to these questions depend on many things, such what is being encrypted, how long must it remain secure, etc. but just some ideas or real-world examples would be helful.


texts: Discussion about the importance of communication complexity for MPC?

texts:
Communication complexity is generally discussed among many papers on secure multi-party computation (MPC).
However, I do not still understand the importance of it.

What communication complexity affects is total computation time in a protocol depending on available bandwidth rate (10Mbps, 1Gbps, etc).

Is the communication complexity really important?
When is it captured as primary result of some paper?

With a specific programming implementation detail, I can understand the total execution time including data transmission during the protocol. But from the communication complexity (even if some paper reduced it significantly compared with prior works), I wonder when and why it makes sense.

What is the advantage of reducing communication cost (in general at the expense of computation time on some nodes) in practice?


texts: In RSA public-key material (e, N), why must the encryption exponent e be relatively prime to $\phi(N)$? Why must any public key encryption algorithm resist CPA?


texts:
After trying to invent my own AES mode, I decided to just implement something that's known to work, namely CTR mode with HMAC-SHA-256.

From what I understand, I can use the IV as a counter, and the IV only has to be unique for each key (generating unique IVs isn't a problem). Correct?

Is it a problem for HMAC-SHA-256 if I construct a SHA block using a 32 byte key, 16 byte counter and 16 zero bytes for padding, or is it better to generate a 64 byte key so it fits in one SHA block and make another block for the counter and pad that block with zero bytes?

If I want to add a salt to anything, I assume the salt is stored unencrypted. Correct?

Edit for clearing up some things:
Using the IV as a counter implies that it changes for each encrypted block. In this case I'll use a simple time stamp directly from the OS that's 12 bytes large (resolution is in ticks, which are 1/50th of a second, software waits one tick before generating an IV, system is slow so not a problem). The remaining four bytes are used as a block counter (simply starts at zero).
The intended HMAC setup is:
The first SHA-256 message is made of the first HMAC key, the IV, padding and the cipher text. The first SHA-256 block will be the first HMAC key (32 bytes), then the 16 byte IV, then 16 bytes of zero padding. The remaining blocks for the message are cipher text blocks, with normal SHA padding after the last cipher text block (normal SHA operation). The resulting hash is the first HMAC hash.
The second SHA-256 message is the second HMAC key (32 bytes) and then the first HMAC hash (32 bytes), with the normal SHA padding at the end. This is the authentication tag.
Second edit:
After searching the web some more, I found that I made some assumptions about the way the HMAC keys are used. I've used some test vectors from NIST to verify that I'm doing things properly, and that's now the case.
Proper HMAC-SHA-256 setup:
Take first 32 byte HMAC key, append 32 zero bytes, XOR IPAD over the resulting 64 byte block, append cipher text, hash.
Take second 32 byte HMAC key, append 32 zero bytes, XOR OPAD over the resulting 64 byte block, append first hash, hash.
I assume you can prepend the nonce to the cipher text so it gets hashed as well. Correct?


texts: How difficult is it to get a key using simple XOR

texts:
Recently someone gave me an algorithm as follows:

XOR = Key XOR Random1 XOR Random2.

They think that in order for someone to extract "Key" from XOR they would need Random1 and Random2.. but looking at the above algorithm, i think it should be fairly easy for someone to guess or extract the Key w/o Random1 and Random2. The data is just 256 bits long.

Thoughts?


texts:
I am implementing the following the algorithm instructions as shown in 1 (section IV, B).

When trying to verify the share given the commits, $a_jG$ verifier $i$ checks whether $f(i)G=\sum_{j=0}^{t} (x_i)^ja_jG $.
The phrasing of the verification is unclear to me, on the left side of the equation there is a scalar on the elliptic curve, on the right side there is a a polynomial.
Should the polynomial on the right be evaluated at point $i$?

A robust threshold elliptic curve digital signature providing a new verifiable secret sharing scheme


texts:
Andy is going to connect to a server Selma over TLS.  Later, Andy would like to be able to publish everything (the ciphertexts, the plaintexts, all his keys) and prove to a mediator what data he sent to Selma over TLS; or prove what data Selma sent to him over TLS.  Is there any way I can do this?

More specifically: We need some way that a third party could look at the information Andy published and convince themselves that he's not lying.  Selma is an existing, unmodified TLS server; it can't be modified.  Assume that Selma is trusted: i.e., the third party will be willing to trust that Selma isn't trying to fool them and isn't in collusion with Andy.  However, the third party doesn't trust Andy: they'll want a way to verify Andy is not lying about what data was sent/received over the TLS connection.  It's OK for Andy to use some clever/sneaky/weird combination of TLS options and features and random values/nonces, if that helps achieve this goal.  It's OK to use client certs.  Andy is willing to reveal his private key and all session keys when he publishes his data.

Is there a way to achieve these goals and enable Andy to prove what data was sent/received over the TLS connection with Selma?

I do know it might be possible for Andy to later prove that he did open a TLS connection with Selma (because the TLS protocol has Selma sign or decrypt something).  But that's not enough for my purposes; I want Andy to be able to demonstrate what data was sent over the TLS connection.  It's not enough to merely demonstrate that a TLS connection between Andy and Selma existed at one point in time.

My analysis: I can't see a way to achieve this goal.  It seems we'd need a way to make Selma sign something that depends upon the application data.  However, in the TLS protocol, what Selma signs seems to be independent of the application data.  The Finished message has a running hash of the contents of all of the handshake messages, but it doesn't seem to include any of the application data, and in any event it isn't signed.  I looked at multiple key exchanges and at features like session renegotiation and false start, but still couldn't find a way to do it.  I've seen Does a trace of SSL packets provide a proof of data authenticity?, which says the answer is no if Andy and Selma don't do anything strange.  Does the answer change if Andy has the freedom to abuse the protocol or send whatever he wants?

To rephrase: if the answer to my question is "it can't be done", that means that the data is fully deniable: regardless of what Andy does, Andy can always change his mind and later come up with a fake transcript and lie about what data was sent/received.  On the other hand, if the data isn't deniable in some circumstances, then that presumably must imply some kind of "yes" answer to my question.


texts: What is the most efficient attack on NTRU?

texts:
So, I got how finding the private key is equivalent to resolving the SVP. I also understood that the LLL algorithm can only be used in small dimensions. Now, I wonder what is the most efficient attack one could do? Does it have to be comprehensive like the meet-in-the-middle one? Is it possible to use the LLL to speed up the process?

Thanks!


texts: What security do Cryptographic Sponges offer against generic quantum attacks?

texts:
In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides:

Collision resistance up to $2^{256}$ operations
Preimage resistance up to $2^{256}$ operations
Second preimage resistance up to $2^{256}$ operations

In general however, using quantum computing, specifically Grover's Algorithm, hash functions can be attacked more efficiently. Daniel J. Bernstein wrote about quantum attacks against all the second round SHA-3 candidates. However, in that paper, all the attacks against Keccak variants are against truncated hashes with an internal capacity of twice the hash length, for example Keccak[r=1152,c=448] with 224 bits of output.

My question is, if the full 512 bit hash output length of Keccak[r=1088,c=512] is used, does this provide security up to $2^{256}$ operations against quantum attackers using Grover's algorithm, or is security limited to half of the preimage strength, that is, only $2^{128}$ operations?


texts: Why do we need to use supersingular curve on SIDH?

texts: if i'm not mistaken, the supersingular curve's endomorphism ring is non-abelian. but why does it matters? or is it not even related to its endomorphism ring?


texts:
I'm currently reading the work "Obfuscation of probabilistic circuits and Applications' by Canetti Lin Tessaro and Vaikuntanathan 2015. It says sub exponentially hard OWF implies
sub exponentially hard PRF ( puncturable PRF) and later again proves that sub exponentially hard PRF ( puncturable PRF) + sub exponentially hard iO $\implies$ pIO(probabilistic circuits).

I'm really confused with what the author means by the term "subexponentially hard" and is it a weather or a stronger assumption when it comes to the OWF or iO.

Thanks in advance


texts: Review of AES encryption concept for an open source project

texts:
i'm working on an opensource project, A generator for static (html/js), password protected photo galleries. The generator AES 256 encrypts many images with the same key in PyCrypto, and decrypt them with CryptoJS. That's what my prototype does so far:

General

AES 256 mode=CBC, padding=Pkcs7
Encrypt many images with the same salted password
an unique iv for every image
store the unencrypted salt and the unencrypted iv with every encrypted image
store the plain sha1 of the unencrypted image with the encrypted image

Password

salt = 16 random bytes from Random()
aes_key = PBKDF2(dkLen=32, count=1000, salt=salt) of the user selected password
The user can select the password. ATM the only requirement is: min 8 chars.

IV

iv = 16 random bytes from Random()

Do you think this procedure is ok for my use case?
If so, can someone review my python code to encrypt the images? (I'll provide the code on github if general procedure  is ok)

Thank you very much for help and have a nice day,
Boerni


texts: Hashing entropy with only 128 bits of internal state

texts:
I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher.

As the key size is only 128 bits, using a 256-bit entropy pool hashing algorithm to maintain each pool would seem to be excessive (and a waste of memory).  I would like to use a hashing algorithm for which I only need to maintain 128 bits of state information for each pool.  Given this, I have a couple of questions:

Would it be possible to use something like SHA-256, but only save (and restore) 128 bits of the internal state between invocations?  Would this somehow risk losing entropy in the process, or produce other undesirable effects?

Alternately, the crypto library I'm using also supports MD5, which does only require 128 bits of internal state.  Would it be better to use MD5 for this application, despite its potential weaknesses compared to SHA-2 hashes, or would SHA-256 be stronger, even when maintaining only half its internal state between calls?


texts: How would P=BPP affect zero knowledge proofs?

texts: If there were a proof to show that P=BPP, how would this affect zero knowledge proofs and the fiat-shamir heuristic for Turing an interactive proof into a non-interactive proof?


texts:
Let's suppose we are given a linear polyonmial
$$\begin{align}f(x) = ax + b\end{align}$$
where a and b is known which satisfies this equation
$$\begin{align}y^3 - f(x) \equiv 0\mod(n) \end{align}$$ where n is RSA modulus.
Is there any way to solve for pair(x,y)?
Follow-up question: If there is restriction where only those values of x are allowed for which $$\begin{align}f(x)<n \end{align}$$


texts: Squaring the coefficients in homomorphic encryption

texts:
In homomorphic encryption scheme FV, I can multiply an encrypted polynomial for any integer scalar, obtaining the same effect on the plain polynomial. For example, given the plain polynomial $\sum_ia_ix^i$, and its encrypted version $\sum_ib_ix^i$, I could multiply the latter by $c$ and decipher it, to obtain $\sum_i(ca_i)x^i$. Is there a way to do the same with squaring? Can I perform some operation on $\sum_ib_ix^i$ and then decipher it, to get $\sum_ia_i^2x^i$? I already tried with $\sum_ib_i^2x^i$, but it just dosen't work.

About the reasons I'm doing this, it's because I have to use a polynomial activation function in a neural network that uses homomorphic encryption, as explained in this paper


texts:
I have recently written an implementation of Serpent and was testing it against known vectors to no avail.  Using 256-bit key, I compared my encryption to the test vectors located here:
http://www.cs.technion.ac.il/~biham/Reports/Serpent/Serpent-256-128.verified.test-vectors
For some reason, I match none of these test vectors, and I do not know why.  I downloaded the Python implementation found here:
https://www.cl.cam.ac.uk/~fms27/serpent/serpent.py.html
The Python implementation agreed with me and disagreed with the published test vectors.  I did, however, find two files in folder Floppy 4 (ecb_tbl.txt) and (ecb_iv.txt) from the full submission package (http://www.cl.cam.ac.uk/~rja14/Papers/serpent.tar.gz) which I completely agree with. If I put in the given 256-bit key and the given plaintexts, I do achieve the correct encrypted ciphertexts.
Are the test vectors published on biham's website incorrect, or is there perhaps something I am missing?  If they are wrong, why are they still up and way easier to find than the ones I matched with?
As an example, on Biham's site,
key=8000000000000000000000000000000000000000000000000000000000000000
plain=00000000000000000000000000000000
cipher=A223AA1288463C0E2BE38EBD825616C0
But both my implementation and the Python reference implementation give:
cipher=abed96e766bf28cbc0ebd21a82ef0819
I think it has something to do with this NESSIE format, but so far, I have been unable to determine if that is true and what exactly that means.


texts: Simplified Lagrange interpolation formula inside Shamir's secret sharing scheme

texts:
I originally posted this question in the math stackexchange, but I then thought that it might be more appropriate in this section. I am currently studying Shamir's secret sharing scheme, which uses Lagrange's interpolation formula to reconstruct a key $K$ from a certain number of shares. In Shamir's scheme, during key reconstruction, there is no need to reconstruct the entire polynomial $a(x)$ since we only need the value $a(0)$, the secret. Therefore, we can use a simplification in the formula by substituting $x=0$ in the original Lagrange formula, which then becomes this:

$$K = \sum_{j=1}^t (y_j \prod_{1 \leq k \leq t} \frac {x_k} {x_k - x_j}) \pmod p$$

where $y_j$ are the shares owned by the participants. If we now define

$$b_j = \prod_{1 \leq k \leq t} \frac {x_k} {x_k - x_j} \pmod p$$

we can then reconstruct the key $K$ with this formula:

$$K = \sum_{j=1}^t b_jy_j \pmod p$$

And during the calculation of $b_j$ is where I hit a wall: in the book that I am using to study this (Cryptography Theory and Practice, by Stinson and Paterson), there is an example of how to compute $b_j$. We are given the following values:

$x_1=1, x_2=2, x_3=3, x_4=4, x_5=5$

And we want to get the value of $b$ for $x_1$, $x_3$ and $x_5$. The book shows this example for $b_1$:

\begin{align}
b_1 &= \frac{x_3 x_5}{(x_3 - x_1)(x_5-x_1)} & & \pmod{17} \\
&= 3 * 5 * (2)^{-1} * (4)^{-1} & & \pmod{17}\\
&= 3 * 5 * 9 * 13 & & \pmod{17} \\
&= 4 & & \pmod{17}
\end{align}

How did we get from $(2)^{-1}$ and $(4)^{-1}$ to $9$ and $13$ respectively?


texts:
I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa?
Also, why will we prefer to use a block cipher at all if we can use a stream cipher - which is faster, errors are not cumulative and doesn't require padding when the message has a different size than the block (like in ethernet encryption, where we have to pad the frame to multiplication of 16 if we want to use, for example, AES-CBC-128 block cipher)?
Thanks in advance


texts: What is the current standard of random bit generators? RSA relies on two large prime numbers, and I am wondering what is the algorithm used to generate such numbers?


texts: Why is the Domingo-Ferrer cryptosystem not used in practice?

texts: The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more significant shortcomings due to which it is not recommended to be used?


texts: How can we know who sent a MAC-then-encrypt message?

texts:
I read about MAC-then-encrypt vs encrypt-then-MAC and I understood why MAC-then-encrypt is better but what if we have two parties that needs to know who signed the message before read it?

Example:

A and B want to communicate but they don't want to open suspicious files, B needs to know that the message received was sent by A. If they MAC-then-encrypt their messages, they can't know who sent the messages.

I was think about a MAC-then-encrypt-then-MAC solution but is this a good way to do this? I think this case has the same problem than encrypt-then-MAC.


texts: Can a PRF distiguisher invoke the function's algorithm?

texts:
The definition of a function $F:\ \{0,1\}^n\times\{0,1\}^n\to\{0,1\}^n$ being a Pseudo Random Function Family (PRF) is that it's implementable by a P.P.T. algorithm $\mathcal F$, and there is no P.P.T. algorithm $\mathcal A$ able to distinguish $x\mapsto F(k,x)$ from a random function for unknown random $k$ and non-vanishing probability.
Is the algorithm $\mathcal A$ allowed to invoke the algorithm $\mathcal F$ implementing $(k,x)\mapsto F(k,x)$? Or even more generally, part of it?

That seems necessary to decide if the following $G$ is a PRF or not.

Let $H:\ \{0,1\}^n\times\{0,1\}^n\to\{0,1\}^n$ be a PRF.
Let $P_c:\ \{0,1\}^n\to\{0,1\}^n$ be a PRP with key fixed to arbitrary constant $c$, with both $P$ and ${P_c}^{-1}$ computable by a P.P.T. algorithm.
Define $G:\ \{0,1\}^n\times\{0,1\}^n\to\{0,1\}^n$ by (assimilating bitstrings to integers per big-endian convention)
$$G(k,x)\underset{\text{def}}=\begin{cases}
{P_c}(k\bmod2^{\lfloor n/2\rfloor})&\text{if }x=0^n\\
1^n&\text{if }x=1^n\text{ and }P_c^{-1}(k)<2^{\lfloor n/2\rfloor}\\
H(k,x)&\text{otherwise}
\end{cases}$$

Essentially, $G$ is the PRF $H$, except it has a set of weak keys $k$ of size $2^{\lfloor n/2\rfloor}$, such that whatever $k$, $G(k,0^n)$ is a weak key; and when $k$ is a weak key, $G(k,1^n)$ is $1^n$.
We can build a distinguisher for $G$ that

submits $x=0^n$, gets $y$
applies the algorithm for $G$ to input $(y,1^n)$
tests if the outcome is $1^n$, which will always be the case for $G$, and only with vanishing  probability for a random function.

However there seems to be no distinguisher if we can neither apply the algorithm for $G$, nor analyze it to extract $c$.

Motivation is this question, which asks if $F_2(k,x)\underset{\text{def}}=F(F(k,0^n),x)$ is a PRF, assuming $F$ is a PRF. If the above $G$ was a PRF, $F=G$ would be a counterexample.


texts: We know that 3DES is created with $E_{K_3}(D_{K_2}(E_{K_1}(m)))$ to extend DES's key length. Is it possible to extend it further by repeating this pattern? Perhaps using $E_{K_5}(D_{K_4}(E_{K_3}(D_{K_2}(E_{K_1}(m)))))$ for a 280 bit key.


texts: Encryption method with master key and user keys

texts: I am working on a concept for a game that in the end will allow data sharing via plain text, but I would like to give the user the option of encrypting the data so that other players cannot modify it, but the program/game will still be able to read the data for use otherwise.  My question then would be, is there a method of encryption where the game/program has a master key that can decrypt the data, but also the user can input their own password as a key to modify the data?  Thank you for your time.


texts: Keys-space for a restricted substitution cipher

texts: How can one calculate the key-space for a restricted substitution cipher? A restricted substitution cipher is one where no letter is assigned to itself. For an alphabet with 26  letters how many keys are there for a restricted substitution cipher? What is the correct way to approach this question? I have been adviced to look into cycle notations, Markov chains and the structure of the symmetric group and its conjugacy classes.


texts: Is it possible to do partial message authentication?

texts:
I want to authenticate part of a message, not all of it, while creating the MAC over the entire message. Let's say I create a 16B MAC over one hundred message blocks that are 64B each. Then I send one 64B message and the combined MAC to the receiver. The receiver has to verify the 64B using the MAC while it does not have the entire message.
Is there any cryptographic algorithm/way to do that?


texts: Message-Recovery variant of Ed25519 signature?

texts:
What would be a Message-Recovery variant of the Ed25519 signature scheme?

Ed25519-MR should be simple to use, fast, with a strong security argument, and striving to stay out of the patent minefield, as the original does.

[Ed25519] is a signature scheme with appendix: it adds a signature of 512 bits to the message that it signs, for 128-bit conjectured security. A Message-Recovery variant would embed some of the signed message into the signature, with that so-called recoverable part of the message a byproduct of successful verification, that needs not be explicitly transmitted. We wish to minimize the overall signed message size.

Signatures schemes with message recovery of the Elliptic Curve Discrete Logarithm family have been proposed, patented and standardized (see bibliography), including ECNR (Nyberg-Rueppel), ECMR (Miyaji), ECAO (Abe-Okamoto), ECPV (Pintsov-Vanstone, aka ECPVS, PVSSR, ECSSR-PV), ECKNR (KCDSA/Nyberg-Rueppel) per their name in [ISO 9796-3].

Addition: I'm puzzled at the achievable gain over a signature scheme with appendix. My reading of [PV1999] and [AO1999] is that for $b$-bit security and arbitrary message, ECPV and ECAO embed $b$ bits into a $4b$-bit signature; when my limited understanding of other schemes is that some aim at embedding $2b$ bits.

Bibliography on (possibly Elliptic Curve) Discrete Logarithm Signatures with Message Recovery.

[NR1993]: Kaisa Nyberg and Rainer A. Rueppel, A new signature scheme based on the DSA giving message recovery, in proceedings of CCS 1993;
[NR1994]: id., Message recovery for signature schemes based on the Discrete Logarithm problem, in proceedings of EuroCrypt 1994;
[US'725]: Rainer A. Rueppel and Kaisa Nyberg, Digital signature method and key agreement method, US 5,600,725.

[M1995a] and [M1995b]: Atsuko Miyaji, Weakness in message recovery signature schemes based on discrete logarithm problems (continued), in IEICE TF;
[Mi1996a]: id., Signature equation suitable for message recovery schemes in IEICE TF;
[Mi1996b]: id., A message recovery signature scheme equivalent to DSA over elliptic curves, in proceedings of AsiaCrypt 1996;
[Mi1997]: id., Another countermeasure to forgeries over message recovery signature in IEICE TF;
[JP'357]: Miyaji Mitsuko, Message decoding type signature system, JP Pub.# H09-034357 ;
[JP'492]: id., Signature system, JP Pub.# H09-160492 .

[AO1999]: Masayuki Abe and Tatsuaki Okamoto, A Signature Scheme with Message Recovery as Secure as Discrete Logarithm in proceedings of AsiaCrypt 1999;
[AO2001] id., id., in IEICE TF;
[JP'178]: id., Message recovery type signature system and program storage medium therefor, JP Pub.# 2001-134178 .

[PV1999]: Leon A. Pintsov and Scott A. Vanstone, Postal Revenue Collection in the Digital Age, in proceedings of FC 2000;
[PV2000]: id., submissions to IEEE P1363a, including [PVSSR-D2] and [PVSSR-D3].

[BJ2001]: Daniel R. L. Brown, Don B. Johnson, Formal Security Proofs for a Signature Scheme with Partial Message Recovery, in proceedings of CT-RSA 2001; drafts: [BJ2000-02], [BJ2000-06].

[P1363a]: IEEE Standard 1363a-2004 - Specifications for Public-Key Cryptography - Amendment 1: Additional Techniques.

[ISO ISO9796-3]: ISO/IEC 9796-3:2006, Information technology — Security techniques — Digital signature schemes giving message recovery — Part 3: Discrete logarithm based mechanisms. Free previews in HTML and PDF.

[X9.92-1]: ANS X9.92-1-2009 (reaffirmed 2017, reportedly without change). Public Key Cryptography for the Financial Services Industry - Digital Signature Algorithms Giving Partial Message Recovery - Part 1: Elliptic Curve Pintsov-Vanstone Signatures (ECPVS).

[Ed25519]: Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang, High-speed high-security signatures, in proceedings of CHES 2011.


texts: Name and security of these non-invertible functions?

texts:
I would like to learn more about a specific set of non invertible functions:

The function should accept 2 inputs: one hidden and the other visible.
The output and the function should also be visible.
The hidden input will not change, the visible will.
The function should be deterministic. Collisions are acceptable given there are not too many.

An important requirement is that given a long enough hidden parameter 10-20 characters it will not be possible calculate the output of the function given another visible input (which includes not being able to calculate the hidden parameter…).
When I say possible to calculate I mean that one would have to basically brute force all the possible combinations for 10-20ish characters and that there is no simple mathematical shortcut.
This is my current algorithm:
x- hidden input string
v- visible input string

I first mix the inputs. Once one of them is finished append the rest of the other on the end, so for example :
if len(x)>len(v):
    s = [x[0],v[0],x[1],v[1], … ,x[len(v)],v[len(v)], … ,x[len(x)-1],x[len(x)]]

Now calculate the output by:
associating each character in s with a predefined number such as

a:1
b:2
…

and
output = 1
for each item in s:
    output += truncate(sin(output+item)) // truncate for similar behavior
                                         // on different sin implementation

The output should be a number between -1 and 1.
Questions:

Will this algorithm fulfill the requirements I mentioned above?
More specifically – for the same hidden input, given multiple visible inputs and their associated visible outputs – can an attacker easily find the output for an additional visible input?

How do I name these functions (So that I can read more about these constructs)?


texts: Stateless proof-of-work system with 0-roundtrip time

texts:
I'm designing an API. To avoid abuse, I need to rate limit the requests somehow, but I don't want to do it per user as it's very easy to create new accounts automatically. I think a proof of work algorithm would do this job well, but I thought I would ask an expert, i.e. this community.

These are the properties I would like:

Stateless, but ahead of time setup of state, such as creating a user account, is ok. Two subsequent requests may hit different servers before they have shared their state with each other.
Preferably zero round trip time, i.e. the user does not have to ask a server what work it should do before actually doing it. This basically implies that the requests are stateless.
Requests should be able to run in parallell, even for the same user.
Adjustable difficulty.

I can think of some systems that fulfill some of the above properties, but not all.

Hash on userid + (request id) + nonce until the prefix of the hash has n bits of zeroes. Request id is some unique number picked by the client. Has properties 2, 3, 4, since we have to keep track of what request-ids have been used already. Otherwise, the same proof-of-work can be used for multiple requests.
Hash on userid + (request-id) + nonce until the prefix of the hash has n bits of zeroes. Request-id is fetched from the server before each request. Has properties 3, 4 and optionally 1, if there's some way to validate that the request-id was generated by one of our servers without touching a database. Since we have to ask the server for a request-id, we need one additional roundtrip time.

Is there a proof of work system that provides all the properties I've listed?


texts: Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

texts:
Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that $k_9=k_8,k_{10}=k_7,...,k_{16}=k_1$.

Since the decryption algorithm is the same as encryption, but we reverse the subkeys, would this make our messages vulnerable given that an attacker had an encryption oracle (takes in plaintext and spits out ciphertext)?


texts: How are public keys securely and reliably obtained across the internet?

texts:
I've just decided to start learning all about PKIs, and I have come across what seems like a paradox.

When fetching a public key from either a server or a CA, how can we be sure that the public key we receive back has not been intercepted and modified by a man-in-the-middle?

Isn't a public-key required to verify a digital signature? If so, wouldn't that public-key also need to have a digital signature so we can verify its legitimacy? It sounds to me like this would almost certainly lead to a never-ending chain of digital-signatures.

This has been an incredibly baffling concept for me, one that I have not been able to reason out on my own. If anyone could point out any flaws in my understanding, I would greatly appreciate it.

I have read some similar questions, one being: How does the sender obtain the receiver's public key?
But, for me, this doesn't really explain how we can eliminate man-in-the-middle attacks from the channels used to fetch public-keys.

Thanks all.

TLDR; How exactly can we eliminate man-in-the-middle attacks from the channels used to fetch public-keys?


texts: Solving a system of equations using both arithmetic and bitwise operations

texts:
At first I asked this question on Stackoverflow, where I was advised to ask here. So there is the question:

I have a system of pretty simple equations:

$x + y = A$
$f(x,y) + y = B$

$A, B$ are known. All of the variables are 64-bit positive integers, including $f(x,y)$.

But the problem is that $f(x,y)$ uses bitwise operations:

$$f(x,y) = x \oplus (x \ll 3) \oplus y \oplus (y \gg 14)$$

I tried to solve this by representing arithmetic addition with bitwise opperations and carry-bits. I also tried to represent each bit as a boolean value and then solve a system of boolean equations. I didn't succeed any much. So is there any method of doing this properly?


texts:
Fairly new to zk proofs. I am trying to find a article or use case of zero knowledge proofs that can prove that more than one entity owns the same data without revealing the data contents.

Entity A
 - some userID
Entity B
 - same userID as entity A

Is if possible to generate of proof for the userID and ask both A and B to verify that they know what the userID is ?

any guidance would be great !


texts: What is Deterministic Authenticated Encryption?

texts:
I came across something known as deterministic authenticated encryption in my studies, and a lot of people were associating it with Synthetic IV mode.
I am having trouble understanding what exactly DAE is because I thought that if something was deterministic, it didn't have a sense of authenticated encryption. It violates the confidentiality of the message -- deterministic encryption modes are prone to CPA attacks.
Can someone explain in layman's terms what exactly DAE is? How does DAE differ from just normal deterministic encryption modes like ECB mode?


texts: What is CCM -- Counter Mode Cipher Block Chaining Message Authentication Code Protocol

texts: CCM puts together two different modes of operation (at least in the name). Does it mean data is encrypted using counter mode and then encrypted using CBC; kind of a double encryption?


texts: libsodium x25519 and Ed25519 small order check

texts:
Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a list of currently known invalid points?

Source code:

X25519 blacklist

Ed25519 blacklist


texts:
Hi illuminated crowd of cryptography.

I am currently working on a login token for a web API.

The feature for the token is to be a mostly featureless identifier. The only property I need is, that I should be able to distinguish it from a random number before I query my database if it is actually valid.

I also don't want the token to be large.

This is what I came up with.

Receive a Username/Password, validate against database, collect user-properties. This can be rather expensive.
Generate a login token to be used for subsequent calls of the user, until the token expires, timeout is not part of the token.

create a UUID
Encrypt it with AES-128 using a server key plus a user specific IV
SHA-1 the original UUID (fake SHA won't matter)
append the encrypted payload to the hash
encrypt again to generate the token

write the token with the user-object to a memory-hash-db

To test the validity of the token, I decrypt the token.
Then decompose the token into hash and encrypted payload.
Decrypt the UUID, hash it and compare to given in token.
If they match, try the lookup in the db.

This is a lot of calculation and hashing. I suppose it is rather fast, yet, the token is only valid for about 10 minutes (at max). Is it worth the effort? Doing a DB lookup may be faster for the in-memory cache.

So, an alternative would be to simply create a random number, big enough, and store it into the cache-database and lookup the token every time. Given the characteristics of UUIDs, an attacker should have a hard time to guess a token currently valid in the database.

Content encryption is established and MITM attacks are avoided using HTTPS.

What is your experience with this situation - is cryptography improving security in this case? What is a good algorithm to create such a token?

UPDATE:

After reading about AES-GMAC and AES-GCM as suggested in the comments, I decided to drop my original idea and use GMAC instead. It offers some nice features:

it is proven
it is approved by NIST
it is standardised, I already have a token-generator build in no time.
I can easily expand the token with encrypted information, if required.
tokens are acceptable in length (<100char BASE64)

My original question has been answered by giving me the hint to use a MAC on the token instead of cryptography. With AES-GMAC I get both, just in case :-)

Not using a MAC or crypto would make an attack with guessed tokens very easy. The MAC protection makes this very hard to hit.

Thanks for your help!


texts: Can I shorten the large ECDSA public key output file from OpenSSL?

texts:
I am working in a very bandwidth restricted environment where I from time to time have the need to distribute public keys. The distribution happens in bit format, so there is no need for encoding, at best I would like all my data "raw".

It is my understanding that the public key, in compressed form, takes up the space of the curve size+1, e.g. 160 bit curve gives 161 bit public key. However, the output from OpenSSL gives me a much larger key size, e.g. 904 bits for the secp160r1 curve. I reckon there must be a lot of metadata involved.

Edit: I removed the "--- Public key starts here ---" etc and that almost cut the file in half ahem. But still there are 60 bytes/480 bits, a lot more than what I would think of as necessary.

Can I somehow reduce this size, getting rid of metadata? For example extract the key components of the signature and reassemble it in a compatible format on the receiver side? I assume DER encoding also adds overhead, but hardly this much?

Here arethe commands I use, in Cygwin:

$ openssl ecparam -out private.pem -name secp160k1 -genkey
$ openssl ec -in private.pem -pubout -conv_form compressed -out public.pem


texts: Is the role of public key/private key determined arbitrarily or mathematically?

texts:
I have read about conflicting information about the roles of public/private keys.

In one article(Asymmetrical-key algorithms), it says:

  Simply put each party, say Alice, picks a private random value, inputs
  this into a key generation program, and receives two keys. It is
  arbitrary which of these is made public and which is kept private, but
  the privacy of the private key is paramount.

While in many other articles, they suggest that private keys is always for decryption and public keys encryption. Or private keys are for the party being authenticated while public keys are authenticating ones.

So my question is, are private keys called 'private' only because you keep them private, or because they have some mathematical merits that fundamentally differentiate them from their public counterpart?


texts: MULalpha and DIValpha operations in SNOW 3G

texts: I'm not able to appreciate the importance of mul alpha and div alpha operations in feedback polynomial of LFSR in SNOW 3G. What problems or weakness do they help in mitigating and how ?


texts: What is the mathematical property stating that it is hard to find a collision in the AES algorithm?

texts:
Finding a collision in the AES algorithm is (apparently) hard. Why ?

What is the mathematical property stating that there is a negligible probability to find a collision by taking two random plaintexts and setting the key ?

Here I mean collisions like : $\operatorname{AES}_{K}(P_1)=\operatorname{AES}_{K}(P_2)$, with $P_1$ and $P_2$ being two random plaintexts and $K$ a 128 bits long fixed key.

In other terms, as AES 128 is mapping a 128 bits input to a 128 bits output, how can we be sure that all the outputs will be reached, for a given key ? What is the mathematical property in the design of AES making it a function "nearly" (fully ?) bijective ?

And, for AES-256, if we now set the plaintext and vary the keys (giving a function with input set size equal to $2^{256}$ and output set size equal to $2^{128}$), why is it difficult to find a collision ?

To clarify: for the last question only, I mean collisions like $\operatorname{AES}_{K1}(P_1)=\operatorname{AES}_{K_2}(P_1)$, with $P_1$ being a plaintext and $K_1, K_2$ two 256 bits long keys.


texts:
I have a file that I am generating a signature for using OpenSSL, and each time I generate the signature, it is different to the last time.

openssl dgst -sha1 -sign update_key.pem TERM010134.bin > Update.sig

Anyone able to tell me why that might be?


texts:
Do you know if is has already happened (since 1980), that someone (academic or not) has "broken" (even in a weak sense) some cryptographic assumption, but has chosen to not first publish and directly attack some security system of the physical world?

I'm really considering the cryptographic/algorithmic level, not a human mistake in which someone didn't use the appropriate standard according to the academic world.

ps: I'm not asking about exploits which are still unknown (it would be an absurd query)


texts: Is there any correlation in between two AES with a key differ only by one bit? (ECB mode)

texts:
Given two AES (128bit, ECB mode) with almost equal keys $k_1,k_2$: 127 of the 128 key bits are equal. Is there any correlation in between the ciphers they build?
$$AES_1(m_i) = c_i$$
$$AES_2(m_i) = d_i$$
Would it be different to two keys differ by 64bit? by 128bit? Or the same key but shifted by $n$ bit?
E.g. An adversary found some correlation in between the target AES mapping and another he knows the key of. Does this help him anything for deriving the key of the target AES?


texts: A question about fully homomorphic encryption (FHE)

texts:
Hypothesis: We define the messages on a field $\mathtt{F}_p$, where $p$ is a large prime number.

I am considering a dynamic outsourced private data scenario.

Assume we have 3 messages: $m_1=2, m_2=4$ and $m_3=77$.
We encrypt them using FHE, so we would have:  $E(m_1), E(m_2)$ and $E(m_3)$.

We send the three ciphertexts to a semi-honest server.

Later on, we want to remove $E(m_1)$  from the outsourced data (in fact we want to remove $m_1$ from there).

Question 1: If we encrypt $m_1$, and send it to the server, can the server "somehow" find $E(m_1)$ and remove it?

Question 2: Is there any other way to remove $m_1$ from the outsourced dataset without leaking any information to the server?

Please note that we are using semantically secure encryption (e.i. FHE); therefore, the ciphertexts of the $m_1$ are different.


texts: Shamir's secret sharing scheme - type of channels

texts:
For information theoretic security in Shamir's [m,m] secret sharing scheme, do i need both authentic and confidential channels?
Another related query is ;is it true that if the channels are only authentic; then the Shamir's [m,m] secret sharing scheme is only computationally secure?
If confidential channels are build on the basis of public key schemes; then doesn't that make the entire protocol computationally secure?


texts: How to ask for an Identity confirmation without revealing

texts:
Let us say Alice has a list of public keys of her contacts. Bob wants to contact Ted and Bob has public key of Ted.

Now, Is it possible to confirm that Alice has the same public key, without revealing that Bob wants to contact Ted? If we ask directly Alice, there will loss in privacy for both the users. Is there any relevant concept in Cryptography that can help me here ?


texts: RSA-based authentication and key-agreement protocol

texts:
An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications.

To that purpose, each of the many devices receive a certificate from a certification authority, binding their identity $ID_i$ (including unique serial number and operational characteristics) to their unique RSA public key $(N_i,E_i)$. The legitimate device with $ID_i$ is initially assumed to be the only thing to possess the RSA private key $(N_i,D_i)$ corresponding to its certified public key, and use it per the protocol's rules only.

An adversary's goal is to convince a legitimate device $i$ that another legitimate device $j$ with $ID_j$ was used during the protocol, when it was not; or to breach the confidentiality of $R$ that $i$ will use (with the assumption that $j$ will not breach it); or make that $R$ different from what it would be under normal execution of the protocol.

The protocol must resist disclosure of $R$ from earlier executions, and compromise of the private key of other legitimate devices. Communications are insecure, including ability for an adversary to alter, replay, or create messages (or communicate with other legitimate devices, but compromise of their private key covers that).

We can assume that in preliminary steps of the protocol, the two participating devices have exchanged their alleged identity and certificate, in clear; have verified the certificates using a conventional off-line PKI; and have unambiguously agreed upon Master/Slave roles in the protocol (statically determined from their respective $ID$; or perhaps with the device having the highest alleged $ID$ assuming Master role).

We want something simple, suitable for implementation in a Smart Card. We'd rather avoid use of a block cipher or MAC during that protocol, though we may assume a hash as used in an RSA message/signature encoding scheme.

I'm looking for literature (or an answer) discussing such protocol, hopefully something with a security argument. One theoretical difficulty is that on each side we have a single key for both mutual authentication, and confidentiality of the shared $R$.

One such protocol is specified in a European Regulation: EEC 3821/85 as modified by EC 1360/2002 and EC 432/2004, Annex 1B, Appendix 11, CSM_020, second drawing, as found page 268 of the PDF, starting with Generate Challenge. Incidentally, I'm interested in the origin of this protocol, or if it is reminiscent of something used elsewhere; and in additional security goals that it might have. To the best of my knowledge it is secure in the sense stated above, but I know of no security analysis. I tried to summarize that protocol, but the question's size doubled before I was done with notations, so I gave up for now.

Nothing in this is related to my current professional activity.


texts: Using simple hashing function to expand already secure key

texts:
Assume I only have only three algorithms available at my disposable: PBKDF2, SHA512, and HMAC-SHA256. (This means I do not have algorithms like HMAC-Expand available.)

Assume I also have a cryptographically secure random 256 bit key. I would like to expand this key to 512 bits, so that I can split this resulting key in half and now have 2 child keys.

The recommended option is to use PBKDF2, but this advice is typically given when stretching a low-entropy, user inputted password. Given that my key is already high-entropy, is there any issue with just using SHA512(key) to expand my key?

The reason I'd rather use SHA512 is that it does not require a salt like PBKDF2 does.

This answer states that it's acceptable to do something like:

child_key_1 = HMAC-256(master_key, "c1")
child_key_2 = HMAC-256(master_key, "c2")

Have I interpreted that answer correctly, and is there a clear winner amongst all my options?


texts:
Last year, I followed this guide to create two GnuPG Smart Cards; one card with the Primary Key and the other card with the Sub-keys.

I noticed that the sub keys were close to expiring so I renewed them and sent them to the sub-key Smart Card and saved the new luks image back to a USB.

My questions are:

What is the proper way to update the sub-keys on a keyserver? Apparently, the key that I uploaded to http://pgp.mit.edu has the Primary key's ID but shows the sub-keys with the old expiration date.
Will I be able to decrypt anything that was encrypted with the old sub-keys? Or use any of the other functions from the old sub-keys (Sign, Encrypt, Authenticate)?

I ask #2 because I was using the sub-key card for SSH Authentication and had to re-run ssh-copy-id for each server. I noticed the output of ssh-add -L had different output as well.

Thankfully, I haven't encrypted anything important with the old sub-keys but I was hoping to understand the process before committing to using it.

I'm running Debian 9.5 (Stretch) with gpg (GnuPG) 2.1.18.


texts: Backdoorable hash function in password database

texts:
I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to generate some form of a private/public keypair on a secure server (airgapped, physical security). I then want to send the public key to the authentication server, and use a hashing algorithm that is reversible (I know that you can't normally reverse hashes) if you know the private key. If I ever need to read the passwords in the database, I copy the passwords and decrypt them with my private key.

The disadvantages are obvious: single point of failure, and in case of a non-established function, maybe a backdoor in my backdoor. (Oh, the irony)

What hash function should I use? Are there any established hash functions that will do this?


texts: Meaning of the $m$ power of a modular world

texts:
A cryptosystem is defined by a 5 tuple $(P,C,K,E,D)$=(plain text, cipher text, key, encryption function, decryption function)

So, my question is with the definition given for permutation cipher, which is stated
"If $m$ be a +ve integer, and let $P=C=(Z_{26})^m$ and let K consists of all the permutation of $\{1,\ldots,m\}$, for a key, $\pi$, we define:
$$e_π(x_1,\ldots,x_m)=(x_{π(1)},\ldots,x_{π(m)})$$
$$d_π(y_1,\ldots,y_m)=(y_{π(1)}^{-1},\ldots,y_{π(m)}^{-1})$$

What I don't understand is, what does $(Z_{26})^m$ mean?


texts: Aside from Keccak, are there any keyed/unkeyed permutations where the choice of all rotation constants is not based on heuristic methods?

texts:
I am interested to see examples of cryptographic algorithms (namely, keyed or unkeyed permutations that transform an $n$-bit input to an $n$-bit output) where the choice of all rotation values is not based on heuristic methods or empirical evidence (assuming that all rotations are constant, that is, their values do not depend on the input). That is, all rotation constants are either generated by a simple algorithm or extracted from some nothing-up-my-sleeve number.

The only example that I have found is Keccak, where all rotation constants are triangular numbers (taken modulo lane size).

Are there any other examples?


texts:
I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a  mental gridlock after watching this Video.
In the video, he uses the mod p which is prime to find a specific generator point (which is also prime) that could iterate all possible points(which i know that G is constant throughout the curve. but why use the order of the curve to find a suitable generator point.). And he also mentions that some numbers can't provide all possible digits that can iterate through all possible values.
But what baffles me the most is that the real values like the generator point and the order of the curves  for example secp256k1, secp192ri is/are not prime. And did i mention that all the answers on the discrete logarithm problem online ALL had prime generator points and the order of the curve were also prime. Can i get a breakdown as of what is going on?
Any opinions would be appreciated.


texts: Signature for Identity Verificaton on "offline" P2P network

texts:
In my scenario i have a very simple P2P network usually working "offline" (i mean that the P2P rely on a detached from internet network).
Each peer on the network is a IoT device bheave automatically, and the first thing it does is present itself to the P2P network trying to join it.
There is no central infrastructure on the network on which i can rely on, so my question is, how can i verfy if a peer that try to join the network is a leggitimate ones and not an attacker?

I have thought to use a private key to identify "me" the network owner (and not shared with the peer) to sign the public key of each peer (different for each peer) that i will relase in the environment (not in a single release).
So when a peer need to present itself to the network other peers (with the public key that identify "me") can see if the peer public key is well signed or not.
But a problem remain, how prevent an attacker with phisical access to a peer to copy its keys (the public with my sign and the private ones) and then impersonate that peer for evil pourpose ?
(how said before each peer on the network is a IoT device easilly accessibile by an attacher and not supervised at all)


texts: What kind of attack would a 128 bit SHA-2 be vulnerable to and why?

texts:
With SHA-2 for hashing, using only the first 128 bits to create a 128 bit hash, what kind of attack would this be vulnerable to and why?

Since 128 bit encryption keys are secure, shouldn't a 128 bit hash also be secure?

Would this be insecure against a brute force attack?


texts: How can I prevent a message replay with RSA?

texts:
I am using RSA to encrypt some data but I would like to eliminate the possibility of message replay. By message replay I mean sending a valid message multiple times to the original recipient. It is obvious that an attacker can capture a valid message without knowing its contents and replaying it.

Is there any efficient way for the recipient to determine if a given message has been replayed or avoid the problem altogether?

The only things I can think from the top of my head are: including an expiration time in the message (rather insecure) or hashing the message, storing it and checking if future messages have the same hash value (can consume a lot of memory).


texts: Proving correctness of pseudorandom generator construction given existing pseudorandom generator

texts:
Say if I have a given pseudorandom generator G which takes a k-bit input and outputs a 3k-bit number.

How should I show that a specific construction using this pseudorandom generator is valid?

For example, if I want a generator which takes a 2k-bit input and output a 3k-bit number. Is the following scheme valid?

1. split the 2k-bit input into two half
2. passes the two half through the given generator G to get two 3k-bit numbers
3. XOR the two numbers to output the final 3k-bit number.


texts: Trapdoors of Lattices: SampleD and SamplePre

texts:
In Trapdoors for Hard Lattices and New Cryptographic Constructions by Gentry et. al, they discuss SamplePre and in Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller by Micciancio et.al, they discuss SampleD.

But still, I cannot understand whether the functionality id same or different. Can you explain?


texts: Why did Rijndael become AES; what is wrong with Twofish and Serpent?

texts:
Why did the Rijndael cipher become the Advanced Encryption Standard instead of Twofish and Serpent?
Do Serpent and Twofish have security issues or weak keys?
Or is it just slower?
I know that some modern cryptography programs use twofish and serpent?

Sorry for the dumb question .


texts: How many AES 128-bit keys does a MIFARE PLUS tag have?

texts:
I know that the question is a bit silly but I dont know how many keys can a MIFARE PLUS tag store in it.

Provided that I have a MIFARE PLUS S tag with 4k memory room and the key length is 128 bit, then the maximum amount of keys stored will be 31.
(4000/128 = 31.25 rounded to 31)

It is correct ? The product leaflet doesn't tips how many keys are or if its is more then one.( I am assuming that its so)

Hugs,


texts: How do you apply bilinear mapping to attribute based encryption?

texts: I'm new to both bilinear mapping and ABE. I have a vague idea of how bilinear mapping works now, but I don't understand how it applies to ABE. Can someone give me an example?


texts: How does a non-prime modulus for Diffie-Hellman allow for a backdoor?

texts:
Recently someone found that a Diffie-Hellman modulus used in a unix tool (socat) was not prime. This led some people to shout "backdoor".

What I don't understand is, how could this allow for a backdoor?

I'm guessing the problem could be small subgroup attacks. But this can be as much of a problem as when the modulus is prime. Or better: a non-prime group could have a big prime subgroup while a prime group could have small prime subgroups.

Thoughts?

It seems like Pohlig–Hellman could be one answer: you can compute the discrete log in a smooth order group. Someone started testing small factors of the non-prime modulus and found 3684787 = 271 x 13597 as a factor. It doesn't seem like any other "easy" factors are findable, so does this mean Pohlig–Hellman wouldn't work even if the adversary knows the factorization? (He needs small factors, not only known factors.)


texts: What's the tightest time-space trade-off law for unbounded time and space?

texts:
Let's say that my CPU can be made arbitrarily faster (or I can become arbitrarily patient waiting for the CPU to complete its task), and let's say that my memory (e.g. RAM) can be made arbitrarily larger.  I.e. none have any limits/caps.
My question is, what is the tightest law, or theorem, that maps change in space/ram into change in time/cpu?
E.g. I'm looking for something like: regardless of the hardware used, for a given algorithm $a$, if we (say) double the RAM, the CPU time will shrink in half.
Of course the above is just an example, and not meant to be exactly like it.  I am simply looking for the latest theories in this area that give the tightest bounds on mapping space-memory relationship.


texts:
I am working on this exercise but can't work out the answer to the question b.
I have solved the question (a) by decrypting the ciphertext $C = 2$ using the formula:
$$
M = C^d \bmod n = 2^{17} \bmod 21 = 11
$$

  Alice and Bob agree to communicate using the RSA cryptosystem. Alice has a private key ($n = 21$, $d = 17$) and a public key ($n = 21$, $e = 5$).

  (a) Alice receives the ciphertext $C = $2 from Bob. Decrypt this message, show your working.
  (b) Bob wishes to ensure that he sent the ciphertext to Alice. Bob sends Alice the plaintext message $M = 9$, what message should Alice send back?
  (c) Perform the calculation Bob would do to verify this returned message.

What do you guys think?


texts: Length extension attack in the middle help!

texts: is it possible to insert the command that you want to execute in the middle of the md5 hash token already known?


texts: Exactly how slow is asymmetric encryption?

texts:
I'm currently doing a project on RSA, and have just come across this website.

https://www.namecheap.com/support/knowledgebase/article.aspx/798/67/what-is-an-rsa-key-used-for

On here, it says that

  Since encrypted data transmission takes too much time in case of asymmetric encryption, this kind of encryption is used for a secure symmetric key exchange that is used for actual transmitted data encryption and decryption.

Now I was not aware that this was the case, so my question is, does this mean that asymmetric encryption is relatively slow compared to symmetric encryption, or is it impractically slow to be implemented in things like SSL?

Also, out of curiosity, exactly how much slower is it in terms of a time value?

Update:

Another question, why do the primes have to be far apart? I guess since the numbers used are so big they are far apart anyway, but is this a prerequisite for RSA, or just a fact that holds due to the size of the numbers?

Thanks


texts:
so to prouve a value $v$ is in range $[0,2n−1]$ we convince the verifier that $v$ is represented by a binary vector $a∈\{0,1\}^n$ so that $<a,2n>=v$
$//$ $2n∈Zn$
is the vector of powers of $2$ satch that $2n={2^0,2^1,2^2,,,,,2^n}$
we have $r∈Zn$ a random vector for blinding
we also have $G$
an eleptice curve generator and $A,R1,R2,R3,R4,V$ are eliptice curve points such that :
$A=<a,1>G,R1=<r,1>G,R2=<2n,r>G,R3=<a,r>G,R4=<r,r>G
$ and $V=vG$
//
for an example $R3$ equals : $R3=(a_1*r_1+a_2∗r_2....+a_n∗r_n)G$
the prouve goes like this:
$-$ the prouver send $A,R1,R2,R3,R4$ to the verifier
$-$ the verifier send back a challenge : $x$
$-$the prouver compute and send:
$fx=xa+r$
$-$ the verifier verify:
$<fx,1>G=?=xA+R1$  $//$ check that $fx$ was constructed corectly
$<fx,fx>G=?=x^2A+xR3+R4$        $//$ check that $a$  is a binary vector because a binary vector is the only vector where $<a,a>=<a,1>$
$<fx,2n>G=?=xV+R2$  $//$ check that $<a,2n>=v$
is this prouve sound? i'm a beginner so probably not
thanks and let me know if anything is unclear


texts: Are Feistel ciphers subject to the birthday bound?

texts: This paper seems to be saying that a balanced Feistel cipher can be broken when an adversary has $2^{0.5 \cdot n}$ pairs of plaintext and cipher text blocks where $n$ is the block size in bits. Is this true?


texts:
In the last months I was searching for a subject for my bachelor thesis. I came up with an idea for a new cipher concept that works by combining already known techniques in a (hopefully) new way.

So I talked to our professor for cryptography. Although she could not find any obvious weaknesses she mentioned that the review of a cipher is an ongoing and protracted process and therefore not suited as a subject for a bachelor thesis.

Is there a way to publish the concept to get some reviews?
What could one do to prevent the idea from falling into oblivion somewhere on my hard drive?

Update

I totally understood her reasons why this subject is not suitable. The question was more about the possible ways I could evolve, publish or analyze the idea (independently from my thesis). Sorry for the confusion this might have caused.


texts: Public Randomness-Based Random Number Generator using Mobile Phone?

texts:
I have an idea to create a True Random Number Generator that use randomness source from a smartphone sensors. My idea is to collect sensors data from a lot of smartphone using mobile apps and then the data is sent to the server to be processed using an algorithm to generate random number.

Is it a good idea to use that method to generate random number? and will it be better using a lot of device rather than just using one device only to generate random number? Can I call that method as Mobile sensor network?


texts: Does a certificate contain the complete chain of all certificates up to the trusted root certificate, or does the program that verifies certificates have to fetch each parent certificate individually in the chain to reach a trusted root certificate?


texts: The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/966.pdf mentions that it is possible to increase the 60 number to 80, which would be sufficient for SSL use. Why is this treeheight not supported in the RFC?


texts: Rabin fingerprint preimage with given length and alphabet

texts:
The Rabin fingerprint looks something like this:

int hash(int[] message){
    int result = c;
    for(int v:message){
        result = result*p+v;
    }
    return result;
}

for some $c$ and $p$. This may not be the canonical Rabin fingerprint but it's the version I'm familiar with.

So let's say we want to generate a message of length $n$ with some alphabet $A$ which hashes to some value $h$.

$n$ is a constant, so we can set $c$ to $0$ and offset $h$ accordingly. The word size is fixed and determines our modulus. Call that $M$. So we're left with some parameters:

$n$, the message length
$A$, the alphabet
$h$, the desired hash value
$p$, the prime used in hashing
$M$, the modulus

Assuming $n$ and $A$ are large enough, how can we quickly generate this message?

I'd guess powers of $2$ moduli are easier to work with, so if it can be done quickly for when $M$ isn't a power of $2$, how?

Example:

$n=16$
$A=\text{"abcxyz123"}$ (ASCII)
$h=0$
$p=3343$
$M=2^{20}$

We might get "1ab1xybb2b22z1az" or "ca32y2x2cyzxa3yc".


texts: While reading the following paper about the Strong Diffie-Hellman Problem, i got curious about ways to compute $ g^{x^{l}} $ for unknown  $x$ in an elliptic curve, without first solving the discrete logarithm problem for $g^x$. Since SDH may not be as hard as DL, there might be a way to get $g^{x^{l}}$ without knowing $x$ first. I couldn't find anything that tires to solve SDH for specific finite groups and would welcome if someone could point me in the direction of related work or has an idea how this could be done.


texts:
Let $\mathcal K$ and $\mathcal M$ be the key and message spaces respectively
 I know for fact that if $|\mathcal K| < |\mathcal M|$ then $\Pr[\operatorname{PrivK}_{\mathcal A,\Pi} = 1] > \frac{1}{2}$, knowing also that $\mathcal A$ is randomized and $\Pi(\operatorname{Gen},\operatorname{Enc},\operatorname{Dec})$ is an arbitrary encryption scheme with $|\mathcal K| < |\mathcal M|$

I'm trying to prove that but I find some problems :

I can't find any relation between the fact that $|\mathcal K| < |\mathcal M|$ and
$\Pr[\operatorname{PrivK}_{\mathcal A,\Pi} = 1] > \frac{1}{2}$, isn't the random bit $b'$ - the adversary generates to choose between the two messages - that defines whether the probability is higher or equal to $\frac{1}{2}$? I'm confused ?

For those of you who doesn't know about the $\operatorname{PrivK}_{\mathcal A,\Pi}$ experiment (Adversary $\mathcal A$ against the encryption scheme $\mathcal \pi$):

  The Adversarial Indistinguishability Experiment $\operatorname{PrivK}_{\mathcal A,\Pi}$ :

  The adversary $\mathcal A$ outputs a pair of messages $\mathcal m_0$ $ m_1$.
  A key $\mathcal k$ is generated using $\mathcal Gen$(A key generator) and then a bit $\mathcal b$$\mathcal  \in${0,1} is chosen. Ciphertext $\mathcal c $$\mathcal \gets$  Enc($\mathcal m_b$) is computed and given to $\mathcal A$. ($\mathcal c$ refers to challenge cipher).
  $\mathcal A$ outputs a bit $\mathcal b'$ $\mathcal \in$ {0,1}.
  The output of the experiment is defined to be 1 if $\mathcal b$ $\mathcal =$ $\mathcal b'$ and $\mathcal 0 $ otherwise. We write $\operatorname{PrivK}_{\mathcal A,\Pi} = 1$ if the output of the experiment is $\mathcal 1$ and in this case we say $\mathcal A$ succeeded.


texts: What prevents a padding standard to cause a data loss?

texts:
In here different byte padding standards are listed as ANSI X.923, ISO 101.26, PKCS7, ISO/IEC 7816-4 and zero padding. All of them seems to apply padding to the last byte blocks. Odds are rare but what happens if the actual data is an integer product of the block size and last bytes conflict with a padding scheme.

For example, for PKCS7 let last 8 bytes be

FF FF FF FF FF FF FF 01

01 may actually be original data or padding. How do we know this? How do we avoid a data loss? (It seems trivial but image formats may become corrupted, because original data size changes.)


texts: Why is feed-forward mechanism used in hash functions?

texts:
The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, the previous block's output (as specified by Merkle-Damgård) is used. These values are fed to the last round of the compression function.

Why would removing the feed-forward part (i.e.,the final step where the input value is added to the result to get the final output) make the hash function insecure? Apart from the fact that the compression function would not satisfy desired randomness properties (being a permutation for each fixed message).


texts:
Let's say I have a cryptographic algorithm that encrypts on 128-bit blocks and makes 20 rounds. Each round has its own keys (one of 72 keys per round). We read blocks before each round. But we're introducing the bit reading order. We can read from the most significant bit or the least significant bit. But in total we can read the bits before each round at 128! ways. We only need to define 20 random 128-element permutations.

But this increases the keys, you need to store these permutations. Is it a good idea?

For the safety of this algorithm there must be some order of bit reading, we can't always read them according to a typical binary number reading scheme.


texts:
I would like to ask you about your opinion on the following scheme of combining a master key and a nonce and stretching the result to the full 256-bytes RC4 key.

Master key $K_m$ is a pre-shared secret of length $M$ bytes
nonce $K_n$ is sent unencrypted and is of length $N$ bytes
both $K_m$ and $K_n$ are chosen to be high-entropy strings
the $i$-th byte of the resulting key would be $K[i] = (K_m[i \bmod M] + K_n[i \bmod N]) \bmod 256$

The period of the string $K$ is $LCM(M,N)$, so I would choose the $M$ and $N$ such that $LCM(M,N) \ge 256$.

Is there anything obviously wrong with this scheme?

PS: This scheme would be used on an 8-bit micro-controller embedded system. Limited speed/memory prevents me from using a more standard method.


texts: Difference b/w Hash function & Keyed Hash function? And HMAC with Matyas-Meyer-Oseas hash function

texts:
I am looking for hash functions. In this process i came across hash & keyed hash functions(HAMC). In which it uses some has function to generate MAC.

And also Matyas-Meyer-Oseas hash function, which is of block cipher hash function.

I would like to know the difference between HMAC, and hash functions?

And about Matyas-Meyer-Oseas hash function, how hash will be calculated?

At least where can i find proper solution for this?


texts:
I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.

Edit: ok, can it be at least partially moved to elliptic curves?


texts:
I need a set of seeds $S=\{s_1,..., s_n\}$, for pseudo-random function where seed $s_i$ is used to generate a set of pseudo-random values. Obviously I need to be able to regenerate the sets of pseudo-random values, but I do not want to keep the seeds. Thus, I'd like to use a master seed to generate the other seeds.

Question: Would it be secure if I generate a seed for pseudo-random function and then use it to generate a set of seeds?

If not what a solution would be?

By secure I mean the pseudo-random values should not be distinguished from random values.


texts: Should an AES byte key generated with OpenSSL be converted to hex?

texts:
I am generating a key & iv with Ruby's OpenSSL wrapper for an AES CBC 256 setup:

cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')
key = cipher.random_key
iv = cipher.random_iv

I am then storing the generated key / iv in blob columns in the database. When trying to display the key or iv it looks something similar to this:

×>×=ñ±8i·ÊahJ[  }öúÇ{xÎÝ¿

My question is:

should the key & iv which seem to be random bytes be converted to hex with an SHA function before using and storing into the DB?

Is it safer this way for storage / use or can they be used just as they are generated in byte form?

UPDATE:

Looks like I was mistaken on my terminology and use of SHA.

Revised question: Is a random byte key from OpenSSL just as random and secure if I convert it to hex via unpack('H*')

Any help is appreciated.

Thanks!


texts:
In the group $\mathbb{F}_p^*$, Bob reads Alice's parameters as $p=234917$ and $g=281$ and uses a secret key $b < 400$ such that $h_b = g^b = 92646$.

Note that $p-1 = 2^2\cdot 11\cdot19\cdot281$

$281^{2\cdot11\cdot19\cdot281} \equiv 1 \mod 234917$

and that

$19452^{281} \equiv 1 \mod 234917$

Find $b$.

281 is too large for the Pohlig-Hellman attack by hand (which is how this question is supposed to be solved). I feel like the answer is staring me in the face but I cannot see it. Can anyone give a hint/help me? Basically we have $2\cdot(\text{order of g}) = p-1$...


texts: Pedersen commitments, what happens if I choose $H$ such that $H = a\times G$?

texts:
For Pedersen commitments of the form $C = x\times G + r\times H$, what is the worst thing I can do if I already know $H$ such that $H = a\times G$ ?

For standard curves, there are specifications for what value of $G$ should be used. Is there any such specification for values of $H$ ? What is the worst an adversary can do when they choose $H = a\times G$ and the rest of the world assumes that no-one knows a relation between $H$ and $G$ ?


texts:
Why for achieving the fairness and guaranteed output delivery, less than a half of the parties should be corrupted? ($t < m/2$, where $t$ is the number of corrupted parties and $m$ is the total number of the involved parties)

Would you please prove it intuitively?


texts: Are there any special points on an elliptic curve which would weaken security?

texts:
So, according to the elliptic curve discrete logarithm problem:

$$A=[r]B$$

In which $A$ and $B$ are points on the curve, and r is the scalar. It is trivial to compute $A=[r]B$ if $r$ is known, but it would be incredibly difficult to find $r$ if $r$ is unknown.

Now, take bitcoin's elliptic curve as an example - secp256k1. Are there any "special" point $B$s on this curve which would allow an attacker, with knowledge of $A$ and $B$, to trivially compute $r$, and thus render the elliptic curve insecure?


texts: Why is Multiplicative group used in RSA or Euler's theorem but not additive?

texts:
I am on the verge to understanding RSA, but suddenly a question popped into mind. When we are calculating $U(N)$ i.e $U(PQ)$, we are taking invertible elements that are co-prime to $N$. For example, $U(5\times2)$ becomes $\{1,3,7,9\}$. We are ultimately never using the inverses in $U(N)$ in either key generation or encryption. But just the order of $U(N)$ is what we need. We are using invertible elements in the order of $U(N)$ as a part of key generation, And that part I understand why, but the never using the invertible elements within $U(N)$ itself. So thereby the question, Why we don't use additive groups? Is it a security thing?
PS, I don't know much about additive groups, just the multiplicative group as it's a part of RSA and I am studying RSA. Thanks :)


texts: Create a bijective and invertible table that are depending on the cipher key

texts:
I'm creating my own symmetric-key algorithm that in many ways are similar to DES.  My key is 16 bits long and is random generated, I will encrypt blocks of 16 bit strings that are split into two 8 bit strings. My approach is to make a 4x8 table where row one is selected if the decimal representation of the key is between 0 and 15000, row two if between 15000 and 30000, and so on. The column is chosen by the 3 last binary digits of the 8 bit string that will be encrypted. So column one is chosen if the three last digits is 000 and column 8 will be chosen if the three last is 111.

This metod works for encryption but I need the same function to work for decryption too. The boxes in the table is decimal numbers. How is it possible to make this approach work for my purpose?

In the picture both left and right side are the same function and thats how I want it to work.


texts: Elliptic curve ElGamal with homomorphic mapping

texts:
I am interested in ElGamal due to the fact that you can achieve some degree of homomorphic properties. I became interested in applying ElGamal to elliptic curves, and found this other question with an answer that shows 2 different ways to apply ElGamal to elliptic curves, but from what I can tell neither approach has the additive homomorphic property.

So are there any other ways to apply ECEG that give us the additive homomorphic property?

The only thing I was able to come up with is using a message-point mapping function that encodes the message with scalar point multiplication, ie the cipher text $(kP, mkY)$

It seems to work because with $(\sum k_iP, \sum m_i k_i Y)$ we can solve $\sum m_i = \frac{\sum m_i k_i Y}{x \sum k_i P}$, but this is solving the ECDLP so is very difficult. Are there any other options?

EDIT: I'm looking for the additive homomorphic property over integers, not points.


texts: How can I derive an ed25519 key pair from a secp256k1 key pair?

texts:
Alice has a secp256k1 key pair that she used some time ago when she communicated with Bob.
Bob can no longer user secp256k1 but he only uses ed25519 instead.
Alice and Bob cannot exchange any messages.

Is there a secure algorithm that Bob can use to derive an ed25519 pubkey from original Alice's secp256k1 pub key and also Alice can derive the matching ed25519 private key from her original secp256k1 private key


texts: How to practically find solutions to a discrete logarithm?

texts:
Are there any ongoing or current practical attempts to solve instances of the discrete logarithm problem of the order of magnitude used in cryptographic applications, for example with a 256 bit modulus and 160 bit exponent? I am interested in efforts similar to the work of members of the Mersenne Prime forum  and the RSA factoring challenge, but for the discrete logarithm problem.

What principles and techniques are involved? Do any of these solutions yet approach a realistic time frame? I am mainly looking for working software implementations of any attempts.

I checked some links given in Wikipeda's Discrete Logarithm records page, in particular GGNFS. Can someone help compiling and testing it?

I also found a similar question: https://crypto.stackexchange.com/questions/100/modern-integer-factorization-software. Does this software also allow what I want?

Here is some test data (all in decimal form):

base: 47
modulus: 112624315653284427036559548610503669920632123929604336254260115573677366691719
result: 107169838909122878937980510796152643759453843830224828060309998762431169006781

You have to find 160 bit exponent.


texts: What's the difference between DH and DHE?

texts:
The DH equation is:

$$ K = g^{xy} \bmod p$$

Does using DHE mean even the $g$ and $p$ parameters are randomly generated (instead of being fixed)? Is this the difference?


texts:
I am reading Rogaway's original paper on EAC, page 7, where the MAC function is an OMAC with a 0.

Iwata´s web page only refers to versions 1 and 2 of the OMAC cipher. So which algorithm is used for OMAC 0?