texts: Can messages be recovered from signatures if the private key is known?

texts: If the message that was signed with a digital signature is not known, can it still be recovered if you have the private key?


texts: Question about hashing passwords with PBKDF2

texts:
I am new here and new to encrypting and securing passwords, so please forgive me if this question is not posted to the right location or if my question is bad.

I have been working on a web app in Java that requires a username and a password. Through my research, I discovered that I need to salt and hash my password in order to make sure it is secure when I place it in a database.
 So far, I am leaning towards using PBKDF2 with SHA512, but bcrypt is still on the table.
 I came across this post about using PBKDF2 for encrypting passwords: http://howtodoinjava.com/security/how-to-generate-secure-password-hash-md5-sha-pbkdf2-bcrypt-examples/
 The example seemed to show what I needed to do as far as hashing and salting my passwords, but I was concerned with using a colon to create a split between the iterations, salt, and password.
 Wouldn't that just give clues to someone who would try to hack my database as to how I was hashing my passwords?
 I know the author of the article was demonstrating how to verify the password using the split method, but I'm thinking this isn't the best method of encryption and verification
 What I am hoping for is if someone could take a look at this and let me know if there is a better way (or example) to use PBKDF2 for password hashing and verification. If there are links or other questions that could be suggested, that would be awesome.
 Also, I am open to hearing others thoughts on which algorithm I should be using because there is a lot of information out there and it seems like there is nothing conclusive as to which one is the best.

I really appreciate any help that is provided, and I hope this is the right place to post this question.

Thanks!!


texts: justification for method to factorize n knowing RSA private exponent d

texts:
I know that knowing the private exponent $d$ corresponding to the private key $k_{pub}\langle n,e\rangle$ it is possible to efficiently factorize n.

The procedure starts stating that:

$ed -1 = s(p-1)(q-1)$

and then saying that:

Randomly picking $x\in\mathbb{Z}_n^*$ we know that $x^{ed-1}\equiv 1\pmod n$ and computing $y=\sqrt{x^{ed-1}}=x^{\frac{ed-1}2}$

We have the identity:

$y^2-1$

And so:

If $y\neq\pm1\pmod n$, a factor of $n$ is obtained as: $gcd(y-1,n)$
If $y=-1\pmod n$, we repeat this procedure from the beginning and pick
another value for $x$
If $y=+1\pmod n$, we iterate the whole procedure starting from the square root of $y^2$

Could someone give me a justification for this? Especially for:

"If $y\neq\pm1\pmod n$, a factor of $n$ is obtained as: $gcd(y-1,n)$"


texts: A missing step in ECDSA signature verification implementation

texts:
On the Wikipedia page of ECDSA, it is stated in step 6 of the verification algorithm that If (x1,y1)=O then the signature is invalid.

In X9.62, it is also stated that If u1G + u2Q is the point at
infinity, then reject the signature.

However, I cannot find explicit checking for this condition in multiple open-source libraries.

python-ecdsa for example:

xy = u1 * G + u2 * self.point
v = xy.x() % n
return v == r

Is there any implicit checking that I missed?

And is there any possible attacking against this, if such a verification was missed?


texts:
I recently studied a Hash function and its security requirement. I have studied that simple hash construction from XOR is weak. My question is, based on Xor property the following Hash based on RSA Mi<n calculated by
$H(M_1,M_2)=(M_1^e \bmod n) \oplus (M_2^e \bmod n)$, where $(n,e)$ is an RSA public key.
satisfy the collision resistant and 2nd preimage resistant?


texts: RSA Encryption that only my family could decrypt

texts:
I was doing some thinking about what would happen to my computer and passwords if I fell off the earth tomorrow. I wanted to have a message that only they would have the ability to decrypt and I wanted it to be very strong.
Lets say they are the only ones who know our first dog's name, Scout.
How could the decrypt a say RSA-encrypted message using this information? I was thinking they could add it to the end of the private key and but I don't think that is how RSA works. How would you approach this task?


texts: Exactly two of the four roots must be greater than N/2

texts:
Theorem: Let $y$ be a quadratic residue in $\mathbb{Z}_N$* where $N=pq$.

There are exactly four integers $x_1, x_2, x_3, x_4$ where $0 < x_1 < x_2 < \frac{N}{2} < x_3 < x_4 < N$ such that $y = x_i^2 \pmod{N}$ for $i=1,2,3,4$.

The above theorem simply states that exactly two of the four roots must be greater than $\frac{N}{2}$.

Most papers will say that this result is well known, without providing any detailed proof. How can we prove that $0 < x_1 < x_2 < \frac{N}{2} < x_3 < x_4 < N$?


texts: AES encryption for repetitive small data packets

texts:
I'm trying to implement simple AES encryption for small data packets (8bytes, fixed length) being sent from nodes with very little computational resources. Ideally the encrypted data would be a single 16byte packet. The data being sent is very repetitive (for an example, wind velocity packet "S011D023", where S and D would always be in the same place, length would always be 8) The nodes may not have the ability to hold runtime variables (e.g. a frame counter, nonce etc.) but could be implemented if essential. How do I make the solution "reasonably" secure against replay, brute force, any other well known attack? Does adding new random padding bytes to each new packet help in anyway? Thanks.
PS: I posted this on StackOverflow where someone suggested this would be a better place for it.


texts: Can the original data be extracted from an RSA private key signed message

texts:
I'm working on a system that the main objective is to verify the message was written by the right person, but it would also be desirable if the message can't be understood by anyone sniffing it.

It runs on Java/Android using RSA/ECB/PKCS1Padding (so it's not textbook RSA, but a real implementation) and the data is guaranteed not bigger than the RSA 2048 bits.

The public key on this case is not really public, it is sent to the server over standard SSL/HTTPs with certificate pinning and kept there.

The desired message is later sent over an insecure channel signed with the private key and the server can verifies the sender.

The question: can someone that sniffed the message over that insecure channel recreate (within reasonable time frame) the original message?

edit:

Adding here to give a more complete explanation to Martin Boner.

I'm mostly a Android developer with general notion of cryptography, that's why I'm making sure to ask questions that might be dumb for some, but it's better be sure I'm not messing up important things.

For that reason, I'm not sure the direct answer to Martin, so I'll just show the code. It's Android/Kotlin code, but it's standard Java APIs:

private const val TRANSFORMATION = "RSA/ECB/PKCS1Padding"

internal fun rsaEncrypt(data: String, keyPair: KeyPair): String {
    val cipher = Cipher.getInstance(TRANSFORMATION)
    cipher.init(Cipher.ENCRYPT_MODE, keyPair.private)
    val bytes = cipher.doFinal(data.toByteArray(Charsets.UTF_8))
    return Base64.encodeToString(bytes, 0)
}

So this returned String is what's being sent. I manually tested that val bytes when converter back to string is unreadable
and I have the inverse operation (below) that runs on my tests that I know the original data can be reconstructed with the public key.

internal fun rsaDecrypt(data: String, keyPair: KeyPair): String {
    val cipher = Cipher.getInstance(TRANSFORMATION)
    cipher.init(Cipher.DECRYPT_MODE, keyPair.public)
    val bytes = Base64.decode(data, 0)
    val decrypted = cipher.doFinal(bytes)
    return String(decrypted, Charsets.UTF_8)
}

How the other end exactly is doing, I don't know because that was up for the Ruby developers, but it's perfectly reasonable to assume it's very similar to the above.

With this edit in mind, I'll add a secondary question:

(original question) Can someone that sniffed the message over that insecure channel recreate (within reasonable time frame) the original message?
(Bonus) Is there any other security concern/issue here? For example, could someone after sniffing a few messages over the insecure channel, be able to regenerate or fake the private key and pretend be the proper user?


texts: What is an extremely basic asymmetric cipher that I can present at the pub?

texts:
I'm trying to explain the basics of Bitcoin to my parents.

One of the core components of bitcoin, is signing transactions to make sure your identity can't be impersonated, and thus the need to explain a simplified asymmetric cipher.

What's an extremely simple asymmetric cipher I can use as an example?

How can this simplified cipher be used for signing?


texts: Storing AES encrypted RSA private keys on a server

texts:
I'm thinking about creating an encrypted messaging web application where users create RSA key pairs, they store the public key on the server for others to see and also store an AES encrypted private key on the server. Thus, to verify their identity, they can decrypt the private key and send a signature.

That said, I'm curious is this is a reasonable idea. I know some similar services that require you always use the same device (like an iPhone) and won't let you use the same account on a different machine. This leads me to believe that they are storing a private key locally on the device. It seems reasonable to me to store an AES encrypted RSA private key on the server, but I am no expert on the subject and since I don't see anyone else doing it, I'm a little skeptical.

Any thoughts or concerns about this?


texts: Is there more than one public key for a private key?

texts: Does deriving the public key from an RSA private key always yield the same result? And if so, does this generally apply to all asymmetric cryptosystems?


texts: What are the costs of generating master key for symmetric ciphers?

texts: I recently read that generating large master keys for symmetric ciphers is very expensive. But what exactly do they cost? Any references would be much appreciated. I have checked NIST but actual costs seem hard to find.


texts: If a DES key correctly decrypts one message, what's the probability it's the real key?

texts: Suppose an adversary gets a message-ciphertext pair $(M,C)$, where $C=DES_K(M)$. They do an exhaustive key reach to locate the lexicographically first key $T$ for which $C=DES_T(M)$.  What's the probability that $T=K$?


texts: Large file validation on an embedded system through hash and encryption

texts:
As a preface, I have to say that I am a noob in this area.  Having said that, I will ask the question.

I have a situation where I need to validate and protect against tampering a handful of large binary files (~1GB each with ~10GB total) distributed on an embedded system (think Android Tablet).  These original files will have a need to have a hash which can ensure that the files have not been tampered with.

Now, the challenge is that these files can be updated with a patch periodically downloaded from a webserver.  These patch files will also be distributed with a hash which will ensure that the patch is authentic.  (The files will be downloaded over a secure connection.)

Finally the patch needs to be applied to the original files on the embedded system which will then result in the need to regenerate the hash for the newly patched files so that they can be subsequently verified in the future.

There are several challenges:

Since these are large files running in an embedded system, the 'recommended' algorithms for hashing like SHA256 may prove to be too expensive to compute at runtime on a mid-range embedded system.  The back of the napkin calculation says that may take upwards of several minutes to compute.  Since this verification must occur every time an application launched to read this data, it must be very fast for 10GBs of data - less than 5 seconds.
Since the patch is being applied on the embedded system, the actual hash for the newly patched file must be computed on the embedded system itself.

My idea:

I was thinking that we could simply compute a faster, "weak" hash (like MD5) on the large files first.  Then I would make a server request (with mutual auth) to encrypt the MD5 hash with a private key and return an encrypted hash to the embedded system.  Then whenever I want to verify the file integrity, I would use the public key to decrypt the encrypted hash and then verify the hash against the actual files.

Any thoughts on this approach?  Does my idea work?

Thanks for your thoughts.


texts: Forgery attack on Poly1305 when the key and nonce reused

texts:
Introduction: I've tried to find how reusing one-time key compromises itself but only found information that it breaks the encryption entirely, it is written everywhere. But since no methods to reuse or restore the key were specified I don't quite get how it can be done, even with plaintext and tag given.
Problem: we have several messages and its tags, encrypted with pure Poly1305 with the same key (generated using python's Poly1305 from chacha20poly1305, implementation code) without AES and ChaCha, as it seems from the code and according to the specification.

The inputs to Poly1305 are: A 256-bit one-time key; An
arbitrary length message

I want to reuse Poly1305 key to sign custom message and therefore forge it.
What should I do to reuse the same key without knowing it on my custom message or, if possible, find the key?
Example, you've got the following data, the same key is used 3 times (data in hex : tag in hex):
Data: e8962f8dada53f589eada744bf3f9bb298be47ebd3416a59a13a709d1bf6fb4d
Tag:  825f51bb7b0f05990f03998c63a51f08

Data: 6e05652fe6a6985c1fed6604f95b133fe7a4a9f95313a8ad15d995195528efad
Tag:  53cc694570e89ec66350b4d7877ea58a

Data: 46a683f0a164bf6e19ee0b05f4c65f1f7b1d6ec454fe0e79ec4debfb22da36c1
Tag:  cba1048b9ee15929a16f0cfe5f4547b1


texts: How could block encryption in counter mode be secure from viewpoint of entropy?

texts:
A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for stream encryption.

However, these bits could evidently have only $1/(2^{128})$ bit of entropy each on the average. Isn't it a paradox that such an encryption could nonetheless be secure?


texts: Size of Fresh Ciphertext's Noise in FHE over the integers

texts:
I'm studying FHE over the Integer which is https://eprint.iacr.org/2009/616.pdf

In the remark 3.4, it says that the fresh ciphertexts have noise at most $2^{\rho'+2}$.

I don't know why that statement is true.

In my guess, the value $2^{\rho'+2}$ came from $m+2r$. But it cannot be strict proof of the statement.

Can anybody help me?


texts: Extract adversary's secret input in simulation based security proofs

texts:
I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the secret input of corrupted parties, even if the corrupted parties' input is encrypted or in secret shared form. I have two questions:

Is there any additional requirement or restriction along with this assumption?
Why can/should we rely on this assumption? Currently, I only focus on the semi-honest setting.

Any advice and explanation would be highly appreciated. Thanks.


texts: Does reusing the same $R$ in Elliptic Curve ElGamal breach its security?

texts:
In Elliptic Curve ElGamal if I reuse the same randomness to get the same point $R$ for different messages, how can it breach its security ?
Can you please illustrate with an example?

Please see my earlier question here for further details

Thankyou everyone in advance!


texts:
My end goal is to have an encryption function $e$ and a hash function $H$ such that for all m we have: $$H(e(m)) = e(H(m))$$
This would work if we use RSA encryption along with RSA "hash", using a different public key. I don't mind the fact that there would be one specific person (who created the private/public key for the hash) that would be able to reverse the "hash".
So my question is can I use RSA as a hash function? I still need all the other properties of hash functions, I just don't mind if a specific person can reverse it.
Or, would there be another hash/cipher pair that would satisfy $H(e(m)) = e(H(m))$?
I have looked into fully homomorphic encryption but it does not seem to help.


texts: Is there practical Attack on A5/1 Cryptosystem?

texts:
There are several and several attacks on A5/1 Cryptosystem, but most of them are impractical. In 2008, Elad Barkan , Eli Biham and Nathan Keller release a practical attack on GSM.

Is there any production of the attack? In another words, does exist any physical production that gets ciphertext as input and get Key or Plaintext in output(due to the EBN attack)?
Thanks.


texts:
Alright so I have some understanding of encryption and how it works. I was trying to explain it to my friend and a few others I couldn't at the time. I later came up with an analogy.

How accurate is this without getting too in depth

Dale, Sam, and Max are all sitting in a class room at their desks
[Dale]---[Sam]---[Max]

Dale wants to send a message to Max. Max knows this so he takes a pencil and breaks it in half handing Dale the tip so he can write the message. Max then keeps the eraser. Dale is to far away to send his message to Max so he has to send it through Sam. Dale doesn't want Sam to read the message. Dale writes his message "Hi Max" he also takes 2 random letters and mixes them in with his message so it reads "qMaxHiD" he then passes the message to Sam to pass to max. Sam then passes the message to Max. Max's special eraser only erases the random letters. So that he can read message." Max would like to reply but he only has an eraser so he can't. So Dale takes a pencil and breaks it in half and sends the tip to Max so that he can send his message.

From Sam's perspective he sees a bunch of random letters "qMaxHiD" he tries to read the message by scrambling the letters until he reads "Hi Max" since their aren't many random letters it's fairly easy for Sam to do this. there are only 5,040 combinations this will take some time for max to do but if he can 100 combinations in a minute it will take Sam about 50 minutes to read the same. Knowing this Dale could add one more random letter bringing the possible combinations to 40,320 taking Sam 6.72 hours to read and making it so the Max only has to erase one more letter. Encryption works because it's easy to erase one letter but really hard to go through all the combinations.

-The pencil is the keypair
-Sam is both the internet the message travel through and uncle same trying to read it
-Having a bigger pencil with more lead allows you to write more random letters to mak

Does this analogy work. Could I improve on it.


texts:
This is probably a silly question, but I could not find any reference. For the DDT of an SBox, it is easy to see why all the values are even. Is there any related result for LAT (i.e., all its values are even)?
LAT, for an $n \times n$ SBox, is a $2^n \times 2^n$ matrix with row $\alpha$ and column $\beta$ defined as follows:
For all $n$-bit $\alpha$, $\beta$; count how many times $\alpha\cdot x \oplus \beta \cdot y = 0$ holds; and subtract $2^{n-1}$ from it; where $x$ is the vector of input variables, $y$ is the vector of output variables, and $\cdot$ is the dot product.


texts: How is the MD5 digest calculated in BGP?

texts:
The RFC is very superficial on the implementation details. What is the injective function being used?

RFC (ietf)

MD5 digest is produced by applying the MD5 algorithm to these items in the following order:

   1. the TCP pseudo-header (in the order: source IP address,
      destination IP address, zero-padded protocol number, and
      segment length)
   2. the TCP header, excluding options, and assuming a checksum of
      zero
   3. the TCP segment data (if any)
   4. an independently-specified key or password, known to both TCPs
      and presumably connection-specific

How are the above items concatenated? I wasn't able to find much information, could someone please point me in the right direction?


texts: Is it possible to represent max{a,b} as a binary polynomial?

texts: For privacy-preserving comparison, is it possible to represent the function of $f(a,b)=\max\{a,b\}$ as a binary polynomial $p(a,b)$?


texts:
For academic reasons, I'm playing around with OpennSSL 1.0.2g.
I tested RSA encryption/decryption.
I created key exchange with DHKE.
But I'm struggling to find a way, to create ECDH, using only OpenSSL.
Is it possible to create such key exchange only using OpenSSL?


texts: Which parts of a TLS connection can I safely reuse for DTLS to the same peer?

texts:
Suppose I need both encrypted TCP and UDP, say TCP for reliable control signals from server to client and UDP for low latency data from client to server. If I first establish TLS, for the DTLS connection:

Can I safely skip the certificate verification?
Is reusing the master secret or sending a new one over the TLS connection more appropriate, or are they both bad?


texts: Hill Cipher the point of a known plaintext attack question

texts: Is the point of a known plaintext attack on a Hill Cipher to get the matrix key?


texts: Proof of (in)distinguishability based on DDH/CDH/DL

texts:
I am wondering whether or not it is known that the following problem is computationally infeasible while working in a group for which the DDH (or CDH or DL) assumption holds (as usual, g is a group generator):
Given the input tuple $(g, g^{\alpha_1}, g^{\alpha_2}, g^{y}, g^{z})$ where $z \in \{y \alpha_1, y \alpha_2\}$, the desired output is $g^{\alpha_i}$ (or simply $i$) such that $z = y\alpha_i$.
If it is not known, I would appreciate any suggestions for a reduction based proof.


texts: Formal Verification of DHKE protocol using ProVerif

texts:
I am new to ProVerif and trying to verify a simple DHKE protocol. The attacker is assumed as passive. The specifications are:

The attacker cannot obtains the mutual key.
Both participants obtain the same key.

This is what I have created.

type G.                             (* The generator *)
type exponent.

free c, sc: channel.
free c02, c12: channel [private].
const g: G [data].
free msg, sameKey: bitstring [private].

fun exp(G, exponent): G.
fun enc(bitstring, G): bitstring.
reduc forall m: bitstring, k: G; dec(enc(m,k),k) = m.

equation forall x: exponent, y: exponent; exp(exp(g,x),y) = exp(exp(g,y),x).

set attacker = passive.
query attacker(msg).
query attacker(sameKey).

let par1 =
    new a1: exponent;
    out(c, exp(g,a1));      (* g^a1 *)
    in(c, v2: G);
    let key1 = exp(v2,a1) in
        out(c, enc(msg,key1));
        out(c02, key1).

let par2 =
    new a2: exponent;
    out(c, exp(g,a2));      (* g^a2 *)
    in(c, v1: G);
    let key2 = exp(v1,a2) in
        out(c12, key2).

let px3 =
    in(c02, k1: bitstring);
    in(c12, k2: bitstring);
    if k1 = k2 then
        0
    else
        out(sc, sameKey).

process
    par1 | par2 | px3

My questions:

Is it enough to verify the first specification?
Logically, the attacker cannot obtain the value of sameKey if the mutual key is identical. But, proverif returns the following output along with some traces. Are there any mistakes in this approach?

The proverif output:

RESULT not attacker(sameKey[]) cannot be proved.

[Update] I managed to solve this problem by using different channel for P1 and P2, denoted by $\verb|c01|$ and $\verb|c10|$ respectively.


texts: Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

texts:
I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit AES keys).

One of the parties (the master) starts the protocol by sending a random nonce authenticated by a MAC computed from a shared secret (derived from MK). The request is also protected against replay by means of a counter.

The parties verify the request and compute a salt by concatening nonce, counter and MAC. Then, they use HKDF (rfc5869) based on SHA256 to derive SK:

PRK = HMAC-SHA256(salt, MK)          // HKDF-Extract
T = HMAC-SHA256(PRK, info | 0x01)    // HKDF-Expand
SK = first 16 octets of T

Now, by protocol, each party has to prove that the derivation of SK from MK was successful, by authenticating fresh data with SK. Assuming each party has a well-known fixed identifier, I build proof of possession as follows:

data = party_ID || salt
proof = AES-CMAC(SK, data)

My question is: is it safe re-use the above salt as a "challenge" for proof of possession, or I have to force the master to send a new random nonce as challenge?
With "safe" I mean: assuming that the rest of the scheme is secure, does the fact of re-using the salt as a challenge leak some information about SK?


texts:
Does the order of a block cipher cascade (e.g. in TrueCrypt) make a difference to the security provided, assuming independant keys?

For example:

Plaintext -> Rijndael -> Serpent -> 3DES -> Ciphertext
Plaintext -> 3DES -> Serpent -> Rijndael -> Ciphertext

The same ciphers, just ordered differently.

My intuition says no, and that the security will be at least that of the strongest cipher, but I can think of a few situations (e.g. timing attacks) where this might make a difference. I can't think of a concrete case where you could exploit this ordering, though.


texts: How to decide which diffusion scheme is better for a block cipher design

texts:
There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion Switching Mechanism. The amount of diffusion offered by these schemes seems to be a good criteria to choose the scheme.

As reference I have "On the Diffusion Property of Iterated Functions" (see here). In that document some degree of completeness is being calculated ($D_c$) that I do not understand.

Is there any strategy to quantify how much diffusion is achieved by the above mentioned diffusion schemes?


texts: Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags（non-deterministic）？

texts: If we use non-deterministic MACs in encrypt-and-authenticate approach， is it secure？


texts: Schnorr signature using discrete logarithm / problem with python implementation

texts:
For educational purposes (by purpose with small values for the prime order q), I tried to write a small Python implementation of the Schnorr signature described in the Wikipedia article https://en.wikipedia.org/wiki/Schnorr_signature

I implemented the following in python (Python 3.6)

from hashlib import sha256
from random import randint

def hashThis(r, M):
    hash=sha256();
    hash.update(str(r).encode());
    hash.update(M.encode());
    return int(hash.hexdigest(),16);

## Notation
# generator g
g = 2

# Prime q (for educational purpose I use explicitly a small prime number - for cryptographic purposes this would have to be much larger)
q = 2695139

## Key generation
#Private signing key x
x = 32991
# calculate public verification key y
y = pow(g, x, q)

## Signing
M = "This is the message"
k = randint(1, q - 1)
r = pow(g, k, q)
e = hashThis(r, M) % q # part 1 of signature
s = (k - (x * e)) % q # part 2 of signature

## Verification

rv = (pow(g, s, q) * pow (y, e, q)) % q
ev = hashThis(rv, M) % q

print ("e " + str(e) + " should equal ev " + str(ev))
# e 2241534 should equal ev 2462540

As you can see, e and ev should be equal - however, they are clarly not.

I don't know where the problem lies - do you have any ideas what I am doing wrong

Many thanks in advance


texts:
Can someone please explain what key sizes are required for the ECDSA algorithm?
I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. Therefore want to know what key sizes are required for the different ECDSA algorithm with SHA1 and SHA2.

Also, how does the key size affect the signature here? Can you please explain?
Thank you.


texts: How is the matrix A related to the lattice space L in SIS?

texts:
Is the matrix $A= (b_1|,...,|b_m)$ where B=$(b_1,...,b_m)$ is the basis of the lattice space, $L$(B)? Not sure if the answer is trivial however I'm having trouble seeing how SIS is a lattice hard problem when it's definition doesn't seem to include a lattice.

Following this, the restriction on the the vector $x$ $\leq \beta$. Where does $\beta$ come from? I understand by restricting the value of $\beta$ you increase the hardness of the problem but at what point do you is it defined?


texts: How are ChaCha-based ARC4Random CSPRNGs initialized and reseeded?

texts:
I'm doing a spare-time project to collect cryptographic algorithms, implement them, and lastly benchmark them.
For the CSPRNG part, I'm evaluating NIST-SP-800-90Ar1 HMAC-DRBG and CTR-DRBG (Hash-DRBG had problems so I dropped it), and I wonder how better HMAC-DRBG will perform if HMAC was instantiated with BLAKE2 instead of SHA-2 or SHA-3, or completely replaced by the keyed BLAKE2, or better yet, how will a purely ChaCha-based PRNG perform better than HMAC-DRBG.
Is there a full-fledged ChaCha-based PRNG (I'm thinking ARC4Random) that supports the basic functions of the NIST special publication? (That is, instantiate, generate, and reseeding.)


texts:
According to Wikipedia, the IND-CPA game is:

  The challenger generates a key pair PK, SK based on some security
  parameter k (e.g., a key size in bits), and publishes PK to the
  adversary. The challenger retains SK. The adversary may perform a
  polynomially bounded number of encryptions or other operations.
  Eventually, the adversary submits two distinct chosen plaintexts
  $M_0$, $M_1$ to the challenger. The challenger selects a bit
  b $ \in \{0, 1\}$ uniformly at random, and sends the challenge
  ciphertext C = E(PK, $M_b$) back to the adversary. The
  adversary is free to perform any number of additional computations or
  encryptions. Finally, it outputs a guess for the value of b.

http://en.wikipedia.org/wiki/Ciphertext_indistinguishability

Because the adversary has the PK, this means he can encrypt any arbitrary text. Why can't he compare the ciphertexts from $M_0$, $M_1$ with the challenge ciphertext? Is the function $E$ different for the adversary and for the challenger?
Does this mean classic hash functions like SHA1, MD5, etc are not IND-CPA secure?

Thanks in advance!


texts: Randomness measure of a sequence over a finite set

texts: If $S$ is a finite set (such as outcomes of a dice). If I have a sequence $x_0 ... x_n$ of elements over $S$, how can I measure randomness quality of such a sequence as compared to measuring quality of random bits?


texts:
I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following:

How does the substitution subround work, as the size of the Rijndael's S-box is 16x16 Octets and size of the input is 4x4?
How does the mixed column operation work on the 4-octet column?


texts: Why is elliptic curve cryptography not widely used, compared to RSA?

texts:
I recently ran across elliptic curve crypto-systems:

An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity management in the Session Initiation Protocol (SIP) (IEEE)
Overview of Elliptic Curve Cryptosystems. (RSA.com)

It seemed to me to be great alternative to RSA as the de-facto cryptosystems to be used in banking and financial systems and in the public key infrastructure for certificates, but is not used! If someone can explain why this is not done, it would be very helpful. A comparison between traditional RSA and an elliptic curve cryptology would be helpful.

To begin with:

Advantage of RSA:

Well established.

Advantages of elliptic curve:

Shorter keys are as strong as long key for RSA (see the IEEE paper)
Low on CPU consumption.
Low on memory usage.


texts: Markov ciphers - generalized group operation

texts:
I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general

http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf

They do their analysis with a general group operation (see Definition on pg 6) which is classically taken as XOR.

Have any ciphers been broken with a group operation other than XOR which can’t be broken by the classical differential? I’m after things independent of using higher order differentials.


texts: What is the security loss from reducing Rijndael to 128 bits block size from 256 bits?

texts:
As you know in the past few weeks it has emerged that NIST/NSA have been involved in weakening encryption standards over a long period of time so that they can retain the ability to break encryption used by corporations and the general public. We've already seen evidence of that with the Dual_EC_DRBG which has been recently disavowed by NIST after public outcry. That's probably a red herring, I think there's another smoking gun here.

I want to highlight a particular issue in the Advanced Encryption Standard process. The Rijndael algorithm had the option of block sizes of 128, 192 or 256 bits to match the key sizes. When that algorithm was decided as the winner, NIST went away and then defined a "restricted" block size of 128 bits for AES. Apparently that was what the spec called for in the first place.

However that doesn't make sense. If you were concerned about security, why would you have a 256 bit key size, but not have a matching block size? It would appear to be more secure to keep them at the same length. For example, a modern cipher like Threefish which has key sizes of 256, 512 or 1024 bits, also has matching block sizes of 256, 512 or 1024 bits.

Can the overall security of AES with a 256 bit key be reduced from
2256 to 2128 by attacking the lower block size?
Could that be combined that with various other attacks on AES which
would reduce the 2128 bit security to even less e.g.
2100 bits?
Now that commercial quantum computers are viable (just one D-Wave Vesuvius is ranked in the top 10 of the TOP500 list), and assuming the NSA have taken advantage of that and constructed a quantum cluster in the basement of Fort Meade/Utah data center, if they employed Grover's algorithm which runs in O(N1/2) time, would that reduce the security of AES to 264 for all key sizes or worse 250 with attacks?

Extra links:

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy
http://www.gizmag.com/d-wave-quantum-computer-supercomputer-ranking/27476/
https://www.scientificamerican.com/article.cfm?id=google-nasa-snap-up-quantum-computer-dwave-two
https://dwave.wordpress.com/2011/12/01/vesuvius-a-closer-look-512-qubit-processor-gallery/
http://www.wired.com/wiredenterprise/2013/06/d-wave-quantum-computer-usc/
http://arstechnica.com/security/2013/09/nsas-pipe-dream-weakening-crypto-will-only-help-the-good-guys/
https://en.wikipedia.org/wiki/Grover%27s_algorithm
https://en.wikipedia.org/wiki/Threefish


texts:
In Matsui's paper (Linear Cryptanalysis Method for DES cipher), lemma 1.

$NS(a, b)$ is even
if $a=1,32$,or $33$, then $NS(a,b)=32$ for all $b$

He said that the following lemma is now trivial from the definition of S-boxes.

But I can't prove this lemma. How can I prove this lemma?


texts: Why do key exchange protocols need secure clock synchronization?

texts:
I'm studying Kerberos and other Key Exchange Protocols.

They always (or very often) require that the clocks are synchronized. To this purpose they periodically probe a time-server. This is said to be a critical operation because new kind of attacks arise. But which attacks?


texts:
Crypto is hard. Thank you for helping me learn.

My encryption scheme currently looks like this:

Salt is stored out in the open
Secret is the user's password, known only to them
EncKey||AuthKey = PBKDF2(Secret, Salt, n) where n = lots
My encrypted payload consists of IV||Ciphertext||HMAC

IV = secure random bytes, unique to each payload
Ciphertext = AES-256 CBC(EncKey, IV, Plaintext)
HMAC = HMAC-SHA1(AuthKey, IV||Ciphertext)

Now, I want to change Secret.  As it stands, this will make all of my already encrypted data unreadable.  So, I want to keep the same EncKey.

Will the following be a secure scheme?

EncKey||AuthKey = secure random bytes, chosen once ever
PwdEncKey||PwdAuthKey = PBKDF2(Secret, Salt, n)
EncKey and AuthKey are encrypted as above, but using the PwdEncKey and PwdAuthKey
Everything else is encrypted and signed with EncKey and AuthKey

To rotate my password, I can then decrypt the payload which has EncKey and AuthKey (which now never change) and re-encrypt it with the newly derived PwdEncKey and PwdAuthKey.

Does it weaken my security having EncKey and AuthKey stored in an encrypted blob alongside the data which they are encrypting?  Is there a smarter way to do this?


texts: Elliptic curves in Edwards form (or Edwards curve) and addition formulas

texts:
In recent studies on elliptic curve cryptography, Edwards curves are remarkable examples on this field. Studies show that this kind of elliptic curves provide faster computation compared to Weierstrass form.

The following equation is called an Edward Curve
$$x^2 + y^2 = 1 + d\cdot x^2\cdot y^2$$
or $$x^2 + y^2 = c^2 \cdot (1+d\cdot x^2y^2)$$

If $(x_1, y_1)$ and $(x_2, y_2)$ are points on an Edwards curve, then new point calculated by addition formula would be still on the curve as illustrated below.

$$(x_1, y_1) + (x_2, y_2) = (x_3, y_3)$$
where:

$$\begin{align}
x_3 &= \frac{(x_1\cdot y_2+x_2\cdot y_1)}{(1+d\cdot x_1\cdot x_2\cdot y_1\cdot y_2)}\\
y_3 &=  \frac{(y_1\cdot y_2-x_1\cdot x_2)}{(1-d\cdot x_1\cdot x_2\cdot y_1\cdot y_2)}\\
\end{align}$$

Proofs of addition formulas for conventional Weierstrass form exist. However, I cannot find any proof for Edwards curve addition formulas. Where do they come from?


texts: What is the flaw in this model for homomorphic encryption?

texts:
Imagine a Field Isomorphism  $g : \mathbb F1 \to \mathbb F2$ given by some $g(x)$

Assume a client is planning to outsource his computations to server, translates every possible $x$ as $g(x)$ and sends to server and once he gets the result he translates g inverse to get the answer.

I know the above is straw man solution for Homomorphic encryption, but am being naive to think of possible problems with such model. One problem I could think of is simple frequency analysis would break the system (but this can be mitigated by coming up padding schemes that retain the homomorphic nature), but what are others?

The catch here is , Most of the current homomorphic encryptions are trying to encrypt the data and perform operations on the encrypted data, but here instead of encrypting it , just the input set is transformed to a another field and such mapping $g(x)$ is kept secret.


texts: Can Web Cryptography API's native key object be reverse engineered in any way?

texts:
I do understand that the security of web cryptography API comes from how it encapsulates the key object natively and disallows its access from JavaScript context unless exported.

However I would like to go further, this security model is only secure if the hacker cannot reverse engineer the browser binary itself to somehow figure out the key. I've been looking for a source on how the technology is actually implemented by browsers internally.

Is there a guarantee that a malicious actor cannot break into a browser and extract out keys "natively" instead? Are the keys stored encrypted internally somehow?


texts: What is the difference between encrypting and signing in ECC asymmetric algorithm?

texts:
What is the difference between encrypting some data vs signing some data (using ECC)?

Does it simply reverse the role of the public-private keys?

In the past, I thought it was just a change of role for publickey and privatekey.

As the diagram:

(Encrypt diagram)

(Sign diagram)

But in practice, it seem not easy like me think.

For example, I can't use ECDSA public key to encrypt and private key corresponding to decrypt.

In this case I must use ECDH.

I do not have much experience on this issue. Please help me.

Thanks in advance.


texts: Information theoretical lower limit on the size of public and private keys

texts:
When we consider public key algorithms, those usually require keys that are much longer than their security level.
According to the Crypto++ Security Level page, for example, integer factorisation algorithms (RSA et al.) require 3072 bits of modulus for a security level of 128 bits.
After RSA, we started to have more efficient systems (both in terms of speed and size), like the very efficient (to todays standards) Curve25519 elliptic curve. This curve requires around 256 bits of storage for the public key, and around 256 bits of storage for the secret key for the equivalent security level of 128 bits.
While RSA doesn't accept any bitstring as secret key, Curve25519 (give or take three bits) does. EC can be broken in $\mathcal{O}(\sqrt n)$, which sadly halves the security level.
So, while practically all public key algorithms have longer keys than symmetric counterparts, I wonder whether this is explicitely necessery. In short: is it (provably) impossible to devise a public key system wherein the public key and private key only take $k$ bits, with the security level equal to $k$, the information theoretical limit?
Bonus:
(If the answer to the above question is "yes, it's is provably impossible", this question gets redundant)
Notably post-quantum algorithms (thinking about SIDH) are heavy on key sizes (NTRU takes a few kB, SIDH a few kb). I restrict the above question to post-quantum public key algorithms: is there a (formal) reason for the requirement of large key sizes in post-quantum cryptography?


texts: Difference between using Schnorr Protocol and just compare hash function to prove knowing something?

texts:
I am studying the Schnorr Protocol, and I just come up a case.
For example, I am a Prover and have a secret $x$. By using the Schnorr Protocol, I create $h=g^x \bmod p$ and save $h$ to a public place.
When a Verifier needs to prove to the Prover,

Prover sends a commitment to verifier $c = g^r \bmod p$ where $r$ is a random value
Verifier sends a challenge to prover $t$ is a random value
prover sends a response to verifier $s = r + t\,x$
verifier accepts iff  $g^s \bmod p= c\,h^t\bmod p$

What is the difference if I store a hashed value for example $h = \operatorname{sha512}(x)$ to a public place, and if prover want to prove he know secret $x$, he just need to send $h'$ to verifier and verifier compare if $h = h'$ stand.
I know that a dishonest prover can send the hash to the verifier directly to fool the verifier. Apart from this, is there any difference? It seems that using a hash can still prove the prover knows secret $x$.


texts: Is chosen ciphertext attack used to obtain a key?

texts:
I don't understand what the goals are of a Chosen Ciphertext Attack.
What I've read from Wikipedia is that it is an attack one can use to obtain the key that the crypto algorithm uses.

However, I think that every file is usually encrypted using a different key.
If so, why is the chosen ciphertext attack used ?
Maybe I don't quite understand the concept of a key...

I'm no mathematician or cryptoanalyst but a simple curious boy :)


texts:
I'm lacking quite some mathematical knowledge here, but could anyone please explain to me why the Paillier cryptosystem is still (additive/multiplicative) homomorphic despite introducing a random value?

$[\![w_1w_2]\!]_g$ = $[\![w_1]\!]_g + [\![w_2]\!]_g\ \bmod\ n$

Does it have to do with the value being sampled from $\mathbb{Z}^*_n$? Is the only requirement for the above statement to hold that $w_1, w_2 \in \mathbb{Z}^*_{n^2}$?


texts:
I want to save the space signatures take up in a block of Bitcoin transactions. To simplify it, here is the general transaction structure in a block:

message
public key
signature of the message

There are many transactions in one block and I want to save the space the signature takes by using signature aggregation.
The signatures in one block are under many different public keys and on distinct messages.

I found these interesting articles about it, but I am not sure that they solve my exact problem. Please tell me if the solution to my problem can be found in one of those articles or point me in a new direction or explain to me why this is not possible.

Signature Aggregation
Multi-Signatures in the Plain Public-Key Model
and a General Forking Lemma
Signature aggregation for improved scalability


texts:
I am currently studying Cryptography and I don't really understand what does 'well-typed' mean when talking about secure cryptographic protocols. I can't find any reasonable explanation on the internet either.

It would be great if someone could give definition and maybe example.

For example quote from “prosecco.gforge.inria.fr”:

  The basic soundness theorem for the type system states that well-typed process do not reveal their secrets." So what is 'well-typed'?


texts: Let F be a deterministic compression function that takes fixed length 128 bit inputs and outputs 8 bits. Each input to the function has 128 bits of entropy, does that mean that the output byte has 128 bits of entropy ?


texts:
My question is related to this:
Security of one-time-pad without $\bmod $ operation?
but the way we mask values is different here.

We consider a finite field, $\mathbb{F}_p$, and a ring $\mathbb{Z}_N$, where $N$ is RSA modulus, and such that $p<<N$. Value $p$ is a (large) prime number and indepent of the prime numbers used to generate $N$.

Let $m_i\in  \mathbb{F}_p$. We mask it as:

$m'_i=m_i+r_i$, where $r_i$ is picked uniformly at random from the ring but  $m_i+r_i \in \mathbb{Z}_{N}$.

Please note that we do NOT perform $\bmod N$ when we compute $m'_i$.

Question 1:  Is there any way to argue that given $m'_i$, a semi-honest adversary cannot learn anything about $m_i$ ? for instance, it is statically indistinguishable etc.

For the sake of simplicity let's assume all the values are non-zero. we can pick large enough $p$ and $N$ to meet any security definition if it's required.


texts: Correlation of an approximation over a random permutation

texts:
I read a paper of linear cryptanalysis that is J.Daemen et al's Probability distribution of correlation and differentials in block cipher.

In this paper's lemma 8's proof, I can't understand this formula (page.13).

  The number of balanced Boolean functions $g(a)$ for a given value of $x$ is :

  $$ {{2^{n-1}} \choose {2^{n-2}+x}} {{2^{n-1}} \choose {2^{n-2}-x}} = {{2^{n-1}} \choose {2^{n-2}+x}}^2$$
  and

  If we divide this by the total number of balanced Boolean functions,..."

Please, tell me how this formula is derived.


texts: What if the p and q used in keys generation of Pailler cryptosystem are composite?

texts:
I've seen a few implementations of Paillier cryptosystem that uses probable primes to choose $p$ and $q$.

Assuming that a keypair  is generated with $p$ and $q$ that are coprime and that $pq$ is coprime with $(p - 1)(q - 1)$, but either $p$ or $q$ is composite, I'm wondering what security issues afflict such a key.

For example I wonder if, when $p$ is prime but $q$ is composite (so that $q = xy$ with $x$ and $y$ primes), there exists multiple public keys that can encrypt/decrypt a message.

Moreover, I'm wondering how it impacts $g$ and $r$ selection, and if the encryption function is still additively homomorphic. For example, with proper primes, one can use $r$ calculation to prove the sender of an encrypted message his control over the private key without sending the encrypted value over the channel. But is this still true for any $r$ if $p$ or $q$ are not truly primes?

Finally, which kind of cryptographic attacks are excluded by proper prime selection?


texts:
My app on Android uses the built-in motion sensors to collect seed-data for the PRNG (java.security.SecureRandom) that is later to be used for key-generation.
The user is told to shake the device so the incoming data should be somewhat pretty random. Also, too slow movements are ignored in order to avoid getting only 0s as seed if the device was not moved during the time of "recording".

In detail: Teh length of the movement-vector is calculated ($l = sqrt(x^2 + y^2 + z^2)$) and $9.81$ is subtracted from it in order to ignore gravity.
If $l$ is less than 81% of the sensors Peek value the set of values is ignored. Otherwise the resulting values for x, y, z are beeing muliplied by $2^{28}$ (because bit-shifting is not supported on floats in Java), then XORed.
These values then fill an array like that:

dataStack[dataSetsRecorded++ % dataStack.length] ^= value;

The question is: is that a high entropy or can this be predicted (e.g. because most phone users would shake the phone up and down but not sidewise and tablet users would rather tilt than shake the device)?
Thanks :)


texts: For RSA keys, is the safety of a given key-length different for signing vs encryption?

texts: I'm wondering if considerations of key-length are different when thinking about signing vs encryption. If for some reason, it was safter to use smaller keys for signing that would be interesting.


texts: Hash or encryption function for challenge-response protocol?

texts:
Say I have an authentication protocol where the shared secret is never transmitted. The server passes a challenge to the client and the client calculates a response using an algorithm where the challenge and the secret is used.

When choosing the algorithm, what are the benefits and drawbacks of using either a hash (such as MD5) or a symmetric encryption algorithm (such as AES)?


texts: What is the motivation of multipartite secret sharing?

texts:
In this thesis chapter 3.1

A multipartite secret sharing scheme is a scheme in which the set of
participants is divided into several parts and all participants in the
same part play an equivalent role in the scheme.
Secret sharing schemes for multipartite access structures have
received considerable attention. This is due to the fact that
multipartite secret sharing schemes can be seen as a natural
generalization of threshold secret sharing schemes. While in threshold
secret sharing schemes all the participants are equivalent, in a
multipartite secret sharing scheme the participants are distributed
into different classes in which all the participants are equivalent.
In addition, similarly to threshold access structures, multipartite
access structures can be described in a very compact way, by means of
a few conditions that are independent of the total number of
participants

Is the above paragraph (information) sufficient for the motivation of multipartite secret sharing scheme?
If it is not sufficient information for the motivation of multipartite secret sharing scheme, please suggest where I have to read motivation of multipartite secret sharing scheme.


texts: How is a public key actually used to encrypt something?

texts:
One thing cryptography articles never seem to explain is how the message actually gets encrypted. You get this long-winded lecture on number theory which ends with, Ta Da! and we have a public and private key. Then, they never explain the process of exactly how some 100,000 byte word document gets encrypted using the public key.

Other times the explanations seem downright misleading. For example, in my book Cryptography (by Meyer and Matyas) it says for RSA the ciphertext is the plain text to the power of key. How do you exponentiate a word document? I don't get it.


texts:
I am trying to understand if it possible to use DLP to build a keyed one-way function with the following properties:

$H_a(H_b(M)) = H_c(M)$, where $a$ and $b$ are the keys, and $c=a*b$
The output of the function is relatively small - e.g. 256 bits

The function itself could be $h_a=M^a$ mod $p$, where $p$ is a 256-bit prime. However, I'm not sure how secure this would be given that the prime is pretty small. Specifically, I want to understand if the following would hold:

Given $h_a$ and $p$, it would be impractical to compute $M$
Given $h_a$, $M$, $c$, and $p$, it would be impractical to compute $a$

The messages I need to process are relatively small (256 - 512 bits), but can be padded if that would increase security.


texts:
As I understand it, CTS pads the last block and swaps it with the second last to compensate for a partial block of data. I have written a DRBG (Deterministic Random Bit Generator) using AES-CBC that only accepts an input size which falls on the block boundary.

Is CTS really necessary here? I can't imagine a way in which it's absence will affect the entropy of the output. Am I understanding this correctly?


texts: Equivalent key size between HMAC and AES?

texts: I have seem comparison between AES and RSA, e.g., AES 128 bit key is equivalent to RSA modulus 3072 bits. Is there such comparison between AES key size and HMAC?


texts: Are there any zero knowledge protocols which do not rely on a Group?

texts:
To me (new), it seems that a lot of cryptography relies on group theory.

Are there any zero knowledge protocols which do not rely on a group?


texts: Is 512-bit RSA still safe for signature generation?

texts:
The standard CSP on Windows XP only supports RSA up to 512-bit, which means that it's the maximum key size I can use for authenticity verification of updates. The public key is embedded in the updater, and the update files are signed with the private key, using SHA256.

I know that RSA-768 was factored back in 2010, which is what makes me wonder if RSA-512 is still acceptable for signing purposes. How much effort is it for an attacker to break a 512-bit RSA key?


texts: Differential Privacy: why $\delta$ negligible on the row numbers?

texts:
The definition of differential privacy says that an algorithm  $M$ is $(\epsilon,\delta)$-differentially private if

$$P(M(x \in D) \in S)\leq e^\epsilon P(M(x \in D')\in S) + \delta$$

where $D,D'$ differ by one row and $\delta$ is  $\text{negligible}$ in the number of database rows, so $\delta< \frac{1}{p(n)}$ with $n$ being the number of database rows; why do we take $n$ as parameter for this negligible function?


texts: Exponentiation Problem of G2 in MNT curve


texts: How would you explain stateful encryption?

texts: I have recently started reading on encryption protocols and their counter attacks. I came across the term Stateful Encryption particularly used in encrypting data that is stored in the cloud. So far I think it is just another variable that is used to calculate ciphertext and gets updated after every generation and storage of ciphertext from a plaintext. Can you explain why statefulness was needed and how it solved that need?


texts: Why not use ordinary hash functions for password hashing?

texts:
Assume we have a password and add a unique salt to prevent various precomputation attacks.

Why don't we do this:

SHA256(SHA256(SHA256 ...(Password || Salt)))

So, we have n iterations (like in PBKDF2) and because of the iterations, it should take much longer to compute the hash for a password, which is key stretching.

Can someone explain to a newbie like me why we don't use specific algorithms like scrypt, PBKDF2, or Argon2 and do this?


texts: Why does key generation take an input $1^k$, and how do I represent it in practice?

texts:
In my lecture, the lecturer said:

  Let $K$ be the key generation algorithm. Given a security parameter represented in unary, $1^k$, $K(1^k)$ will output a keypair $(pk; sk)$, known as the public key and the private (or secret) key, respectively.

My question is: When I want to implement the cryptosystem, how should I represent this $1^k$?  When I implement the key generation procedure, do I literally require callers to pass me a string of $k$ one-bits that the procedure will never use?  And, if so, why is it there in the first place?


texts: How far is public-key crypto involved in "banking world"?

texts:
I would like to know how public key cryptography is used in the banking world. I am not looking for big details, but for example:

Are banking card embedding a private key used for signing (authenticating) user transactions?
During a transaction between Bank A and Bank B, is Bank A expected to sign the transaction so that it can't deny the transaction?
How are digital signatures used between a Point-Of-Sale and a Bank?


texts: How do I check if the secret key polynomial of the ATV-FHE (NTRU based) scheme is invertible?

texts:
I want to implement the ATV-FHE scheme as described here https://eprint.iacr.org/2014/039.pdf. To generate the secret key polynomial I compute f = 2*u + 1 , with scheme parameters chosen such that this polynomial is invertible with high probability.

If I want to compute the public key I should compute it as indicated in section 2 :

  $h(i) = 2g(i)*[ ( f(i) )^{(-1)} ]$

or should I sample the public key as indicated in section 3 Parameter selection in NTRU_FHE :

  Recall that for the NTRU-FHE scheme, the public key is of the form $h = 2gf^{(-1)}$  where $g$; $f$ chosen from
  a Gaussian distribution $D$ where $f$ is kept secret. The DSPR problem is to distinguish polynomials
  of the form $h = 2gf^{(-1)}$  from samples $h_0$ picked uniformly at random from the ring $Rq$. If the DSPR
  problem is hard, we can replace $h = 2gf^{(-1)}$ by some uniformly sampled $h_0$.

The bad part for the second option (described in section 3) is that parameter selection is very difficult to be made as noted here

  The impact of the new parameter settings to the security level is largely unknown
  and requires careful research. However, even if we assume that the DSPR problem is hard for typical NTRU-FHE parameter selection, concrete parameters are still hard to chose. The RLWE problem is still relatively new and lacks thorough security analysis.$h_0$.

I have found an alternative so far: to generate a random polynomial and to verify if this polynomial is the invers of the secret key polynomial. Here is an example : https://github.com/tlepoint/homomorphic-simon/blob/master/YASHE/YASHEKey.cpp, in constructor YASHEKey::YASHEKey there is a portion of code

if(sigmakey == 1)
{
    // Sample g, f1 with coefficients in {-1,0,1}
    fmpz_mod_polyxx g(q);

    fmpz_mod_polyxx f1(q);

    binaryGen(g, ell-1);

    do
    {
        binaryGen(f1, ell-1);
        *f = t*f1+one;
        finv = (*f).invmod(*phi);
    }
    while (((*f)*finv)%(*phi) != one);

    *h = (t*g*finv)%(*phi);
}


texts: Can one generalize the Diffie-Hellman key exchange to three or more parties?

texts:
Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties?

I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 or more parties.


texts: How does GnuPG compress a file and how to deal with it?

texts:
When encrypting a file symmetrically with gpg -c file.txt, when and how does it compress the file?

I was working on a cryptopals challenge and wanted to test out my AES ECB detection function. I made a simple text-file that was around 1KB and encrypted it through the python package PyCrypto, the output file was also 1KB. I took this same file and encrypted it via gpg and got a file that was only 100B. My ECB detection function completely failed to tell it was 128 AES-ECB.

Edit: I've noticed that no matter the file, when the contents are encoded to b64 the first string is always jA0EBwMC, yet even removing these first bytes from the data doesn't yield any repeat blocks.

I tried to decompress the file with bz2, but it put out an error saying it wasn't a bzip2 file. I also can't tell if the file was compressed before the cipher was applied or before. How can you deal with something like this?


texts: Length of password requirement using openssl aes-256-cbc

texts:
I am using the following OpenSSL command to AES 256 encrypt a file:

openssl aes-256-cbc -salt -in secret-file -out secret-file.aes
  enter aes-256-cbc encryption password:
  Verifying - enter aes-256-cbc encryption password:

As far as I understand, the encryption password should be 32 characters/256 bits, but passing a single character a seems to work just fine.

What is happening behind the scenes here? Can you really pass any length encryption password? What are the trade offs?


texts:
I am reading a paper and notice that the term St is used without being defined. I suspect it is a common notation that I am not aware of.

It is used in the following paper:
https://eprint.iacr.org/2015/482.pdf

The first instance of it appears in Section 2.1, in the formula used in Definition 2.

What does the St denote?

Thanks


texts: How would I convert an arithmetic circuit into a system of bilinear equations?

texts: Given an arithmetic circuit, are there any examples of turning it into a system of bilinear equations, with the end goal of turning it into a matrix?


texts: I want to "translate" a text so that its encrypted form should be pronounceable text. Is there any crypto technique that can make encrypted text look as another language? (yet, difficult to decrypt).


texts:
I'm looking to discover what DES's Strengths and Weaknesses are.

I understand that DES is a block fiestel cipher operating on 64 bit blocks and 56 bit keys (after deduction of 8 bits). And I realise that DES is weak against Brute force in this day and age.

But I'm looking to understand firstly, why is/was DES so strong originally. I.e. how does it defend against common attacks.
And secondly: other than key space, are there any DES specific weaknesses that can be practically exploited? If so, is there an obvious solution to preventing that weakness?

As a side note, I'm not very mathematically inclined so a high level explanation is likely needed, additionally I'm not as interested in Double or triple DES.


texts: What is the "shared secret" used for in IPSec VPN?

texts:
Can somebody explain what the "shared secret" and "password" do when opening/creating a VPN tunnel?

In this specific case I setup a VPN to my Fritz!Box and I had to provide a shared secret (which was pregenerated and very long) and a password.

I'd like to understand how each of these two credentials is used in terms of encryption.


texts: Is an RSA variant with public exponent $e=f+(p-1)\cdot(q-1)$ safe (for $f$ random in some small interval)?

texts:
Alice is going to use some existing RSA scheme (employing industry-standard signature or/and encryption with proper padding), which she can't change, or influence beyond her choice of key. In this scheme, all public modulus $n$ are exactly $b$ bits with $b$ even (e.g. $b=4096$); and any odd public exponent $e$ with $3\le e<e_\mathtt{lim}$ is allowed, for some $e_\mathtt{lim}$ at least $n$ (this is common; e.g. PKCS#1v2.1 uses $e_\mathtt{lim}=n$).

Contrary to standard practice, Alice would like her RSA key to have a public exponent $e$ crafted to slow down use by other parties (say, she wants to better resist some denial of service attack starting with sending her an RSA-encrypted message); but she would like to keep her own actions fast when performing a computation normally involving her public key (that includes Alice checking a signature she just generated using the CRT, as customary to guard against the mother of many fault injection attacks).

Towards these goals, Alice can generate her key as follows:

she secretly chooses a random odd $f$ with $3\le f<2^{b/2}$;
she secretly chooses random primes $p$ and $q$ with $2^{(b-1)/2}<p<q<2^{b/2}$, $\mathtt{GCD}(p-1, f)=1$ and $\mathtt{GCD}(q-1, f)=1$;
she computes $n=p·q$;
she computes $e=f+(p-1)·(q-1)$;
she computes $d=f^{-1}\bmod{\mathtt{LCM}(p-1,q-1)}$, or/and $dP=f^{-1}\bmod{(p-1)}$, $dQ=f^{-1}\bmod{(q-1)}$, $qInv=q^{-1}\bmod p$.

Alice's public key is $(n, e)$, made public, and her private key is $(n, d, p, q, dP, dQ, qInv)$. These are usable as customary in RSA. In particular, the construction yields $2^{b-1}<e<n<2^b$ with $e$ and $n$ odd, and thus meets the conditions required for $(n, e)$ to be acceptable in the scheme.

For a user of Alice's private key other than Alice, computing $x^e\bmod n$ for arbitrary $x$ requires over $b$ modular multiplications (more like $3·b/2$ with basic binary exponentiation), rather than $17$ modular multiplications for the customary public exponent of $2^{16}+1$. Thus Alice's goal of making use of her public key slow is largely met.

Notice that $\forall x\in\mathbb Z$, $x^e\equiv x^f\pmod n$ (proof sketch: the equality holds $\pmod p$ using Fermat's little theorem; same $\pmod q$; thus the equality holds $\bmod(p·q)$ as well). Therefore, Alice can use $f$ instead of $e$ when she wants to perform the transformation $x\mapsto y=x^e\bmod n$. Because $f$ is at most $b/2$-bit when $e$ is $b$-bit, this gives Alice a performance advantage of about a factor of $2$.

Question is, does Alice's choice of key create a risk, compared to established practice? And how can we keep (or make) that safe, and maximize the cost of computing $x^e\bmod n$ directly, and Alice's advantage over that?

Update: In particular, how much can we safely reduce the interval for $f$ at step 1? Can we make the binary expression of $f$ sparse to further speed its use by Alice? Can we increase the cost of using the public $e$? How can we use freedom given by $e_\mathtt{lim}$ when that's more than $n$? Notice each of these could improve Alice's advantage.

Update: By using a CRT form of her public key $(n, f, p, q, fP, fQ, qInv)$ with $fP=f\bmod{(p-1)}$ and $fQ=f\bmod{(q-1)}$, Alice gains an extra advantage by a factor of about $2$ (and more should we increase the number of prime factors of $n$).

Update: As pointed in the first comment, Alice must keep $f$ secret as well as $d, p, q, dP, dQ, qInv$, since knowledge of $f$ combined with $e$ reveals $(p-1)·(q-1)=e-f$, wich combined with $n$ is known to allow efficient factorization of $n$. In particular, Alice should be wary of side channel attacks such as these when computing $x^f\bmod n$, which are not to fear when computing the same value as $x^e\bmod n$ (at least when $x$ is public).

Note: AFAIK this is new, and hereby put in the public domain.


texts:
I'm trying to write a code to perform encryption and decryption of 64-bit DES but I'm having a problem in verifying that my code is working correctly. My graduation project is about DES crypt-analysis so I'm trying to implement DES to generate the pairs used in the attack.

Can anyone give me an example on encryption of DES with all stages?

For instance, I would like to see the key schedule and the values of all 16 round keys generated by the input key.


texts: Is This method of generating Initialisation Vector for Cipher Block Chaining secure?

texts:
I have worries about security defined in BACnet protocol (ASHRAE/ANSI Standard 135, ISO 16484-5). Full text of security is here: http://bacnet.org/Addenda/Add-135-2008g.pdf and here is my summary:

In my message I have header containing unique message ID and timestamp (along with some other data) and payload. I sign whole message using HMAC with first key and MD5 or SHA-256 as hash algorythm. Then i use first 16 bytes of signature as IV for encrypting payload with CBC AES with second key. I attach signature to the message.

Is My IV unpredictable enough? Is signing a plain payload making my security vulnerable?


texts: Is my understanding of CPA indistinguishability experiment correct?

texts:
Following are steps to conduct Chosen Plaintext Attack (CPA) indistinguishibility experiment $PrivK_\mathcal{A,E}^{eav}(n)$.

$\mathcal{A}$ is the adversary $\mathcal{E}$ is the encryption scheme (Gen, Enc, Dec), $n$ is the length of the input.

a secret key SK is generated using Gen($1^n)$
$\mathcal{A}$ is given input of $1^n$ and oracle access to $Enc_{sk}(.)$ and outputs a pair of messages $m_0$ and $m_1$ of the same length.
A random bit $b$ is chosen.  $Enc_{sk}(m_b)$ is computed to form $challenge$ ciphertext $C$ given to $\mathcal{A}$.
$\mathcal{A}$ continues to have oracle access to $Enc_{sk}(.)$ and outputs another bit $b'$.
If $b'== b$ then $\mathcal{A}$ succeeded, otherwise $\mathcal{A}$ lost the game.

To better understand the experiment above, I decided to run it with simple values of my choosing:

secret key SK 10101010 generated with length n=8 by defender (one who wants security)
$\mathcal{A}$ is given an input $1^n$ =  11101110 by defender.  Using the length of this input, $\mathcal{A}$ comes up with $m_0 =  11111111 $ and $m_1$ = 00000000
Defender randomly selects $b$ = 0 and encrypts $Enc_{sk}(m_b)$ = $Enc_{sk}(m_0)$ = $Enc_{sk}(11111111)$ = 10111011 = $C$ challenge and given to $\mathcal{A}$
Using $C$ = 10111011 $\mathcal{A}$ tries to guess if it came from $m_0$ or $m_1$.  Guesses $b'$ = 1.  This means $\mathcal{A}$ lost the game.

My understanding is the adversary continues to pick different $m_0$ and $m_1$ values and has the defender encrypt them until he starts guessing correctly over 1/2 the time.

Is this a correct understanding or am I missing something?


texts: Why calculate pi to estimate randomness?

texts:
Why do testing suites calculate $\pi$ (pi) using the Monte Carlo method to determine if a series of numbers are random?  As far as I can tell, the Monte Carlo method can be used to estimate $\pi$ itself (as a numeric means of calculating it).  It just so happens to use random numbers.

Why does it have to be $\pi$ if you're testing a numeric sequence for randomness?  It seems that plotting random points inside and outside a circle to get $3.1415 \dots$ achieves exactly the same as plotting points inside /outside a triangle to get $0.5$.  Is there something special about the circular shape pertinent to cryptography?


texts: Splitting text before Format Preserving Encryption operation

texts:
What is the effect on Format Preserving Encryption security if I reorder text before FPE encryption?

Take as an example Canadian postal codes (letter-digit-letter digit-letter-digit):

Parliment: K1A 0A6
Santa Claus: H0H 0H0
Easy to remember: A1B 2C3

Using the postal code as a base 36 number and applying FF1 (NIST 800-38g test vector AES128 key, no tweak) gives this ciphertext:

$$E_k(\mathtt{K1A0A6}_{36}) ==> U7F8BD_{36}$$

But the original format is not preserved (last character is not a number).

What is the difference effect on the security of encryption if I

Group digits and characters toghether prior to encryption
Reduce the base to 26 and 10 for letters and digits, respectively
Apply FF1 on the two sets
Re-order the ciphertext so format is preserved

Something like this:

\begin{gather}
E_k(\mathtt{KAA}_{26}) ==> FDE \\
E_k(\mathtt{106}_{10}) ==> 143 \\
\end{gather}

Would end up with FF1 encrypted postal code: F1D 4E3


texts: Using CBC with a fixed IV and a random first plaintext block

texts:
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:

Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the plaintext.
After decrypting, ignore the first block.

Is this exactly the same in terms of security as using a random IV?

Also, would it make any difference if I used something like a message counter instead of a random block in step 2?


texts: Relation between "P is not equal to NP" and "Existence of One-Way Function"

texts: We know that If there exists a one-way function, then P ≠ NP. Why can we not conclude that if P ≠ NP, then there exists a one-way function? Is there a  polynomial time computable function that is hard to invert in the worst case and isn't one-way?


texts:
I have a primitive that is able to generate a AES-128-CMAC from a message.

$\operatorname{CMAC}(\text{MessageAddress}, \text{MessageLength}) \rightarrow \text{result}$

I cannot change this primitive. I don't have direct access to the key, nor to the internals of that function.

Let's say that I want to authenticate a message that is split over non-contiguous chunks. How is it possible to chain calls to this primitive while not opening a breach to an attack?

For example, if $M = M_1 || M_2 || \ldots || M_n$, compute

$\operatorname{CMAC}(\operatorname{CMAC}(M_1) || \operatorname{CMAC}(M_2) || \ldots || \operatorname{CMAC}(M_n))$

Of course, the result is completely different than $\operatorname{CMAC}(M)$ but that doesn't matter because both sides would implement the same algorithm for signing and verification.

However, is it still secure? Would it be better to use a XOR operation instead?

$\operatorname{CMAC}(\operatorname{CMAC}(M_1) \oplus \operatorname{CMAC}(M_2) \oplus \ldots \oplus \operatorname{CMAC}(M_n))$

Any other idea?


texts: Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

texts:
I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support.

I even checked open source cryptography libraries which implemented AES-GCM with CMS support (AuthEnvelopedData Content Type), but none of them contained any test vectors that I could extract and use. Openssl doesn’t seem to provide any cms support for aes-gcm either. I also checked the Bouncy Castle cryptography library. In their release notes they state

  AES GCM mode is now supported by CMS EnvelopedData.

but the standards (RFC 5083 & RFC 5084) say it should be AuthEnvelopedData. Am I missing something here? Also, in the source code of Bouncy Castle there is a class named CMSAuthEnvelopedGenerator which is supposed to do the work, but only a few static variables have been defined in the class – no methods defined yet. So, it seems that there are some unfinished business left there.

Warn me if I am wrong but I have come to the decision that very few people are using AES-GCM mode in file encryption and other encryption purposes (except TLS). Because in the other case, how can a library decrypt a file encrypted by another library without using the standard syntax?

TL;DR

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. Can anyone provide (or point me to) test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?


texts: DES: how does Richard Outerbridge's Initial Permutation operate?

texts:
I know how initial permutation works, but I've never heard of this part.
People say it's Richard Outerbridge's initial permutation and that it's faster than usual IP (initial permutation) and simple.

How does this IP work? I've only the source to work with:

work   = ((leftt >>  4) ^ right) & 0x0f0f0f0f;
right ^= work;
leftt ^= (work << 4);

work   = ((leftt >> 16) ^ right) & 0x0000ffff;
right ^= work;
leftt ^= (work << 16);

work   = ((right >>  2) ^ leftt) & 0x33333333;
leftt ^= work;
right ^= (work << 2);

work   = ((right >>  8) ^ leftt) & 0x00ff00ff;
leftt ^= work;
right ^= (work << 8);
right  = (right << 1) | ((right >> 31) & 1);

work   = (leftt ^ right) & 0xaaaaaaaa;
leftt ^= work;
right ^= work;
leftt  = (leftt << 1) | ((leftt >> 31) & 1);


texts: What is the probability of finding 4 equal bytes?

texts: Is it $2^{-32}$ or $2^{-24}$ as one byte is assumed to take a given value and the remaining 3 bytes should have the same value?


texts: Are Paillier and El Gamal encryption schemes secure against quantum attacks?

texts: I was wondering if there is a security difference between Lattice based homomorphic encryption schemes versus an partially homomorphic encryption scheme like Paillier, and El Gamal encryption schemes especially with respect to the security against quantum attacks?


texts: How do SignRecover and VerifyRecover work?

texts:
In PKCS#11, there are the SignRecover and VerifyRecover methods,

where the data can be recovered from the signature. How do these methods work?

Can I implement signrecover and verifyrecover with openssl?


texts: Why does DES use exactly 16 rounds and not more or less than 16? What is the significance of using 16 rounds?


texts:
Consider 3 parties, Alice, Bob and Charlie. Suppose
  each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively.
  Show how construct a scheme with which they can compute the function $f (a, b, c) = a \oplus b \oplus c$
  such that the following are satisfied:

  (1) All parties learn $f(a, b, c)$ at the end.

  (2) No party can learn more about the other party's input than what they can infer from $f(a, b, c)$ and choosing their own input wisely.

My attempt: A chooses $r_1,r_2\in\{0,1\}$, B chooses $s_1,s_2,\in\{0,1\}$, and C chooses $t_1,t_2\in\{0,1\}$ randomly. Then dealer of respective secrets (bold) distribute 3 shares to each party in the following manner.

$A: \it{\bf{a\oplus r_1 \oplus r_2}}, s_1, t_1$

$B: r_1, \it{\bf{b\oplus s_1 \oplus s_2}}, t_2$

$C: r_2, s_2, \it{\bf{c\oplus t_1 \oplus t_2}}$.

To reconstruct the secret $a\oplus b\oplus c$, they can compute their sum of shares,

$A: (a\oplus r_1 \oplus r_2)\oplus s_1\oplus t_1$

$B: r_1\oplus( b\oplus s_1 \oplus s_2)\oplus t_2$

$C: r_2\oplus s_2\oplus( c\oplus t_1 \oplus t_2)$.


texts: Secure algorithm for calculating token and comparison

texts:
I am trying to define algorithm that would create a irreversible token from IDs, which are 10 digit information, and then would be compared on two different end points.

Between end points, only sending tokens is allowed, no IDs can be send from one end point to another. End points are not sharing any secret information like cryptographic keys.

The situation will be that server would have database with stored tokens, not IDs. When end point would like to verify ID, it will calculate token from ID using the same algorithm and send it to server to match. It should not be feasible for attacker to get ID back from token.

I was thinking about using SHA-512 but it seems to be not very secure as, for example using hashcat, I am able to create all hashes of 10 digits IDs very fast.

If I use PBKDF2 with number of rounds to slow down the attack I would need to use the same salt for every end point as they need it to calculate token, which defeats the purpose. (PBKDF2 with the same salt for all IDs)

HMAC would probably be a good solution but it need to have symmetric key distributed among all end points that would like to calculate tokens, and I can't do that.

What algorithm would be the right for such solution if any?
Is it even possible to achieve my goal without using shared secret?

EDIT:

Token should be then used as a unique ID so I assume that it should be calculated deterministically.


texts: AES - What is the advantage of a 256-bit key with a 128-bit block cipher?

texts:
I'm just trying to wrap my mind around the decision to select the 128-bit Rijndael as the AES cipher, even with 192-bit and 256-bit keys. Even with a 256-bit key, you only get 2^128 possible outputs per 128-bit block, thus kind of rendering the larger key size meaningless (not to mention the weaker key schedules).

Was this a NIST oversight when standardizing AES?

(Answering this isn't urgent. I'm using libsodium, which uses Xsalsa20 + Poly1305, in most of my projects these days, but it's something I don't readily know the answer to.)


texts: How do I calculate a password space if the password only has eight alphabetic characters (not case sensitive)

texts: I read this wiki article and saw this formula for random password's information entropy. Also the wiki article mention that the symbol count for non case sensitive is 36. Is there a way I can calculate the password space with this information.


texts:
I would like to know if the following process to generate keys for a set of devices is secure.

Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key DK for each device:

DK1 = KDF(MK, salt1)
DK2 = KDF(MK, salt2)
…

where the salt is, for example, the serial number of the device.

The device key is assigned to the device. They use their Device Key and the same KDF to produce message keys with 128bit:

K1 = KDF(DK1, mc)

where mc is a message counter.

The key is used for encryption or CMAC authentication.

When the devices communicate with the back end system, the back end can derive the K1 by

K1 = KDF( KDF(MK, salt1), mc)

Is this secure? The proposal for the KDF is CMAC according to NIST/SP 800-38B.


texts: Is SHA-256 bijective on a certain domain?

texts:
Following the discussion on bijectivity and given that function inverse is studied on domain/codomain, I would like to ask whether we can find subsets where this function can be bijective.
Let's say the subset of all alphanumeric strings of exactly 5 characters. The cardinal of this subset should be Arangements of 62 characters in a line of 5 characters = 62! / 57! ~ 776 mln . This is definetely lower than 2^256 . Is this enough to say the function is injective on this domain or do I need to calculate every single value to make this conclusion? What happens to surjectivity in this case?
OBS: I might make confusion with continuous functions so do let me know if I have mistaken something.


texts: To decrypt a cipher text encrypted using keyed substitution

texts:
I'm looking for decryption of this cipher text which was encrypted using simple substitution using secret key. I have already spend a lot of time on this. However it should not be that tough. So I think my procedure may not be correct.

The question is something like this:

The secret key (a permutation of the English alphabet) was generated from a key letter and a keyword. The key word is an English word (names of cities and countries are allowed) having no repeated letters. The secret key is then derived by writing the key word beneath the key letter in the alphabet; followed by then writing the remaining letters of the alphabet in cyclic order after the key word.

For example,if the key letter is 'm' and the key word is LAND, then the secret key is:

a b c d e f g h i j k l m n o p q r s t u v w x y z
O P Q R S T U V W X Y Z L A N D B C E F G H I J K M

All punctuation and spaces were removed from the plaintext, which was then blocked into groups of 5 letters prior to encryption.

The cipher text is:

LUPFK LLVBB VSTBU PAPFK VBVST QEALE ZPBUV STEAL EZPME OHKSO LVSNP LVBBV STKSO
FKVBV STFKL BUPES YHBUV STBEO EWCLB BUPSL UPLKB KSOFK VBPOF VBUKY YUPAZ VTUBK
SOZKV SZKBB UPFPS NECSB PAPOB UPLBK BVESZ KLBPA YENXV STCRB UPBVN XPBEQ QVNPR
APRKA KBEAH BETEV STUEZ PQEAL CRRPA KSOKL XPOUV ZVQBU PQVDP BUVAB HBAKV SFECY
OLEES MPKYE STBUP QVDPB UVABH BAKVS UKLMP PSVSK SOTES PUKYQ KSUEC AKTEK SLFPA
POBUK BMAVL XEQQV NVKYM CBBUP APFKL KRKLL PSTPA OAERR POEQQ QEAHE CKYVB BYPTV
AYLUP LLVBB VSTEC BBUPA PESBU PLUVS TYPLV KLXPO UPABE TEVSB EBUPY KOVPL FKVBV
STAEE ZMCBL UPVSQ EAZPO ZPTAK DPYHB UKBLU PRAPQ PAAPO BELBK HECBL VOPBU PAPFK
LZEAP LNERP QEAVZ KTVSK BVESL UPLKV OLUPL KNKLP VLUEC YOLKH VZSEB PGRPN BVSTK
TVAYL KVOZK BBUPF MYKSX YHVBL KMEHV DPNEZ PQEAU PLUEC YOMPU PAPZA LKYPG KSOPA
LRPSN PAFKL BEMAV STUVZ EDPAQ AEZSE DKLNE BVKQE AZPBU PLBKB VESZK LBPAF UVLBY
POPBN

We know the following are the letters of the English alphabet, grouped by letters whose frequencies are approximately equal.

The letters in each group are listed in order of decreasing frequency:

Group 1:   e
Group 2:   t a o i n s h r
Group 3:   d l
Group 4:   c u m w f g y p b
Group 5:   v k j x q z

The  most  commonly  occurring  digrams  in  the  English  language,  in decreasing order of frequency, are:

th  he  in  er  re  on  an  en  at  es  ed  te  or  ti st

So I started with frequency analysis and some guesses and could find:

T was encrypted as L
H was encrypted as U
E was encrypted as P

A was encrypted as V
N was encrypted as S
D was encrypted as T

R was encrypted as A
S was encrypted as B

Am I doing things correctly?

I seem to be stuck after doing this. Are there any techniques that I get try to get this solved?


texts:
Is it possible to device lightweight (i.e. without asymmetric crypto and PKI; and without third party Trent) provably secure (in the exact security sense) scheme? Were there any attempts? Is it possible to make entity authentication using only one pre-shared secret key without MitM attacks?

Some remarks. By exact security I mean concrete security approach (by Bellare and Rogaway).

By entity authentication I mean to prove that it is me who interacts with device. MAC is not an option because everyone who can intercept my message can pretend that he is me actually.


texts:
Ahead of the question, little warning. Question is not about what are the better options. Question is why it is bad idea?

Ok, suppose we have plaintext $p$, which divided into blocks: $p_1,p_2,p_3,...,p_n$

CBC (cipher block chaining) can be then defined as $c_1=E_k(p_1 \oplus IV)$,$c_2=E_k(p_2 \oplus c_1)$,$c_{i+1}=E_k(p_{i+1}\oplus c_i)$

Ok. What would be bad about this version $c_{i+1}=E_k(p_{i+1}\oplus p_i)$?

($E_k$ is some encryption function)


texts: Is it safe to derive secret from alice's private key and alice's public key?

texts:
I'm using secp256k1; in normal scenario alice.privateKey and bob.publicKey (or vice versa) is used to derive the same secret.

Is it safe to use alice.privateKey and alice.publicKey to derive secret as a key for encryption for alice's personal information - where alice.publicKey and encrypted blob is publicly available?


texts: Multi-party computation with untrusted nodes?

texts:
Let $L = [b_1, \dots, b_k]$ be a list of blocks of a file.

I want to compute the function $f = h(g(b_1), \dots, g(b_k))$ on $N$ untrusted nodes such that:

Anyone can be reasonable convinced (with high probability) of the correctness of the result.
The algorithm is practical (no homomorphic encryption nonsense or similar).
No node has seen the entire list L or can gather it by knowing where the rest of the blocks are.
I'm willing to replicate computation up to a multiplicative constant (not too big).

Is there any protocol you know of that can solve this problem?


texts:
Say, $X= a\cdot b$, where $(a, b) \in Z_q^*$ and $q$ is a large prime. If $X$ is given, then what is the complexity (or hardness) of finding $a$ and $b$?

Note that, either $a$ or $b$ can be reused to compute another $X'$ which is also public.

Edited: (more details)

Let's say Alice chooses two random numbers $a, b\in Z^∗_q$ and computes $X=a\cdot b$. Alice publishes $X$. What is the complexity of Bob to guess (or compute) $a$ and $b$ from the known $X$ and $Z^∗_q$?


texts: MAC security and adversaries with memory

texts:
The usual definition of MAC security is (roughly) that there is no "efficient" adversary that has non-negligible advantage in the "MAC game" where the MAC game is as follows: the challenger chooses a random key, the adversary sends some messages to the challenger, the challenger sends the MACs of those messages with the chosen key back to adversary. For the adversary to win, the adversary now has to come up with a forged message-MAC pair. The adversary's advantage is the probability that the adversary can win the game.

Every time the adversary plays, a new key is chosen by the challenger. Does it make a difference if we allow the adversary to have a "memory" of previous plays?

For example, in round 1 of the game the challenger generates a random key $k_1$ and the adversary sends $s$ messages getting back $s$ tags, but has no idea of how to forge a MAC, losing round 1.

In round 2, the challenger generates a new random key $k_2$, the adversary sends the same $s$ messages and, because of some weakness in the MAC algorithm and the fact that keys $k_1$ are $k_2$ are different, in round 2 the adversary can now come up with a forgery. Of course, for this to make sense, the adversary must be allowed to "remember" the results from round 1.

Maybe there are MAC algorithms that are secure against adversaries that do not remember results from round-to-round but insecure against adversaries that are allowed to have some memory.

Adversaries with this sort of memory are at least as strong as adversaries without memory. Are they strictly stronger?


texts: using hash function of (key||plaintext) instead of random value for IV

texts:
for a protocol which implements AES under CBC mode, an $IV $(initialization vector) is required for each encryption.
Instead of picking the $IV$ randomly, is it advisable for us to set the $IV$ to be $\text{SHA1}(k||m)$ where
$k$ is the key, and $m$ is the $1^{st}$ 128 bits of the plaintext, e.g is this scheme semantically secure?
Any thoughts is welcome! Thanks!


texts: Encoding scalar values to points on Ed25519

texts:
I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519.

Specifically what I would like to be able to do

Generate two eddsa private keys: (pub_1,key_1), (pub_2,key_2)
Compute the private scalar for each. key_1 -> exp_key_1 , key2 -> exp_key_2
Convert the keys to ed25519 points. exp_key_1 -> pt_1, exp_key_2 ->pt_2
Add the points to each other to get a third point. pt_1 + pt_2 -> pt_3
The sum of the points multiplied by the base point is expected to equal sum of the original public keys. Knowing how to convert the sum of the points to the base point would also be nice  pt_3 * G == pub_1 + pub_2

The part of the this process that is least clear to me is step 3.

The ref10 code makes it easy to do point arithmetic on public key. Just decode and do the add point addition as per question “Point addition and doubling in Ed25519 (ref10)?”

Using the raw bytes to Point decoder on the scalar fails about half the time and when it succeeds the expected homomorphisms don't hold; i.e.: $(a+b)\times G == A+B$

I'm aware the libsecp256k1 makes these sorts of manipulations very easy. I think it would be useful to be that on curve25519.


texts: how to avoid attack on Certificate Revocation List by the owner of the private key?

texts:
suppose A owns the private key, and its correspondent certificate locates in site of CA.

B request for A's certificate from CA for verifying the signature sent to him/her.

There is an attack exists as follow:

A send message with signature to B.
A send revocation request to CA after confirming the message is successfully accepted.
B received the revocation information from CA.
A repudiate the message.

As for it is totally possible that a private key owner keep using the key before he/she find the key has been compromised. So, in the above case A can successfully make repudiation.

My question, is the above attack really applied to real life ? how to avoid if so?

edit: under the assumption that the attack is raised intentionally by private key owner, it is totally different from the case that attacker use the time difference between A requests for revocation and B receives the inform, which can be mitigated by OCSP.


texts: Simple proof that shows AES is not a uniform permutation on any n-bit string?

texts:
Is there a simple proof that shows AES is not a uniform permutation on any $n$-bit string?

Since I'm just starting with crypto, I'd like to see a simple yet elegant proof for the said property. Thanks!


texts: In this paper, a quantum algorithm to solve the 3-SAT problem in linear time is presented. Is it true? Did the author make a mistake? What state-of-the-art algorithms exist for this problem?


texts: One-way hash on encrypted data, result hidden from hasher

texts:
I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, Key), except the output hash cannot be known by A.

Usage:

B encrypts data D => E(D)
B sends E(D) to A
A contains a secret key SK
A performs F(E(D), SK) => E(H(D))
A sends E(H(D)) to B
B decrypts E(H(D)) => H(D)

Constraints:

A cannot recover D
A cannot recover H(D) from E(H(D))
B cannot recover SK from E(H(D)) or H(D)

I believe there may be a solution involving public/private key cryptography, but I'm not about to roll my own.


texts:
Is the following statement correct?
Let $F$ be a OWP. Then the inverse $F^{-1}$ of $F$ is also a OWP.


texts: Crypto AG (Switzerland) - Which algorithms were used and how did the backdoors work?

texts:
Backstory

Crypto AG was a company located in Switzerland that specialized in communication security. They produced a number of encryption machines (some similar to the infamous Enigma) used for secure communication.

The company was secretly bought in 1970 by the CIA and the German intelligence agency BND. It has recently been revealed (11. February 2020) that the CIA & BND were responsible for installing backdoors in Crypto AG's machines (with knowledge of some high level Swiss state officials). The operation was first known by the code name "Thesaurus" and later "Rubicon".

Crypto AG was apparently a desirable target for it's neutrality as it is a Swiss company and because they sold products to over 120 governments (Iran, Argentinia, Italy, Vatican City, UNO, etc.), indifferent of political orientation.

Edit: Further information

Machines / designs that were definitely and intentionally compromised:

C52 / CX52, first manufactured in 1951

  Many of the C-52 and CX-52 machines sold by Crypto AG were compromised to benefit the US and British national signals intelligence agencies, National Security Agency (NSA) and Government Communications Headquarters (GCHQ), respectively. (Wikipedia)

H460, first manufactured in 1967

  In 1967, Crypto released the H-460, an all-electronic machine whose
  inner workings were designed by the NSA.

  The warning proved prescient as Caflisch (American electrical engineer
  who applied and subsequently was hired by Crypto AG without knowledge
  of the American intelligence services) soon began probing the
  vulnerabilities of the company’s products. She and Spoerndli, a
  colleague in the research department, ran various tests and “plaintext
  attacks” on devices including a teletype model, the HC-570, that was
  built using Motorola technology, Spoerndli said in an interview.

  […]

  “The algorithms,” he said, “always looked fishy.”

  In the ensuing years, Caflisch continued to pose problems. At one
  point, she designed an algorithm so strong that NSA officials worried
  it would be unreadable. The design made its way into 50 HC-740
  machines rolling off the factory floor before company executives
  discovered the development and stopped it. (Washington Post)

Machines / designs that were compromised with (so far) uncertain involvement of intelligence agencies (I have not yet found any reference other than Wikipedia mentioning these machines):

CD57, first manufactured in 1957

  Sullivan shows how the CD57 can be attacked using a hill climbing search technique. (Wikipedia)

Questions

These backdoors (as others) could apparently be achieved on the basis of mathematical principles.

My questions are:

How did the machines work?
How exactly did the backdoors work?


texts: Why do these Python XTEA implementations require different deltas?

texts:
I once needed to an XTEA snippet to from C++ to Python and it did not work properly. I then found a function on ActiveState.com and noticed that it looks almost exactly like mine, with one exception - for some reason, its "delta" variable was changed. Here's the test code:
import struct

def XTEA_encrypt(buf, k):
    ret = bytearray()
    for offset in range(int(len(buf)/8)):
        v0 = struct.unpack("<I", bytes(buf[offset*8:offset*8+4]))[0]
        v1 = struct.unpack("<I", bytes(buf[offset*8+4:offset*8+8]))[0]
        delta = 0x9E3779B9
        sum_ = 0

        for _ in range(32):

            v0 = (v0 + ((v1<<4 ^ v1>>5) + v1) ^ (sum_ + k[sum_ & 3])) & 0xFFFFFFFF

            sum_ = (sum_ + delta) & 0xFFFFFFFF

            v1 = (v1 + ((v0<<4 ^ v0>>5) + v0) ^ (sum_ + k[sum_>>11 & 3])) & 0xFFFFFFFF

        ret += struct.pack("<I", v0) + struct.pack("<I", v1)
    return ret

print(repr(XTEA_encrypt('\xfc\xd9\xd8A\x0b\xc4~\x82',
    [4060739823, 3225438839, 2808461571, 1241583342])))

With the new delta = 0x9E3779B9, the code prints \xec\xe8\xeaZ!\xec7\xde, as expected. On the other hand, the original C++ implementation (https://github.com/otland/forgottenserver/blob/788198e1afd96a0b83ddeb025a9f3910e72626d5/src/protocol.cpp#L87) had delta = 0x61C88647, which results in \x87Z\xed})\t:\xbe being printed. Why do the implementations differ?


texts: Establishing encryption key using shared secret

texts:
I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes.

I have zeroed in on a shared secret based scheme. Setting up shared secret is out of scope. Encryption is AES128.

To securely create and share an encryption key between two nodes, A and B, I cooked up this:

A creates an encryption key Ks = H(Ns, R0)
A sends R0 to  B
B calculates key K's = H(Ns, R0)

K's and Ks will be same if and only if B has Ns

Where H = Hash(R0|Ns|R0), or Hash(R0|Ns|H(Ns)) or maybe HMAC (still undecided)
R0 = random number
Ns = Shared network secret.

Ns is 16 byte. R0 is 4 byte. Both come directly from a RNG.

Primary Objectives are: Tamper proofing, Forward secrecy.

Not concerned about resistance to Side channel or replay attacks for now.

R0 (and hence Ks) will be updated periodically, perhaps every 100-10K independent packet transfers.

Is the scheme ok? Do the Ns or R0 need to be increased in size? Most importantly, will this scheme be able to keep Ns safe, and for how long?

===============
Edit:

Reg Forward secrecy:

I wanted to ensure that as long as network secret is safe, if a future session key (Ks) is compromised, past session keys and data should not also be compromised. Also, a renegotiation of session key should re-establish security.

That may not be exact definition of forward secrecy, but that's what I meant. I don't have sessions but I will expire keys periodically and after time or some count of packets is crossed etc, and call that a session.

===============

Reg H()

Based on answers, I have added AES(k=Ns, d=R0) to list of functions for H(). Will decide based on time/clock requirements.

===============

For now, based on the answers, I infer that all current options for H() will create good enough keys that will protect both encrypted data and Network Secret Ns.

If you are reading this text and feel that any of them might not be safe, please leave a comment or answer. Thanks.