texts: How would the opponent defraud this secure communication?

texts:
I am new in the cryptography and the information security problems, I try to understand things as much as I can and I know it's really complicated in the beginning.

Considering the communication protocol between a bank and its machines is standard and we have got an opponent who knows a little bit the way the information is encrypted. Of course this wouldn't cause a problem since the code that the bank uses is considered secure ( a secure Stream Cipher ).

The problem is the bank does not use a MAC. In that case, how would the hacker defraud the bank ? I thought that the MAC doesn't have any relation with the confidently ?

I appreciate your help/ explanations


texts: Double permutation patterns for transposition ciphers, how to crack

texts:
I'm reading from Cornell , I know for a single permutation, I can find the ciphertext length (100), divide in some key lengths (10x10, 5x20), then try all permutation (10x9x8... 5x4x3x2x1). then find anything legible.
Is there any case the above method will not work, and is there any better method to crack this permutation cipher?
Also, what if I use two-permutation patterns, for example; for the 100 plaintext length:

I divide it into 10 characters per column.
Then for the first 4 characters - I use one permutation.
For the next 6 characters, I use another permutation.

Am I right that this makes no difference on the cracking step?
i.e. I tried 10x10, then I tried all permutations 10! I will find anything legible.


texts: Is lattice-based cryptography practical?

texts:
How viable is lattice-based cryptography in a "practical" setting?

It has been said that lattice-based cryptography would be a "post-quantum" cryptography scheme, but is it feasibly implementable?


texts:
I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly appreciated.

If you double encrypt secret data with two different algorithms. How does the attacker know if he already broke the 'first layer' of encryption?
Is it possible to determine the encryption algorithm used by analyzing the cipher text?
If you find out what algorithm was used does it give you the necessary information to know when you successfully broke the 'first layer'?
Considering the above, what difference would it make if the attacker knows the open-source program or the (public available) algorithms used to protect the data?


texts: How is Twofish flattening the result of Reed-Solomon MDS matrix multiplication into a 32-bit result?

texts:
I have trouble understanding how Reed-Solomon coding can produce same number of output bits than the input was.

Twofish uses this technique. I've read the paper, but still can't quite understand how the flattening works. In my understanding, RS should add redundant bits, and the output must be larger than the input. What am I missing?

In addition, how is the MDS matrix constructed from RS coding? It seems that it was constructed using clever heuristics.


texts: Correct way to map random number to defined range?

texts:
Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX.

What is the best way to map this random number to a defined range (say I want something random between X and Y) without loosing too much entropy?


texts: Verifying a downloaded file with an .asc file

texts: I downloaded CentOS 6.8 for 32-bit over torrent. It comes (among other things) with a sha256sum.txt file and a sha256sum.txt.asc file. I know how to verify the signature of a file when I have the encryption key, but in this case, what would be the encryption key to import?


texts: Scheme that encrypt with $n$ pk that any sk of the pks can decrypt?

texts:
Suppose there are $n$ users each with public/private key pair $(pk_i,sk_i)$ $i=1,\cdots,n$. Is there any scheme that I can encrypt $m$ using the set of public keys $(pk_1,\cdots,pk_n)$, and can decrypt it using any $sk_i$?
That is $C=Enc_{(pk_1,\cdots,pk_n)}(m)$ and $m=Dec_{any\ sk_i}(C)$.

This is meaningful when these $n$ users are just a small portion of a group of $N$ users. A bit like "ring encryption" (opposite to ring signature). Thank you!


texts: Which SHA-1 attacks apply to TOTP tokens?

texts:
Update: it's actually hmac(secret, time). I'll leave the post as-is, in case someone is ever looking for the hash(secret+time) case (for which I provided some reasoning at least), but for TOTP tokens, this question is a duplicate of Why is HMAC-SHA1 still considered secure?.

TOTP tokens are basically hash(secret+time). Since you don't know the secret, you can't use them as prefix to compute the random "near-collision block pair", so an attack like Shattered won't work here (even if the time matched this random block pair, which it also won't).

Am I correct in thinking that Shattered does not apply to TOTP?

Are there any other attacks that do?

Of course, the recommendation is always to move away from SHA-1, but the question is whether this is a direct vulnerability that a well-funded attacker could exploit or (as far as is public knowledge) just hardening advice.


texts: Understanding a claim made by NIST SP 800-22 on the possibility of calculating $\beta$, the probability of error type 2 in a hypothesis test

texts:
NIST SP 800-22 on page 1-4 (that's page 16 of the PDF) states the following.  Pay attention to the bold passages.  (Emphasis are mine.)  Are they true?!  Can you advise?

  One of the primary goals of the following tests is to minimize the
  probability of a Type II error, i.e., to minimize the probability of
  accepting a sequence being produced by a generator as good when the
  generator was actually bad. The probabilities α and β are related to
  each other and to the size n of the tested sequence in such a way that
  if two of them are specified, the third value is automatically
  determined. Practitioners usually select a sample size n and a value
  for α (the probability of a Type I error – the level of significance).
  Then a critical point for a given statistic is selected that will
  produce the smallest β (the probability of a Type II error). That is,
  a suitable sample size is selected along with an acceptable
  probability of deciding that a bad generator has produced the sequence
  when it really is random. Then the cutoff point for acceptability is
  chosen such that the probability of falsely accepting a sequence as
  random has the smallest possible value.

In particular in the context of random number generation, if the null hypothesis is false --- that is, if the generator is a bad one ---, there is an infinite number of possibilities for it not being random, so we don't know exactly what distribution of probability to use, so we can't calculate $\beta$.

Now, look at page 16 of the PDF.  See the paragraph right above.  It says precisely what I just said.  It reads

  The probability of a Type II error is denoted as β. For the test, β is
  the probability that the test will indicate that the sequence is
  random when it is not; that is, a “bad” generator produced a sequence
  that appears to have random properties. Unlike α, β is not a fixed
  value. β can take on many different values because there are an
  infinite number of ways that a data stream can be non-random, and each
  different way yields a different β. The calculation of the Type II
  error β is more difficult than the calculation of α because of the
  many possible types of non-randomness.

So how come they state the bold passages above?  Can you educate me on this?


texts: In hybrid encrytion, I still see that some site's use RSA in their https connection, so now I wonder, why do they not use ECC instead of RSA, ECC requires less computational power and encrypt's and decrypt's faster (atleast that's what I read). I know that there have been smiliar question's about this but none of these answered specfically why rsa is still used. The only two reasons what I can think of is that some hardware may not support it or that there are some web administrators that are being to lazy to upgrade, but im not sure if that is the case. I hope someone could explain this to me and shed some light on it :) .


texts:
I'm really lost.

I'm creating a classroom lesson about Rabin encryption and I had understood the encryption process, the creation of public-key (N = p*q) and the steps I need to find the 4 values that can be the solution.

BUT, every sample I find consider the true P and Q to demonstrate the decryption process (Extended Euclidean or Euclidean) and most of them using p=7, q=11, N = 77!

I mean, how they have P and Q?

For instance: this and this and some other as in Applied Cryptography (section 8.12) and so forth.

Is the factoring of N the first step to calculate the secret-key?
Or the solution of trying random values to put into Chinese Remainder Theorem? I can't believe in this because doing so, I would be considering Bob like Eve (have to try a lot of values to get P and Q)!

Can you light my way?
I appreciate in advance.


texts: Why is Diffie-Hellman used instead of just RSA in key-exchange (TLS, IKE)?

texts: Why should a key exchange protocol (such as in TLS or IKE) use Diffie Hellman? Why not just use RSA? For example: Alice picks a random session key, signs it, encrypts it with Bob's public key, and sends it to Bob.  Why introduce Diffie-Hellman? What does DH add?


texts: Do certificates need to be stored as encrypted?

texts:
The titles says most of what we're confused with. Here's some details:
On an embedded device, we have a microcontroller and external flash memory.  This memory can be easily read and written to in place.  On that memory we store SSL certificates and a private key.
The microcontrollers internal flash memory is secure and can be used to hold fixed encryption keys, even uniquely generated so are only ever known inside the microcontroller.  I cannot store certificates on the internal flash memory.
It seems obvious that the private key should be stored as encrypted but I am not so clear about the certificates.
What is not so obvious is if the certificates used to verify a TLS connection should be stored as encrypted to.  It is likely that the root level certificates will be self signed and have no chain back to a verified root CA.
Thoughts?


texts: Collision resistance of hash functions with short, fixed-length inputs?

texts:
Regular hash functions like SHA-256 have a variable length input and measure security against collision attacks in bits. For SHA-256 this is 128 bits. When I limit the input length of SHA-256 to for instance a fixed 8 bits, the chance of a collision drops to zero (with SHA-256 there are no collisions possible with only 256 inputs, all inputs have an unique output).
How much can I truncate the output of the SHA-256 with a fixed input length of 64 bits so that I keep the same collision resistance strength characteristics as the original SHA-256 with variable length input?


texts:
I am looking in to AES-NI which is now supported by many new CPU's and I have read a few papers which states that AES-CBC works faster with AES-NI, but I am unable to understand how exactly AES-NI works.

As far as I know, AES-CBC encryption is sequential, so how does AES-NI make it so faster?

(Also even after using AES-NI, is AES-CBC performed sequentially?)


texts: is the perfect secrecy of one time pad dependent on the xor randomness preserving property?

texts:
Is the perfect secrecy of the one time pad dependent upon the xor "randomness preserving" property (xoring a uniformly random string with any string yields a uniformly random string)? I have seen different arguments in different sources.

For example, in this discussion, the first answer derives perfect secrecy without referring to the randomness preserving issue. The derivation starts with

$$Pr[C=c]=\sum{Pr[C=c|M=m']\cdot Pr[M=m']}
=\sum{Pr[K=m'\oplus c]}\cdot Pr[M=m']
=\sum{2^{-n}}\cdot Pr[M=m']
=2^{-n}$$

where the second equation, which seems to be the core of the proof, is based on the fact there's a unique $K$ such that $K=m' \oplus c$. Ostensibly this would work for any other logical operator that has an inverse, not necessarily xor.

On the other hand, the other answer to that question states "The main point in any security proof for the one-time pad is that xoring a plaintext with a (uniformly) random bit string yields a (uniformly) random bit string no matter what the plaintext was.". If this is indeed the main point in the proof, then this proof would not work for other operators that have an inverse but don't preserve randomness.

Who is right?

Thanks!


texts: Is the order of applying transformations in SP cryptosystems significant?

texts: SP-cryptosystems Is the order of applying transformations in SP cryptosystems matter? What will change if we first apply the P-transformation and then the S-transformation? Will cryptographic strength be less? And if yes, why?


texts: Is $H'(M) = 5M + 9H(M) \pmod{2^n}$ a secure hash function?

texts:
theorem: For arbitrary $i≥0$ there exists $m,n≥0$ such that $35+i=5m+9n$.

We can use this theorem for constructing simple hash function.

Let $M$ be message and $H(M)$ be its hashed value with hash function such as the $\text{SHA}256$. We construct new $n$ bit hash function $H'$ as follow:

  $H'(M)=5M+9H(M) \pmod {2^n}$

Is this hash function safe?

Edit: I want use this to compress $H$. So suppose that $n$ is smaller than bit size of $H$.


texts: consequences of using fixed values with OAEP

texts:
With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) was developed.

OAEP / PSS, as described in PKCS#1 v2.0+, used randomized values as well.

For PSS I guess it isn't a huge problem since the only randomized element is the salt and the salt has a variable length with 0 being a valid length.

For OAEP my assumption is that the only issue with a fixed seed is that if the same message were encrypted twice you'd be see the same ciphertext each time. Or is there another more severe issue that the randomized seed protects against?

I note that the original encryption described in PKCS1 employees randomized padding as well.


texts:
Regular 3-steps Schnorr protocol is a proof of knowledge system for discrete logarithm.
It's honest-verifier zero-knowledge,
but not full zero-knowledge.
My question is, is it witness-hiding?
(I guess it should be the most important property in many cases,
rather than too strong and not required ZK, and too weak HVZK).


texts: Does this use of hash provide anything over a nonce? HMAC instead?

texts:
I ran across some CSRF code that does:

Tokens.prototype._tokenize = function tokenize (secret, salt) {
  return salt + '-' + hash(salt + '-' + secret)
}

where hash seems to be a SHA1 digest modified to fit in a multipart/form-data body without extra encoding:

function hash (str) {
  return crypto
    .createHash('sha1')
    .update(str, 'ascii')
    .digest('base64')
    .replace(PLUS_GLOBAL_REGEXP, '-')
    .replace(SLASH_GLOBAL_REGEXP, '_')
    .replace(EQUAL_GLOBAL_REGEXP, '')
}

IIUC, the use of hash doesn't prevent forging.
Does this provide much over just using a closely held nonce?

Does hash make it particularly difficult to derive the input?  Since secret is not encrypted, this seems to assume that either

secret need not be secret or
the token is closely held, which should be the case for a CSRF token.


texts: What is the appropriate public key encryption for secure coin flipping?

texts:
I quote Bobby's question here since I encountered the same one...

Random Coin Flip using ElGamal and a Trusted Party

Consider the following protocol for two parties to flip a fair coin.

Trusted party $T$ publishes her public key $K_{pub}$
$A$ chooses a random bit $b_A$, encrypts it under $K_{pub}$, and announces the ciphertext $c_A$ to $B$ and $T$
$B$ does the same and announces a ciphertext $c_B$ (where $c_B \neq c_A$)
$T$ decrypts $c_A$ and $c_B$, and announces the results. Both parties $XOR$ the results to obtain the random value $b_A\oplus b_B$.

It was shown that ElGamal was not appropriate for the encryption scheme. RSA seems to fail to work also. Since $c_A=m^e \mod N$. Then if $m=1$, $c=1$. If $B$ receives $A$'s cipher he will know the exact value of $m$.

So what should the appropriate encryption scheme be?


texts: How is biometric data used to generate encryption keys?

texts:
I understand that biometric data such as fingerprints and face patterns are matched for recognition with a certain degree of tolerance to account for differences given by empiric factors (positioning, aging, dirt, different measurement tool, etc.).

Given that's the case, how are biometric characteristics used to generate encryption keys to encrypt and decrypt data?

I.e. If you encrypt data using a particular reading of a biometric characteristic, wouldn't the small differences in future readings prevent you from successfully decrypting the data?


texts: Does encrypting both the message and digital signature adds to the integrity of the digital signature?

texts:
Reading Cryptography And Network Security Principles And Practices 6th Edition by William Stallings, I came across the following excerpt on digital signature that got me confused:

  A -> B: M || E(PRa, H(M))

  This method guarantees that A cannot later deny having sent the
  message. However, this technique is open to another kind of fraud. Bob
  composes a message to his boss Alice that contains an idea that will
  save the company money. He appends his digital signature and sends it
  into the e-mail system. Eventually, the message will get delivered to
  Alice’s mailbox. But suppose that Max has heard of Bob’s idea and
  gains access to the mail queue before delivery. He finds Bob’s
  message, strips off his signature, appends his, and requeues the
  message to be delivered to Alice. Max gets credit for Bob’s idea. To
  counter such a scheme, both the message and signature can be encrypted
  with the recipient’s public key:

A -> B: E(PUb, [M || E(PRa, H(M))])

Where

A -> B: A is the sender (Bob), B is the recipient (Alice)
M = Message
E = Encryption function
PRa = A's private key
H = Hash function
PUb = B's public key

My understanding of digital signature is that by decrypting with Bob's public key, Alice already knows that it was signed by Bob (provided Alice is guaranteed to have Bob's real public key, which is not discussed in this excerpt). So if Max replaces Bob's signature, Alice will be alerted already that the signature was forged. Encrypting the whole message as in the final solution does not add anything to the integrity of the signature, it only prevents from eavesdropping, right ?


texts: Does zero-padding the secret in Shamir's sharing scheme increase security?

texts:
When performed in binary Galois fields $GF_{2^n}$, Shamir's threshold secret sharing scheme produces shares that are each the same bit-size as the secret. Though the scheme is "perfectly secure" in that less than the requisite number of shares provide no information about the secret, in practice it does leak information about the secret, namely its size (when performed in binary fields).

Would padding the binary representation of the secret (say to a bit-length that is a multiple of 1024, or something) increase the security of the scheme?

If padding improves security, would padding with random bits be better than zero-padding?

If random padding is better, when reconstructing the secret, what is the best way to know how many random bits were added? Should I have the first few bytes be a number that stores this info? Obviously, zero-padding does away with this problem, because any leading zeros can be dropped on reconstructing the secret.

I should add: I'm operating in $GF_{2^8}$, and computing each byte of the shares from a byte of the secret, with different random coefficients for each polynomial, as discussed in this question.


texts: Recovering private key from Secp256k1 signatures

texts:
I've seen many answers here and many articles that says we can recover the private key from reused R signatures.
But, what if the r,s signatures are different in transaction of bitcoin then is there a way we could find the ephemeral Key k used in both the cases and find the private key?


texts: Can authenticated encryption reduce bandwidth overhead of per-packet encryption?

texts:
I know that authenticated encryption modes of operation like GCM offer certain security advantages, as well as increased performance. (On my laptop with AES-NI, the benchmark performance of AES-128-GCM is about 3.7× faster than AES-128-CBC-SHA1.)

What I'm less certain about is whether authenticated encryption modes offer any advantages in terms of bandwidth overhead, in particular for datagram/UDP-based VPNs.

I've been working recently on supporting a commercial ESP-based VPN in an open-source VPN client, and have been struck by the substantial overhead of wrapping IP packets in ESP:

20 bytes for SHA1 MAC
16 bytes for an AES-128 IV

Including ~17 bytes for padding and a 4-byte SPI), the ESP overhead can be around 5% of the size of an IPv4 packet on a network with a typical MTU around 1500 bytes.

Do authenticated encryption modes offer any possibility to trim the per-packet bandwidth overhead of encryption and authentication, while retaining similar security levels?

My understanding of GCM is that it still uses authentication tags and IVs of similar length to ciphersuites like AES-128-CBC-SHA1, but perhaps there are possibilities that I'm looking here.


texts: CBC mode works well for input greater than "b" bits. What is that "b" bits?

texts: This post on geeksforgeeks.org about block cipher modes of operation, says that one of the advantages of the CBC is that it works well for input greater than b bits. I also saw that in the book "cryptography and network security by William Stallings". But neither of them said what exactly is that b bits. Can anyone explain? thanks.


texts: Does two-factor authentication require one time use of one of the factors?

texts:
Do we need one of the factors of two factor authentication to be one-time use?

TOTP and password are considered two factor authentication, but does smart card and password also count as two-factor authentication?


texts: What is the reason behind picking either $3$ or $2^{16}+1$ for generating the public key in RSA?


texts: Do Export Restrictions Still Apply To The Key Length of RC4?

texts:
I've just read a paper from 2004 which stated that the RC4 encryption algorithm was restricted to a 40 bit key size when exported from the USA; however the reference for this information (Applied Cryptography - Schneieir) was published in 1996.

Here's the link to the paper "The effectiveness of brute force attacks on RC4".

I'm relatively new to cryptography but as far as I'm aware, a lot of the old export laws have been relaxed. Was the key length of RC4 still restricted in 2004? If so, is that still the case?

Thanks for any help.


texts: Blowfish vs. Twofish regarding power consumption

texts:
If I wanted to use Blowfish or Twofish to provide security on a device where power consumption is crucial. Regarding power consumption, which one would win?

Generally, which algorithms are known to consume the least energy and why? Which parameters should be considered the most? How much research is done regarding power consumption of cryptographic algorithms?


texts: What are the most appropriate PKI based cryptographic protocols for peer to peer communicaton?

texts: I've been trying to find out which is the most appropriate PKI based cryptographic protocol for peer to peer communication. I do understand that they vary with respect to the peer to peer architecture model. It would be wonderful if someone is able to name a few and also the reason behind it.


texts:
Disclaimer.
I have asked a similar question on Electronics StackExchange: they advised me to try here.
The question
I am in the process of developing a simple protocol whose security relies on the assumption that computing the SHA256 hash of a very long string of bytes x takes a long amount of time. Intuitively, even a massively parallel adversary can only compute SHA256(x) by successively feeding each chunk of x into SHA256, which takes a long time.
Now, in implementing my protocol in the real world, I need to put constants to this intuition. Which leads me to the question:

How quickly can we compute the SHA256 hash of a long string x?

More precisely, let us assume that the length of x is, e.g., 1 GB. Given our current / foreseeable level of technological development (this includes both algorithms and hardware), how quickly (in seconds) can an adversary realistically compute SHA256(x)?
To the best of my current understanding, ASICs represent probably the answer to my question: by designing application-specific circuitry, one can speed up even computations that are not easy to parallelise, e.g., on a CPU. However, I am not aware of how quick ASICs can get. This is why I originally asked this question on Electronics StackExchange.
More details

I am aware that this question has been previously asked on Crypto StackExchange here. However, that question is three years old, and technology advances constantly. More importantly, that question does not seem to address ASICs! The only answers there concern CPUs for SHA256, or ASICs for SHA3 (which is actually designed, as far as I understand, to be sped up with dedicated hardware).

The protocol I am working on is a super-simple design for Proofs of Space: one plots some large portion of its memory, others can quickly verify that the plot is correct (with high probability). My scheme relies on repeated hashing to plot, so what I am looking for is a hash function that satisfies the following:

As fast as possible: the faster the hash function, the faster and simpler the plotting.
As egalitarian as possible: the speed ratio between the fastest possible implementation of the hash function and standard, CPU-based, market-available implementations should be not much larger than $1$

This is why I am inquiring about SHA256: it is reasonably fast, and I know that it is already accelerated in standard x86 CPUs, which (I suppose) can reduce the gap between CPU-based and ASIC-based implementations.


texts: Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?


texts: Does secure LWE implementation leak bit information?

texts: We know RSA leaks one bit about the factors and improper yet secure implementations of Discrete Logarithm leak one bit about the discrete logarithm. Does LWE leak any information?


texts: Best method for checking integrity of 50 GiB files?

texts:
I'm making backups of compressed data (using ZPAQ), some compressed archives are large (50 GiB)

I was just going to use sha3sum -a 512, for example:

sha3sum -a 512 "Total_DOS_Collection-RELEASE#17-[1981-1995].zpaq"

Then storing the value and later periodically checking if the value of the backup is still the same

Then I started wondering if there would be a better/safer/more appropriate/effective method...


texts: Homomorphism with subtraction for Pedersen Commitment

texts:
I was trying to use Pedersen's homomorphic property for some privacy preserving mechanism, and to the best of my knowledge

$Com(x1,r1)\cdot Com(x2,r2)^{-1} = g^{x1-x2}h^{r1-r2}$

That is, if we commit $x1-x2$ with blinding factor $r1-r2$ we should get the commitment with value $Com(x1,r1)\cdot Com(x2,r2)^{-1}$.

However, I'm only getting this if $x1-x2>0$ and $r1-r2>0$. I believe this should hold whatever the values of $x1-x2$ or $r1-r2$.

I am taking the mod of all values i.e., $(x1-x2) mod\ p$ for some prime p, so none of the numbers are negative. So does Pedersen commitment not support homomorphism for subtraction?


texts: Does IND-CPA to INC-CCA effects on the error probability?

texts:
If we have a key encapsulation mechanism (KEM) that is IND-CPA secure, with some error probability $P_e$ (probability that the shared keys are not equal).
The goal is to use the Fujisaki-Okamoto transformation to obtain an IND-CCA security.
Does this transformation effect the error probability?


texts: A simple attack on DESX in time $2^{120}$

texts:
Let $\mathcal{M}$ be our message space and $\mathcal{K}$ our key space. Now, let $\mathrm{E} : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$ be a block cipher. Define the block cipher $\mathrm{EX}((k_1, k_2, k_3), m) := k_1 \oplus \mathrm{E}(k_2, m \oplus k_3)$, where $m \in \mathcal{M}$, $k_2 \in \mathcal{K}$, and $k_1$ and $k_3$ are of the same length as the message (I suppose I could write $k_1, k_3 \in \mathcal{M}$).

In the case of DES, we get DESX, giving us a total key size of $64 + 56 + 64 = 184$ bits.

At the end of this lecture (as well as what can be inferred from the Wikipedia entry), prof. Dan Boneh mentions that there is a simple attack on all block ciphers of the form $\mathrm{EX}$ in time $|\mathcal{K}| \cdot |\mathcal{M}|$, meaning a simple attack on DESX in time $2^{120}$.

I finished the course during this summer and generally had no problems, but could not figure this attack out for DESX / the general case. Can anyone explain to me what it is?


texts:
In NTRUEncryption, I seen the trucated polynimials, but I cannot understand the trunacated polynomial calculation.
So, could tell me anyone How do we calculate the truncated polynomial?


texts: Proxy Reencryption - semi-trust into proxy required?

texts: As far as I understood, PRE claims to hide the underlying message from being read by the proxy. Why can't the proxy simple use a public key of himself as target?


texts: Predicting value of E(k,0) for Block cipher with random and secret key

texts: Some mode of operation of block ciphers rely on the fact that E(k,0) is an unpredictable value when k is random and secret (with 0 denoting the all-zero binary string). Why is this a reasonable assumption?


texts: Security of ring-lwe sample? can we do it simpler?

texts:
Assuming

a secret key $s\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$,
a plaintext $m\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$,
$e,e'$ are sampled from B-bounded Discrete Gaussian Distribution over $\mathbb{Z}[X]/\langle X^n+1 \rangle $ with reasonable standard deviation for security.
$a$  (a part of public key) is a random element sampled unformly at random  from  $\mathbb{Z}_q[X]/\langle X^n+1\rangle$ (q >> 2),
$b=[-a \cdot s-e]_q$ (a part of public key)
$u$ is an element over $\mathbb{Z}_2[X]/\langle X^n+1\rangle$ (with small coefficient).

Then, is the following RLWE sample secure?

$([u \cdot b + 2 \cdot e' + m]_q,  [u \cdot a]_q)$


texts: Randomized stream cipher using multivariant quadratic equations

texts:
This is an idea I had for cipher that I thought might reduce to a known hard problem. It is efficient (compared to something like BBS) in terms of time but not in terms of space.

Here's the algorithm:

Produce 128 real random streams equal in length to the plain-text. (These do not need to be secret, they can be published with the cipher text.)
Let each bit of the 128-bit streams define the terms of a multi-variant quadratic polynomial in 128 variables over GF(2). One way to do this would be to label each stream as defining a specific term to multiply.
Split the secret key in to 128-bit 1 bit variables and substitute in to the equation take from step 2.
The resultant bit is then XORed with the plain-text to produce cipher-text.
Repeat for all bits in the plain-text and transmit the cipher-text plus the 128-bit key-streams.

My security argument is that solving systems of multivariant quadratic equations in a lot of variables is a known hard problem. In the average case, it is meant to be NP Hard.

All I've done is randomized the selection of the specific instance of the problem. Of course, very quickly the system would become over-determined which might aid solution of the problem.

My question is whether I've made a mistake somewhere or misunderstood something?


texts: Why don't PyCrypto and M2Crypto produce the same result as OpenSSL here (AES-128 ECB)

texts:
If I run the following, for openSSL:

echo -n "0123456789abcdef0123456789abcdef" | openssl aes-128-ecb -nosalt -nopad | xxd

and enter the key "YELLOW SUBMARINE", I get the following ciphertext:

a2a5 8316 129f c596 8341 c78a 0c36 5d20
a2a5 8316 129f c596 8341 c78a 0c36 5d20

Yet in PyCrypto, the following code:

from Crypto.Cipher import AES
key = b'YELLOW SUBMARINE'
cipher = AES.new(key, AES.MODE_ECB, "")
msg =  cipher.encrypt(b'0123456789abcdef0123456789abcdef')

Outputs:

20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad
20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad

(line breaks added for clarity)

What is the cause of this discrepancy? Both are 128-bit AES in ECB
mode. PyCrypto doesn't appear to be salting, and padding should be
unnecessary in any case with this plaintext.

P.S. The same thing happens with M2Crypto:

import M2Crypto
cipher=M2Crypto.EVP.Cipher('aes_128_ecb',b'YELLOW SUBMARINE',"", op=1,
padding=0, salt=None)
out=b''
plaintext=b'0123456789abcdef0123456789abcdef'
out=out+cipher.update(plaintext)
print ' '.join(x.encode('hex') for x in out)

Outputs:

20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad
20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad


texts: Can a block cipher encrypt the message to itself (plaintext equal to ciphertext)

texts:
The result of the cipher should be indistinguishable from random, but can it happen that cipher produces the ciphertext that is equal to the plaintext as it also lies in the corresponding space? I guess it's just the probability is extremely low, probably equal to guessing the clear text on the first attempt, but just out of curiosity: is it theoretically possible and/or happened in real life?

The same goes to other types of cipher and e.g. hash function on small inputs.


texts: Is there a PAKE algorithm that is fully resistant to a server data leak?

texts:
I'm looking to build an authorization system with a completely "public" server which involves two assumptions:

The server's data is public
The server is incorruptible and uncrackable i.e. nobody can pose as or hijack the server.

I've found SRP which is a pretty nifty concept, but even that one relies on the privacy of the server to be effective. By obtaining the verifier and salt, brute force attacks can be mounted offline without any additional input from the server.
My goal is to have a system that requires interaction with the server to check for the correctness of the password, with all server-side data assumed to be visible.

I understand that may be very difficult if not outright impossible. Perhaps leveraging its other features (the server is verifiably legit, client can hold secrets) could be key? Or perhaps there is a way of securely encrypting the verifier.


texts: A generalisation of Shannon's theorem of perfect secrecy

texts:
The proof I'm struggling with is the following:

Let $\mathcal{E}$ be a cipher defined over $(K, M, C)$. Suppose that $SSadv[A, \mathcal{E}] ≤ \epsilon$ for all adversaries $A$, even including computationally unbounded ones. Show that $|K| \geq (1 − \epsilon)|M|$.

The semantic security advantage, $SSadv[A, \mathcal{E}]$ of an adversary $A$ (in a standard attack game) over cipher $\mathcal{E}$ is defined as:

$SSadv[A, \mathcal{E}] := |Pr[φ(E(k, m_1))] − Pr[φ(E(k, m_0))]|$

Where $φ$ is a binary predicate on the ciphertext space $C$ (and the associated probability is the probability of the binary predicate evaluating to $1$), $k$ is a random variable uniformly distributed over the key space $K$, and $m_0, m_1 \in M$ (message space) are chosen by the adversary $A$, although the inequality $SSadv[A, \mathcal{E}] ≤ \epsilon$ should hold for all $m_0, m_1 \in M$.

Thus, what we are trying to prove is:

$|Pr[φ(E(k, m_1))] − Pr[φ(E(k, m_0))]| ≤ \epsilon \implies |K| \geq (1 − \epsilon)|M|$

How would I approach this?


texts: What's the meaning of probabilities in differential privacy formula?

texts:
I don't understand what does it mean by "The probability is taken is over the coin tosses of K."

Does it mean, the probability distribution is generated based on exactly same data but only the function is selected randomly?

So it's the data that ensures the differential privacy instead of the function, right?


texts: School exercise on untrusted channel comunication

texts:
Possible Duplicate:
  Why is H(k||x) not a secure MAC construction?

I've the following problem:
two parties, A and B, share a secret key Kab.
M is a plaintext message, H an unkeyed hash function

A send to B M, H( Kab | M ) (where | means concatenation).

If we want to provide data origin authentication and data integrity (no confidentiality required) my exercise states that we have to change the protocol to this:

A send to B M, H( Kab | M | Kab ).

I don't understand the difference in term of guarantees of the two protocols and thereby, why the second one is 'right' and the first one is not?


texts: Do perfect squares count as valid moduli for an RSA semi-prime?

texts:
The question is pretty self-explanatory but basically I just want to ask if, when choosing the p and q primes that, when multiplied, become the modulus for an RSA public key, is there a risk that attackers can exploit if p and q are equal to each other?
The only requirement that I've seen up until now is that both p and q need to be primes but I never read anywhere about what happens if they are the same number. Basically, p = q and, as such, the square root of the N modulus is p. Is there an efficient algorithm that can detect this efficiently and, as such, factor the numbers and compute the private key? And, if such an algorithm exists, doesn't this mean that this can compromise existing RSA keys with such setups?
Is this even a realistic risk at all or is it just too unlikely to happen in practice?


texts: Security of right-zero padded signatures with $e=3$

texts:
I am facing this question about RSA signatures and I understand that a hash encode is secure, but I was asked this:

Given the scheme based on RSA assumption.
Consider the RSA function f with some modulus $N$ of 1024 bits and an exponent $e = 3$, satisfying $\operatorname{gcd}(3, Φ(N)) = 1$; let $d$ be the inverse of $e$, $ed = 1 \mod Φ(N)$. The RSA signature has verification key $vk = (N, e)$ and signing key $sk = (N, d)$. The signing algorithm first encodes the message using some encoding algorithm $\operatorname{encode}(m)$ and then simply
computes $π = \operatorname{encode}(m) d \mod N$ and sets $π$ to be the signature of $m$.

We know that if $\operatorname{encode}(m) = \operatorname{H}(m)$, where $\operatorname{H}$ is as good as
a random oracle (i.e., a public random function), then RSA signature is secure. Here consider a different encoding algorithm $\operatorname{encode}(m) = 0||m||0^{99}$, where $|m| = 1024 − 100 = 924$. Show that when this encoding algorithm is used, the RSA signature is insecure.


texts: Find a LFSR given 2n (or more) non-consecutive keystream bits

texts:
How can I calculate the polynomial and state of a LFSR given 2n (or more) non-consecutive keystream bits? It is known to be n bit. If they were consecutive, I could use the Berlekamp–Massey algorithm.

Simple example: n is 7 and I know the keystream is
0...0...1...0...1...0...1...1...1...0...1...0...1...0
where the . is an unknown bit

Any explanation or reference to paper or text book with algorithm will be greatly appreciated.


texts: Miller Rabin - Error probability of .5 a possibility?

texts:
I'm testing the property of Miller Rabin that the error probability is at most 1/4 when only a single base a is chosen and we iterate only one time. We are testing odd integers 90,000 to 100,000.

I've written up the implementation in Java and as the test is running, I'm seeing a lot of probabilities of .5. This leads me to believe that there is an issue with my implementation.

Some of the odd integers in which I'm seeing a .5 error probability are:
90007
91571
94343

There are plenty more (the test is still running).

Update: Here is the Algorithm I've implemented

 Miller–Rabin Primality Test
 Input: prime candidate ˜ p with ˜ p−1 = 2ur and security parameter s
 Output: statement “ ˜ p is composite” or “ ˜ p is likely prime”
 Algorithm:
 FORi = 1 TO s
    choose random a ∈ {2,3, . . . , ˜ p−2}
    z ≡ ar mod ˜ p
       IF z ≡ 1 and z ≡ ˜ p−1
          FOR j = 1 TO u−1
             z ≡ z2 mod ˜ p
             IF z = 1
                RETURN (“ ˜ p is composite”)
          IF z = ˜ p−1
             RETURN (“ ˜ p is composite”)
 RETURN (“ ˜ p is likely prime”)

Here is the implementation, if anyone could take a look and determine what the problem is I would really appreciate it.

Thanks

public BigInteger mr(int x, int y){
    int u = 0;
    BigInteger p = BigInteger.valueOf(x);
    BigInteger r = p.subtract(ONE);
    BigInteger a = BigInteger.valueOf(y);

    while (r.mod(TWO).equals(ZERO)){
        u++;
        r = r.divide(TWO);
    }

    BigInteger z = a.modPow(r, p);
    if ((!z.equals(ONE) && !z.equals(p.subtract(ONE)))){
        int j = 1;
        for (; j < u; j++){
            z = z.modPow(TWO, p);
        }
    }
    return z;
}

public boolean isPrime(int n){
    if ( n % 2 == 0)
        return false;

    for (int i = 3; i <= Math.sqrt(n) + 1; i+=2){
        if (n % i == 0)
            return false;
    }
    return true;
}

public static void main(String[] args) {
    double ea;
    MillerRabin mr = new MillerRabin();
    int count = 0;
    BigInteger ans;
    for (int n = 90001; n< 100000; n+=2){
        count = 0;
        for (int a = 1; a < n; a++){
            ans = mr.mr(n, a);
            if (mr.isPrime(ans.intValue())){
                count++;
            }

        }
        ea = ((double)count) / (n-1);
        System.out.println(ea);
    }
}


texts: How to interpret Berlekamp-Massey algorithm?

texts: I'm trying to find a way to understand the process of the Berlekamp-Massey Algorithm. But I'm struggling in understanding the fourth step of the process, which is $B^{(r+1)}(x) = A^{(r)}/\delta^{(r)}$. I found this algorithm from this paper, "VLSI Architectures for Reed-Solomon Codes: Classic, Nested, Coupled, and Beyond". However, I don't know what this step is doing. Can anyone explain to me the purpose of having this step?


texts: Choice between AES-128 and AES-256 for password protection in MS Office

texts:
Why are we still using the default of AES-128 when password protecting a Microsoft Word document. My answer is and always has been - because its good enough and MS don't recommend changing to AES-256. However, that has got me thinking: if a user password protects their word document (.doc, .docx) with a 10 character password of P@ssw0rd10 using the default AES-128 encryption, is that a harder password to crack than an 8 character password of P@ssw0rd using AES-256?

What is it a brute force attack is trying to achieve. Crack the AES-128/-256 algorithm which then in turn reveals the password? Does password length and character selection actually matter (you can input a password of up to 255 characters on a word doc) or is it the AES type in use that matters?


texts: Discrete log analog of ECM factoring algorithm?

texts:
Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas.

Is there an analog of the elliptic curve (ECM) factoring algorithm, but for discrete logs?  Something that uses similar ideas, but can be used to compute discrete logs modulo $p$?


texts: In the Diffie Hellman Key exchange, why is a value of $a=\frac{p-1}{2}$ a bad choice?

texts:
In Diffie Hellman key exchange, we have a large prime $p$ and non zero residue class $g \in F_p^x$ with a large order.  An $a$ and $b$ are chosen in secret, and those are used to compute $A \equiv g^a \mod p$ and $B \equiv g^b \mod p$.

Then the two communicating agree on value $g^{ab}$ via $A^b$ and $B^a$.

$a=p-1$ would be a bad choice (by Euler Fermat theorem). My question is why is the value of $a = \frac{p-1}{2}$ a bad choice?


texts: Given a set of numbers which return a response code, how can I find the algorithm used to produce the response?

texts:
I'm working on a problem where I provide an 8 digit integer and a 16 digit integer, then a 10 digit integer response is produced.
For example 12345678 and 1234123412341234 produces 138259849
The same inputs always produce the same output.
Is it possible to find the algorithm used to calculate the response?


texts: Protocol for Randomized Oblivious Transfer?

texts:
If we define Oblivious Transfer as following:

Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about b), and Bob gets $x_b$. Now if we use a Random functionality R, which requires no input but output random bits $(z_0,z_1)\in F^2$ to Alice and $(c,z_c)$ to Bob, where $c \in \{0,1\}$ is also a random bit.

How can I design a protocol, so that it will realize OT securely with access to R only once at the beginning of the protocol?

I am thinking that the protocol should be as following:

First, Alice inputs $(x_0,x_1)$, then she gets $(x_0 \oplus z_0,x_1 \oplus z_1)$ as output, thus learning nothing. Now Bob gets $(c,z_c)$, treat $c$ as his input $b$, then he can recover $x_c$ from $(x_0 \oplus z_0,x_1 \oplus z_1)$.

I don't know if it will work, or maybe I am working in the wrong direction?


texts: Converting a "raw" non-ASN.1 EC private key to a public key?

texts:
I have this ECDSA private key that isn't very important, but I do not have it in any other format.

008AF2DA031B2DC39FBE418A238EFDA3B10ABC7C77FE12A750BFE899

I also need it in public form with a size of 0x3C. I don't know how to start with this.
Of course, OpenSSL chokes on it, but that's because it isn't in ASN.1 format, and again I don't know where to start with that.


texts: Practical lattice based signatures and key exchange with strong security reduction

texts:
I am looking for practical lattice-based signatures and key exchange with strong security reductions.

Specifically:

Provable security under the relevant standard assumptions.
Fast in software while resistant to timing attacks
At least 128 bits of security


texts: How bad it is using the same IV twice with AES/GCM?

texts:
I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP based protocol that needs packet encryption) I increment the counter and use it as IV.

However, since I will generally need that protocol to transfer files and to send keepalives for very very extended periods of time, in principle for very large files it is conceivable to send more than $2^{32}$ packets, or over the years it is conceivable to send out $2^{32}$ keepalives. To keep the IVs always unique, I would probably need to use a 64 bits integer, but that is 4 bytes more of overhead per packet, that can sum up to quite large quantities which I would like to avoid if not strictly necessary.

So I wonder: how bad it is to reuse the IVs with AES/GCM? Can I have an idea of how dangerous that can be? I mean: if as soon as I repeat an IV once I get immediately so easily exposed to an attack that I could just give out my key publicly, then I have to take countermeasures. However, if that becomes dangerous only when I use the same IV a lot of times, that is completely another thing.


texts: Need an introduction to SPKI (or "SPKI for dummies")

texts:
I am familiar with concepts such as the following:

PKI and CAs
ID based cryptography
Certificateless cryptography
PGP web of trust
more or less anything in basic Crypto that is taught in a college course

I need to quickly understand the main ideas behind "SPKI" or (Simple public key infrastructure). The Wikipedia page, while not entirely disappointing, has not been very helpful either.

I would be grateful if someone could point me to a "for dummies" article on SPKI or explain it here. Basically, what I need to understand is:

What problem does it solve?
How is it different from tradational PKI or PGP web of trust?

Thanks in advance.


texts: Less known hash functions producing 128 bit hash

texts:
Good day.
While reversing a malware I stumbled upon a function producing 16 byte hash. I tried to determine which one is that by checking every function from wiki. Nothing fits. So, there are two ways: a less known, or just custom algorithm.

Can somebody point me out where from can I get a more comprehensive list if hash functions?


texts: Why do we need to hash both the message and the $h$ value in ElGamal signature?

texts:
The professor left us a question on ElGamal signatures:

  Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of $H(M||h)$, the signature can be existentially forged.

I am struggling with the problem, and I think that maybe we can get one known message signed twice with different $(M, c_1, h_1)$ and $(M, c_2, h_2)$, and then use that to sign some other messages $M'$, but I have no idea how to proceed. Can anyone give me some hints?


texts: What are some real-world examples where one-time-pad encryption is used or can be used?

texts:
I understood that one-time-pad (OTP) encryption ensures perfect secrecy. However, I couldn't find any real-world examples where an OTP was used.
Also, what are some real-world examples where it won't be suitable to use the OTP.


texts: RSA Encryption and Signature - Weak Padding

texts:
Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$.

Then to assure its integrity we use our signature key and we publish the verification key. The input to the signature is this (so again we have padding) $01||Sm$. Then the signature $Sign$ is calculated and we send both $Sign$ and $Sm$ to the receiver.

Is there anyway somebody could change our message assuming that he knows the public encryption key and the verification key as well?

In order to verify it or decrypt it all the padding bytes on the left are discarded.
I've been reading the RSA-survey but I can't find any attacks that would work, only if somebody made us sign another message like a blind attack. Do you have any suggestions? Would a key-only attack work in this case?


texts: What type of hash functions provides non-malleability of hash digests?

texts:
I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment.

A simple deterministic commitment scheme Commit(x) = Hash (x) may be insecure, since I read some time ago that this attack is possible:

Given y = hash(x) , the attacker finds z so that z = hash(f(x)). Here f() might be the addition of a suffix to the message or any other mathematical transformation.

None of the three properties of hash functions (pre-image resistance, second pre-image resistance and collision resistance) prevents this attack to be feasible.

I find keyed MACs (Message Authentication Codes) more suited for commitments. Setting Commit(x) = MAC(k,x) and opening the commitment by publishing k and x seems to prevent the attack, but I found no literature on this topic.

I also found Something called perfectly one-way hash function (POWHF), but I found no simple practical example of such a construction.


texts: Standardized parameters for elliptic curve cryptography

texts:
When an elliptic curve-based cryptosystem is deployed, a single set of public parameters (consisting of a particular elliptic curve over a finite field as well as a generator of a prime order subgroup of its group of points) is typically shared across all users.

Some of these public parameters are standardized in some form. The best known ones are NIST-approved curve parameters, described as part of the FIPS 186-{2,3} standard, but there are others. For example, a French agency recently released a set of parameters recommended for local security applications (possibly over concerns re the security of curves over the very special base fields used by NIST?—they didn't say).

Is a list of such curve parameters compiled somewhere? Do you know any aside from the previous ones?


texts: Creating a share of a random shared secret

texts:
I am interested to know if there is a solution to the following scenario:
Assuming we have $n$ party members, is there a scheme that at the end of it, every party member $i$, holds a shamir's threshold share, $S_i$, of the secret $a$ where $k$ of $n$ can reconstruct $a$ using the shamir's threshold reconstruction and none of them individually knows the secret itself.


texts: Can we calculate the "previous hash value" in the SHA256 compression function with a known message block and final hash?

texts:
Suppose we have a $512$-bit (or $512\times n$ bit) message that we'd like to hash using SHA-256. I've looked at the implementation, and from what I understand, after padding, there will be a total of $2$ (or $n+1$) message "blocks" that are fed into the function, with the last block being completely padding. The last message block in this scenario is completely known, it should begin with the "1" bit that marks the beginning of the padding, followed by a bunch of zeros, followed by the message size in bits.
So now, let's say we hash the message. If we follow the chain, the first "hash value" is known, it's the $H_0$ of SHA-256 which is the following (from wikipedia):
h0 = 0x6a09e667   h1 = 0xbb67ae85   h2 = 0x3c6ef372   h3 = 0xa54ff53a
h4 = 0x510e527f   h5 = 0x9b05688c   h6 = 0x1f83d9ab   h7 = 0x5be0cd19

But for every subsequent execution of the compression function, the values above will be changed. My question is, since we know the final message block, can we compute the intermediate hash right before the last hash $H_n$ using just the final message block (which is fully known), and the output final hash $H_{n+1}$?


texts: How to make the interactive Schnorr identification protocol become non-interactive

texts:
I am reading about ZKP and I found this interesting question about changing this protocol from  interactive Schnorr identification protocol to non-interactive and I need help in solving it :

Peggy (prover) and Victor (verifier) have shared primes p,q such that q|p-1 and a generator $g$ such that $1<g<p$ and $g^q=1 \bmod p.$

Peggy has a private key $s$ and a public key $v=g^s$ ($v$ is known to Victor). Peggy wishes to convince Victor that she knows the secret exponent s without revealing what s is. She performs the following interactive protocol with Victor.

Peggy chooses a random $r$ from $[0,q-1]$, calculates $x =g^r \bmod p$, and sends $x$ to Victor.
Victor chooses a random challenge $e$ from $[1,\ldots,2t-1]$ where $t$ is a security parameter and sends $e$ to Peggy.
Peggy calculates $y = r-se \bmod q$ and sends it to Victor.
Victor checks that $x= g^yv^e \bmod p$. If so, then Victor “accepts”; otherwise, Victor “rejects”


texts: How to reverse engineer a cryptography algorithm if some input-output pair is known.

texts:
I am trying to reverse engineer an unknown encryption algorithm. By this, I mean I dont know what kind of algorithm is used to encrypt the words.

But I know some input-output pairs. From this point what can I deduce/reverse engineer?
Thanks


texts:
How does certificate-based encryption solve key revocation problem?

For example, if a user accidentally reveals its secret key or an attacker compromises it, the user may request revocation of its certificate. Alternatively, the user's company may request revocation if the user leaves the company or changes position and is no longer entitled to use the key.

My questions are:

How can we do this process in certificate-based encryption and how different is it compared to PKE (that uses CRL or OCSP for certificate revocation)?
In the case of signature, how can a user verify the validity of verification keys? How can the user check whether the key is valid and not revoked?


texts: When does the first rotor in Enigma machine rotate?

texts:
I read a ton of articles about the Enigma machine. And the one thing that I can't get is when the first rotor stars rotating.

Some articles says the rotor rotates after the first letter of message has been encrypted. So if the first rotor is set to 'A', the first input would go through 'A', the second - through 'B', etc.

But some articles say that the rotor starts rotating when you press a key. Only after that the machine encrypts the letter. I mean, I set the first rotor to 'A'. The I press a key to input the first letter of my message. When I press a key, the rotor goes to 'B' and the first letter goes through 'B'.

Which articles are correct?


texts: At what point does passphrase strength match the strength of the cipher?

texts:
Let's say that I have an ordinary hard drive encrypted with VeraCrypt 1.0e full disk encryption and implementing:

-AES

-RIPEMD-160 Hash Algorithm

Now let's say that for an arbitrary machine, the amount time that it takes to make 1 guess at the master encryption key itself is equal to 1 unit of time. (I understand that, in practical terms, it is beyond infeasible to attempt to crack the master encryption key of AES-256. This is a purely theoretical question.) Knowing that VeraCrypt uses 327,661 iterations of PBKDF2-RIPEMD-160, how many units of time would it take to check 1 password?

What I am interested to know is, at what point K, where K is the keyspace of the randomly generated password, does the strength of the password match the strength of the cipher itself, knowing that the former will have to been run through 327,661 iterations of PBKDF2-RIPEMD-160 to arrive at the latter, where an equivalence of strength is defined as an equivalence of the amount of time that, on average, a brute-force attack would take.

Assuming that the amount of time that it would take for 1 iteration of PBKDF2 to occur = the amount of time that it would take to make 1 check at the master encryption key itself (which I DO NOT simply assume to be a correct assumption), then 327,661 iterations adds log(327661)/log(2) = 18.3 bits of entropy to the overall "strength" of the passphrase. It seems that finding an answer to my question would yield the logical upper-limit of password strength, the point after which it makes no sense to use a [password + key derivation function] whose average time to crack is longer than that of the cipher master encryption key itself.


texts: Diffie-Hellman key exchange: Why is $(g^{k_1} \bmod n )^{k_2} \bmod n \equiv (g^{k_2} \mod n)^{k_1} \bmod n$

texts:
In a Diffie-Hellman key exchange, with a generator $g$ and a modulo $n$, and two keys $k_1$ and $k_2$, why is

$(g^{k_1} \bmod n )^{k_2} \bmod n \equiv (g^{k_2} \mod n)^{k_1} \bmod n$


texts: Are there any signatures based on matrix multiplication with noise? Representing the message as a matrix and multiplying with some randomness coming from another matrix such that the signature itself is a matrix?


texts: ROCA Implementation, Coppersmith Algorithm does not return roots

texts:
We are currently trying to reproduce the implementation of the ROCA-Paper. Therefore we calculated $M'$ from $M$ and $Order_M'$ from $Order_M$ to reduce the search space, but when we hand these values to the coppersmith algorithm as described in Algorithm 1 of the paper, this algorithm does not find any roots.vIt only finds "potential" roots, which are fractional numbers and result in float numbers between $0$ and $1$.

These Roots have the form:

7903163834028830451137438186485015861/17304344567133368654502628603056098610,
213501605850162343745788742125935233/17304344567133368654502628603056098610, ...

Our Implementation can be found on Github

Does anybody have an idea, why the coppersmith algorithm does not return correct roots?


texts: Signature algorithm for constrained environment, curve25512 already present for ECDH

texts:
I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no performance constraint; signature verification is a rare event. The data to be verified is obtained by a one-way channel with untrusted intermediate parties so there is no option to substitute key exchange or similar in place of static signatures.
Curve25519 code is already present for ECDH use, as is BLAKE2s for hashing (needed elsewhere). My understanding is that it's not possible to share much code between Curve25519 ECDH and Ed25519 or ECDSA-with-Curve25519, but the bigger problem I'm facing is that (standard) ECDSA and EdDSA require SHA512 as their hash function, and SHA512 is utterly giant compared to the size of the system.
Is there any reason not to replace SHA512 with BLAKE2s (expanding it up to 512 bits in a suitable manner) for the hash? If it's okay but there's no standard way to do this, does it make sense to base it on Ed25519, or would it be better just to do ECDSA with Curve25519? (In other words, can the ECDSA form be done in a way that shares some or all of the code with the ECDH?)


texts: What is the relationship between p (prime), n (order) and h (cofactor) of an elliptic curve?

texts:
I am reading up on ECC and having trouble understanding how these are related.

In a finite field, all point operations are taken modulo $p$.

$n$ is the order of the generator $G$ — which apparently is the number of different points on the curve which can be generated by multiplying a scalar with $G$. This is clear. But —

How is this $n$ chosen? Is $G$ chosen so that $n$ is a certain number?
Does $n$ effect the security of the curve?
Do all the points of the crypto operations with a given $G$ fall in the set of $n$ points for that $G$?

$h$ is the cofactor which is the $\#E(\mathbb F_p)/n$.

What is the significance of this?
$\#E(\mathbb F_p)$ is the number of points of the curve apparently. Why is dividing that with $n$ interesting?


texts: How the decryption process of AES is the reverse process of Encryption process of AES? Mean Reverse in what sense mean final round would be conducted first or steps in each round would be conducted first? Please Guide me...


texts:
The equivalance operator is the inverse of the XOR operator, it's symmetric. Would this mean that it would also provide theoretical perfect secrecy just like XOR?

XOR

x ⊕ y = (x ∨ y ) ∧ ¬ (x ∧ y )

EQUIVALENCE

x ≡ y = ¬ (x ⊕ y)

There is no information leakage in theory if you just take the inverse of a perfectly symmetric function, it has to be perfect in both ways in theory.

What are you thoughts?


texts: What is the importance of Rcon in Rjindael's key expansion from a security prespective?

texts:
I do not see why the Rcon function is important, it looks like a waste of cycles.

$$\operatorname{Rcon}(i) = 2^{i-1} \bmod p(x)$$ is in  $\operatorname{GF}(2^8)$, where $p(x)$ is the irreducible polynomial $x^8+x^4+x^3+x+1$.


texts: Using hashed password as shared secrets. Good or bad idea?

texts:
I built a system that allowed users to generate an unlimited number of email addresses.

Instead of storing each one in a db, I created addresses dynamically and made the address an hmac signed message with the shared secret being the bcrypt hashed version of their account password. e.g. 1948417:11eea538fdc926e38ff97689d913d34da152b072@example.com

Security wasn't critical and it worked pretty well, but I'm considering using the same strategy for something a little more delicate.

So, the question is... Is using a hashed password as the shared secret a good idea or bad idea?


texts:
Let's say my public key is defined as $P = p \cdot G$, where $p$ is my private key and $G$ is a generator point of an elliptic curve. If I wanted to sign a message $m$, could I do the following?

Hash $m$ to a number using a hash function: $h = Hash(m)$.
Compute signature as $S = \frac{p}{h} \cdot G$.

The verification of the signature can then be done by checking that $P = Hash(m) \cdot S$.

This seems like it should work - but also seems too simple - so, I'm wondering if there is anything I'm missing here.


texts: Which bitlevel operations must a fully homorphic crypto system support?

texts:
My question is:
If I want to develop an turing complete programming language (for example some kind of assembly language) on top of a homomorphic encryption system, which bitlevel operations does this encryption system need to support so we can carry out all sorts of functions?

Bonus question: What operations is a usual CPU capable of carrying out at the lowest level? Because if you look at the number of operations in the x86 assembly language it seems obvious not all of them are supported a the lowest hardware level.


texts:
I was reading up on blind signatures. I came across the following paragraph in this paper.

  Previous methods of proofs used to establish security arguments for
  signature schemes no longer work since, during the collusion between
  the signer, the attacker and the random oracle, we lose control over
  the value that the signer receives: it no longer comes from the random
  oracle, but from the attacker. As a consequence, the signer cannot be
  simulated without the secret key, otherwise the signature scheme would
  be universally forgeable

The authors go on to use the concept of witness indistinguishibilty to solve the above problem.

I am not able to understand what the author means by :

  the signer cannot be simulated without the secret key.

Can anyone explain why this is the case?


texts: Sequence of Encrypting RSA like Chaum Blinding scheme

texts:
I'd be a noob in cryptography but reading up a little on RSA, I do get some understanding and I want to specifically resolve this issue.
UPDATED
Lets say we have the following values in place:
KEYSIZE = 512
HASHSIZE =  sha.digestsize*8
digest = some SHA 512 function

We calculate the pub_key,pvt_key e,d via n = pq
and totient function phy = (p-1)(q-1) in effect getting 1 < e < tot_func
and we get d=e mod tot_func
PS : pub and pvt keys are created as an RSA_function(KEYSIZE)
Implementing an RSA scheme, we have a token m
Now
c(m) = m^e mod n

Decrypting it would be:
m = c^d mod n

PS: m is a token number (instead of padding a m=token hash, converted from some m=f(M))
To be specific:
m = convert_str_to_long(sha_digest(M))

M itself is of random HASHSIZE bits

Chaumian Blinding
I want to know where I'm going wrong with this.
Given the same scheme as above for token id m, However I want to be clear with a Chaum's blinding scheme and implement that instead.
we have n,p,q,d,e,m
To blind quoting from Blinding

For example, in RSA blinding involves computing the blinding operation E(x) = xr^e mod N, where r is a random integer between 1 and N and relatively prime to N (i.e. gcd(r, N) = 1), x is the ciphertext, e is the public RSA exponent and N is the RSA modulus. As usual, the decryption function f(z) = zd mod N is applied thus giving f(E(x)) = x^dr^ed mod N = x^d*r mod N. Finally it is unblinded using the function D(z) = zr^−1 mod N. Since D(f(E(x))) = x^d mod N, this is indeed an RSA decryption. However, when decrypting in this manner, an adversary who is able to measure time taken by this operation would not be able to make use of this information (by applying timing attacks RSA is known to be vulnerable to) as she does not know the constant r and hence has no knowledge of the real input fed to the RSA primitives.

Blind requires creating a blinding factor,r.
while 1:
    r = random.getrandbits(KEYSIZE-1)
    Verify that GCD(r, n) ==1
    if gcd(r, n)==1: break;

Create a blinding factor, r
Create blinded_token = m * (r^e % n)

Questions:

What the heck do you do after that? Decrypt > Unblind Or Unblind > Decrypt to recover token m?
Also, if you want to sign the blinded_token do you Sign > Decrypt > Unblind OR Sign > Unblind > Decrypt ?
How do you Unblind actually based on above blinding?

My goal is to recover back m.
Please do tell me if you need some more info. I need this asap.
Thanks in advance!
UPDATE
I would like to credit both Rick and the OP here in my work regarding this.
I got the solution finally.


texts: Is CPU timing jitter a usable entropy source?

texts:
In some virtualized environments, the only source of entropy available is CPU timing jitter.  Can one get enough entropy from this source for practical uses?  Also, is this secure against local side-channel attacks against unprivileged local attackers?

"enough" in this context means "enough to seed a CSPRNG" (256 bits?).
"unprivileged" means that the attacker cannot simply read the RNG state directly because of process or VM isolation.


texts:
I am working on an LWE instance where q is a power of 2 and I'm wondering if there is any literature about attacks in this context, especially if there are any attacks which work significantly better. I know about the general attacks (combinatorial, lattice based, algebraic) found in Concrete Hardness of LWE for example, but I don't know if they get better for this special q. I would be grateful in fact for any LWE literature at all which talks about this context.
The q used in the Frodo key exchange (based on LWE) are powers of 2, and this is one of the alternate candidates for key exchange in the NIST PQ competition, so power of 2 q's seem to work OK.


texts: Additive inverse for elliptic curve addition in finite field in jacobian coordinates

texts:
I wrote a solidity smart contract for elliptic curve point addition in Jacobian coordinates.

Jacobian coordinates: [X,Y,Z]
Affine representation: [x,y]=[X/Z^2, Y/Z^3]

I used the following formulas: Link. My code seems to work fine however my questions are:

What is the additive inverse in Jacobian coordinates? Is it the point at infinity and the result therefore: P-P=[0,1,0]?
My elliptic curve multiplication function seems to have an error, any idea? I think I need to set the start value of R to "additive zero for points".

// function for elliptic curve multiplication in jacobian coordinates using Double-and-add method
function ecmul(uint256[3] P, uint256 d) constant returns (uint256[3] R) {

  R[0]=0;
  R[1]=0;
  R[2]=0;

  //return (0,0) if d=0 or (x1,y1)=(0,0)
  if (d == 0 || ((P[0]==0) && (P[1]==0)) ) {
    return (R);
  }
  uint256[3] memory T;
  T[0]=P[0]; //x-coordinate temp
  T[1]=P[1]; //y-coordinate temp
  T[2]=P[2]; //z-coordiante temp

  while (d != 0) {
    if ((d & 1) == 1) {  //if last bit is 1 add T to result
      R = ecadd(R,T);
    }
    T = ecdouble(T);    //double temporary coordinates
    d=d/2;              //"cut off" last bit
  }

  return R;
}


texts: Is HMAC-MD5 still secure for commitment or other common uses?

texts:
MD5 collisions have been out for some time. In spite of this, HMAC-MD5 is still secure for authenticating data1. This illustrates a strength of the HMAC construction, it does not require that the hash function be (weakly) collision resistant.
Recently, Dan Kaminsky posted a simple method for finding HMAC-MD5 collisions. The steps of the attack are:

Given a hash function with a collision and a key either known or controlled by an attacker, it’s trivially possible to generate a HMAC collision.  The slightly less quick and dirty steps are:

Start with a file at least 64 bytes long
Generate a collision that can append to that file.
XOR the first 64 bytes of your file with 0x36’s.  Make that your HMAC key.
Concatenate the rest of your file with your colliding blocks.  Make those your HMAC messages.
HMAC(key, msg1+anything) will equal HMAC(key, msg2+anything)

HMAC has been suggested2 as a way to do cryptographic commitments.
Is HMAC-MD5 (or more in general, HMAC with a non-collision-resistant hash function) still a secure way to do commitments?
This is important because, for example, Python's HMAC library uses MD5 by default.
Bonus Question: Are there any other common uses of HMAC and are they still secure for HMAC-MD5?
1. Though not recommended for new applications.
2. If anyone knows of a more authoritative reference for using HMAC for commitment, please edit it in.


texts:
Given $F$ , a PRF family and $F_{n,k}$ a permutation over the set $\{0,1\}^n$. In addition, each permutation (as usual for PRF) and their inverse (not usual) has an efficient calculation.

  Define:
  $M_n=\{0,1\}^{n/2}$
  $K_n=C_n=\{0,1\}^n$

  in addition to that, $ENC_n(k,m;r)=F_{n,k}(r,m)$ when $r$ belongs to $\{0,1\}^{n/2}$.

  Propose a DEC algorithm that will suffice correctness.
  Prove that the encryption scheme provides CPA security.

I need help please with understanding the question.
Also, a construction of how to do it will be pleased.

What I've tried

i've had unsuccessful attempts with understanding exactly how my DEC algorithm should look like at 1.

To answer 1, I must show that Pr(DEC(k,ENC(k,m;r))=m)=1. for a designed DEC. i had two main problems.

How does the ENC algorithm return a cypher text in length 'n', with a key and message with length 'n/2'. It seems like it's using some "addition func" with the bits.
Writing a valid DEC algorithm. i was thinking using the inverse function of 'F' to get 'm' and 'k' with the DEC algorithm, but there was no success.


texts: what is the difference between RSA and DHM mathematically? And why RSA is hard to break

texts:
This is my assignment question and I m looking for immaculate answers from crypto experts. The aim of the assignment includes the critical analysis of both algos and answers to the given questions in the assignment must reflect the critical analysis has been done. Kindly, provide me a clue about the main differences and I'll search for the rest of the material.
I ll be thankful for your time and really appreciate your efforts


texts:
Does anyone know of any commonly accepted or standard specifications for languages, modelling, diagramming, etc. for specifying and describing the life cycle of keys in a system?

Thanks.


texts: Estimated entropy per bit given P-value of a statistical test, and number of bits tested?

texts:
Assume that a certain statistical RNG test (say from the NIST Statistical Test Suite, Dieharder, etc..) gives us a certain P-value (per the definition [*] used in NIST Special Publication 800-22), after testing $n$ bits of a RNG; say, $P=0.001$ (indicative of failure of the test with high confidence) and $n=2^{20}$.

Based on that information alone, what can we say about the (maximum) entropy per bit $H$ of the RNG tested, with some prescribed confidence? By this I mean, more precisely: the hypothesis that the tested generator has at least entropy rate $H$ can be rejected with fair confidence; perhaps, as associated with some P-value (possibly higher than the $P$ obtained in the test, say twice that).

How can we refine this, given P-values $P_i$ for that experiment repeated $k$ times?

Update: if that's not answerable as it, does it remain so when we add some very general hypothesis on the structure of the RNG under test, like: it outputs independent bits with some unknown constant bias? Refine this additional hypothesis as needed to obtain some relation between $P$, $n$ and $H$ !

Update: I do realize that if any statistical test RNG pass, that gives no insurance at all about the entropy per bit of the RNG tested; and that if it fails with values as in my numerical example, any hint that it may give in term of entropy per bit will be that it is at most $H$, with that $H$ dangerously close to 1, thus not very telling (even with the now-reduced P-value).

[*] My understanding is that the correct definition of the P-value used for statistical RNG test is that the statistical test promises that for any $\alpha$ with $0\le\alpha\le 1$, it outputs a P-value at most $\alpha$ with odds at most $\alpha$ when applied to a perfect TRNG.

Further, I believe only the second sentence is right in this quote of NIST SP 800-22 page 1-4

  For a P-value ≥ 0.001, a sequence would be considered to be random with a confidence of 99.9%. For a P-value < 0.001, a sequence would be considered to be nonrandom with a confidence of 99.9%.

Correct me if necessary!


texts: Reverse output of general Fibonacci LFSR

texts:
Suppose we have some Fibonacci LFSR, and it outputs some sequence.

How to change starting LFSR so, that it outputs exactly same sequence, but in reverse order?


texts: Mathematics behind the paper "how to leak a secret" for ring signature

texts:
I'm reading the paper "How to Leak a Secret" (Rivest, Shamir, Tauman; 2001).

On page 8/14, in chapter 3.4, the authors present the following "combining function":

$$C_{k,v}(y_1, y_2,\ldots,y_r) = E_k(y_r \oplus E_k(y_{r−1} \oplus E_k(y_{r−2} \oplus E_k(\ldots \oplus E_k(y_1 \oplus v)\ldots)))) .$$

Is there any explanation for why this function satisfies the second one of the three properties listed on the previous page:

  Efficiently solvable for any single input: For each $s, 1 \leq s \leq r$, given a $b$-bit value $z$ and values for all inputs $y_i$ except $y_s$, it is possible to efficiently find a $b$-bit value for $y_s$ such that $C_{k,v}(y_1, y_2,\ldots,y_r) = z$.

A concrete example of how to solve it would be ideal.


texts: Key exchange and man in the middle issue. Secure solution

texts:
I am trying to design MiTM protected key exchange algorithm.
For instance I am using RSA asymmetric keys.

Alice and Bob respectively have each their own pair of keys. And they should be able to exchange public keys. In real life implementation there would be a relay 3rd party which should only allow Alice and Bob exchange messages in case if there is no way for direct connection. However this relay party can be compromised by Eve where she would have her own pair of keys, accept Alices And Bobs public keys during the exchange and send out hers instead. Therefore all encrypted messages will be decrypted, read, encrypted again and sent further by Eve compromising the whole key exchange process.

Apparently there can be Trent that could sign the key before it is sent to the recipient and later after it has been received could verify the signature. However I feel that this schema also has a flaw as Eve could somehow obtain public key signed by Trent.

Is there a way to make sure that if Trent is not compromised (means that it is not someone disguised as Trent) we can make sure that keys are exchanged securely?

What comes to mind is that any party can have information about Trent (certificate, public key or something similar) using which they can make sure they communicate with Trent, whereas Trent would confirm to each party from whom they received the key. Does this schema has a flaw or any issues that I haven't noticed?


texts: How to simplify a the signing process in an elliptic curve signature scheme that involves a quadratic verification equation?

texts:
I am looking at a proprietary signature scheme used in production. It involves a short Weierstrass curve $E_{\mathcal{W}}:y^2=x^3+ax+b$ in the prime field $\mathbb{F}_p$. The parameters are set up such that $E_{\mathcal{W}}$ is always expressible as a Montgomery curve $E_{\mathcal{M}}:y^2=x^3+x$ (i.e. $a_{\mathcal{W}}=1$, $b_{\mathcal{W}}=0$, $A_{\mathcal{M}}=0$, and $B_{\mathcal{M}}=1$). As far as I know, the Montgomery form is never used for verification. The curve has highly composite order $n$, with a base point $B$ having prime order $\ell$.
The verification process given a hash function $H$, a keyed hash function built from $H$ with (namely $H$ in HMAC mode, $H_k$), a message $M$, a public key $K$ and a signature consisting of a scalar $s$ and a hash $h$ is performed as follows:

$h_1=H_{c_1}(M||h)$.
$R=s\cdot(sB+h_1K)$
$h_2=H_{c_2}(M || R_x || R_y)$, where $R_x$ is the $x$ coordinate of $R$ and accordingly $R_y$ is the $y$ coordinate of $R$
If $h_2=h$, the signature is valid; else, it is invalid.

$c_1$ and $c_2$ are static HMAC keys known both to the signer and the verifier. My conjecture is that they act as domain separation strings.

I am trying to determine if there is an efficient way of creating a signature that does not involve taking a square root in $\mathbb{F}_p$. Square roots are not trivially found in $p$ because $p$ it may be that $p\equiv1\pmod{4}$ and $p\equiv1\pmod{8}$.
Currently, I reach the following signing process:

Choose a nonce $r$ such that $0<r<\ell$.
$R=rB$
$h_2=H_{c_2}(M||R_x||R_y)$
$h_1=H_{c_1}(M||h_2)$
$s=\frac{-Hk\pm\sqrt{(h_1k)^2+4r}}{2}\pmod{\ell}$, where $k$ is the secret key corresponding to $K$ in the verification process
If $\sqrt{(h_1k)^2+4r}$ has no solution in $\mathbb{F}_p$, restart from the beginning.
Output signature $(s, h_2)$.

Is there a way to create a signature passing the above verification process that does not involve a square root in $\mathbb{F}_p$?


texts: Hierarchical access control using CP-ABE

texts:
Is it possible to use CP-ABE to provide a layered (hierarchical) organization?

For example, If I have 100 records, I will encrypt the first 10 records (lowest level) to be decrypted using certain attributes. The next level can for instance decrypt up to 20 records.

Encryption depends on a secret $s$ for the first ten records and a different secret s' for the next 10 records. How could I give the higher level in an organization a key that could decrypt all 20 records?

I am trying to avoid giving people in the higher level the secret of the lower level.


texts: How were the constants chosen in round 2 and 3 in MD4?

texts:
Just reading Ron Rivest's explanation of MD4 the hash uses two round constants one $ \text{5A827999}$ on round $2$ and the other $\text{6ED9EBA1}$ on round $3$.
I think they are supposed to be hex representation of square root of $2$ and $3$. But $\sqrt{2} = 1.\text{6A09E667F} $ and
$\sqrt{3} = 1.\text{BB67AE858}$
which are very different from the the values given. Any ideas?


texts: Why would the use of Curve25519 in Dragonfly leak information?

texts:
An answer explaining Dragonfly, a form of key exchange used in WPA3, has an interesting footnote:

  One final note: reviewing the Firefly RFC, I see that it would (as written) leak some information if you run in on an elliptic curve that doesn't have a prime number of points (that is, has a cofactor $h \gt 1$). If you're using (say) the NIST curves, that's not an issue; if you try to adapt it to run over (say) Curve25519, that would need to be addressed...

Why is this, and what would be leaked if using a curve without a prime number of points?


texts: I'm trying to figure out how padding works by seeing what happens when I try to encrypt a 16 byte file with AES-128-CBC. My understanding was if I encrypt a file of size, say, 28, then there would automatically be 4 bytes of padding to make it 32. But when I encrypted my 16-byte file, the size ended up being 48 bytes. I did research and learned that a single padding block is automatically added to direct multiples in order to distinguish the padding from the plaintext, but if that's so, then why is it 48 bytes and not 32 as well (16 plaintext + 16 padding)?


texts:
How to decode Playfair when only a small part of key is available?
What is the plain text for this message?
Can someone explain how to recover the plain text for this message?
Is there a program that I can download and execute on my PC to test possible keys in bulk to solve the following problem?
The cypher used is Playfair.
The partial key as a word is: ?A?D????BCG??KLNQ???V???Z.
The partial key as a 5x5 table is:
? A ? D ?
? ? ? B C
G ? ? K L
N Q ? ? ?
V ? ? ? Z

Note that the symbol "?" indicates an unknown letter.
The plain text is supposed to be in English or Portuguese.
Only one of these following 3 texts is encoded by the Playfair cypher, but I don't know which.
TXT1
WL_SWVJDTA_GSFSSL_SKKGJAZVWVJ_GEMWHUG_FSFS_WSWTW_SSG_SHWGWID_F_WELAWKS-_SWFKWGFELN__OZSE.ESEV_SA,AFUEAW_DWID_WEYFGSEGSMK_VAWW_XUDSKMJV_J,AL,FI_LVF_MWSLN__GF__OZHFFL_FKK_GAWLSGFWX__WGJ_S_L_GWKJSE_MYHKGWSD_AKTF.WGLDFVASLL_FKWUA_FW_LMUGSKGAF_GAWH_LKLSGGGIGSL_GU_F_WLJMFXSFJ_WNNGUBF__YFWVWMS__F,SWJ_WA_K_GGLSFKWAVAA_SVFYJSGWJE_G_NLU_F_GLSWWLJJ,M_JAUEWWLMJLSSLXDGUVFSW_GSKEWAMFG_FAUSL_F_SSKVMLX__JKS_JNSNVVEYSDJHM_AGUEWSWWWLMFJ_AJLS__SGYFGWF_WES-_DWX

TXT2
SNPQUNBFMIENSKVNSXPQAZMEFONUGSNFRHOEKHBSQRQKRHUPXOUOTULAADZAMARNQEQUSCCORLPQLMTUDECUGXACQKCZKUSIDQOLVFRHEHUCULMIENSKVNKSQRTULAADUDQUHOKUDSERLGPAMACKOCTUQRUBPSZPQUSMQPULMIENSKVNPZPUQKAZAMKEXIMXNDAXACCNIUNEACMEFONUACUMPQUSSLUDQRTPUCAQKGDUIKTUCLGQEIPIZXKGKCDUHRQTMPMBDQSMQPGCAMRHPOXOTNRLOQABNLEPZPIEOFPUUKPISXSKMUDASKISWESKPSPQPTDQQCEHOKQOTUACAFPELMSKPSZAUPPESDPXACMECOROTVRLEHUCVNOUPQEAOQXIPQXBKGOCRHLDMQPSQKSXGSFMPEKMUCSMQCUPXDBPSXMEZPBWCDMPCAKSRETFACPOBDMPMBOHQTQBPOBCNTGSOUQOEDDNSMQPTPEPGKZPMCMAOEXMMLDUEHSIAOBUGSUDGKQOPYPQMLVNKSNXSXSMSPRNQEQUSCAFERSKREGKYDGSMEIZHEMDHRSKPSXHQKUCOEGSHKTPNTQBWDTPEROEOCLMAOBQUPMQSDCMGSHNQEQUSCRMMIQKCUDRSDMEIOCOMFHOHCPOGKYDGSUDIUSNPQUNBFMIENSKVNCAUORHRLNOPQTULAMEFOUCUDTUERGBMARSTCKSQOTPEHIPMHQKIXCAUORHRLSDMEQUMAUCUCBUMASGMUPQOKQUACMESVUPBUQMAUSLCABYMIDHPAHRBULMEHSNPQUNBFMIENUDMQMPMWCAEHXACHEOOVEGLMDQSMQTRHPOGKYD

TXT3
VBRCTB%RS1W2G_0CBKDAPQBG___GXGW,O_QCWEF2GQDGA9QG-NDRY__1U-BWCT__YRKKTYXCKBZAB_HJVG_BXY_YDUR_B39_0JS2QG-_AD__TGVKHBD__GCBDT__0KBJD_.BDYG_CD2R0Y1H_DYJGUKWJKKB,C_BHWOB_NCODXZKDG__ZB__S2_20BDECTYDDKCYY_HY5UDY_GKOT1W_CC2
_CKDPQ_0G%X9GDTKNJFJ_CC_V_TC_B_BâUKTGKXTBFAP5BK2G30T_,_-BDURGBB_DDH,N0YB_BYGBK8_A__0
SB-CD_S2J.T_CBUJU_W_UDJVBUKYDUTY€YTYCJXHC_AD0C_0K_
K2_EYGG_CCVWGBVB_K%VWCMDDG__CTOY1CNDSBYA30__WDBJC,QHYGYG_YKYN_BCKO™VUKC.X


texts: RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$

texts:
Suppose for a RSA system I have the following variables given:
modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$,
Is it possible to find the private exponent $d$ ?
Note: $p$, $q$, $p-1$ and $q-1$ are not known


texts: Two-party symmetric key establishment protocol

texts:
I need a symmetric key protocol that will mutually authenticate and establish a new short-living session key between two parties that have a pre-shared key. Unfortunately, I have not found any existing protocol that would fit my purposes, so I quickly devised my own. Would greatly appreciate your feedback on the protocol, or otherwise any advice to find something that already exists.

Notation:

C         = Client
S         = Server
K         = pre-shared key between C and S
ENC(K, m) = message m encrypted with key K; encryption function is AES-256-CBC
MAC(K, m) = a message-authentication code of message m, computed using key K
rnd       = random value
c1        = client challenge (randomly generated by the client)
c2        = server challenge (randomly generated by the server)
K'        = short-living session key

The protocol:

C -> S : em = ENC(K, (rnd, c1)), MAC(K, em)
S -> C : em = ENC(K, (c2,  c1)), MAC(K, em)
C -> S : em = ENC(K, (c1,  c2)), MAC(K, em)

Further session messages are encrypted with session key K' = c1 + K + c2:

* -> * : em = ENC(K', m), MAC(K', em)

Rationale for using PSK instead of private/public keys.
Simplicity of usage. A tool is run on a server, and generates a unique PSK automatically, which the user then needs to manually or programmatically transfer to the clients he wants to connect. For the user this is much easier than using public-key cryptography.

Rationale for having session keys in addition to PSK.
In the system I am working on, A PSK establishes a limited-time trust between a server and multiple clients. The underlying protocol is for configuration management, and there should be a protection against replay attacks. IF I were just to use the same PSK to encrypt different sessions, THEN it could be possible, as far as I see, just to record and then replay a session to achieve another (unauthorized) configuration update, which would be bad. Usage of session keys precludes this scenario.

P.S. I am asking this question here after I've asked the same on security.stackexchange, and was pointed out that cryptography.stackexchange might be a better fit. People there also pointed out that TLS-PSK protocol might fit my purposes; would appreciate your comments on that as well. It might also be that I am totally overcomplicating the things, will be grateful for any simplification suggestions!


texts: What is the security concept in printer cartridge?

texts:
Based on this datasheet or this patent, one of the usage of PUF is printer cartridge identification and authentication. I was wondering why printer cartridge needs identification and authentication. In other words, what is the security concept behind it?

Furthermore,

what is the required protocol for it?

which item behaves as PUF?

who sends the challenge?

who verifies the correctness of the response for the given challenge?


texts: How are security proofs done in ABE Schemes?

texts:
I have been studying several ABE schemes and I understand the security assumptions and the several types of security models used for the security game between the Challenger and the Adversary.

What still confuses me is the security proof which involves an additional entity "The Simulator" which is usually done at the end of the different papers.

My question is what is the concept behind that security proof? What is the aim and what are the rules that guide the process as I need to understand that to apply it to the scheme I am working on.

N/B - If the question needs any additional details I would be glad to provide them or edit if it needs any changes. Also I have not stated any exact papers as its a general concept that applies to all the schemes I have read about and I am not sure yet if there is any difference in how it is done except for the fact that the different schemes are based on different security assumptions.


texts: Is SSL getting faster because it's getting less secure?

texts:
There has been some discussion about it being more practical to use SSL due to advances in hardware. From my understanding, stronger public-key encryption means that both encrypting/decrypting and breaking it (via brute-force or vulnerabilities) take longer.

Is the return (in security) for the performance loss of using SSL increasing, or has today's hardware simply outgrown the strength of encryption used?


texts: Quadratic sieve for DLOG performance - theory vs actual?

texts:
Is there any report on comparing quadratic and number field sieve performance in theory vs actual data for discrete logarithm over primes?

Is actual data better than theory in any way unexplained (I think I read this somewhere and cannot recollect)?

My query was more about distinction between theory and practice of quadratic sieve and distinction between theory and practice of number field sieve and not between distinction between quadratic and number field sieve.


texts: Why does 3DES need private key to decrypt?

texts:
I create two files, my.cer and my.pem ( include certificate and private key), I encrypt a file with my.cer, I use openssl smime -encrypt command. When decrypting data, it needs my.pem.

I think 3DES is symmetric cryptography so it should just need my.cer. Please explain.


texts: Shamir Scheme: Whats the problem of not using random x-coordinates?

texts:
i would like to know why there is a problem of not using random x-coordinates in shamir secret sharing schemes.

I consider that after evaluating the points in a polynomial $f(x)$, the share is composed by: $(x, f(x))$, where the $f(x)$ is secret and the $x$ could be public. So, why i always find in some literature that it is a problem using not random x coordinates? Could i have an example of why is it a problem?

Associating the shamir scheme with ortogonal arrays (respecting the strength and lambda properties), i know that fixing the x-coordinates i am restricting the matrix to only the known columns and, consequently, we have a smaller matrix. But we still have the perfect privacy properties, because even knowing the x-coordinates, each secret appears exactly the same quantity of times for each t-tuple, where $t$ is the threshold. Therefore, even knowing the x-coordinates, i can not know anything about the secret.


texts: In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?


texts: Difference between oracle behavior and real execution

texts:
Suppose that there is a place in a security proof where the behavior of an oracle differs from the corresponding real execution (for example, the decryption oracle rejects certain types of ciphertexts but in the real world the decryption function accepts them). Let us assume also that the probability of this situation is not negligible (i.e., the adversary can force this easily).

My understanding is that this automatically means that the proof is incorrect, although I cannot justify it further than stating that "there is a difference between oracle behavior and real execution".

First of all, am I right? If so, is there a more profound explanation?
Do you have some authoritative reference on this matter?

Update: The only example I can find on this respect is a paper from Bellare and Ristenpart, which discusses the proof of Waters' IBE scheme. This proof is tricky:

  But A can make Extract queries that force any conceivable simulator to
  fail, i.e. have to abort. This means that the advantage against DBDH
  is conditioned on A not causing an abort, and so it could be the case
  that A achieves $\varepsilon$ advantage in the normal IND-CPA experiment but
  almost always causes aborts for the simulator. In this (hypothetical)
  case, the simulator could not effectively make use of the adversary,
  and the proof fails. (...) To compensate, Waters’ introduced “artificial aborts”

Although I grasp the meaning in the remarked sentence, I would like to have a deeper explanation


texts: When the salt is applied before the text is salted , then what is "that"?

texts:
In all the documentation I read that the salt is applied before the text is hashed and the salt is stored somewhere in the database in plain text.

So for example bcrypt generates the following structure:

$2y$10$M8z/Bcli/eh3ay5.4w4Y5.hbTZ2wrwDKdJXkCQ7HuFazAzOqZzl4`.

$2y$10$M8z/Bcli/   <-- this does not look like a part of the hash

What kind of structure is this?


texts: So when genrating a private key / or key pair in OpenSSL ther is the -nodes tag to deactivate the encryption of the private key . i looked it up and It means "no DES" . So no DES is used . Why is DES used for encrypting such secret information even tho it is not considered secure any more and OpenSSL is one of the most widely used tools for generating rsa keys


texts: What is an efficient random number generation algorithm

texts:
I have been looking for the algorithm that generates random number and this algorithm has to be more secure.

I am going to use this algorithm to generate the salt that will be used in PBKDF2.

Through my reading, I found that ISAAC is fast algorithm and better than RC4 but it is not good in terms of the security. Also, I thought about Blum Blum Shub algorithm but some articles said it is not an efficient algorithm.

What I need is your opinions about which algorithm is better OR which algorithm you prefer to use?

Thanks


texts: What's the difference between PBKDF and SHA and why use them together?

texts:
I've been reading a little bit about hashing lately and according to AgileBits, they use "SHA512 within PBKDF2" in their new vault file.

I've looked in Wikipedia for both names and I know PBKDF2 is a key derivation function and SHA is a cryptographic hash function but I can't really understand the difference and why they are both used together with one inside the other.

Can anyone explain this for a person without experience in cryptography?

(You can assume I only know about math, if necessary).


texts: Calculating ciphersize of Paillier, SSE and OPE

texts: If I have to encrypt a 32 bit plaintext in each of Paillier, SSE and OPE, how can I make an estimate of the ciphertext sizes respectively in order to reserve the amount of space in a database?


texts: What's the ASN.1 structure of ECIES encryption result?

texts:
I got a ECIES encryption result and a publickey,the publickey after decoding to ASN.1, I obtained the following:

SEQUENCE {
   SEQUENCE {
      OBJECTIDENTIFIER 1.2.840.10045.2.1 (ecPublicKey)
      SEQUENCE {
         INTEGER 0x01 (1 decimal)
         SEQUENCE {
            OBJECTIDENTIFIER 1.2.840.10045.1.1
            INTEGER 0x008542d69e4c044f18e8b92435bf6ff7de457283915c45517d722edb8b08f1dfc3
         }
         SEQUENCE {
            OCTETSTRING 787968b4fa32c3fd2417842e73bbfeff2f3c848b6831d7e0ec65228b3937e498
            OCTETSTRING 63e4c6d3b23b0c849cf84241484bfe48f61d59a5b16ba06e6e12d1da27c5249a
         }
         OCTETSTRING 04421debd61b62eab6746434ebc3cc315e32220b3badd50bdc4c4e6c147fedd43d0680512bcbb42c07d47349d2153b70c4e5d7fdfcbfa36ea1a85841b9e46e09a2
         INTEGER 0x008542d69e4c044f18e8b92435bf6ff7dd297720630485628d5ae74ee7c32e79b7
         INTEGER 0x04 (4 decimal)
      }
   }
   BITSTRING 0x040ae4c7798aa0f119471bee11825be46202bb79e2a5844495e97c04ff4df2548a7c0240f88f1cd4e16352a73c17b7f16f07353e53a176d684a9fe0c6bb798e857 : 0 unused bit(s)
}

I don't really know what's the meaning of every field of the ASN.1 structure.

And the result(use bouncycastle in java) is:

  04067c432c80857e3bd3c437cf6617309768f5ad1a0875d576feda7badf95bb2d572471b75afee6e089ad1128e4b8d587d2b755edf23d0f560dabfdcd66ce1e3c52eca632f28246eb626c148857b1e04b112ac9e2030551b39a87e

I can't decode it with ASN.1 Decoder.

However, I got another result of ECIES use openssl in C, which is:

  304b04210355f43b1936c7d95da83056240032b334334d5166108a37e74b3b1cceebe1d8e00410da784547fd402c00f9aff3d2c2b1a4f50414bec74472761453d0ce9abfee81693c895d5b5840

And I obtain the the ASN.1 structure :

       SEQUENCE {
          OCTETSTRING 0355f43b1936c7d95da83056240032b334334d5166108a37e74b3b1cceebe1d8e0
          OCTETSTRING da784547fd402c00f9aff3d2c2b1a4f5
          OCTETSTRING bec74472761453d0ce9abfee81693c895d5b5840
       }

Which I guess is R||c||d according to Integrated_Encryption_Scheme, but what's the result of bouncycastle ? I want to use openssl to encrypt and use bouncycastle to decrypt, is there any suggestion?


texts: Does any $x < p$ satisfy the curve equation of X25519?

texts:
I've been reading about the famous X25519, a montgomery curve from wikipedia  and in that article they say that we do not have to check for point validity. Is it because that any $x < p$ satisfy the curve equation ? Is this possible for  X25519 because it is a Montgomery curve or because it was specifically designed to do so (for the sake of efficiency,  and more possibilities for public keys) by its discoverer Dan Bernstein ? Why every $x < p $ does not satisfy the curve equation for other curves like SECP256k1, where the equations are of the Weierstrass form, $y^2 = x^3 + ax + b
    \mod p  $ ? I would really like to know the mathematical reasons behind it. Thankyou everyone in advance!