texts:
I need a SHA3-255 or 511. What if I simply truncate a standard SHA3-256 or 512? Apart from the doubled probability of hash collision, are there any other things I should be aware of? I could also truncate one byte instead of one bit, if useful.

What I need is being able to store something different than the hash, in the same 32 bytes, or 64 bytes, so I need to sacrifice one bit to mark when the bytes represent a hash or something else.

Alternatively I could say that if the first byte, not bit, is 0xff, then the remaining ones represent something else. This should reduce the probability of hash collision, but what I would have a probability of 1/256 that a hash starts with 0xff, generating ambiguity in my encoding. I could say that if the for 4 bytes are 0xffffffff, then I would end up with probability of generating an ambiguous encoding of 1/2^32, but I would prefer having a well-defined encoding under any circumstances.

Any well known approach I'm not aware of?


texts: Zero-knowledge transfer of value protocol inspired by EC El Gamal

texts:
This is a follow up on the question I asked here. I designed a scheme that allows the following:

Alice has a value $a$ which she wants to keep secret
Bob has a value $b$ which he wants to keep secret
Alice can "transfer" a part of her value to Bob such that whatever she transfers must be subtracted from her value (the sum of their value must remain the same). For example, if she has $10$ and Bob has $5$, after transferring $2$, she should have $8$ and Bob should have $7$
Victor is an independent observer and must be able to verify that the sum of the values does not change as a result of the transfer. But he should do it without learning any of the numbers involved

The scheme below is inspired by EC El Gamal. If anyone can see holes in it, would really appreciate feedback.

Setup

Alice and Bob hold pairs of EC keys generated using an Elliptic Curve with generator $G$ (an example of such curve could be secp256k1)
Their private keys are $x_a, x_b$, and $X_a, X_b$ are corresponding public keys
Alice has committed to her number by making $A = a*G + X_a$ public
Bob has committed to his number by making $B = b*G + X_b$ public

Transfer

Alice wants to transfer value $c$ to Bob such that $a' = a - c$ and $b' = b + c$. To do this, she does the following:

Calculates commitment to the new number $A' = (a - c)*G + X_a$
Calculates commitment to the transferred number $C_1 = c*G$
Calculates shared secret with Bob and uses it to build a shared key $s = H(x_a * X_b$), where $H$ is a hashing function
Encrypts $c$ with the shared key $C_2 = E(c, s)$, where $E$ is a symmetric encryption function
Makes the following info public $(A', C_1, C_2)$

Bob receives the info and does the following:

Calculates shared secret with Alice and uses it to build a shared key $s = H(x_b * X_a$)
Uses the shared key to decrypt the value of $c = D(C_2, s)$, where $D$ is a symmetric decryption function
Verifies that $C_1 = c * G$
Calculates commitment to the new number $B' = (b + c) * G + X_b$
Makes $B'$ public

Verification

An independent observer (Victor) can verify that the total value in the system didn't change by doing the following:

Verify that $A = A' + C_1$
Verify that $B' = B + C_1$

The scheme above should be secure because all numbers are padded. The numbers are 256-bit integers with:

64 most significant bits containing the actual number
The remaining 192 bits set randomly

So, effectively, instead of transferring something like $2$, Alice would be transferring something like $2.00034094035343043$


texts: How can uniformity of hash functions (e.g. SHA-256) be proved?

texts:
In reading about the Bitcoin protocol I noticed how much its proofs-of-work apparently depend on uniformity of the SHA-256 hash function. And so  presumably do many other applications.

How do researchers go about proving uniformity of proposed hash functions? Is it just an empirical matter of running many inputs through the function and observing the distribution of outputs, or can one formally prove the property? Where could one (non-crypto-expert) learn about how such proofs are constructed and look one up e.g. for the case of SHA-256?


texts: Secret sharing scheme with possibility to change the secret

texts:
Here's a scenario I want to handle with a secret sharing scheme:

Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares
based on $S$ for Bob, Charlie and Dave, and communicates them to their intended recipients via a secure
channel.
Alice generates a parameter $P$ based on $S$ and publishes it.
Each of Bob, Charlie and Dave can reconstruct the secret using $P$ and their personal share. Eve can't reconstruct it, even if she knows $P$.
Alice needs to change the secret. Alice recomputes only a new $P$. All private shares of the participants stay the same.
Each of Bob, Charlie and Dave can reconstruct the new secret using the new public parameter $P$.
Alice wants to add a new participant Fred and remove participant Bob from the group. Alice recomputes a new $P$ and a new private share for Fred.
Each of Charlie, Dave and Fred can reconstruct the secret using their shares and the new $P$. Bob can't reconstruct the secret using the new $P$.

Is there some secret sharing scheme that can handle such a scenario? I found myself some secret sharing schemes like Shamir's secret sharing or secret sharing using the Chinese remainder theorem, but those do no satisfy all my requirements.


texts:
I have several problems approaching the following problem:
Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), but without disclosing Bob's identity. She needs to show that the signature does not belong to her.

If we use blind signatures. then Alice could be the one who signed it, so we cannot be sure that it was signed from someone else.

By using group signatures, more or less we have the same problem, sure there's the group manager who could certify that, but we break the anonymity...

With ring signatures, we have the needed anonymity, Bob presents a message having himself along with others, however, if you want to make it efficient, the ring has to be quite small.

Any other ideas?


texts: Revocable IB Signature scheme with short public parameters

texts:
Is there a signature scheme similar to Adaptively Secure, Decryption Key Exposure Resistant, and with Short Public Parameters? From an implementation perspective A Fully Secure Revocable ID-Based Encryption in the Standard Model and Strongly Secure Revocable ID-based Signature without Random Oracles
 seem to share most public parameters, user secret key generation, time key generation and key combining so was wondering if there was a similar signature scheme that enables some shared implementation with encryption


texts: Is the private key required once the certificate is hashed and signed? After a certificate is generated, public key is shared within the certificate itself. Is the private key used for any other purpose within the handshake or certificate validation?


texts: Is a number generator based on hashing an incremental string considered random?

texts:
Consider the following system

1 - fixed string as a seed, example "something"

2 - concat an increment number "something-1"

3 - hash it, assume it is "9f2054ea4d2c"

4 - take the first 3 digits to get a number between 0 and 4095 for example

The next number will be taken from the hash of "something-2" and so on


texts: AES (or otherwise): can you decrypt concatenated encrypted messages as one?

texts:
Say I have 20 distinct encrypted messages.
Using AES, I am only getting the correct output if I decrypt each of the 20 messages individually.
Is it possible using AES or another method to call my decrypt function on the concatenated 20 messages as one message and get the concatenated decrypted results?
It seems inefficient processing time to call decrypt 20 times.
(Note: I am doing this with raw audio, and interestingly when I decrypt 20 together it sounds like the original but with some clinky noise)-- I want without the clinky noise.


texts: EC non-shared cryptosystems - different group for every party

texts:
Efficient Identity Based Parameter Selection for Elliptic Curve Cryptosystems by Arjen K. Lenstra contains a proposal for a non-shared elliptic curve cryptosystem. Every party chooses its own field and then after some computations and checks (Table 1 in paper) chooses Weierstrass model. The main reason of this work is minimize of trust to the third parties (don't use pre-selected elliptic curves).

Cite:

  The same Weierstraß model used over two different finite fields gives
  rise to two different and, from a security point of view, independent
  groups. With the current algorithms, ability to solve discrete
  logarithms in one of those groups does not make it easier to compute
  discrete logarithms in the other group.

Question: How is possible that parties do not have to have the same group? I thought that having the same group is essential. How can I perform any operations correctly, if the chosen groups are not identical?


texts: Why security proof uses random oracles in identity-based encryption?

texts: In identity-based encryption, users decrypt the ciphertext by using private keys. Without private key, no one will be able to decrypt.In security proofs like here, random oracles are used with the restriction that the attacker is not allowed for key extraction for target identities.With this restriction, it is sure for security because attacker does not know the private key of target identities. Then, why presents random oracles?


texts: Binary representation of the inverse of a big number

texts:
In one of the first FHE schemes by Gentry, the KeyGen algorithm is defined as follow:

For a security parameter $\lambda$, set $N = \lambda ^ 2, P = \lambda ^ 2, Q = \lambda ^ 5$.

KeyGen$(\lambda)$: Generate a random $P$-bit odd integer, $p$. A set $\vec{y} = \{ y_1, y_2, \ldots, y_\beta\}$ is generated with $y_i$ bits. There must exist a sparse subset $S \subset \vec{y}$ of $\alpha$ elements such that $\sum\limits_{y_j \in S} (y_j) = \frac{1}{p} \mod 2$.

Set $sk$ to be a binary encoding of the subset $S$, where $s = (0,1)^\beta$.
Set $pk \leftarrow (p, \vec{y})$.

My problem here is with the subset S. Especially, for a large enough security parameter, the random integer $p$ is so large that I don't see how to print its inverse on my terminal. Are there some specific libraries in Python or C to handle this kind of inverse? I have tried to shift it by the size of p in base 10 but the problem remains as I can't convert p to float/double before dividing.

This may not be the most accurate forum for this question, and I apologize in advance if it is not.


texts: Making a secure file sharing scheme usable

texts:
I am trying to realize a secure file sharing scheme based on asymmetric crypto. Users will access this via browser.
In short, it works like this:

Users register and set their username and password. From this password, a public/private key pair is deterministically generated and the pk is published to the server.
Once someone wants to publish a file to a selection of receiving users (organized as a room or group), they retrieve the respective list of public keys and generate a symmetric key. They then encrypt the file with the symmetric key and that key with each of the receiver's public keys respectively. Then they send those keyfiles and the encrypted file to the server.
To receive the file, another user can download their keyfile and the encrypted file, then decrypt the keyfile with their own private key and the file with the decrypted symmetric key.

Now there is two main drawbacks to this (in descending priority):

After logging in by providing their password, in order to generate the asymmetric key pair and thus be able to encrypt and decrypt files the client (browser) has to somehow save the password or ask for it anytime it is used.
I want to be able to add a new user to a room/group so that they can access the published files in there. To do this, that user needs to get the "permission" of another member of that room to access the file (by that user reencrypting the keyfile). Can the effort required by another user be reduced?

Do you think those can be fixed within this scheme or how can it be changed to not have these drawbacks?


texts: Secure multi-party private set intersectio: Protocols supporting MULTI-party VS supporting TWO-party

texts:
Let assume party $B$ wants to receive secure multi-party computation (MPC) output.

The are many private set intersection (PSI) protocols that support only two parties but they  cannot support multi-party. In this case, party B needs to run PSI  with  party A. Then B uses the result as the input and runs two-party PSI with party C and, so on. However, this setting leaks more information to client B, than the protocol supporting, multi-party PSI.

Example: let computation be "set intersection"

Assume party A has $S_{A}=\{1,2,3\}$

party B has $S_{B}=\{1,2\}$

party C has $S_{C}=\{2,5\}$

Party B in the protocol only supporting two-party receives:

1- $K=S_A\cap S_B=\{1,2\}$

2- $K'=S_C \cap S_B=\{2\}$

Then, it finds $K\cap K'=\{2\}$. So it learns party A has $1$ but party C does not have $1$.

In contrast, if a protocol could support multi-party client B would only learn intersection of all sets that is $\{2\}$.

Question: What are the real-world applications (examples) of multiple-party PSI?

So I can use the examples  to show/justify that protocol supporting multi-party PSI is better (in terms of security) than those only supporting two-party.


texts: Is it possible to re-cipher with Paillier?

texts:
I know that with ElGamal we can re-cipher and get a second ciphertext equal to the first.

Is it possible with Paillier too?

When saying "re-cipher", I mean "A sends me a message, that is encrypted with my public key, I somehow modify the ciphertext, so that it is now encrypted for C without actually having simply decrypted and encrypted".


texts: Who assigns algorithm OIDs for cryptographic algorithms?

texts: I am aware that this is at the border to security but I guess that I will rather find an answer here. The question is which institution generally assigns object identifiers for cryptographic algorithms so that they can be used in higher level protocols (with corresponding adoption of standards). I am aware that theoretically everyone can become an OID registry but I guess there is one that takes care of cryptographic algorithms.


texts: Can "OPAQUE-over-TLS" authentication be optimized?

texts:
So while discussing the issues of password-hashing off-loading in our chat I noticed that it's easy to extend OPAQUE (CFRG draft) to essentially be a better standard password based authentication when executed over TLS. Namely one could simply append a message $F_K(2)$ (for some pre-defined PRF $F$) from the client to the server and only if the client arrived at the correct shared secret $K$ the server will get the same PRF evaluation value and confirm the authentication.

Now my question is:
This protocol contains the full OPAQUE key-exchange, can it be optimized to remove heavy computations (such as exponentations) from either side without compromising security while keeping the number of sent messages or even lowering it?

To give a more concrete direction: Can we remove parts of the (or even the complete) key exchange and only rely on the OPRF (or a parallel instance)?

For your convenience, here is the overview of the protocol:

\begin{align}
U\to S:&\ \text{username}, H'(\text{pw})^r, g^x\\
S\to U:&\ g^y, H'(\text{pw})^{rk}, c\\
U\to S:&\ F_K(2)\\
\end{align}

with $r$ being chosen uniformly at random for each protocol run by the user $U$, same with $x$, $y$ is chosen the same way by the server, $k$ is a static per-user server-side secret, $\text{Rwd}=H(\text{pw},H'(\text{pw})^k)$ and $c=\operatorname{Enc}_{\text{Rwd}}(p_u,P_u,P_s)$ where $P_x$ is $x$'s public key and $p_x$ is $x's$ private DH key. The server also retrieves $p_s$ based on the username (as well as $P_u,P_s$) and $K$ is the result of securely combining (HMQV) $(x,p_u,P_s,g^y)$ or $(y,p_s,P_u,g^x)$.


texts: Is it possible to choose which point will have the public key of a given Elliptic Curve?

texts:
I am wondering if there is a feasible way that, given a specific elliptic curve (such as secp256r1), I could create a keypair where the public key has a given $x$-coordinate. If it is not possible, is there a way to choose the most significant digits of that coordinate?

For example, is there a way to make a secp256r1 ECC keypair with the $x$-coordinate of the public key having the form 04 0000....1234?

Thank you.


texts: Can you get two unpredictable hashes from the same message with, e.g. SHA1?

texts:
I'd like to create a database of questions and answers so that an attacker with access to the database can't obtain either the questions or the answers.

If H0 and H1 are secure hashes, looking up the answer to a question might proceed as follows:

lookup(H0(question)) -> value
H1(question) XOR value -> answer

Can this be done securely with a hash function such as SHA1?

I've looked at HMAC, which could be used to combine the message with additional strings. The additional strings wouldn't be secret. Would access to one MAC weaken the other?

Btw.: The answer would be the same size as the hash.

EDIT

To answer a question that was asked -- the application is unique. The database would be publicly accessible, and anyone could store a question, answer pair. The encryption would be done client-side, so the server would never see plaintext. You shouldn't be able to get any useful information from seeing the database itself.


texts: Sources about NTRUEncrypt implementations

texts:
I'm looking for any source that explains the final implementation of NTRUEncrypt for the NIST's third round as simple as possible. I have been trying to understand it directly from the submitted code and reference documents, but some notation and mathematical definitions differ from other ones I have read previously, probably because those correspond to earlier versions of the cryptosystem.
Do you have any recomendation?


texts: Is there a practical upper limit for password rehashing?

texts:
When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?

Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, Consider the case of $2^{256}$ iterations using SHA-256.


texts: Background for modular arithmetic function

texts:
I'm investigating this function:

$a := ((b\cdot c) \bmod k) - (b \cdot c)/k$

where $/$ indicates integer division.

Two things I've noticed:

It's equivalent to multiplying a·b, and then subtracting the high digits from the low digits (in a radix which divides k)
It's completely linear and can be inverted (that is, given a and b, determine c) in constant time.

Is there any background on this function? Does anyone discuss it, or similar functions? Does it belong to a known family? Does it have any known applications?

In short: Where can I look to find out more about it? I'm especially interested in applications for cryptography.


texts: How to compute the discrete logarithm of Diffie-Hellman with a composite modulus?

texts:
Imagine $n = pq$ with $p-1 = 2 p_1 p_2$ and $q-1 = 2 q_1 q_2$.

I can compute the discrete logarithm of $y = g^x \pmod{n}$ by computing the discrete logarithm of $y$ modulo $p$ and $q$. But then how to recompute it?

What I'm doing right now is recomputing it in $2p_1p_2q_1q_2 = \frac{(p-1)(q-1)}{2}$ with CRT (they all happen to be co-prime). But we're still not modulo $(p-1)(q-1)$ (it lacks the last 2). I usually have a solution though, and I can get the other solution by adding $(p-1)(q-1)/2$ to it.

I figured out I should find the $x$, but I find two other solutions. I can't seem to understand why, shouldn't I find the exact $x$ this way?

Also here I'm lucky, most primes (except one of the $2$) were co-prime. What about when $lcm(p-1, q-1)$ is way smaller than $(p-1)(q-1)$ ?


texts: Is this an error in the Pinocchio Protocol paper

texts:
I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which contains this expression:
$$e(g^{v_0}.g^{v_{io}}.g^{v(s)}, g^{w_0}.g^{w(s)})/e(g^{y_0}.g^{y(s)},g) = e(g^{h(s)},g^{t(s)})$$.

since $e:G \times G \to G_T$, what is the definition of the division operation as shown in the expression above, wrt $G_T$?
If my understanding is correct, the first term in the first pairing should be $g^{v_0}.g^{v_{io}}.g^{v_{mid}(s)}$ instead of $g^{v_0}.g^{v_{io}}.g^{v(s)}$


texts: What is the difference between PKCS#5 padding and PKCS#7 padding

texts:
One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The other platform API only provides PKCS#7 padding.

Are PKCS#5 padding and PKCS#7 padding compatible?


texts:
In CPA secure IBE systems, the advantage of attacker (A) is defined as  absolute value of

$$Pr[b=b^{'}]-\frac{1}{2}$$

Can someone please explain this to me in a few words? Where exactly does that absolute value come from? And how common is this advantage in the realms of cryptography; meaning: how often is this attacker advantage to be considered in general?


texts:
This question came up as I tried to answer an earlier question I asked: Cryptographic data structure: sparse array without membership test.  I still have not resolved that question to my satisfaction, but this question may be appreciated independently.

I want an error-correcting code that has the additional property that when encoding a string that cannot itself be feasibly distinguished from a random string, the encoding cannot be feasibly distinguished from a random string either.  So, for example, Alice could generate a random 1000 bit string, encode it using the algorithm to get a 2000 bit string, and send it over a noisy channel to Bob.  Bob could recover Alice's original 1000 bit string (even if there were many corrupted bits) but would have no way of knowing that Alice did not just send a random 2000 bit string.

I realize that "deniable" may not be the best word to use for this property since this word already has a different technical use in cryptography.  But I am not sure what to call the property.

Also, are there any tags I should be using besides "algorithm-design"?  For both my previous question and this one, I felt that there was no completely appropriate tag.


texts: What could "look for the constants that you might find in RC6" mean?

texts:
In this presentation at the 30c3 (long but extremely interesting and well-documented), Jacob Appelbaum gave this verbal advice (circa 43'30"):

  look for the constants that you might find in RC6

I'm trying to make sense out of that; my problem is, there are very few constants that I could find in the description of RC6. Any idea?


texts: Hash function without avalanche effect but with few collisions

texts:
I am searching for a hash function which has these attributes:

low Avalanche Effect, similiar files should get similiar outputs
low number of collisions (if I have 0*10000 in one file, and 0*99999 + 1 in another the hash should differ and should not collide to easily)

The use case is "bruteforcing" a file hashed by the function, so I give a input file of 0*10000 and then bruteforce the input file.

By reducing the avalanche effect I hope that I can speed up the process by analyzing the difference (fc5e038d38a57032085441e7fe7010b0 is the output hash of the original file and as my bruteforce gets near the original file the hash should have less and less difference like fc5e038d38a57032085441e7XXXXXXX)

Is this even mathematically possible? Wouldn't a hash with these properties lead to a ton of collisions especially when I bruteforce it?


texts: Retrieve message from rsa ciphertext based on some conditions

texts:
Assume:

$x = m^{e-1}\bmod n$
$y = m^{d-1}\bmod n$

Here $m$ is a message, $e$ is the public exponent, $d$ is the private key and $n$ is the modulus of an RSA key pair.
Now if I know $e=65537$, $x$, $y$, and $n$, can I retrieve the message $m$?


texts: How do I check if the output of my CFB TEA encryption algorithm is correct?

texts:
I have an assignment question regarding the TEA cipher in CFB mode. After much difficulty and research, I managed to produce an 8-bit TEA / CFB encryption algorithm. My input is supposed to be a number in string format; for example; "12345678".

This is the result of the encryption

However, i do not have any way to check if the encrypted message is indeed correct.

I do understand a way to find out if it is correct is by programming a CFB mode decryption. Unfortunately, THE decryption of the ciphertext I generated is different from the initial plaintext.

Hence, I'm a little confused on whether is it my encryption that is incorrect or is my decryption that is incorrect.

Is there any way to verify if the encrypted message output is correct? Or is the CFB mode decryption method the only way to verify?


texts: Multilinear Extension Polynomial: Compute the coefficients of the expanded polynomial

texts:
Let $\textbf{a}=\left[10, 32, 57, 81\right]$ and $x=\{0, 1, 2, 3\}$.
Then multilinear extension of vector $\textbf{a}$ is the polynomial, $f_\textbf{a}(x_2, x_1) = 10(1-x_2)(1-x_1) + 32(1-x_2)x_1 + 57x_2(1-x_1) + 81x_2x_1$, where
$x_2$ and $x_1$ is the second and first bit of $x$ respectively.
Thus,
$$ x = 0, f_\textbf{a}(0, 0) = \textbf{a}[0] = 10$$
$$ x = 1, f_\textbf{a}(0, 1) = \textbf{a}[1] = 32$$
$$ x = 2, f_\textbf{a}(1, 0) = \textbf{a}[2] = 57$$
$$ x = 3, f_\textbf{a}(1, 1) = \textbf{a}[3] = 81$$
Expanding the polynomial:
\begin{align}
    f_\textbf{a}(x_2, x_1) &= 10(1-x_2)(1-x_1) + 32(1-x_2)x_1 + 57x_2(1-x_1) + 81x_2x_1 \\
     &=  2 x_2 x_1 + 22 x_1 + 47 x_2 + 10
\end{align}
Is there an algorithm to directly compute the coefficients of the expanded polynomial $f_\textbf{a} = 2 x_2 x_1 + 22 x_1 + 47 x_2 + 10$ without naively expanding the polynomial from $10(1-x_2)(1-x_1) + 32(1-x_2)x_1 + 57x_2(1-x_1) + 81x_2x_1$?


texts: Reversing SHA1 (don't know the correct term)

texts:
Given sha1(pad(A) || pad(B)), where B is known, can I calculate sha1(pad(A))? pad(A) means its length is exactly 1 block (64 bytes for SHA-1)

If yes, for which other hash functions it will work too?

Would it work vice versa when A is known?

Why do I think it's possible?

If you take a look on SHA-1 source, 16 ints block is expanded to 80 ints and then during 80 rounds one int is added using invertible operations. When you have the block in plaintext, you can calculate the expanded block and revert the hash round by round until you'll get the IV of the block, i.e. the hash of the last block. Do you understand what I mean?


texts:
Can we use a polynomial $P(x)$ to securely communicate ?

For example Alice & Bob agree on a degree of a polynomial. The value $x$ & the coeficients are generated from a seed using a hash function or any other PRG and change in each communication, the plaintext $m$ is hidden into $P(x)$. For example  $P(x) = ax^2+b(m)x+c$

alice sends the result of $P(x)$ to Bob, once received bob retreive $m$ from $P(x)$

can we provide a certain security level with the above method ?


texts: I am doing an error propagation experiment with the CBC mode.I have encrypted a 100 byte text file with openssl. I made the 55th bytes of my encrypted file corrupted.As per theory the corresponding block of 49-64 bytes and the subsequent block of 65-80 bytes should be affected on decryption.But I am only getting the 49-63 bytes impacted in the result.Any help to let me understand this contradiction will be appreciated.


texts: How does AES-GCM produce different ciphertexts, and how can the algorithm decrypt the values if they're random?

texts: The title explains it. How does AES-GCM (or other modes for that matter) generate random ciphertexts per execution, and how does the algorithm decrypt a random value since the sender randomizes the ciphertext?


texts: What type of cipher or encryption method is this called?

texts:
Let's say I have a key value of 5.

The message I want to encrypt is "AAAA"

A = 1,
B = 2,
C = 3,
and so on...

the final message is "FLRX"

Each letter will be the value of itself + the value of the previous + the key

1. A = A + previous + key = 1 + 0 + 5 = 6
*6 corresponds to the letter F
2. A = A + previous + key = 1 + 6 + 5 = 12
*12 corresponds to L
3. A = 1 + 12 + 5 = 18
*18 corresponds to R
4. A = 1 + 18 + 5 = 24
*24 corresponds to X

What is this method called? I've been looking at most known ciphers and it doesn't seem to match any. The reason it caught my attention is because the same letter doesn't correspond to the same output much like the majority of the well known ciphers. It is based on the previous letter assignment.


texts: How to handle a lost key in Diffie-Hellman Key Exchange

texts:
I implemented the Diffie-Hellman Key Exchange algorithm but, I was wondering how to handle if one of the parties lost his key.

Let's take a chat app as an example, Bob and Alice they used to have a shared key, but sadly Alice changed his device, and what if Bob sent a message to her encrypted with the shared key while she was offline. How can this be handled?

Not Sure about this solution:
Can I once Alice logs in with the new mobile device it requests from her room users to re-authenticate? and how about that message that Bob sent pre-re-authentication?

Thanks in advance. :)

EDIT ONE

As @kelalaka said, I can send an excuse to bob by re-auth and resending the message from his device.


texts: Is a timing side channel attack effective when the leaked information is related to the result of a hash?

texts:
I'm writing a function to act as a cryptographic hash of a number within a range that returns another number of the same range. The catch is that the result needs to have certain properties. I run a simple test for these properties and call the function recursively if the test fails. Naturally this raises a red flag for a timing attack, however, the test is performed on the result of a hash only. Everything preceding the hash takes exactly the same amount of time regardless of input.

My question is, is this a harmful leak of information?
Here's the function in question.

def numhash(num, maxnum):
    num = sha256(str(num)).hexdigest() # calculate sha256 of string version of number
    num = int(num, 16) % maxnum # convert this to an integer and mod it by the top bound of the range (exclusive)
    if bin(num).count('1') % 2: return numhash(num + 1) # check for an even number of 1 bits in the number, reject and try again if true. This is where the timing issue is caused
    return num

Note: I'm aware of the slight bias towards lower results and high collision rate. This is acceptable.


texts:
I am using the javax.crypto.Cipher in Java to do AES/CBC/PKCS5Padding encryption. What I am observing is that, if you try to encrypt a Plaintext with no padding, PKCS5 adds another entire block just to padding. For example, if I got a 32bytes Plaintext, assuming that AES is using 16byte block size, the padding size should be 0. But, instead of that, PKCS5 adds another block for padding.

Is this correct or is just a matter of javax.crypto.Cipher implementation?


texts: With public-key crytography, is private-key crytography still useful?

texts: It seems that, with public-key cryptography, there is no need to use private-key cryptography. But obviously, both public-key cryptography and private-key are taught in cryptography classes. Can anybody let me know when private-key crytography is useful in practice? If so, can it be replaced with public-key cryptography?


texts: Why can't we give block ciphers larger keys?

texts:
I have limited math's knowledge so sorry if this question sounds stupid.

I saw many people complaining about AES, Twofish and Serpent that these ciphers all could be crackable in the near future and even today with big datacenters.
But all these ciphers use max. 256 bit keys . And because there is no better way of finding the key then brute force the ciphers are equally strong.

Would it be possible to take these algorithms e.g AES and just change the key size from 256 to 512 or 1024? I mean the algorithm is well tested, you would just have to modify the key and block size.


texts: Algebraic relationship between Original Key and Sub Key of DES

texts: Does there exist any sorts of algebraic relationship between Original and Sub Key of DES? I understand that by solving K-Maps of 64-bit Input/48-bit Output, I can get 16 algebraic relationships relating each sub key with the original key. Has someone done it already? Can this be of any use in exploiting the vulnerabilities of DES?


texts: Exchanging pre-image of hash over a network securely

texts:
Suppose A and B both have a secret value $S_a$ and $S_b$. A sends the hash of his secret $H(S_a)$ to B and B sends $H(S_b)$ to A.

At a later point in time, if both of them want to exchange their original secrets with each other. How do we ensure that the exchange happens atomically?


texts: Repeatable encryption for pseudonymisation

texts:
Is there a good way to do repeatable (with the same result) encryption for pseudonymisation where the pseudonym can be decrypted?

I want to set up a system to allow multiple services to communicate about subjects without them being able to join their data together themselves. They would send their requests through a "middleman" service which would translate the IDs to enable communication between the services.

So for instance, a score service and a user info service where the score service could ask for the user's first name without having to know the actual id for this user.

Because I don't want to store a large lookup-table for each service in the middleman I would like to generate the pseudonyms on the fly. So far I've looked at some RSA (OAEP) and AES (CTR, GCM) algorithms. The problem with these (I believe) is that they add some random padding or require a unique initialisation vector (which is there to prevent information about the key to be leaked) which makes the encryption non-repeatable. (Data stays the same but the result changes for every time we encrypt)

The data would be something like secret:service_uuid:object_type:object_id to make these unique for each object-service pair.

A (maybe ignorant) solution I came up with was to use something like AES and create iv from the data (d) by doing something like this:

$iv = hash(d) \bmod m$

Where m is the max value for iv

But I'm not sure if this compromises the strength of the encryption algorithm.

Long story short, I have not been able to find any "standard" to solve this, and I have the feeling I might be introducing some vulnerabilities by forcing some algorithm to do something it wasn't designed to do. Does anyone know if there is a better way to do this?


texts: What are the advantages and drawbacks of using long term private keys compared to session keys?


texts: AES CBC mode is good for encrypting 15-20mb files and then sending it in parts?

texts:
I want use CBC mode for sending and receiving files (avi, mp3, docx, jpeg) max up to 20mb. But also I want cut this file after encryption on sending site for example on 2mb size and send each file separately to receiver and on his site i will again join all 10 files together to one and then decrypt it.

Is CBC good mode for this? I have read some topics here (cryptography) that CBC is not good for sending only "part" of the file. But I don't know if this is also my case because: yes I am sending only parts of whole files but on the receiver site my code will wait until all parts are downloaded and then I will join all files together. After that I will encrypt whole 20mb file.

Is it OK to use CBC for this case? I am not trying to encrypt/decrypt only some parts of the file but always whole file after I join all sending parts correctly.


texts: I don't get why the size of C (the capacity) of a sponge construction influences the security of the sponge construction. And what is the influence of the size of R?


texts: Regarding the need to hash the shared secret in X25519 with the public keys

texts:
I was looking at the LibSodium documentation where it says

  [...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the output of the multiplication $q$ directly as a shared key is not recommended.

  A better way to compute a shared key is $h(q \mathbin\| pk1 \mathbin\| pk2)$, with $pk1$ and $pk2$ being the public keys.

My questions are as follows:

What is the chance for two $(p, n)$ pairs to produce the same result? (is it for example worse than the chance of two 252-bit random numbers being equal?)
What are the subtle attacks mentioned and how does $h(q \mathbin\| pk1 \mathbin\| pk2)$ defend against them?

I noticed that NaCl in crypto_box/curve25519xsalsa20poly1305/ref/before.c simply hashes the secret without the public keys. So I presume that not following said advice can't be that bad.


texts: Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode?

texts:
Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size.
Encryption using CTR mode:
\begin{align}
C_0 &= P_0 \oplus E_k(nonce\mathbin\|0) \\
C_1 &= P_1 \oplus E_k(nonce\mathbin\|1) \\
\vdots &  \quad\quad\vdots\\
C_{n-1} &= P_{n-1} \oplus E_k(nonce\mathbin\|(n-1))
\end{align}
Why is the following MAC tag not secure: $T = (P_0 \oplus P_1 \oplus \cdots P_{n-1}) \oplus E_k(nonce\mathbin\||n)$ ?


texts: What is the default behaviour, if no ciphers are enabled

texts:
Lets assume for example, that a server is configured to use TLS 1.0 and there are no ciphers enabled for it.
What will be the default behaviour if a client connects to it?
Will the server use any null ciphers by default to complete the TLS handshake?


texts: For elliptic-curve cryptography, does a 256-bit key imply that $x$ and $y$ are each 256-bits or 128-bits?

texts: In the wikipedia article, the claim is made that "256-bit elliptic curve public key should provide comparable security to a 3072-bit RSA public key". Since, in ECC, the public-key consists of a point $(x, y)$, when they say a "256-bit public key", does that imply both $x$ and $y$ are each 256-bits? Or that, together, they are 256 bits (meaning that each would be 128 bits)?


texts: Authentication protocol for communication with Arduino Uno

texts:
I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the confidentiality part of the secure communication I want to establish.

Now, before establishing shared secret between the Arduino Uno and the Android device, I want to have two-way authentication. It would be nice to have some sort of session IDs in order to be able to communicate with multiple Arduino Uno devices from a single Android device.

What do you suggest? Please consider the memory size of Arduino Uno (2kB RAM, 32kB flash).


texts: Elliptic Curve Factorization: Why are elliptic curves suited for this kind of task?

texts:
Currently I'm working on a presentation of a paper that talks about the factorization of large numbers. In the paper elliptic curves are presented as a way to factorize large numbers. After hearing a lot about elliptic curves it's the first time that I delve into the details of elliptic curves and I'm a bit bit baffled to say the least.

My question is: why are elliptic curves suited for the factorization of numbers?

In the paper it's stated that for an integer number $n$ there exist various suited elliptic curves that can be used for its factorization, meaning that checking multiple elliptic curves for a number can be parallelized. But still, what is the real reason (from a mathematical point of view) why elliptic curves are used for this kind of task?


texts: Bundling hash into the initialization vector?

texts:
Given the need to transmit relatively short messages (a few dozens of bytes max), how unsecure would the following bundling of a hash in the initialization vector be?

(A) = 64 bits of cryptographic random
(B) = cryptographic hash of A concatenated with original Message

Then concatenate (A) with 64 bits of (B), and use that as IV for an AES CTR mode encryption.

This weakens the IV randomness to allow bundling the hash in it, and attempts to hide information the unencrypted hash in the IV could leak.

The key used for AES is itself changed every time, it is a HMAC of (secret + message counter).


texts: Using SHA512 (or other hash) for message authentication

texts:
I need to encrypt and authenticate a stream of data so that it is resilient against unexpected power loss, so I cannot write authentication data at the end of the stream.

I am currently using AES-GCM, just for encryption, as my understanding is that the authentication tag for GCM must be written at the end of the stream.

What I have in mind to do instead is to buffer the stream into fixed-size blocks, the SHA512 sum of each block, and then encrypt the block and n bits of the SHA512 sum and write them out. (My understanding is that truncating the SAH512 sum to save space is okay.)

My thinking is that, if an attacker wishes to tamper with the data in any given block, there will be a 2^-n chance that the hash calculated on decryption will match the one on-disk, (2^-n chance of the tampering going undetected). I also imagine that tampering with the hash won't improve the chances.

Is my thinking correct?
Is this scheme secure?
Is there a better/more established/more convenient way to do this?


texts: How would I get started in auditing and finding vulnerabilities in encryption algorithms?

texts:
I know, it sounds dumb. Very dumb in fact. But regardless, I want to actually begin doing security research on cryptographic algorithms (SHA, RSA, ECDSA, etc.). I would prefer that this question be focused on auditing and finding vulnerabilities in the actual algorithms themselves. What resources should I begin looking at to get started in auditing the actual algorithms? I'm really willing to put in the massive work required but it's a bit difficult if I don't know where to start. I know it's dumb, but I still want to try my hand at it and eventually succeed. (auditing and breaking the actual algorithms)
Stuff on cryptanalysis is also welcome, but again, I'd like to keep this one focused on the actual algorithms themselves.
EDIT: For clarity, what I'm asking is this: What resources are available for a beginner like me to begin learning cryptanalysis and begin performing cryptanalysis on modern encryption algorithms? (And also asking where to start)


texts: How to perform the lfsr scrambling used in PCIe for 2 byte input?

texts: In PCIe Gen 3 on-wards there is 128b/130b encoding used which scrambles incoming bit using a LFSR with polynomial: $$G(X) = X^{23} + X^ {21} + X^{16} + X^{8} + X^5 + X^2 + 1.$$ Is there any way to perform required scrambling on 2 bit in one clock using parallel scramblers, where output of incoming msb will be dependent on lsb's output.


texts: How to prove that permutation and substitution ciphers satisfy H(X) = H(Y) in Shanon Entropy?

texts:
I was not able to mathematically prove that all permutation and substitution ciphers satisfy H(X)=H(Y) if we say that Y is the set of ciphertexts while X is the corresponding set of plaintexts in Shanon Entropy?
More generally, how is it possible to mathematically prove that Shannon entropy does not change when applying any bijective function to X?


texts: Inverting the encryption equation of a symmetric cipher

texts:
I've just started a cryptography course. I am beginning to understand the concepts (I'm only in week 2) but I just can't get my head around the theories and principles when written as equations.

I've been posed the below question to answer:

  Consider a very simple symmetric block encryption algorithm in which 64-bit blocks of plaintext are encrypted using a 128-bit key. Encryption is defined as:

  $$C = (P ⊕ K_0) ⊞ K_1$$

  Show the decryption equation, that is, show the equation for $P$ as a function of $C$, $K_0$ and $K_1$

  $C$ = ciphertext
  $P$ = plaintext
  $K$ = secret key
  $K₀$ = leftmost 64 bits of secret key
  $K₁$ = rightmore 64 bits of secret key
  $⊕$ = bitwise exclusive or (XOR)
  $⊞$ = addition mod $2^{64}$

I simply don't understand what the function of $⊞$ serves.

Can anybody assist me with tackling this problem? I just don't know where to start other than to $P = (C.....)$ possibly? I'm unsure as to what the 'addition mod 2⁶⁴' refers too.

EDITED FOR CLARIFICATION

So if for example, our plaintext is:-

messagea (ASCII)

01101101 01100101 01110011 01110011 01100001 01100111 01100101 01100001   (binary - 64 bit)

and our 128-bit secret key is:-

mysecretpassword (ASCII)

01101101 01111001 01110011 01100101 01100011 01110010 01100101 01110100 01110000 01100001 01110011 01110011 01110111 01101111 01110010 01100100 (binary - 128 bit)

To achieve the first past of the algorithm, "C=(P⊕K₀)", I XOR the plaintext against the first 8 characters (64 bits) of the secret key to get the following:-

01101101 01100101 01110011 01110011 01100001 01100111 01100101 01100001

01101101 01111001 01110011 01100101 01100011 01110010 01100101 01110100 ⊕

00000000 00011100 00000000 00010110 00000010 00010101 00000000 00010101

Now, how do I then apply '⊞K₁' to the above? I am aware that I need to do something with the above to the last 64-bits of the key but I'm unsure what calculation. If someone could walk me through it, that'd be great. Thanks


texts: PQ Key Exchange based on Elliptic Curve Isogenies

texts: I was reading the Wikipedia article on Post Quantum Cryptography and was interested in opinions as to whether the Supersingular Elliptic Curve Isogeny Diffie-Hellman listed there would be a good Post Quantum replacement for Elliptic Curve Diffie-Hellman that is being implemented today?


texts: How do herding attacks on hash functions work?

texts:
I read this paper Herding Hash Functions and the Nostradamus Attack, 2005 of Kelsey and Kohno on herding attacks but I do not understand how it works.
Would anyone be able to give me a summary of how herding attack as well as the diamond tree structure works?
It is mentioned "In the diagram, the attacker starts with eight different first message
blocks, each leading to a different hash value; he then searches for collisions between pairs of these
hash values, yielding four resulting intermediate hash values". What does it mean by searching for collisions between pairs of these hash values? Hashing 8 different message blocks will produce 8 different hash values so how would there be a collision?


texts: Largest integer factored by Shor's algorithm?

texts: I'm studying Shor's quantum factoring algorithm. I was wondering what the largest integer is which they were able to factor with a small quantum computer. Does anybody have an idea about this?


texts: Let's assume we have an RSA 2048 that was produced by two primes multiplication. What is the digit's difference in those 2 factors? For example one prime is 1024 digits and second one 1024 or, one is 900 and second one 1148? Are there any limits for primes that could be used in RSA or it could be "1" and a 2048 bit prime?


texts: What is the difference between CPA and IND-CPA?

texts:
I am writing a paper and I got comments from the reviewer that I don’t really understand.

Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under Chosen Plaintext Attack) when evaluating the security of an encryption scheme?


texts: HW acceleration for Camellia cipher (x86_64/AES-NI/AVX2)

texts:
Modern processors support hardware acceleration for various crypto functions such as AES directly, or general vector operations which can be used in crypto functions, such as SSE SSE2 SSSE3 AVX.

On my machine, I can see the difference in speed between AES in software and in hardware, which gives speeds up to 5 times faster:

openssl speed -evp aes-256-cbc
openssl speed      aes-256-cbc

(Note: I am using OpenSSL here only as an example, because it is easy to demonstrate.)

Also, the Linux kernel can be compiled with support for these functions as well. If so, all encryption in kernel space (for example IPsec, dm-crypt) can take advantage of these fast hardware instructions.

Again, the kernel compiled with AES-NI support is many times faster when uisng aes in software only.

I have noticed that there is also hardware support for the Camellia cipher and it looks as if Camellia could use the same instructions as AES, namely AES-NI and AVX.

However, I am unable to test/confirm this.

openssl speed      camellia-256-cbc
openssl speed -evp camellia-256-cbc

I see no difference in speed when tested with OpenSSL and I suspect the hardware acceleration is not being used for Camellia.

My cpu supports all above mentioned instructions: AES SSE SSE2 SSSE3 AVX.

Is it possible to speed up Camellia by using hardware instructions on supported cpu, same as with AES?


texts: Reducing key shares in Damgård-Dupont threshold RSA

texts:
I'm working on understanding and implementing

  Damgård, I., & Dupont, K. (2005). Efficient Threshold RSA Signatures with General Moduli and No Extra Assumptions. Public Key Cryptography-PKC 2005, 346–361. doi:10.1007/978-3-540-30580-4_24. Retrieved from http://www.iacr.org/cryptodb/data/paper.php?pubkey=3431

On page 7 (356), step 2 of the key share generation process is

  $D$ chooses a random polynomial $f(x)$ of degree at most $t$ with integer coefficients, such that $f(0) = d$; $$ f(x) = d + c_1x + \ldots + c_tx^t$$ where the $c_i$'s are random independent integers chosen from the interval $[0\ldots\Delta{}n2^t2^L]$, where $L$ is a secondary security parameter. The secret share of the $i$'th server is $s_i = f(i)$. With the given choice of coefficients, it can be shown that, if we compare the distribution of any $t$ shares resulting from sharing $d$ with the one sharing resulting from sharing any other $d^\prime$, the statistical distance between the two is at most $2^{-L}$.

($n$ is the standard RSA modulus; $d$ the standard RSA secret exponent; $l$ is the number of secret shares/servers; $\Delta = l!$; $t$ is the maximum number of corrupted servers/shares we want to accept)

The given formula for secret shares makes them numerically rather larger than the original secret (by a factor of something like $l^t \cdot l! \cdot 2^{tL}$). I think I can reduce them $\text{mod } \phi(n)$, since the further calculation of partial signatures/decryptions uses the shares in a standard RSA operation (with some extra multipliers): $x^{2\Delta{}s_i} \text{ mod } n$.

Question 1a: Will this modulo operation break the functionality of the scheme? I did some experiments, and think it will work, but have no firm basis. From all the papers I've read I seem to understand that doing operations $\text{mod } \phi(n)$ in the exponents is always right, but I don't understand why and thus can't apply this understanding here.

Question 1b: Will this modulo operation break the security of the scheme? I have an intuition that one of the options might be bad, but can't tell which. Points I've considered:

Without modulo, it's standard Shamir secret sharing, so an attacker with up to $t$ shares shouldn't learn anything.
$\phi(n)$ is a secret, so applying it might give the attacker something he wouldn't otherwise have.

Question 2: The last sentence of the section I quoted leaves me at a loss. The authors cite "M. Koprowski: Threshold Integer Secret Sharing, manuscript, 2003", but I couldn't find a copy of that online. What is the "distribution of shares" and "statistical distance" and why is it important here? Shouldn't Shamir sharing unconditionally hide all information about $d$ ($=c_0$) if all $c_i$ are from the same number space? I assume that the last part of the quoted sentence means that I should set $L$ to something like 128 for 128 bit security?


texts: What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

texts:
A group of bankers will store sensitive financial information on a server owned by a third party.  I represent the 3rd party server.

The financial information  will be stored as plain text on the server except that the customer's Account Numbers will be encrypted.  The banks do not want us to know their customers' account numbers.

My question is, how safe is it to use the Account Number as a nonce if it is also the message being encrypted when using AES-GCM?  So, how safe is it to encrypt as follows: AES-GCM[Key, Nonce = AccountNumber, Message = Account Number].

I know this is an example of deterministic encryption and it would be best to use GCM-SIV mode but I cannot find any libraries that implement this encryption that I can use with the .NET Framework.

On a side note, has anyone ever used Miscreant .NET?  As far as I know it has not received FIPS compliance.

Here is an example of the design:

Banker's Data:
Note, that the AccountNumber is a primary key and will not be repeated.  Therefore, nonce = message = AccountNumber will never be repeated.

PK*AccountNumber   Balance     Nonce
1                  $10,000     1
2                  $15,000     2
3                  $20,000     3

3rd Party Server
AccountNumber   Balance
A2B3C4          $10,000
T4K8S9          $15,000
L6D9S8          $20,000

If the Banker wants to query the 3rd party server for the balance of AccountNumber = 1, he will query the server for AES-GCM(Key,Nonce=1,Message=1)='A2B3C4'.  Since only the banker knows the Key and AccountNumber only he can know which record to query for.  This is in essence a zero-knowledge encryption scheme where only the Banker has any knowledge of the key, nonce or message.


texts: What is the meaning of the notation $\langle a, b\rangle$ in certain cryptography papers?

texts:
I'm trying to understand a paper from Brakerski and Vaikuntanathan. In it, they use the notation $\langle a,b \rangle$ but they don't explain what that means.

The answers on this question say that it's just another way to write a tuple, but I don't think that's right in this case since the authors use the regular $(a,b)$ notation in the rest of the paper to denote a tuple.

Does anyone know what else $\langle a,b \rangle$ could mean?


texts:
I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content.

I'm considering switching to ECDSA, would this require less space with the same level of encryption? And is the verification performance in the same range as RSA?


texts: Is this problem based on a known hard problem?

texts:
Suppose I generated an $n$-dimensional vector $a_{(1)} = [a_1, \dotsc, a_n]$ with integer component (actually I can generate as many $a_{(i)}$ as possible). Now I need to get an vector $b = [b_1, \dotsc, b_n]$ such that $\langle a_{(i)}, b \rangle = c_{(i)}$, for all $i$. I don't know the value of $c_{(i)}$ but I can verify whether $c_{(i)}$ is correct (by an decryption algorithm which have $c_{(i)}$ as the key, like AES).
I want to know, is this problem hard? If true, what hard problem is it based on? I've read materials about the knapsack problem, subset sum problem even integer programming. But I don't think that they match.
Edited on Dec 3, 2014: Allow me to modify the question described above because it may not be meaningful. Now I have a group of equations $Ba = c$, where $B$ is an unknown matrix, $a$ and $c$ are known vectors. They are all $n$-dimensional (the previous question is one equation of this group, and I remove the restriction to $c$ because if I want to realize better security, I need to assume that $c$ is known). So in group $1$, we have
$$
Ba^{(1)} = \left[
\begin{array}{cccc}
b_{11} & b_{21} & \cdots & b_{1n}\\
b_{21} & b_{22} & \cdots & b_{2n}\\
\vdots & \vdots & \ddots & \vdots\\
b_{n1} & b_{n2} & \cdots & b_{nn}
\end{array}
\right] \cdot \left[
\begin{array}{c}
a_1\\
a_2\\
\vdots\\
a_n
\end{array}
\right] = \left[
\begin{array}{c}
c_1\\
c_2\\
\vdots\\
c_n
\end{array}
\right] = c^{(1)}
$$
Now my question is:

As far as I know, if we have $n$ groups of $a^{(i)}$ and $c^{(i)}$ such that $Ba^{(i)} = c^{(i)}$, we can calculate $B$ easily. But what if we can get at most $n-1$ groups? I think there are infinite solutions, but can we recover part of $B$? Or all of the $\{b_{ij}\}$ are indeterminate? (Suppose $\{a^{(i)}\}$ are independent vector set.)
What if $B$ is an orthogonal matrix? How many groups are enough to recover $B$? And is it hard to calculate $B$ if $n$ is big?


texts: Lagrange Interpolation for finite field GF(2^8), for Secret Reconstruction

texts:
I'm using Lagrange's Interpolation technique to reconstruct the secret from a set of point pairs (x,y).
Since I only need the secret, not the whole polynomial, I have simplified the reconstruction process as follows:

  Let Secret $D = 10$, and we use a 3 out of 3 secret sharing scheme which generates 3 key pairs
      and all of them are needed to reconstruct the secret. We pick two random numbers as the coefficients.
      This gives us the polynomial $5x^2 + 2x + 10$.
      3 Points are generated from the polynomial: $(1, 17)$, $(2, 34)$, $(3, 61)$
      To get secret $D$, we only need to take care of the constant part of Lagrange's Polynomial.
  $$
\it{l}_{0} = \dfrac{(x-2)(x-3)}{(1-2)(1-3)} = \dfrac{(x-2)(x-3)}{2}
$$
  $$
\it{l}_{1} = \dfrac{(x-1)(x-3)}{(2-1)(2-3)} = \dfrac{(x-1)(x-3)}{-1}
$$
  $$
\it{l}_{2} = \dfrac{(x-1)(x-2)}{(3-1)(3-2)} = \dfrac{(x-1)(x-2)}{2}
$$

  By only considering the constant part of Lagrange's Polynomial (ignore $x$es),
      we can calculate secret $D$:

  $$
D = 17 \dfrac{(-2)(-3)}{2} + 34 \dfrac{(-1)(-3)}{-1} + 61 \dfrac{(-1)(-2)}{2}
= 10
$$

  which is our secret.

Now the same method should work for finite field GF(2^8) as long as the arithmetic are replaced with finite field arithmetic. However this is not the case:

unsigned int decodeByte(vector<pair<unsigned int, unsigned int>> keys) {
    int numKeys = keys.size();
    //extract the x's and y's from the vector
    vector<int> x;
    vector<int> y;
    for (int i = 0; i < numKeys; i++) {
        x.push_back(keys[i].first); //extract x
        y.push_back(keys[i].second); //extract y
    }

    GF256elm result(0);
    for (int i = 0; i < numKeys; ++i) {
        //calculate the constant term of lagrange interpolation polynomial
        GF256elm l(1);
        for (int j = 0; j < numKeys; ++j) {
            if (i == j)
                continue;
            GF256elm nxj = GF256elm(x[j]);
            GF256elm xi = GF256elm(x[i]); //xj
            GF256elm xj = GF256elm(x[j]); //xj
            GF256elm ximxj = xi - xj;  //xi - xj
            GF256elm prod = nxj / ximxj; // (-xj)/(xi-xj)
            l *= prod;
        }
        GF256elm product = GF256elm(y[i]) * l;
        result += product;
    }
    return result.getVal();
}

Basically what I'm doing here is I'm calculating $\dfrac{-2}{1-2}$, then multiply it with $\dfrac{-3}{1-3}$, then multiplying everything by 17, (which is the y value from the first point $(1, 17)$). This is the first term in D's equation above. I then go on and calculate the other two terms.

Problem is, instead of 10, I get 14 as my answer.

My Questions

In finite field arithmetic, negating x ($-x$) is really $0 - x$, which is actually $0 \oplus x$ (XOR), and it ends up being $x$ itself, am I right?
Is there anything wrong with my approach to finding the Secret $D$?

Additional info:

My division and multiplication is implemented using table look up. This part of the code has been tested and its results are the same as other sources.

GF256elm& GF256elm::operator*=(const GF256elm& other) {
    int temp = (_logTable[val] + _logTable[other.val]) % 255;
    val = _expTable[temp];
    return *this;
}

GF256elm& GF256elm::operator/=(const GF256elm& other) {
    int t = _logTable[val] - _logTable[other.val];
    int temp =  ((t % 255) + 255) % 255;
    val = _expTable[temp];
    return *this;
}


texts: What is the difference between 'completeness' and 'soundness' in ZKP?

texts:
I'm reading Matthew Green's great blog, especially the Zero Knowledge Proofs: An illustrated primer post and I'm wondering what is the difference between completeness and soundness?

In the post, there is this part:

Completeness If Google is telling the truth, then they will eventually convince me (at least with high probability).
Soundness Google can only convince me if they're actually telling the truth.

Can I have some explanation? I don't understand the difference.


texts: How is information disclosed by modular multiplication?

texts:
Consider the case that

$c = a \cdot b \mod p$

where $p$ is a known prime and $0 < a < p$ and $0 < b < p$ are unknown integers numbers. Furthermore, some bits on the value of $c$ are known.

Q1: Can an attacker learn some bits of $a$ using this information?

The question is based on the following non-modular example:

$a = x_1 \cdot 2^z + x_0$

and

$b = x_2 \cdot 2^z + x_3$

gives the product:

$a \cdot b = x_1x_22^{2z} + (x_0x_2+x_1x_3)2^z + x_0x_3$

Then if anyone knows the $z$ least significant bits of $a \cdot b$ (the product $x_0x_3$), then some of the divisors of $x_0x_3$ is equal to $x_0$, allowing to bound the possible values of $x_0$ to the possible divisors of $x_0x_3$.

Q2: Can this non-modular analysis be applied to the modular one ?


texts: Possible issues with ECIES using a static (non-ephemeral) sender key

texts:
After looking at this bitcoin-related ECIES repo I believe the intention is that, at least in some cases, the recipient would know that the message is intended for them and use an secp256k1 public key that they know belongs to you to perform the key derivation process on their end.  Even if that is not their intent, I am curious about the security implications of such a schema.

That is, a recipient of ECIES ciphertext data (containing an IV, AES ciphertext, and a HMAC), performs key derivation with a known, static sending public key and their private key.  As is done in this library, they compute the diffie-hellman shared secret and use SHA-512 as a key derivation function.  The first half of this has is used as an AEC-CBC decryption key, but before that the second half is used to authenticate the ciphertext with HMAC-SHA256.

Assuming all goes well they are confident of both the origin of the message (by virtue of the key derivation being successful and the HMAC authenticating the ciphertext) and of the data itself.

The primary issue I see with this schema is that that encryption/HMAC keys will be the same for any messages sent between the two parties.  However, assuming the IV is chosen intelligently I believe this should be safe, though it removes any forward secrecy provided by using an ephemeral sending key.

Are there any other downfalls of this approach?  Is this regarded as just a form of ECIES or is it possibly something different since the sending key is not ephemeral?  (At the very least, Wikipedia seems to imply the key should be ephemeral.)

Finally, it seems to me that a saner way to achieve the goals of this library would be to generate an ephemeral key for the key derivation process, send that ephemeral public key with the cipher text, and include a signature with the known key either as a part of the message plaintext (to avoid the possibility of the public key being derived from the signature) or simply included with the ciphertext data.  What trade-offs exists with this alternate approach?


texts:
My understanding is, ignoring implementation details, iOS disk encryption works like this: On boot (and/or every time you unlock your phone) an ephemeral session key is created that can decrypt encrypted files.

My question is, how is it possible to create ephemeral keys, without re-encrypting the files on disk?

The only solution that comes to my mind is use the ephemeral key to decrypt the "real" key that then is used to decrypt the files. And when your session expires and you need to invalidate the ephemeral key basically you delete the encrypted copy of the real key that was encrypted by the ephemeral session key.

Are there any other solutions to this? basically to create ephemeral keys without re-encrypting the data?


texts: Key exchange protocols non-reducible to groups

texts:
Some questions I have ended up wondering about while reading through many of key-exchange protocols are:

Is there an intrinsic reason, why most key exchange protocols use group-based approaches apart from it being a well-studied area?
Given a key exchange protocol does there always need to be some group or a particular algebraic structure involved?
What about key-exchange with a requirement for perfect forward secrecy?
What would be the least constrained algebraic structure involved for a secure key exchange?
If not can you give some examples of perfect forward secure key exchange protocols not involving group operations?


texts: Deciphering “easy” ciphers without hints

texts:
I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic encryption/decryption knowledge.

So I've got a ciphertext without knowing about the algorithm or key used encrypting the plaintext. I assume that this cipher is not "too hard" (no AES e.g.) to crack, because it would be an overkill for a simple challenge.

I want to mention that I would like to crack it on my own, but I need advice in which direction I should go - what's most likely to be used, how I can verify if some encryption algorithm is used or not, etc.

About the cipher: The Cipher contains [cghijklmnopqrsuvwxyzABCDEFGIJKLMNOPQRSTUVWYZ0-6+] without whitespaces, while some patterns are recurring (same characters are repeating in the same order a few times in the cipher).
 I'm also quite sure the ciphertext isn't hashed as I'm supposed to read what the result is. Cracking a 1000+ characters cipher won't be the "challenge".

What I've already done:

I tried a frequency analysis to see if it's just substituted
monoalphabetically sign for sign - without success (many results
staying at ~8%, no one above 10%)
I had a look at classic transpositioning and substitution methods which lead me to encryptions like Vigenére, Autokey, Beaufort and so
on. However, those are designed to work with non-numeric alphabets as
far as my understanding goes.
I calculated the "Index of Coincidence" being about 0.06, which should tell me that problably a substitution is used (I haven't yet
figured out completely how this works in detail)
I already tried to separate the cipher at points where suspicious, recurring "words" are, just to find something that seems
like separator-signs. However it's not much clearer afterwards and
I'm not sure how to go on.
I did already base64 decode as suggested, but the result was even less helpful. Looks more unrelated than before, just many special characters mixed up with periods and numbers here and there.

What I need would be a good advice on how to find out which cipher may be used as I'm currently running out of ideas what to try.

I hope somebody can help me out here as I'm really interested in the topic, but somehow stuck.

Thanks in advance!


texts:
I am currently doing my masters research on security of wireless sensor networks, the topic is "ENHANCING THE SECURITY OF WIRLESS SENSOR NETWORKS BY COMBINING GEOENCRYPTION AND LIGHT WEIGHT CRYPTOGRAPHIC HASH FUNCTION (LOCHA)"
The encryption process will use MiniAES which IS same as normal AES with all component reduced while maintaining the same structure and security of normal AES. So, i am finding a justification on MiniAES computational time and space complexity when use to show the gab the research will bridge in terms of space and time complexity compared with other existing encryption algorithms to work with limitations of sensors. Though MiniAES is not that popular i do not know if some have an idea or come across such thing.
Thanking you in anticipation for your answers.


texts: KCV and compatibility with block cipher modes of operation

texts:
There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV.

This "KCV" (also known as CKA_CHECK_VALUE object attribute) value is derived as follows:

For most objects: first three bytes of SHA-1 hash of the object.
For cryptographic keys for block ciphers, it is the first three octets of ciphertext produced by ECB mode encryption of a block full of zeros.

Sending KCV (key check value) with cipher text is done rarely, because the check does not ensure correctness of the key very well. The excellent answer from poncho to this question Sending KCV (key check value) with cipher text illustrates a few reasons.

My concern is that KCV could jeopardize confidentiality or authenticity of proper usage of some modes of operation:

CMAC mode uses $k_{0} = E_{k}(0^{128})$ for deriving sub-keys.
If CTR mode is used starting with counter value 0, that would obviously allow revealing three first bytes.

Is it good idea to avoid using KCV in above situations?

Are there some other modes of operation, where revealing the first octets of encryption of zero block is bad?


texts: How to prove that ECB mode is not CPA secure?

texts: I am new to cryptography and I do not know how to prove the ECB mode is not chosen plaintext attack (CPA) secure.


texts: Current standard for hash function security parameter?

texts: When designing a hash function, what should be the secure input and output lengths? In particular, what lengths do I need for collision resistance?


texts: What makes a hash function good for password hashing?

texts:
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the database is compromised.

Which properties of a cryptographic hash function make it suitable for hashing passwords and the like?

Which functions are secure enough, while still being widely available, without patent issues and not too computationally intensive?


texts: Any downside to encrypting original signed message with the private key?

texts: Is there any downside to encrypting the original message for signing purposes. I understand this does not provide actual protection, and any one with the public key (any one in the world if the public key is made completely public), however, it would seem if the public keys were kept restricted to TLS tunnels and required password access, this would seem to be a small layer of protection. The upside is small, but is there any downside?


texts: Finding tetration in a multiplicative group modulo p

texts:
I have a variant on the discrete logarithm problem, involving finding tetration in a multiplicative cyclic group of integers modulo a large prime $p$:

$$a = x^x \mod p$$

Where $a$ and $p$ are known, and $p$ is not necessarily a safe prime. Can $x$ efficiently be found or is this at least as hard as the DLP?


texts: How does hashing help improve password security?

texts:
Suppose we visit https facebook.com for the very first time. We are creating a new account and creating a password. Then we send then password to the server, the server receives this and only then hashes it.

All consequent log-ins, you won't have to send your password as a plaintext, it will be sent as a hash and the server will compare the stored hash and the hash you've sent. If they match up, it means you know a password.

But interesting thing happens. When we create a password we need to send a password to the server as a plaintext for the very first time in order for the receiver to hash it and store.

What if someone intercepts the data at this time? What am I missing here?


texts:
I wonder if there are secure cryptographic hash function $H$ and encryption function $E$ such that: $H(E(m)) = E(H(m))$ for all $m$.

Do such functions exist?


texts: Best method of converting a private key string into a 12 word mnemonic?

texts: Is there a method of converting a Bitcoin private key into a 12 word mnemonic seed out of a 1000-2000 word dictionary? I couldn't think of a good way of solving this.


texts: Searchable encryption vs Homomorphic encryption

texts:
For a search algorithm, what are the differences between using searchable encryption (SE) and using homomorphic encryption (HE) ? What are the advantages or disadvantages of using one of the above over the other if the requirement is a method for "searching"?

Does this only depend on the particular scheme/algorithm chosen in each of these types of systems ?


texts:
From Dogbert's blog:

  Sony has a line of laptops ("Vaio") which compete mainly in the high value market segments. They implemented a master password bypass which is rather sane in comparison to the rest of the bunch:

  The randomly generated master password is only stored in RAM, e.g. it's lost after the next reboot ("one time password").
  RSA is used for encrypting the password which is then converted to a human-readable form (4x4 characters/8 bytes/64 bits).
  Their customer support apparently allows for one free password generation per device which is pretty decent by the industry standard.

Dogbert claims he was able to factor the password used to encrypt the OTP key because Sony used a key lenght of 64bits. And did this using an unoptimized python implementation of a general number sieve in less than a minute.

I was not aware that such small key length was even possible for RSA (I think pycrypto will not allow anything below 1024).

With a key (D63K-XFVF-TK7H-RJKX) and a password (43878945) is it really that easy to figure out the scheme used? How should I approach the problem?

[UPDATE]

  First of all, RSA works for any size modulus. 10 bits, 32 bits, 64 bits, 1 million bits. I'm having a hard time seeing exactly what the question is. You are given the key (D63K-XFVF-TK7H-RJKX). Is that key the RSA key? That key then encrypts the password (43878945)? Or is that key the result of encrypting the password with RSA? – mikeazo 2 days ago

@mikeazo: it is a challenge-response theft protection. Type the wrong password 3 times and you will be presented the 16 character challenge. You call Sony customer support, fax them a proof of purchase and based on the challenge they will give you a password. You can't brute-force it because it changes every time.

@Schwartz: of course, Dogbert disassembled the Sony Vaio BIOS and got the public key! Calculating the private key was the easy step... I was not thinking like a hardware hacker, thanks!


texts: Can a salt for a password hash be public?

texts:
From my understanding, salts in password hashes are used to prevent the precomputation of plaintext→hash values (rainbow tables).
I know from different threads that it is unnecessary to keep the salt secret (i.e., it doesn't need to be encrypted), but I wondered if it would be a problem by making it public.
The background of this question is the following idea:
For password authentication, a strong hashing function like bcrypt or scrypt is used. Every user has their own random and unique salt. However, to minimize the load on the server, the hash is calculated on the client-side. For this to be possible, a function must exist that allows an unauthenticated user to retrieve any registered user's salt.


texts: Linear Cryptanalysis - possible without plaintext?

texts: If Linear Cryptanalysis exploits the fact that the plaintext and ciphertext are not completely unrelated, is the attack possible without having access to the plaintext?


texts: Neural networks in Differential Power Analysis?

texts:
I am trying to understand how neural networks are used to do DPA, but I am having trouble understand DPA.

My current understanding is that with DPA, we are just guessing one piece of a key at a time, and DPA tells us if our guess is correct or not.

Now I am not sure what role do the neural networks play here. Are they trained to make better guesses, or is DPA computationally efficient enough to go through each guess? Or do neural networks act as image recognition for the trace graphs to find the one corresponding to the correct key?

How correct am I?


texts: I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to be EUF-CMA IF the hash function in question is collision-resistant. Lets take the case of $H(x) = 3x \mod N$. 3 is a prime number and N is always going to be prime as well. The function, in this case, is collision-resistant but despite this, is it still possible to break the EUF-CMA of RSA-FDH?


texts: Which public key cryptosystems are not based on number theory?

texts: Are there any public key cryptographic systems whose hardness assumptions don't involve number theoretic problems?


texts: How many queries can you do (concretely, not asymptotically) for a balanced Feistel network with 7 rounds?

texts:
In this paper Patarin says that:
"for every $\epsilon > 0$, when $m \ll 2^{n(1 - \epsilon)}$ ... for 7 rounds or more it is secure against all adaptive chosen plaintext attacks" where m is the number of queries that the adversary can evaluate.

What concretely is meant by $m \ll 2^{n(1 - \epsilon)}$?

For instance, to have statistical security $2^{-\sigma}$ (e.g. $\sigma = 40$) concretely how many queries can be evaluated?


texts: Advantages using Diffie-Hellman or ElGamal

texts:
For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of ElGamal, and most important why should we use one or the other?

I do not see a clear difference between these two algorithms. What are their respective advantages?


texts: Mitigating timing attacks with a random sleep

texts:
Could you mitigate all timing attacks by putting a sleep(random()) with a naive crypto implementation? Eg if your implementation looks solid, but you're not sure what the next CPU cache vulnerability is around the corner, would this be a legitimate mitigation strategy?

To clarify, this would be a random delay measured from before the algorithm starts, so that you're not simply adding fuzz to the runtime.


texts: Check if two ed25519 points are equivalent

texts:
How to check if two points are equivalent given their projective coordinates (XYTZ)?

For example if I do unproject() of a point to pass from XYTZ to XY coordinates and then I come back to XYTZ coordinates, the new XYTZ coordinates are different respect to the original ones.

How can I be sure that the two points are equivalent in C if they are represented in the following way:

struct ed25519_pt {
    uint8_t  x[32];
    uint8_t  y[32];
    uint8_t  t[32];
    uint8_t  z[32];
};


texts: Quality of randomness on a Linux system with haveged

texts: Has anyone checked if using haveged, a Linux daemon which uses the HAVEGE algorithm, changes the non-deterministic properties of the random data from /dev/random in any negative ways?


texts: Why is encryption slower than decryption in elliptic curve cryptography (ECC)?

texts:
While performing encryption using public key and decryption using the private key, I am always finding that encryption takes more time than decryption in elliptic curve cryptography (ECC). It's the same for signing and verifying. The key is 60 bytes.

Is this the normal behavior or I am using the wrong implementation of ECC?

If this behavior is normal then what is the reason behind it?
Thanks in advance.


texts: How to find Difference distribution table of DES S box?


texts: Why RSA-KEM is more secure than Textbook-RSA?

texts:
I am studying RSA-KEM but I can not see why it should be as secure as padding RSA messages (e.g with RSA-OAEP) when exchanging a key between two parties (say A and B).

It is easy to see that Textbook-RSA is problematic, as sending a key with $k_1^{e_B} \bmod n$ leaves the possibility for an attacker to analyze the message. Let's say that by coincidence A sends to B a second key $k_2^{e_B} = (42 k_1)^{e_B} = 42^{e_B} k_1^{e_B}$ (in the following $\bmod n$ is always omitted). An attacker could easily notice this as it could divide $k_2^{e_B}$ by $42^{e_B}$.

Now let us suppose that A and B are using RSA-KEM to exchange keys. An attacker cannot detect anymore if e.g. $k_2 = 42 k_1$ as a key encapsulation key is used to encrypt the shared key. However, the random integer to generate the key encapsulation key is still encrypted over Textbook-RSA.

Why is this not a problem? An attacker is still able to perform e.g. statistical analysis on the randomly exchanged integer, e.g. if A and B again perform two key exchanges and it happens that $r_2 = 6943 r_1$ an attacker may be able to notice this and eventually even find out the random integers, thus breaking the shared key as it depends on these integers.


texts: How does Clifford Cocks 'Non-Secret Encryption' work?

texts:
I have read Clifford Cocks "A Note on 'Non-secret Encryption'" and thought I would try to implement this, but I don't seem to be able to get it to work. I'm obviously missing something.

From the paper:

  The receiver picks 2 primes $P$, $Q$ satisfying the conditions:

  i. $P$ does not divide $Q-1$.

  ii. $Q$ does not divide $P-1$.

  He then transmits $N = PQ$ to the sender.
  The sender has a message, consisting of numbers $C_1, C_2,\dots, C_r$ with $0 < C_i < N$
  He sends each, encoded as: $D_i$ where $D_i = C_i^N \mod N$.
  To decode, the receiver finds, by Euclid's Algorithm, numbers $P\prime$, $Q\prime$ satisfying:

  i. $P\cdot P\prime = 1 \pmod{Q - 1}$

  ii. $Q\cdot Q\prime = 1 \pmod{P - 1}$

  Then
  $C_i=D_i^{P\prime} \pmod Q$ and $C_i = D_i^{Q\prime}\pmod P$ and so $C_i$ can be calculated.

In my program I don't seem to be able to reverse back to the original message. I don't see how I can recover $C_i$ using this method? Do I need to combine the two calculations of $C_i$ in step 3?

Any ideas where I am going wrong?


texts: Help understanding lattice-based aggregate signature scheme

texts:
I came across this paper about aggregate lattice-based signatures, however, I'm not able to fully understand it. Specifically, I'm wondering if someone could help answer the following questions:

In part III. System model of Aggregate Signature, the authors state there is a KeyExtract algorithm where "Given parameters $n$ and $PP$, the KGC provides public/secret key pairs ($pk$; $sk$) for all single signers." - is this to be understood as all key pairs must be generated by some trusted authority?
What are the sizes of public keys, signatures, and aggregated signatures (in bytes)? On the second to last page there are two tables that address this, but I'm not sure how to translate this info into bytes (at ~128 bit security level).


texts: Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?

texts: I'm wondering why we use encrypt-decrypt-encrypt (EDE) sequence in 3DES (also known as DES-EDE, TDES or TDEA) with three keys instead of three times encryption (EEE) with three different keys?


texts:
The key idea in AES is the use of matrix multiplication and the corresponding inverse (as opposed to Fiestel).  But the algorithm does that using a GF instead of simple modular arithmetic.

Is there any obvious reason to not use simple modular arithmetic?

(Just curious.)


texts:
In a typical digital signature scheme in which in order to sign we compute:

hash of the message: $h(m)$
resulting hash signed with the private key $[h(m)](private key)$

If there were a collision on the hash, what an adversary could do?

Solution (?)

An adversary can find a different message $m_2$ with the same hash of $m_1$.
The user (good guy) signs $m_1$. The adversary can claim that $m_2$ has been signed by the user because $m_1$ and $m_2$ have the same signature.

Is this the correct answer? How can the adversary claim that? I mean… the hash of the message is signed with the user's private key. The adversay does not know that key.


texts: What are the implications of limiting the private key space with elliptic curve Schnorr signatures?

texts:
Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows:

Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the main subgroup's order being $\ell$. Field $F$ can be assumed to be secure. (For the sake of an example, it may be assumed that the parameters are those for Curve25519, but I am looking for a generic, canonical answer.)

I am looking at Schnorr signatures in particular, but the answer to my question will likely extend to EdDSA and its variants as well. Summarizing the signing process for private key $k$ (scalar) and message $M$ (sequence of bytes)

Randomly select a scalar value $r$ (nonce) as ephemeral random scalar in the range $0 < r < \ell$.
Generate the ephemeral curve point $R = [r]G$.
Generate the hash value $c = H(\underline{R} || M)$, where $H$ is a cryptographic hash function, $\underline{R}$ denotes the serialized form of the point $R$ as a sequence of bytes and $||$ denotes concatenation. Interpret the sequence of bytes $c$ as a scalar integer.
Compute the scalar value $S = r + ck \mod \ell$.
The signature is now the tuple $(c, S)$.

Note how $S$ is the result of an addition and a multiplication taken modulo $\ell$. By limiting the private key space (i.e. the artificially reducing the possible range of $k$), it is therefore also possible to limit the size of the resulting $S$.

Assume now that the upper limit for $k$ is reduced from $\ell$ to $2^n$; within this reduced space, $k$ is still picked uniformly at random. The nonce value $r$ is picked in the normal space $0 < r < \ell$ in any case.

Given this background, my questions are:

How does reducing the upper limit for $k$ improve an attacker's chances to learn $k$ other than the obvious reduction in brute force search space for any given $n \le \log_2 \ell$?
How does reducing the upper limit for $k$ from $\ell$ to $2^n$ interact with short Schnorr signatures? I take “short Schnorr signatures” to mean trimming the hash value $c$ is trimmed to $b$, where $b$ is the strength of an elliptic curve in bits (e.g. for Curve25519, that would mean using a 128-bit hash value for $c$; see also Schnorr's original paper on p. 242 in particular as well as the subsequent analysis by Gregory Neven, Nigel P. Smart, Bogdan Warinschi. Hash Function Requirements for Schnorr Signatures, Journal of Mathematical Cryptology 3(1), 2009, pp. 69–87, which ends with an uncomfortably loose security reduction, but should be assumed safe for the purpose of this question).
Assuming a curve over a prime field $F_q$, where $q$ is a 256-bit number, how much could the space for $k$ be reduced and still meet a target security level of 80-bit symmetric equivalent strength?

This is interesting for efficiency reasons: If the space for $k$ can be lowered significantly, the final computation $\mod \ell$ can be either skipped entirely or at least simplified, yielding speed increases at signing time.

I am aware that BLS signatures exist and yield short signatures (e.g. BLS12-381 gives 48-byte signatures), but they are significantly more complex to implement and compute. Similarly, I am aware that some multivariate cryptography schemes yield very short signatures (Gui comes to mind, though patented). If I just wanted very short signatures, I would look into schemes that are not Schnorr signatures.

A similar question has been posted before; “64 bit Elliptic Curve Key”. However, the answers there generally assumed either creation of a new curve over a 64-bit field or truncating the public key, neither of which apply here, as I am reducing the range for the private key, leaving the public key and the field as-is.


texts: Encrypt a message with hash function, shared symmetric key, but no cipher

texts:
I am very new to Crypto and need some clarification or input. The question is:

  Suppose that Alice wants to encrypt a message for Bob, where the message consists of three plaintext blocks, $P_0$, $P_1$, and  $P_2$ - Alice and Bob have access to a hash function and a shared symmetric key $K$, but no cipher is available. How can Alice securely encrypt the message so that Bob can decrypt it?

What I had came up with appears to work but seems way too complicated.

Alice can compute an HMAC using the hash function, message and key for integrity and send it to Bob like so:

Let $M$ = the plaintext consisting of $p_0, p_1, p_2$,
Let $B$ be the block length of hash in bytes,
ipad = 0x36 repeated $B$ times,
opad = ox5C repeated $B$ times.

Then the HMAC of $M$ is defined to be:

$$HMAC(M, K) = H(K \oplus opad, H(K \oplus ipad, M))$$

Since there is no cipher for the symmetric key,  Alice can send Bob a public key where only she has the private key.  From here she can send the ciphertext $C = [M]$. Alice to Bob and Bob can verify decrypting ${M}Alice = M$ and plugging it into $HMAC(M, K) = H(K \oplus opad, H(K \oplus  ipad, M))$  is consistent with what Alice had originally sent.

First, is this a way to encrypt/decrypt a message? Second, is there an easier way? No cipher available means the message cannot simply be encrypted/decrypted with the symmetric key, correct?


texts: To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still there even if the "salt" in the RSA-PSS scheme is constant over all messages, or it conditioned in generating a random salt each and every signature? That is, does the security proof of RSA-PSS assumes random salt over messages?


texts:
So, having read a variety of documentations on AES encryption, I came to the unknowledgeable conclusion that the key schedule applied to the array of chunks, and not just the 14 cycles on a single chunk. Thus I concluded that AES was not a linear hash, such that ciphering sequential equivalent chunks would produce a set of non-equivalent chunks.

I guess I kinda didn't pay attention though - I just used AES encryption source code to cipher an array of the same character, and got a very linear result. x-)Is the AES key constant for all chunks? And should I be using a block-cipher mode other than ecb? Or is AES strong enough on its own?


texts: Is the seed/salt input of a Key Derivation Function confidential?

texts:
I'm implementing a security protocol and for the key management a scheme is proposed using a key derivation function on the remote device. Thereby the input seed is uploaded in plaintext to the remote device.
Now if both entities share the same masterkeys and generate sessionkeys from these masterkeys and the seed/salt, they derive the same sessionkey.

Now the thing I don't understand completely is that the random seed should be generated with a crypto-safe random generator, but can be uploaded in plaintext to the remote device.
Is that true? And is that because from a cryptanalysis point of view, using a deterministic random seed would leak information about the masterkeys?
As this is part of a thesis I would appreciate any literature on this.

Thank you in advance


texts:
I need help for my bachelor thesis.
I have a general question regarding hybrid encryption in different ransomware. The hybrid encryption often uses symmetric and asymmetric encryption techniques.
During an infection the symmetric key will be generated on the system. This symmetric key will be encrypted with the public key of the asymmetric key pair. The public key can be hardcoded in the source code of the ransomware. Now I read an article that says this is an bad approach, because if one victim will pay the ransom he can share the private key. That is right, but is it possible that the victim send me his encrypted symmetric key and I will send the decrypted key back?
Have I overlook something?
I hope someone could help me to clarify this understanding problem.


texts:
This might seem an impractical and unnecessary conversation, but I feel it's something I need to clarify. Especially, as I just got my first developer job in a blockchain startup.

So hashes are said to generate the same thing for any information it sees, and it's only a one-way interaction.

As far as I understand, hashes are just long alphanumeric strings. If one computes hashes across all documents, keys, information, files, etc, over and over again- it's simply a matter of time until the same combination comes up again for different information (applying it across all possible contexts)? This might be an impractical test given size and possibility, yes, but is it this that makes hashes powerful, that it's practically impossible to recreate a hash that for any foreseeable endeavor it's fine, or is there some element that I'm missing that reduces even that extremely low probability to zero?
Is there any design constraint that prevents a very powerful computer to back-calculate the original data from a hash? Or is it simply that the design is so complex that it's simply a futile exercise to dream of such a large computer required for this task?
What's stopping a hacker or malicious middle man to hack open the software program or library that creates this "hash" and then use that library to create hashes of his/her own or mislabel some target company's hash with his/her own pointing to their version of the file? Especially since many applications, languages, and developers use hashing independently. Whichever is most weakly secured, we can use that to take on the rest?

Any resources are also appreciated.


texts: Format Preserving Encryption after compression algorithm?

texts:
I have large data set which has sensitive information. I want to encrypt different parts of it with different keys. There is also need for compression as data is very large (100s of GB that has to be distributed to users that have got permission).

I have been reading about format preserving encryption and would like to use it. I would like to know if its a good idea to use FPE after compression or would that even make sense.


texts:
Modern Laravel uses OpenSSL to provide AES-256-CBC encryption along with a MAC. However, I was under the impression that this is not a particularly secure approach.

Why does Laravel only support AES-256-CBC?

While I'm not using this feature for sensitive data, I'd still like to follow best practices.


texts:
Sorry for not having a better name, but I cannot seem to find a better name.

Each client will append an element $a_i$ to the server at some time, and the server keeps appending the element to the database $\{a_1,a_2, \dots, a_i\}$.

Is there a way for the server to "cryptographically" prove to the clients that it behaves honestly? one trivial example is to publish the whole database/hash of each element and handle one client at a time.

I am not sure if people have looked into this problem before


texts: find prime number of diffie-hellman algorithm

texts:
at IPsec, Diffie-hellman is used in framework ISAKMP resulting shared secret. some of Diffie-Hellman group may define the length of the prime number of q and the size of the secret key of K: group 1 (768 bit),Group 2 (1024 bit), atau Group 5 (1536 bit).

a. what is the prime number of group 1 at decimal and hexadecimal
b. what is the maximum length primitive root of q in decimal?


texts: Any theory about period length for AES applied to itself?

texts:
For example AES-128 starting with a 128-bit message $m_0$ and static 128 key $k$

$AES128(m_0,k)\rightarrow c_0$
$c_0\rightarrow m_1$
$AES128(m_1,k)\rightarrow c_1$
$c_1\rightarrow m_2$
...
continue  until $m_i$ is equal to any $m_j, j<i$

The period length would be $l = i-j$

Any theory about how big that $l$ will be?
Will it be equal for any possible $m_0$?
Is $l=j$ for every $m_0$?

(edit: in AES $j$ is always 0 because symmetric algorithm. Each cipher value has only one possible plain text)


texts:
From Wikipedia:

  Information-theoretic security is a cryptosystem whose security derives purely from information theory. In other words, it cannot be broken even if the adversary had unlimited computing power. The adversary simply does not have enough information to break the encryption and so the cryptosystems are considered cryptanalytically-unbreakable.

List of unbreakable encryption-methods:

Secret sharing
Private information retrieval with multiple databases
Reduction between cryptographic primitives or tasks
Symmetric encryption with high entropic security
Quantum Cryptography

Why quantum cryptography isn't commercially used:

  GCN Article: “There are limitations to QKD (= Quantum key distribution),” Hayford said. Photons can only be sent about 60 miles, and it is a point-to-point protocol, meaning that complete system hardware is needed at each location. Expanding a system beyond a campus or a small number of local facilities “starts to be a little impractical.” And: "There also are challenges with existing hardware, particularly in the generation and measurement of individual photons. “That is a complicated physics problem,” which NIST and other research facilities have been working on for years, he said. Ideally the photon source would generate a single photon on demand. “We can’t do that right now.”

  The problem for a broad execution of QKD is, that the two parties have to know each other before communicating. And there needs to be a physical established line of communication, either from point to point or in nodes.

One-time pad
Pedersen commitments against the opener
ElGamal encryption used as commitment, against the committer

My questions are:

Are there more known unbreakable encryptions? If so, please provide a link & I will extend the list.
Why aren't these schemes commercially used? Please provide an explanation (and link if possible) and I will edit the list as well.


texts: Can data over a very low bandwidth channel still be encrypted?

texts:
If you have a very low bandwidth channel, can encryption still be used?

Another way of putting this might be, does encrypting well increase the size of the data significantly?

Are there good encryption techniques that keep the block size the same?