texts: Storing a secure key in an embedded device's memory

texts:
I am working on an embedded device which send/receive data and stored them in ciphertext mode (encrypted mode ). Now what's best approach for storing Keys (I used ARM CORTEX M series MCU) ?

Storing keys in the SRAM memory,in each booting sequence ,inject keys to the embedded MCU and store them in the SRAM memory. It is best way I think,then when MCU sense penetration (with tamper sensor or ...) it can erased SRAM quickly and reset itself. Disadvantage: if attacker success to pass tampers and access to device,how safe is SRAM memory (against code mining). I can't find any security ability for this memory in MCUs.
Generate keys and stored them in the flash memory in programming MCU. MCU flash memory's support CRP (code read protection) which prevent from code mining and with assist of its internal AES engine and RNG (random number generation) engine we can make a random key and encrypt flash memory and stored that random key in the OTP (one time programmable memory -a 128 bit encrypted memory), then in code execution we decode flash memory with RNG key and access to initial key and codes. Disadvantage: Keys stored in a non volatile memory, tampers will be useless and attacker have a lot of time to mine keys.
Stored key in the EEPROM memory,combination of 2 above approach, key stored in the non volatile memory but when tampers sense penetration EEPROM is erasable.
I consider LPC18S57FBD208(cortex m3 with 1MB of flash memory, 180MHZ, 136KB SRAM, 16KB EEPROM and a TFT LCD controller which i need to drive a 7" TFT LCD and AES 128 bit crypto engine) for that is there any other better suggestion?

part 2:
I am using a PCD (proximity coupling device or the card reader) like CLRC663 for reading RFID tags too.
connection between PCD and MCU is based on SPI,Becouse of unsecure and un-encrypted connection between them ,each attacker can sniff the connection and achieve the keys used for reading and writing to the RFID tags.
 what is your suggestion for this?


texts: Choose a random number that is different from a bunch of other secret numbers

texts:
I'm looking for an algorithm where n participants each have a different secret number between $[0..x]$ (and where $x$ is known) and where the participants then select randomly another, non-secret, number between $[0..x]$ which must not clash with the secret of any participant and which must not reveal any number used by any participant.

That each participant has a secret number and that no two participants have the same number is a given.

Proofs that participants are acting honestly is not necessary.  You can assume that the parties are semi-honest (i.e., they will not deviate from the protocol).

So, for example (this part I'm not interested in):

Alice has the number $18$
Bob has the number $52$
Eve has the number $193$

At this point each participant knows:

its own number
that each participant has a different number
that each participant knows only its own number

Considering that as our starting point, now Alice, Bob and Eve have to reach a consensus allowing to pick randomly one (and only one) public number between $[0..200]$, which does not clash with any of the three private numbers, without revealing any information about the private/secret number of any participant.

Is there a practical algorithm allowing to do this? By "practical" I mean something that can be used today and that would run in very reasonable times.

Maybe some homomorphic scheme?

You can assume that $x$ will be small and $n<x$, but unfortunately $n$ will be large enough that a random number will have a significant probability of clashing with some participant's secret number.  In other words, $n/x$ is a relatively large fraction.


texts:
When creating padding for RSA using OAEP, a message is prepared as follows:

Hash(Input Parameter) || Zeros || 1 || Message

My question is, what should the Input Parameter be? It must be known to both sides, I understand it can be an empty array (string, whatever). In that case there is no need to calculate the hash, hashing an empty input always produces the same result.

Is there a recommendation regarding what to use as the input parameter?

I'm thinking about hashing the public modulus n, which is already known by all parties. It's not necessary I suppose since the random seed from the other part of the OAEP procedure will change the final value anyway, but I'm still curious what is considered "best practice", or some requirement that I missed.


texts: Inconsistent terminology for ciphers and algorithms

texts:
I've been baffled by all the different kinds of names which are given to cryptographic algorithms.

There are block ciphers and stream ciphers (AES and RC4).

There is symmetric and asymmetric encryption (AES and RSA).

I get that block ciphers and stream ciphers are symmetric encryption, but Wikipedia makes things more difficult because it states it's the other way around:

  By type of key used ciphers are divided into:

  symmetric key algorithms (Private-key cryptography), where the same
  key is used for encryption and decryption, and asymmetric key
  algorithms (Public-key cryptography), where two different keys are
  used for encryption and decryption.

then it goes on to say:

  Ciphers can be distinguished into two types by the type of input data:

  block ciphers, which encrypt block of data of fixed size, and stream
  ciphers, which encrypt continuous streams of data

However, RSA is not a cipher because it is not a block cipher nor a stream cipher, is it?

So am I missing something, or is there indeed a gap in this terminology?


texts: What is the significance of the Period of a Steam Cipher

texts:
If we only know the period of a Stream Cipher, let's say 150-200 bit in length, how can we use this information to attack a stream cipher?

Taking a look at this link, What is the period of a cipher? I see that the period of the stream cipher is simply the amount of data we encrypt before starting the encryption over again.

From the attacker's stand point, this let's us know the chunk size of data we are encrypting but how does this help us attack the stream cipher? Won't we still need to know plaintext and cipher text?


texts: Group membership with unique anonymous claims

texts:
Is it possible to accomplish the following scheme?

There is a Server (S) and many clients.

Each client enrolls with S, exposing its real identity; S saves the real identity information in its database and executes some keys/identifiers exchange with each client (could be something like DHE or RSA).

Then, someone sends to S a claim such that S would be able to tell that this claim comes from one of the enrolled clients, but not being able to identify from which one (inability similar to factoring large prime numbers). At the same time S should be able to save it and only accept 2 more claims from the remaining clients (i.e. the client that have sent a claim can't send it again).

No client should have such information that, if leaked, could invalidate the entire scheme. In other words, any exposure of the identifier of a single client should only put in danger the ability of this client to make its claim.

A case: 3 clients (X, Y and Z) enroll with S.
X makes a claim to S.
S verifies that it comes from one of the clients and saves it, notifying the client that the claim was accepted. S does NOT know that the claim came from X. At this point, S only knows that 2 of the 3 claims remain.
Z makes its claim. S verifies and accepts it.
At this point S knows that only 1 claim remains.
X sends its claim again. S finds that it was already claimed and rejects it.
Y sends it claim. S verifies and accepts it.
At this point, S knows that all the claims were made.


texts:
For context, I was watching this bit of the video: which goes over this source code. The piece is about elliptic curve cryptography and how it works. I want to use some of this knowledge to make my own curve as an exercise. I did some self-study on this stuff and understand how some it works, like how point doubling and point addition operations and that this is all done over some prime field $\mathbb{F}_p$, but some things escape me.

Now, few seconds after the mark in the video, he mentions that changing the generator point $(x_g, y_g)$ on the elliptic curve can easily break the digital signature algorithm. But suppose I want to use a different generator point. How would I go about finding the order of the field $N=\#E(\mathbb{F}_p)$ for some arbitrary generator point $(x_g, y_g)$?  What about some arbitrary prime field p? I don't know how to find $G$ or $N$.

My goal here is to do something a little insane. Like... make a 1024-bit elliptic curve I could use to sign things. Again, as an exercise, but I would like to actually code this stuff.


texts:
Overview
One feature that is often underlooked of the One-Time Pad is its perfect deniability.  i.e. If Alice sends a message to Bob that is seen by Eve then if Eve later goes to Alice with the ciphertext and tries to force Alice to disclose her key Alice can "make up" a key and Eve can't prove that the key Alice provided was the real key or not.
One downside of the OTP is its malleability.  So a common suggestion is to append a MAC so Bob can see if the message was tampered or not.
I am curious if it was possible to construct a MAC such that if Eve tries to retrieve the key from Alice, Alice can "make up" a key for the MAC and Eve can't prove that that was the real key.  i.e. Given a plaintext and MAC Alice can construct a real looking "fake" key in polynomial time.  For example HMAC will not satisfy this property because otherwise it would be prone to preimage attacks.
Is this a good definition for perfect deniability of a MAC?
Applications

Realistically none since the OTP is impractical.
If Alice and Bob are on an anonymous network (example TOR) then Eve cannot prove who sent the message, but Bob can confirm it was sent from Alice and if it was tampered with
If Alice posted this in a public place (like a forum, blockchain or public bulletin board) nobody can prove Alice posted it (assuming she posted it anonymously) but Bob can confirm it was sent from Alice and if it was tampered with
Can you think of other applications?


texts: Key size and finite fields in ECC (References)

texts:
So somehow I know that the key size in ECC is defined over the number of elements in a finite field or that it is almost equivalent to that (Correct me if I am wrong). However, other than on Wikipedia I cannot seem to find any source (Article, Book, Encyclopedia with a trusted author, etc.) that states this and I am not allowed to use Wikipedia as reference for my work.
I have been scrolling back and forth in my book (Cryptography & Network Security, Sixth Edition) and on Google without finding anything that states exactly this except from Wikipedia. Also, I have looked through the references on Wikipedia and they don't really have anything even though they state it themselves.
Therefore, I would just kindly ask if someone knows of a trusted source where the author is shown that states this, unless I am wrong of course...


texts: Timing Attacks on ECDSA, ECDHE, AES and SHA2

texts:
Are there any known timing attacks (both practical and theoretical) on any implementations of  the following?

ECDSA (I'm aware of this one - are there any applicable to prime fields?),
ECDHE (again, over a prime field),
AES,
SHA2


texts: Are the signcryption and the authenticated encryption same?

texts:
The signcryption and the authenticated encryption are both the combine of encryption and authentication with three natural composition (i.e., EtS, StE, E&S). I am not sure that if they are the same cryptographic primitive.

If they are the same, why a cryptographic primitive has two different names?

If not, the only difference I personally found is that signcryption is a symmetric version and another is an asymmetric version. But I strongly believe that the difference I found is not true.


texts: How to calculate time taken by encryption?

texts:
First of all, I know that this all it's very complicated, I know that CPUs are complex beasts, and may not work at their full potential all the time, they can have more than one core, and the calculations may very well be reordered, optimized, or vectorized, there are different cryptographic libraries, etc.

However, I need a simple, straightforward formula, very approximate formula for calculating the time taken by the encryption algorithm on a specific CPU. For simplicity, let's consider 2 situations:

CPU has 1 core, and 2.8GHz, algorithm is AES-128-CBC, data size
to encrypt is 1024 MB
CPU has 4 cores, operations are ordered
hypothetically as they "should be", algorithm is AES-128-CBC, data
size to encrypt is 1024 MB

I know that 1Hz means 1 second, and a CPU that has 2.8GHz performs about 2.8 billion operations per second (which means 2.8 billions cycles per second). I also know that:

$$ \text{cycles per byte (CpB)} = \frac{\text{cycles per second (CpS)}}{\text{speed (S)}} = \frac{2.8GHz}{\text{speed (S)}}$$

and, of course:

$$ \text{time (T)} = \frac{\text{data size (DS)}}{\text{speed (S)}} = \frac{1024 MB}{\text{speed (S)}}$$.

But I don't have the speed (bytes per second), and also, even if I had one, how to calculate time needed by encryption? I mean, I only have data size (DS) and cycles per second (CpS), but it seems I still need bytes per second (BpS) or cycles per byte (CpB), and of course, time (T).

I know that the best way is to do the actual measurement, but I need to make some assumptions about the hardware I don't have, and I need some encryption time for those devices (approximate time of course).

How can it be calculated? Are the information I have enough? What else do I need to calculate the time needed by AES-128-CBC to encrypt 1024 MB of data on 2.8GHz CPU?


texts:
I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. An example used is KeeLoq.

Assuming a car opener (sender) and a car (receiver):

What happens if the sender is at another point in the sequence? Think of that the key is pressed while out of range to the car.
How does they sync the point of the sequence?
Is there any prevention to detect replay attacks? How are they implemented?


texts:
As far as I know, PBKDF2 uses an underlying pseudorandom function in order to generate a hash (like SHA256) so as far I understood PBKDF2 is basically a hash function that uses an underlying function in order to generate a hash but what I don't understand is that what's the point of hmac here?

I expected to use something like PBKDF2WithSHA512 instead of PBKDF2WithHmacSHA512 and I really can't understand what's the point of HMAC.


texts: RSA Protocol behind Yaksha Security System

texts:
So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys.

It states

  nAlice - Alice(some user) modulus
      dAliceA - First private key only known to Alice
      dAliceY - Second Private key only known to Yaksha server
      eAlice - Alice's public key

The keys are related by the following:

  dAliceA*dAliceY mod phi(mod nAlice) = dAlice

It states that the server sends Alice:

  Calice = (Ksession) ^ dAliceY * eAlice mod nAlice

And Alice can determine the session key as:

  (Calice) ^ dAliceA mod nAlice = Ksession

My question is, Can Alice obtain the session key due to the multiplicative properties of the modulus function and the basis of which RSA is built on? Or am I missing something here?

Edit: Also, is dAlice just the combined private key of the server and Alice to verify that the keys are correct?


texts: Could be El-Gamal signature scheme constructed via Fiat-Shamir heuristic?

texts:
For example, Schnorr signature is pretty similar to El-Gamal.
And everywhere where Schnorr signature is explained (for example - on Wikipedia),
there's said that there's Schnorr scheme which is actually interactive proof of knowledge scheme (or identification protocol). Then, applying Fiat-Shamir transformation, we get Schnorr signature scheme.

At the same time, there are no mentions about El-Gamal interactive/non-interactive proof of knowledge El-Gamal protocol. And nobody mentions Fiat-Shamir heuristics alongside with El-Gamal. Does it have some sensible reasons? Could be the idea underlying El-Gamal signature be used for constructing proof-of-knowledge protocol? identification scheme?
Could El-Gamal signature scheme be constructed from some proof-of-knowledge protocol by applying Fiat-Shamir heuristic?


texts: Why routers don't just use Diffie-Hellman protocol?

texts:
Routers could just use Diffie-Hellman protocol with any computer who tries to connect to that router. Then it would be impossible to eavesdrop for anyone. Only router and computer would know the secret key for that session. No?

Or someone could act as a router and send his own public key and get the traffic through his computer and that is the reason routers don't use it?


texts: How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?


texts:
what is the meaning of this notation ??

  AES{Yi, (Yi XOR Ki | nonce1)}

https://tools.ietf.org/html/draft-bhattacharyya-core-coap-lite-auth-00


texts: Is it hard to determine an automorphism when the mapped value by several compositions of the automorphism is given

texts:
Generalization of the Discrete logarithm problem to non-abelian groups is discussed by many authors. One of the generalizations is shown in MOR cryptosystem as in the below link, by considering the inner automorphisms.
https://arxiv.org/pdf/cs/0607011.pdf
So if group $G$ is generated by elements $\{\gamma_1, \gamma_2, \cdots, \gamma_s\}$, a communicating party, say Alice makes $\{\phi_g(\gamma_i)\}_{i=1}^{s}$ and $\{\phi_g^r(\gamma_i)\}_{i=1}^{s}$ public for an inner automorphism $\phi_g$ and a private key $r$. By the generalized discrete logarith problem, it is hard to compute $r$. To use this method, they have to use a suitable non-abelian group where the generalized discrete logarithm problem is proven to be hard.
However, suppose I have a group of automorphisms, and for an automorphism $f$, I need to make public only $f^m(t_i)$, for a private key value $m$ and generating elements $t_i$'s of a related group. Then since I'm not revealing $f(t_i)$, anyway determining $m$ nor the original automorphism $f$ is a hard problem right? Even if it is not in the format of the generalized discrete logarithm problem?
According to my situation I don't need to reveal $f(t_i)$. But I need to clarify when I only reveal $f^m(t_i)$, it is impossible to find $f$ nor $m$ whatever the group is.
Please be kind enough to advice and please mention if I need to include more explanations/any unclear part.
Thanks a lot in advance.


texts: How difficult is it to crack sha256(sha256(pin)) with a 6 digit pin and no salt?

texts: My friend forgot the password to his electrum wallet but knows that it's a 6 digit pin. I looked into it and from what I can find electrum uses the sha256(sha256(pin)) to generate the key used to encrypt the private key with AES in CBC mode. What I'm not sure about is whether or not it is feasible to crack this and I want to be sure before I attempt it.


texts: How many bits should a token have to be unguessable (given some computational resources)?

texts:
If an attacker may try 10 billion (1E10) random numbers per second.
And its attack can last 500 years (500*365*24*3600 = 1.5768E10 seconds).

Then the attacker will try 1E10*1.5768E10 = 1.5768E20 combinations.

Now suppose I have 100 billion (1E11) tokens, which are random numbers of n bits.

I want to calculate n so that the probability the attacker finds any token is around 1 in a billion (1E9).

I believe the answer is n = log2(1E11*1.5768E20/1E9) = 73.74 bits.

Questions:

Is this calculation correct?
If instead of independent random numbers the attacker can avoid repeating numbers, how much is n? I guess I should use factorials, and I guess this relates to the birthday paradox, but my mathematics seems to escape me know.
If simply knowing one of the tokens serves as authentication, what is the recommended n for an attacker with a few million dollars available, as of 2017?

Update:

By using the formula in https://en.wikipedia.org/wiki/Universally_unique_identifier#Collisions, with my specific numbers, in WolphramAlpha, I get: sqrt(2*(2^n)*ln(1/(1-(1/1E9))))=1.5768E20.

Wolphram solves for n: n=163.088. I guess this is the answer to my question 2. I think my calculation for question 1 is correct, but since question 2 is the more realistic scenario I am satisfied with that and will close this question.


texts:
In the paper On the Size of Pairing-based Non-interactive Arguments by Jens Groth, it is always referred in the equations to satisfy that $a_0 = 1$ and the others $a_1, ..., a_m \in \mathbb{F}$.
I am not sure I understand this specification, as we can always set $a_0$ later to 1 if needed. I first thought it was to introduce the constant 1 for the arithmetic circuit basic operation but I am wondering now if this specific value has another use.


texts: Choice of finite fields for use in elliptic curves

texts:
this is maybe a basic question but I'm trying to better understand elliptic curve cryptography at a fundamental level.

I understand that a finite field is required in order to define a boundary for an elliptic curve.

Then, x,y values that satisfy the curve over this field represent the ec group of the curve.

My question is simple, how are the finite fields defined? They seem so arbitrary...

Example,

The finite fields for secp256k1 and curve25519 are

2^256 - 2^32 - 977

and

2^255 - 19 respectively...

My naive question is, how are these fields defined? The seem to be arbitrary bounds on the size of the ec group for the curves defined inside them.

I'm not asking why they are prime, but more why these numbers are chosen, and how the right size group is selected?

I did consider it was something to do with all of the elements satisfying some criteria, but really the values seem too large and arbitrary for that.


texts: Is it possible to have identical public keys for different ciphers?

texts: Is it possible (and is there any research I can read) to have 2 key pairs for different ciphers, for example RSA 1024 and some yet to be released EC (or other asymmetric cipher) than uses 1024 bit keys, that have the same public key?


texts: Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?

texts:
For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to increase security?

Note: I just want more secure output and CPU cycles does not matter


texts: What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

texts:
I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices.

There are many forms of authenticated encryption. (AES-GCM, AES-SIV, AES-GCM-SIV, CBC + HMAC, CTR + HMAC, etc.) However, I'm having a hard time determining which of these modes-of-operation suits my use-case best. Speaking broadly:

I've heard many times that "GCM is harder to get right" due to the serious risks associated with nonce reuse as well as its predisposition to side-channel attacks if implemented poorly. Although it is fast.

I know AES-SIV is at least utilized by Cryptomator, a tool similar to what I'm trying to develop, (per their architecture docs). AES-SIV has a smaller penalty for nonce reuse compared to GCM but perhaps isn't as fast.

AES-GCM-SIV attempts to combine the positives of both GCM and SIV by being both fast and somewhat resistant to nonce reuse.

As far as CBC + HMAC is concerned, HMAC leverages 256-bit authentication tags over GHASH's weaker 128-bit authentication tags (used by GCM). However, CBC cannot be parallelized in the same way GCM can.

CTR + HMAC can be parallelized in a way similar to GCM but with stronger authentication tags. (Again, HMAC using 256-bit authentication tags over GHASH's 128-bit authentication tags)

Despite the reading I've done so far, I haven't been able to determine why one might choose one of these methods over the other. At the end of the day, I would really just like to secure my files safely in the cloud with at least some assurance that the files I encrypt are authentic and have not been tampered with or corrupted in any way.

I would really appreciate any help that could point me in the right direction.


texts:
Classical asymmetric cryptography is commonly based on the Discrete Logarithm Problem and Integer Factorization, which are known to be solvable with a quantum computer if it has the ability to run Shor's algorithm, or an algorithm that solves these is devised to run on a classical computers.

Nowadays we know this is impossible to come at least in a few decades. But that doesn't imply that a passive eavesdropper gathers key exchange handshake packets where the symmetric key is negotiated.

The eavesdropper could decrypt the communications associated with these key negotations once the aforementioned quantum computer is built. For example, in the past, cryptosystems that were being used ended up being vulnerable to attacks so a specialized attacker could recover all the stored private information during years.

The evident matter here is that moving to post-quantum cryptographic schemes in the present would stop an attacker in the future to recover private information once conventional asymmetric schemes are broken. I know these schemes are being analyzed right now i.e NIST calling for new post-quantum crypto schemes.

Q1: Is there any institution or government in the present implementing for example NTRU, SIKE or multivariate crypto schemes on their communication establishment to prevent past private information recovery?

Q2: What would be a good estimation on time (i.e years) to move on to these post-quantum cryptographic schemes? I mean, we cannot wait until these attacks are possible on a theoretical capable quantum-computer.


texts: Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

texts:
I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal to the MAC when used in this way.

If it's instead used in encrypt-then-MAC, wouldn't that be acceptable? Every bit of the MAC would rely on every bit of the ciphertext, preventing chosen ciphertext attacks.

Is there something I missed here?


texts:
I am a beginner in cryptography. I studied the RSA algorithm and now I want to solve an exercise.

Cipher Text (HEX): 41A387CABD1C144C99E4B44CE2812A7696CE8A9B5941164741E91B82D89886700DD73A61C580BD75DFC0351D3D6BBF644408A77CB421A115C5
Public Key (e, n): (4049, 16395979)

If:

n = p*q
z= (p-1)*(q-1)
e*d mod z =1

And after trying I found:

q = 3659
p = 4481
z = 16387840
d = 10118449

Now,
1) Is it correct value for d(secret key)?
2) I know that I should compute $c^d mod n$, But c is very big hex! How can I do it? Should I split it first?


texts: Why develop Edward curve formulas that deviate from unification?

texts:
Edward curves were considered initially because they provide a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently involving construction of a different class of addition and doubling formula (e.g. differential addition formula, w-coordinate formula), particularly concerning efficiency of these formulas in terms of the number of field multiplications/squarings. Thus, the point of unification becomes invalid.

Please can anybody explain/cite some relevant papers which address this issue?


texts: Role of long-term asymmetric keys in a forward secrecy instant messaging protocol?

texts:
I am trying to understand how forward secrecy works in general, using a simple instant messaging protocol as an example. Tell me if I have this process right or not:

1) Alice and Bob each generate a pair of long-term public and private keys, then verify public key fingerprints in person. The ONLY thing these keys will be used for is for authentication (signing messages, and signing things during session key exchange). These keys will NEVER be used for encryption of any kind.
2) Alice and Bob use a key exchange algorithm such as Diffie-Hellman in the clear, using the keys from step 1 only to authenticate one another during this process. They end up with a shared session key.
3) Alice sends Bob a message, encrypting it with a symmetric cipher using the session key negotiated in step 2.
4) Bob decrypts Alice's message using the key negotiated in step 2.
5) The process repeats for each new message sent, starting from step 2. Step 1 is never repeated.

Forward secrecy (by generating new session keys) ensures that past communications cannot be decrypted if the long-term private keys from step 1 are compromised, however, masquerading as Alice or Bob would be possible going forward if this occurred, possibly compromising all future messages.

Where have I gone wrong here? Thanks so much in advance!


texts: Helios voting system voting verification

texts:
In the decryption step in helios, why do we need Chaum-Pedersen to prove that a certain plaintext $m$ corresponds to a given ciphertext $c$?
Why can we just encrypt $m$ and see if it's equal to $c$?


texts:
In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt:

Consider an implementation of this protocol, with the additional feature of
confirmation messages. Whenever Bob receives a message, he returns it as a
confirmation of receipt.

1. Alice signs a message with her private key, encrypts it with Bob’s public key,
and sends it to Bob.

EB(SA(M))

2. Bob decrypts the message with his private key and verifies the signature with
Alice’s public key, thereby verifying that Alice signed the message and
recovering the message.

VA(DB(EB(SA(M)))) = M

3. Bob signs the message with his private key, encrypts it with Alice’s public
key, and sends it back to Alice.

EA(SB(M))

4. Alice decrypts the message with her private key and verifies the signature
with Bob’s public key. If the resultant message is the same one she sent to Bob,
she knows that Bob received the message accurately.

Assume that Mallory is a legitimate system user with his own public and private
key. Now, let’s watch as he reads Bob’s mail. First, he records Alice’s message to
Bob in step (1). Then, at some later time, he sends that message to Bob, claiming
that it came from him (Mallory). Bob thinks that it is a legitimate message from
Mallory, so he decrypts the message with his private key and then tries to verify
Mallory’s signature by decrypting it with Mallory’s public key. The resultant
message, which is pure gibberish, is:

EM(DB(EB(DA(M)))) = EM(DA(M)) [1]

Even so, Bob goes on with the protocol and sends Mallory a receipt:

EM(DB(EM(DA(M)))) [2]

Now, all Mallory has to do is decrypt the message with his private key, encrypt it
with Bob’s public key, decrypt it again with his private key, and encrypt it with
Alice’s public key. Voilà! Mallory has M.

The message that Mallory recorded is:
EB(SA(M))

But why the DA in formula [1] and [2]

I think if Mallory want to 'steal' the origin message M, he should do the following steps:

Mallory receive the encrypted message as a confirmation of receipt from Bob :
EM(SB(VM(DB(EB(SA(M)))))) = EM(SB(VM(SA(M)))) = X
Then Mallory have to decrypt X with his private key : DM(X) = SB(VM(SA(M))) = X1
And then verifies X1 with Bob's public key : VB(X1) = VM(SA(M)) = X2
And then encrypt X2 with his private key EM(X2) = SA(M) = X3
finally, verifies X3 with Alice's public key VA(SA(M)) = M

Can any one point out my mistake?


texts: Is it possible to trim some encrypted values under fully homomorphic encryption

texts:
Suppose we have $N$ encrypted values under homomorphic encryption (BFV/BGV ..), and we know that $M$ of them are below $t$. Is it possible to remove those $M$ values?
It is known that some methods (e.g. homomorphic comparison) can out put $N$ encrypted $1$ or $0$s denoting whether the value is above $t$ or not, but I need to crop those below $t$, leaving $N-M$ encrypted values.
Edit: I understand it's not possible to directly remove the $M$ values, but is it possible to output $N-M$ new encrypted values, whose plaintext is exactly those $N-M$ values above $t$.


texts: Number of different substitution alphabet ciphers possible with given conditions?

texts:
If you consider a 26 letter alphabet, and a cipher where 24 of the letters are sent to themselves, and only 2 letters switch, how many different substitution alphabet ciphers are there, and what percentage are they of total possible?

I thought it would be there are $26\cdot25=650$ such possible ciphers, for a percentage of $$\frac{26\cdot25}{26!}\cdot100\approx1.61\cdot10^{-22}\%$$

But it seems there are only $325$ possible ciphers, when switching only two letters, and i dont understand why?


texts: Use of q-ary lattices in developing cryptosystems

texts:
Why q-ary lattices are used to most cryptosystems rather than lattices.
In most of the papers q-ary lattices are used. Is there any advantage?
and

Given $$B=(v_1,v_2,v_3,.....v_n)$$ is the basis, lattice generated by B
               $$ L(B)=\{a_1v_1 + ........ + a_nv_n\ |\ a_1........,a_n ∈ Z\}$$
Fix q and given a matrix $$A ∈ Z_{q}^{n×m}$$
 m-dimensional lattice $Λ(A^T)$ is defined as
$$Λ(A^T)=\{y ∈ Z^m | y ≡ A^Ts\ (\text{mod } q) \text{ for some } s ∈ Z^n_q\}$$
How can we say that the above set of points forms the lattice and does it contains exactly $q^n$ points?


texts: Factorization for special primes $P$, $Q$, and $R$

texts:
Suppose that $p$, $q$, and $r$ are distinct $n$-bit primes, we define
$$
\begin{array}{rcl}
P & = & p \mathbin\Vert q \\
Q & = & q \mathbin\Vert r \\
R & = & r \mathbin\Vert p
\end{array}
$$
Where $\mathbin\Vert$ means concatenation of two integers. For example
$$1165993 \mathbin\Vert 1420831 = 11659931420831$$
We are given $N = P \times Q \times R$ and $P, Q, R \in \mathbb{P}$, that is they are primes too. Can we factor $N$ in polynomial time?
I have listed an example for this question too, we know that
$$\scriptsize N = P \times Q \times R = 12263640959607413166286548792372138857838409113471105337781351695720741222286495632687410855193016269011718576637693250596988228986909434347895553431945099$$
Can we factor it?


texts: 521-bit ECC keys are the same strength as RSA 15,360-bit keys

texts:
521 bit ECC uses key sizes 7.5 times smaller than the RSA standard while offering encryption that is magnitudes more secure. An RSA 2048-bit key's secure enough for banking, but a 521-bit ECC key is the equivalent of a 15,360-bit RSA key.

I read it on SKYECC - Explaining 521-bit ECC Encryption From the Ground Up.
Can anyone give me an independent answer and opinion on the claims made here
This messaging apps claims to be the most secure

Is there a really much difference between 128bits 256bit and 512bits as it comes to security implemented in messaging apps or is t more important the way it has been implemented?


texts: A linear feedback shift register can be thought of as an array of bits where NEW_BIT is calculated using F(REGISTERS). F is a function that takes values from two or more elements of REGISTERS and XORs them together. The new value of REGISTERS is equal to (in Python) [F(REGISTERS)] + REGISTERS[1:]. Do the dynamics change if we store values greater than 1 in each register, like say bytes? If F invoked operations other than XOR, then it seems like that would make it more like an NLFSR. Are the dynamics different there, too? Is something like this used by any cipher out there?


texts:
RSA has limitation in input size for encryption and decryption.

Can RC6 be used for encryption and decryption of files larger than 5 MB?
Is there any limitation for input size?
Is RC6 safe for using encryption or has it faced any attacks?


texts: Is there a method of encryption where you can't work out the key even with the encrypted and decrypted message?

texts:
I'm looking for a method of encryption that fulfills the following parameters:
To still be able to display a result even if decrypted with the wrong key.
If the encrypted and decrypted message is found, the key cannot be worked out.
Forgive me if I'm being stupid but I'm new to this area!
Thanks


texts: In Diffie-Hellman, can everything be sent in plaintext?

texts:
I think my limited understanding of DH might be messed up - what's wrong with this scenario?

C wants to connect to S.
C has an ECDSA public key that it trusts belongs to S.

Here's what happens:

C connects to S.
S sends its part of the DH key exchange, signed to prevent tampering*.
C sends over its part of the DH key exchange, in plaintext and without a signature.
C and S now calculate the shared key.
The shared key is used for all further communication.

*Add padding, etc. to prevent forgeries and reuse.

A MitM can't lie to C, because it can't forge the signature, and if it lies to S, it isn't really gaining anything, because if it could effectively pretend to be C without routing everything back through C, it wouldn't have to make a MitM attack in the first place.


texts: Is the 'nonce' in bitcoin really a nonce? Reading definitions of nonce and salt it seems the number is used as a salt but the same value can occur in multiple blocks; there's no requirement or indeed method to enforce that the value is not used again.


texts: The AugPAKE spec says it can be implemented over elliptic curves. This sounds very promising, but they don't actually back that claim. Can this really be achieved? If so, how would one go about mapping the existing protocol to elliptic curves?


texts: How is it possible to trust a public key that can confirm a message's signature?

texts:
Let's assume I am able to confirm a certain message's signature with a public key that seems to be from Alice.
So I should be sure that the sender of that message is really Alice. But what if I have a public key where I think it is from Alice but actually is not and it still can confirms the signature of the message I got. So I am thinking it is from Alice since I used a key that is published as Alice's Public Key just from somebody else and that can confirm a message's signature I got where I think it is from Alice.

How can I be sure that both the message and the public key are really from the person they are named to be from?

There might be some weird thinking mistake I did here so I'd be happy to get enlightened.

Tried to visualize it.

Thanks in advance.


texts:
Let $E = (E,D)$ be a Shannon cipher defined over $(K,M, C)$. Consider a
probabilistic experiment in which $k$ is a random variable uniformly distributed over $K$. Then $E$ is perfectly secure if and only if for
every predicate $Φ$ on $C$, for all $m_0,m_1 2M$, we have

$Pr[Φ(E(k,m_0))] = Pr[Φ(E(k,m_1))]$

I dont understand the meaning of $Φ$ in this theorem


texts: TLS - sharing 1792 bits of unidirectional keys

texts:
I've just watched a video on the TLS protocol and learnt that it uses unidirectional keys (meaning keys for both sides, from browser to server and from server to browser).

Given that the server uses TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 , how are all those keys shared? We need:

AES 256-bit key for the browser
AES 256-bit key for the server (CBC)
AES 128-bit IV for the browser
AES 128-bit IV for the server (CBC)
HMAC 512-bit key for the browser
HMAC 512-bit key for the server

So in total we need 1792 bits, if we use 2048 bit Diffie-Hellman we can at most share 256 bits securely, if we take the SHA512 of it we get 512 bits, but how are we gonna securely derive so much keys from it?

Indeed we could use PBKDF2 to derive keys, but that would be kind of expensive. Does anyone know how TLS does all this?


texts: Why is the subhash key (H) of AES-GCM defined as such?

texts:
From what I've read in section 5.3 of NIST 800-38D it states:

  The hash subkey, denoted H, is generated by applying the block cipher
  to the “zero” block.

In serious crypto J.P Aumasson describes the implementation of it as H = AES(K,0) for a single block of zeros, hence no block chaining mode, hence no IV as I understand it. Therefore the mapping between H and K should be universally constant.

The book notes:

  In GCM, GHASH doesn't use K directly in order to ensure that if GHASH's key is compromised, the master key K remains secret. Given K, you can get H by computing AES(K,0), but you can't recover K from that value since K acts as AES's key.

If the mapping is universally constant wouldn't it be the case that this could be pre-computed and available somewhere? (I wanted to say rainbow table here, but that probably doesn't quite apply based on what I read in this response)

So is the strength just that storing this permutation space for later indexing is thought to be too large? Or is there more to it that what I laid out?


texts: What happens if you multiply a point with its order on complete Edwards curves?

texts:
I was recently working with some ECC crypto and stumbled across the following phrase on the SafeCurves page:

  The rational points of a complete Edwards curve are the pairs (x,y) of
  elements of F_p satisfying the equation; there is no extra "point at
  infinity".

Normally, if you have a point $G$ on a curve $E$ with order (of the point) $q$, multiplying $qG=0G=\mathcal O$ results in the point at infinity.

But apparently complete Edwards curves don't have said extra point.

So what happens in this case?


texts: Is AES/CBC/PKCS5Padding vulnerable if used for store data on a db

texts:
Is padding oracle attack applicable to data stored on a DB in AES/CBC/PKCS5Padding?
Specifically I would like to be able to use Postgres with pgcrypto https://www.postgresql.org/docs/13/pgcrypto.html#id-1.11.7.34.9 (that currently not support GCM)
The idea is to achieve totally anonymized data, even in the case where an attacker obtain a dump of the db.
Currently I'm using AES/GCM/NoPadding on the application side, but having the opportunity to decrypt directly on database could be helpful.


texts: ECDSA vs RSA: Performance on Android platform and surprising results

texts:
For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, a signature-based approach is used. After we've implemented it with RSA, we decided to optimize the protocol a bit by using ECDSA. The result was very surprising: on Android, signing and verifying in the case of ECDSA was 10 times slower than for RSA with the corresponding key length!
Any viable explanation for this?
Maybe the android smartphones don't have hardware support for elliptic curves, and for RSA operations they do?
The exact parameters are below:
RSA:   signing: 52ms,  verifying:   6ms
ECDSA: signing: 692ms, verifying: 975ms

Smartphone: Samsung Galaxy S Advance, GT-I9070P with CPU: 1 GHz STE U8500 DualCore
Crypto-lib: SpongyCastle 1.50.0.0
The elliptic curve used: 224 bit, secp224r1
ECC signature: SHA256 with ECDSA
RSA 2048 signature: SHA1 with RSA


texts: Is this a secure implementation of password reset email?

texts:
I am redesigning a password reset email mechanism because the existing implementation scares the hell out of me. My goal is to generate reset codes that are:

Expired
Tamper Resistant
Single Use
Resistant to replay attacks

The format of the reset code I have come up with is:

B64( B64( iv ) || B64( E( uid || timestamp ) ) )

Where B64 is base64 encoding and E is for symmetric encryption. The iv is the initialization vector used for encryption (randomly generated), and is in the clear. The || indicates concatenation and I actually use the string "||" as the separator. The uid is an opaque identifier of the user so I can look them up in the database.

The timestamp allows for a code to be expired.

I am using AES 256 in Galois Counter Mode which should provide protection from modified ciphertext attacks.

The encryption key is stored on the server, and used to perform the encryption.

The iv has a dual use. When the reset code is generated the iv is stored with the user in the database. This is used to enforce single-use of a reset code (it gets cleared when a reset code is processed) as well as prevent use of reset codes generated previously. If the iv in the database does not match the iv used to decrypt the reset code, the request is refused. This may also help with security in the event that the encryption key on the server is somehow compromised, as the attacker has to inject the iv into the database as well to make it work. Of course if the attacker is on the host we are pretty much toast...

Are there any weaknesses in this design I am not seeing, or does it needs additional improvement?


texts:
Digital signatures allow authentication of content based on a secret held by the signing entity. Are there any existing schemes, proposals or even services for letting "location" or "time" sign the content?

Motivation: Time and space (i.e. geolocation) are fundamental variables in our lifes and their integration in digital signatures could be useful e.g. for impeding fake news or elaborating on new proof-of-** principles for the broader field of "blockchain"-like technologies.

Are there any existing third party services? Or are there even trustless approaches maybe based on distributed computing / p2p-networks / sealed hardware?

Edit 1: I now see there are already some topics dealing with centralized timestamping services (e.g. here). Thus, the emphasis of this topic should be more directed towards trustless approaches.


texts: Is it secure to choose d in a RSA key pair?

texts:
An RSA key pair consists of the private key $(n,d)$ and a public key $(n,e)$ such that $de \equiv 1 \bmod{\lambda(n)} $.

Usually one chooses a small $e$ and computes $d$ by inverting it modulo $\lambda(n)$. This makes things computationally easy for the user of the public key, but makes it expensive to use the private key because $d$ is large (typically only a few bits shorter than $n$).

If one wants to shift computational cost from the private to the public side of the cryptosystem, would it be secure to select $d$ as, say, a random 128-bit number coprime to $\lambda(n)$ and then compute $e$ as its inverse instead of the usual way around?


texts: Show that if a fixed key MAC is not collision resistant then the MAC function is not computation resistant for every key K

texts:
I'm really having some trouble with this one.

Let $H$ be a MAC function. For every key $K$ we can create an unkeyed hash function (i.e.an MDC) by using $H$ to hash messages with the fixed key $K$. We denote this unkeyed hash
function by $H_K.$ (Note that every key $K$ gives a different hash function $H_K$. Therefore, we can
create a large family of MDC functions from a single MAC function, one for each key).

Show that if $H_K$ is not collision resistant, then $H$ is not computation resistant for every key $K$.

Make your argument as clear as possible.


texts: RSA encryption/decryption values not working as expected

texts:
I'm faced with an issue I can't seem to understand when it comes to RSA. Below are my values for all of the parameters, unfortunately I can't seem to get the expected decrypted values from my encryption message
p=113, q=117,phi=12992,n=13221
encryptionKey = e = 8473
decryptionKey = d = e^-1 = 12969
msg = 3;
(encryption) cipher = (3)^(8473) (mod 13221) = 6633
(decryption) msg = (6633)^(12969) (mod 13221) = 12546

why is the msg prior to encryption not equal to msg after encryption? how to get them equal ?


texts: is it safe to leak some information about scrypt result?

texts:
I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file.

Is it safe to generate my IV (public) and key (private) together using scrypt (e.g. set dklen=64 then use scrypt[0...31] for key and scrypt[32...63] for IV), or will I be leaking some kind of state information?


texts: Encrypting a small value $m\in\{1,\dots,100\}$ using textbook RSA

texts:
When encrypting a small value $m\in\{1,\dots,100\}$ using textbook RSA, and since that is deterministic, an attacker could try every possible number to determine $m$.

To prevent this kind of attack, one could select a big random number $x$, and send $x^e\bmod n$ and $(m+x)^e\bmod n$.

What would be a problem with this encryption technique?


texts: Curve parameter for hyperelliptic curve cryptography?

texts:
RFC5639 defines some curve parameter for Elliptic curve cryptography.

Aren't there any curve parameter database for Hyperelliptic curve cryptography? What I can only find was that written in this PDF.


texts: Is the 51% attack the only technical reason no country will ever adopt Bitcoin as a state currency?

texts:
Is the 51% attack the only technical reason no country will adopt Bitcoin as a state currency?

Let's suppose a country with a GDP size less than 300 Billion USD adopt the Bitcoin as an official currency. It will be very easy to crush or take control of state currency if a country like the US or China invests to run 51% of the mining pool.


texts: Does RSA padding have to be unpredictable if the payload is?

texts:
I'm trying to understand the precise requirements on padding when using RSA for encryption.

Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send $\mathrm{RSA}_{B_{pub}}(\mathrm{pad}(\mathtt{?}) || M)$ to Bob, with a padding procedure to be determined. Assume reasonable sizes, say a 1024-bit RSA key and a 256-bit payload. Alice may send the same payload $M$ to multiple recipients, encrypted with each recipient's private key. Only a recipient must be able to recover $M$. But it's ok if an external observer can tell that Alice sent the same $M$ to Bob and Charlie (sent as $\mathrm{RSA}_{B_{pub}}(\mathrm{pad}(\mathtt{?}) || M)$ and $\mathrm{RSA}_{C_{pub}}(\mathrm{pad}(\mathtt{?}) || M)$ respectively)¹.

With no padding, this is broken: the plaintext can be reconstructed from $e$ ciphertexts. In general, RSA padding must be random and not recoverable without knowing the private key, if only because otherwise the attacker could verify a guess of the payload; but here I assume the payload is unguessable. So what are the requirements on padding in this scenario?

Is it ok to use a deterministic padding function that depends only the recipient, say $\mathrm{pad}(B) = \mathrm{SHA256}(B_{pub})$?
Is it ok to use a predictable padding function, say by incrementing global counter for each recipient (assume Alice does have a reliable monotonic counter)?
Is it ok to use random padding that is leaked? In other words, in this scenario, is the mere fact that the attacker knows the padding a problem?

¹  What prompted this line of thought was a message $M$ that was a single-use symmetric encryption key; the long message encrypted with that symmetric key would be identical for all recipients anyway.


texts: Performing DFS search with garbled boolean circuit

texts:
Given $G=(V,E)$

How can i implement a DFS search in the Boolean circuit? ( The output should be to assign each node it's DFS value from a root node)

I assume the complexity should be exponential, because each move we don't know the next node to be it's consequent node).

But is there any justification to that? Can I do it better?

The above question is algorithmic, Because it's a preliminary stage to make the circuit obliviously...

Thanks.


texts: Is there something wrong with using a hash function as a PRG?

texts:
I need to create cryptographically secure pseudorandomness in JavaScript. However, when I googled for PRGs, all I found was very sketchy.

My idea is as follows (in pseudocode):

seed = "0x1a29fd..." // long number I always get passed (impossible to guess but used in a different context as well)
hashedAndSaltedSeed = sha256sum("seed: " + seed)
purpose = "..." // my current function's name (no spaces)
usageIndex = 1; // will increment this each time

randomness = myPrg(hashedAndSaltedSeed, purpose, usageIndex)

function myPrg(hashedAndSaltedSeed, purpose, usageIndex, numberOfBytes) {
    if(numberOfBytes > 32) {
        fail()
    }

    input = purpose + " " + usageIndex + " " + hashedAndSaltedSeed
    return sha256sum(input).binary2hex().slice(0, 2*numberOfBytes).hex2binary()
}

I only need a small amount of randomness (at most 32 Byte at a time, very few times), so the speed difference won't matter. But is there anything else wrong with this approach?

The randomness I need doesn't need to be distributed perfectly randomly but it needs to be infeasible to guess the resulting randomness when only given purpose and usageIndex but not seed nor hashedAndSaltedSeed.

Edit: I'm sorry that I forgot to mention an important requirement. I'm sure it was in my question at some point as I wrote it but I seem to have deleted that part accidentally. I need to be able to reproduce the same randomness when given the same seed. That's why I can't just use something that gives me randomness but doesn't let me control the seed.


texts: Convert a state-dependent hash-based signature scheme into a stateless message-dependent one

texts:
Suppose we have an XMSSMT instance that is capable of signing up to 2^60 messages securely when given some state-dependent information, I could envision making it stateless as follow:

Hash the message and truncate the digest $t$ to 60 bits.
Split $t$ into $d$ (Hypertree layers) chunks and interpret as integer leaf indicies at every layer.
At each layer, each leaf signs a WOTS+ public key generated from a seed created by encrypting the leaf index.

Obviously this would reduce the security of the scheme from acceptable to merely 30 bits, because the signing key is selected based on a 60-bit hash digest.

Q1: Can this be salvaged by using some unique-mapping function? Or we have a better chance rely on UTC time or use SPHINCS-family schemes?

Q2: What benefit can we get out of using XMSSMT over SPHINCS-family schemes?


texts: Is public key ever used to encrypt data directly?

texts:
In TLS, asymmetric encryption is used to agree on a symmetric key, which is used to encrypt/decrypt the data.
I want to ask if there is any scenario or system where the public / private key is directly used to encrypt and decrypt data.


texts:
I've been studying homomorphic encryption. From their instantiations, i read  Labeled Homomorphic Encryption (labHE) scheme 1 where it combines the notion of homomorphic encryption with labeled program.

Can someone please explain to me: What is a labeled program, and it's implications on crypto. Furthermore, I need to know what is the difference between an identity program and a labeled program.


texts:
I have read about AES and different modes of operation (CBC, ECB etc) and have 2 questions related to disk encryption:

-AES data block is 16 bytes - how does it relate to sector sizes on the drive which is typically 512 bytes? Also who or what is responsible for dividing disk sectors into data blocks?

-disk encryption software lets me configure AES key size (128/256) and is stored somewhere on the disk. Does it mean that I will use the same key to encrypt all sectors? Or maybe this key is used to calculate/derive sectors keys/block keys?


texts:
When 128-bit long data blocks are unavailable for one-time MAC:

Could 64 bits be used instead?
Should $q$ then be >=64 bits? E.g. $2^{64}+5$
Can this be scaled even further downwards to 32, 16, … bits? (block size and $q$)

The few theory sources I found:

https://www.youtube.com/watch?v=OMDDvINZNnE
http://www.crypto-it.net/eng/theory/mac.html


texts: Why does the FBI ask Apple for help to decrypt an iPhone?

texts:
The current debate of the FBI trying to get Apple to assist in decrypting an iPhone made me wonder:

Normally, upon turning on an iPhone, everything is decrypted using a 4-digit pin (or actually, a key that is derived from the PIN with a strong KDF, but that's not the point here). The key element of Apple's protection is a locking mechanism that locks or destroys the data upon 10 (or so) failed attempts.

What prevents the FBI from reading all data from the device (including any hardcoded data that may be encoded in chips or whatever) and perform the same decryption within their own environment? (…which does the same as Apple's implementation except for the self-destruction or locking feature.)

Brute forcing a 4 digit PIN is peanuts. The locking feature is not essential for the decryption process.

Is iOS's protection really just security through obscurity, or am I missing something?

(Android wouldn't be any different of course, I'd say everything that can be decrypted with a 4 or 5 digit pin instead of a strong password is fundamentally insecure).


texts: What does TLS 1.2 mean by SHA functions?

texts:
I'm looking at the technical docs for TLS 1.2 and it says it uses SHA (so hashing algorithms):
7.4.1.4.1.  Signature Algorithms
But hashing just digests an input, to do things like user authentication.
TLS is supposed to provide "communications security." Is the info itself encrypted over with TLS? What encryption algorithm does it use?


texts: Security difference(s) between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme?

texts:
We know that Blakley's scheme is less space-efficient than Shamir's and that they both work based on pretty different aspects (Shamir = polynomial-based; Blakley = hyperplane-based).
Looking at how both work, my gut feeling tells me Shamir’s scheme seems to be more robust than Blakley’s because – for example – if an insider can gain any more knowledge about the secret than an outsider can, then Blakley's system no longer has information theoretic security.

But gut feelings rarely tend to represent actual facts and I might be missing something in relation to Shamir’s scheme, which is why I’m asking:  Are there any practical security differences between Shamir's Secret Sharing Scheme and Blakley's Secret Sharing Scheme? Am I correct to think that Shamir’s scheme is more robust than Blakley’s?

It would be nice (but optional) if you could add one or more relevant references to your answer.


texts: Is knowing the distribution of input domain only way to do cipher text only attacks?

texts:
Imagine there is a $n$ bit block cipher. The attacker has harvested some how all possible $2^n$ cipher texts for some given key. Without the knowledge of the distribution of input domain as in frequency counts or some statistical information of input data. Is it possible to perform ciphertext-only attacks? Are there any examples?

Edit: Stated in other way, what does it take to launch ciphertext-only attacks on block ciphers? Can you provide any examples?


texts: To what extent is WhatsApp's statement on secure messaging realistic?

texts:
As those of you who use WhatsApp Messenger probably know, with their recent update chats and calls are now encrypted. Here's what WhatsApp claims:

  Messages you send to this chat and calls are now secured with
  end-to-end encryption, which means WhatsApp and third parties can't
  read or listen to them.

Now let's put aside how WhatsApp is honest but what they claim is a technological feature. Is it really not possible for them to read or listen to our messages? If that's a lie, then  don't they risk that some guys like you might say "Hey, what the hell are you talking about? Why do you lie?". So my question is, if they are the ones who encrypt this, then why can't they also decrypt it?


texts: Diffie–Hellman key exchange, why it's hard to break it?

texts:
I'm a bit confused why it's hard to break Diffie–Hellman

Let's take the example

ALICE has G, a, and n

BOB had G, b and n

Eve (the third party) succeded to intercept G, n, $G^a,  G^b$

ALICE generate the key G^(ab) mod n

BOB generate same key G^ba mod n

What I don't understand is why Eve cant' get a or b by knowing G^a and G^b.?

For me he can just use dichotomy:

Eve will take a random number r_a.

    if G^r_a$ < G^a /* already known */
        increase(r_a); /* by power ietration for example, +1 +100, +1000, +10000 */
    else
        decrease(r_a);
    adjust(r_a);


texts: I am trying to create a simple image encryptor in python result isnt promising

texts:
I am writing a program in python (myself) to encrypt images. I don't want or expect it to be state of the art encryption and safe at the end but i have a problem. The result encrypted image still has a recognizable trace of the original image. I know its because of they way i am encrypting it.... so what my program does it loads an image as an array of integer values for all pixel colors (RGB) and then i convert an ASCII password into numbers  from 0-94 (type-able characters) and then use a saved randomly generated dictionary to map these numbers randomly to numbers from 0-255 so that i would avoid colors possibly staying to similar. Then i use this number to shift the pixel values with formula old_pixel_value + hashed_password_character mod 256. The problem is though that if there is a big white-space or a patch of uniform color there are these repeating stripes and then you can kind of still recognize the shape ill put a picture below. So how do i change or what do i add so that the encrypted image seems more random???

(the first one is the non encrypted the second is after encryption)


texts: Calculate all possible keys for AES 128 encryption to exploit hardware encryption

texts:
Some background: I am using the MicroChip ATAES132a for hardware encryption/decryption. The ATAES132a is very configurable and can be misconfigured in such a way that the encryption/decryption will be performed using the same nonce. In theory, if the nonce is known I can do an encryption of the plain text and get the same ciphered text result. Based on this, I could possibly try to encrypt the same plain text with the known nonce and compare to the generated ciphered text until I get a match.

For example, in theory my target key could be some thing like this (see below). I would need to calculate every possible key, use the known nonce and the same plain text until I get the same ciphered text result.

const uint8_t g_key0[] = { 0x01, 0x08, 0x0E, 0x91, 0xe2, 0x64, 0x8f, 0x49, 0x0c, 0xe9, 0x80, 0x45, 0x38, 0xb5, 0x85, 0x3f };

This would exploit how the device was configured incorrectly. The ATAES132a does all its encryption with AES in CCM mode. I can perform the attack either on the ATAES132a or on any PC using any standard AES library.

Is this attack plausible using a modern PC?


texts: Is it secure to compute the exponentiation and the LWE operation?

texts:
Suppose Alice and Bob have specified an elliptic curve, for example, secp256k1. Alice has a secret number $s$ (can be seen as secret key), Bob choose a point $g$ on the curve and send it to Alice. After receiving the point, Alice computes $g^s$ and sends it the Bob.
$\text{Whether the interaction will reveal Alice's secret key?}$

Similarly, in a RLWE system, Alice has a secret polynomial $s\in R_q$ ($R_q=\mathbb{Z}_q[x]/(x^n+1)$),Bob chooses a polynomial  $a\in R_q$ and sends it to Alice, Alice  compute $as+e$, where $e\leftarrow \chi$ is a secure distribution in RLWE, then in this situation, whether Bob will learn the secret $s$? Intuitively, if Bob chooses some polynomial $a$ satisfied $ab=0$ for some $b$, then it seems that Bob could learn the $s$, but does Alice have some methods to judge if the polynomial $a$ come from Bob has the property?


texts: Obtaining the key length of a columnar transposition, given a known plaintext word

texts:
I'm revising for a cryptography exam at the moment and I'm having some problems with a question.

The question looks for the key length of a cipher given that the word "earthquake" appears in the plaintext.

Ciphertext:
aaatr ksams itahb netrs weurs rheti aadne ttrht eakgt snqid s

I was wondering how I use the fact that the word "earthquake" appears in the plaintext to make it easier to obtain the key length?

At the moment, I'm just using the method of looking for repeated letters in the ciphertext to obtain a possible key length.

EDIT:
Here's the actual question:

  Consider the following ciphertext, [12 marks]

  aaatr ksams itahb netrs weurs rheti aadne ttrht eakgt snqid s

  i) Provide some evidence to suggest that this is not a substitution cipher.
  ii) Determine the keylength of this cipher given that the word earthquake
  appears in the plaintext.
  iii) Hence or otherwise decrypt this message to recover the plaintext.
  iv) Historically a variant of this cipher had a very important application.
  Briefly describe the variant and the application.


texts: How is the plaintext to ciphertext expansion ratio on AES cipher?

texts:
My understanding for AES cipher is just mapping a plaintext of a some length to a ciphertext of the same length.

Is the ratio always |Ciphertext|/|Plaintext| = 1?

Please correct me if you have noticed something. I may luck some assumptions.


texts: Can the HMAC of a pre-hash be considered equivalent to an HMAC of the message?

texts:
Assume:

size of m = 1kB
HMAC hashing function = SHA256
H hashing function = SHA256

It seems reasonable to think that there would be no difference in authenticating a message if either HMAC(k, m) or HMAC(k, H(m)) are used as this other post indicates.  Am I missing something or are there other potential security risks in doing this?

Pre-hashing is preferred due to the reduction in HMAC validation time on large messages as only the 32byte pre-hash would need to be run through HMAC validation (vs. the entire 1kB message).


texts: What is the difference between a one-shot MPC protocol and a unbounded invocation of multiple MPC protocols?

texts:
In this paper on pg. 1236, under the section "Security Against Continual Leakage", the authors say:

  "We further remark that the weaker security notion previously
  achieved cannot be extended meaningfully to continual leakage in the
  MPC setting. That is, it cannot address the setting where the $n$ users
  do not just perform a one-shot MPC protocol, but rather engage in an
  unbounded number of MPC protocols for many functions, and during
  each MPC invocation the adversary leaks $\ell$ bits from each of the honest
  party’s internal state."

I'm confused about the difference between a "one-shot" MPC protocol vs. "unbounded number" of MPC protocols.

I am envisioning something like:

MPC protocol 1: leaks $\ell$ bits from each honest party's internal state
MPC protocol 2: leaks $\ell$ new bits from each honest party's internal state
MPC protocol 3: leaks $\ell$ new bits from each honest party's internal state
...
MPC protocol $k$: leaks $\ell$ new bits from each honest party's internal state

If there are a total of $n$ honest parties, then you have a total leakage of $n \times \ell \times k$ bits.

But if you consider the "one-shot" MPC protocol, you get just $n \times \ell$ bits leaked.

They give an example of threshold cryptography and say that, when you have a bunch of parties that compute a decryption function jointly, you may end up with the entire decryption key leaked, because every time $\ell$ bits are leaked, you can think of it as if $\ell$ bits of the decryption key were leaked.

Why are the authors even considering this "unbounded number" of MPC protocols ?


texts: Combining public key signature schemes and private key encryption

texts:
I'm working on my bachelor thesis and I have some questions.
I want to combine a CPA-secure private key encryption scheme and some unforgeable public key signature scheme (in my case some sanitizable signature scheme but I think it doesn't matter). The resulting scheme should be CCA-secure.
How can I do that?

If I use a MAC instead of the signature scheme, I get a CCA-secure scheme, but I have to use signatures, since I'm in a juristic context.
I tried to combine both schemes them by signing the message and then encrypting the signature together with the message. But I struggle with proving that such a scheme is CCA-secure. CCA Security is only defined for private-key encryption schemes or public key encryption schemes but I have to prove it for the combination of priv key encr. and pub key signatures.

So my questions are:

How can I combine an unforgeable Public key signature scheme with a CPA secure private key encryption scheme, such that the resulting scheme is CCA secure?
How can I prove CCA Security for such a scheme, since it is not defined?


texts: What procedure to use to verify a raw public key (TLS ECDHE_EDCSA ciphersuite)?

texts: Contrary of verifying a certificate which is a well-known procedure, I am wondering what the procedure is to verify a raw public key 'certificate' (https://tools.ietf.org/html/rfc7250). This certificate, as a matter of fact, does not carry any signature.


texts: Does there exist an agreeable algorithm to substitute XOR function in Shamir's no Key Protocol?

texts: I think Shamir's no key protocol (also known as three-pass protocol) is a secure cryptography scheme but the designer only proposed the XOR function to encrypt the message which could be easily broken when the eavesdropper has all the encrypted messages: all the eavesdropper has to do is to XOR them and there he has the plain text


texts: Is WPA2(PKS) AES vulnerable to 4 way hand shake and brute force attack?

texts:
I can easily crack a WPA TKIP using a dictionary/brute force method, provided that I collect the four way handshake. Is the same method possible on WPA2 AES? I cannot find any articles about '4 way handshake capture' and 'WPA2 AES cracking' together; but I was able to use aircrack-ng to crack my WPA2 AES wireless network.

Does WPA2 AES uses uses the same method as TKIP where using a 4 way handshake a temporary password is generated?


texts:
Why is Tor alone not enough to guarantee anonymity for Bitcoin?

Why do we need the constructions like Zerocoin?


texts:
is this RSA private key valid?

First, here's the RSA private key in question:

-----BEGIN RSA PRIVATE KEY-----
MIICXwKBAQACgYDDlegCjkr+Fwf48IVDJimiQdYrpDbrlyMazVeP88ELQLQrTUp/
BrCeC82CUFOyjjbuJagixYsuHhgueS3g/NXrR7XulWBjE2BruSeek8hmK+Ch+jzu
SMT+WbFIiUDHfJoERUHF02nJ12vFSuJ435/4+7vr/7zAo2M2E76et7a92wKBAwEA
AQKBgKuL7kVfnPMkLD/yZlAxRs8kQ79fdzRICehWNvjx6V3/UIeycSbdLUhSPdyQ
q/iuuAtFSCXHcn3us3L/onf2C4GZgMwh3n7022SXm3iQztSWPE4ei6CFjzG6NB2+
hXjcRoq/En/FD+65PXvnNxOJAhHSrS+kGLmNTeHMZIj4jJGBAoFA98V8RkdOgb6I
XRX/PQCI3215ODIHeqV7SZiw9TXM4dHRFYc19cXXPGffwNAi2hkOkClBRcrZT96u
AOO9Lam9uwKBQMoUvqYplONRc0JGA2+m8kUrMmaO+xKRGVQ1qkxaU5H5vKShHpPv
aO598i8yWE0rOxkEX72IawAUAv2sHxLm7mECgUBwwO5NDSYs5QgpVFlS6WtgQfFo
IVxF9Aim9VWSQWl7WoBLy7xCnEXWt26b0BwMJFr8P8n0eNtr/Wox/XGZ1iUBAoFA
O+fSbKe+/3RR2r+unRa8k0yu8EBKpcJl49TU2zWbuJZ0Gcm5qtk6HhkwBlXCX34F
UvE9AI7ESY2lJVY1EAFtgQKBQBNf1NuWHXts0msdOnCHzcb1g+CqhdUnknW5dHf4
nFKr9b9fq3f2kpqFwPUC5Ea+tocL7bwN4kgfFLJMMaLwr6A=
-----END RSA PRIVATE KEY-----

Here's the ASN.1 parsing of that key:

    0:d=0  hl=4 l= 607 cons: SEQUENCE
    4:d=1  hl=3 l=   1 prim:  INTEGER           :00
    8:d=1  hl=3 l= 128 prim:  INTEGER           :-3C6A17FD71B501E8F8070F7ABCD9D65DBE29D45BC91468DCE532A8700C3EF4BF4BD4B2B580F94F61F4327DAFAC4D71C911DA57DD3A74D1E1E7D186D21F032A14B84A116A9F9CEC9F9446D8616C3799D41F5E05C311B73B01A64EB776BF388365FBBABE3A2C963628943AB51D8720600704441400433F5C9CC9EC416148494225
  139:d=1  hl=3 l=   3 prim:  INTEGER           :010001
  145:d=1  hl=3 l= 128 prim:  INTEGER           :-547411BAA0630CDBD3C00D99AFCEB930DBBC40A088CBB7F617A9C9070E16A200AF784D8ED922D2B7ADC2236F54075147F4BAB7DA388D82114C8D005D8809F47E667F33DE21810B249B6864876F312B69C3B1E1745F7A70CE45CBE2417A8723B97540ED803AF01146C28418C8EC76FDEE2D52D05BE74672B21E339B7707736E7F
  276:d=1  hl=3 l=  64 prim:  INTEGER           :-083A83B9B8B17E4177A2EA00C2FF77209286C7CDF8855A84B6674F0ACA331E2E2EEA78CA0A3A28C398203F2FDD25E6F16FD6BEBA3526B02151FF1C42D2564245
  343:d=1  hl=3 l=  64 prim:  INTEGER           :-35EB4159D66B1CAE8CBDB9FC90590DBAD4CD997104ED6EE6ABCA55B3A5AC6E06435B5EE16C109711820DD0CDA7B2D4C4E6FBA0427794FFEBFD0253E0ED19119F
  410:d=1  hl=3 l=  64 prim:  INTEGER           :70C0EE4D0D262CE50829545952E96B6041F168215C45F408A6F5559241697B5A804BCBBC429C45D6B76E9BD01C0C245AFC3FC9F478DB6BFD6A31FD7199D62501
  477:d=1  hl=3 l=  64 prim:  INTEGER           :3BE7D26CA7BEFF7451DABFAE9D16BC934CAEF0404AA5C265E3D4D4DB359BB8967419C9B9AAD93A1E19300655C25F7E0552F13D008EC4498DA525563510016D81
  544:d=1  hl=3 l=  64 prim:  INTEGER           :135FD4DB961D7B6CD26B1D3A7087CDC6F583E0AA85D5279275B97477F89C52ABF5BF5FAB77F6929A85C0F502E446BEB6870BEDBC0DE2481F14B24C31A2F0AFA0

Here's what RFC3447 says the format of a private key is:

  RSAPrivateKey ::= SEQUENCE {
      version           Version,
      modulus           INTEGER,  -- n
      publicExponent    INTEGER,  -- e
      privateExponent   INTEGER,  -- d
      prime1            INTEGER,  -- p
      prime2            INTEGER,  -- q
      exponent1         INTEGER,  -- d mod (p-1)
      exponent2         INTEGER,  -- d mod (q-1)
      coefficient       INTEGER,  -- (inverse of q) mod p
      otherPrimeInfos   OtherPrimeInfos OPTIONAL

So pretty much the key has a negative modulus.  Seems to me that as such it's a bad key.  That it needs to have a zero before it.

From X.690-0207.pdf...

  The contents octets shall be a two's complement binary number equal
  to the integer value, and consisting of  bits 8 to 1 of the first
  octet, followed by bits 8 to 1 of the second octet, followed by bits 8
  to 1 of each octet in turn up to  and including the last octet of the
  contents octets

So given all this, why does the following work?:

openssl rsautl -inkey privatekey.txt -encrypt -in plaintext.txt -out ciphertext.txt

Quoting more from RFC3447:

   RSAEP ((n, e), m)

   Input:
   (n, e)   RSA public key
   m        message representative, an integer between 0 and n - 1

So basically, the function that does the exponentation isn't supposed to allow numbers less than zero and yet that's what we have here.

Any ideas?


texts:
I am implementing ORUTA and using JPBC library for it.
In one of the algorithms, for hashing a message, it is specified that for message m:

$m \in \mathbb Z_p$ , for some large prime $p$.

I have a message text, so how can I make sure that the above equation holds true?
(If possible someone please reply with example code or any predefined funtion able to do this).


texts: Secure degree reduction for Shamir's secret sharing

texts: I understand the basic Shamir Secret Sharing protocol, and when two shares are multiplied, the degree of the polynomial increases. I've seen in a number of papers a reference to a degree reduction protocol that can be performed to securely reduce the degree back to the original $t$. Yet I cannot find this construction anywhere. Could someone explain to me how the degree reduction is done and/or point me to a paper which describes the details?


texts: RSA: Private key given public key, plain text, and cipher text with no padding?

texts:
Are there attacks which will return the RSA private key when the attacker knows the public key, plain text, and cipher text when no padding is used in the RSA algorithm?  If yes, what are the known attacks, under what conditions have they been successfully implemented, and what other cryptographically-secure asymmetrical encryption algorithms will produce identical cipher texts from the same plain text without the attacker being able to determine the private key through knowledge of the public key, the plain text, and the cipher text?

It is not important that the attacker knows the plain text or the cipher text because they will have access to that information along with the public key.  What is important is that the private key can not be obtained and that the public-key encryption results of identical plain texts are the same.

For reference, the asymmetrical encryption usage is a subset of an algorithm which requires the characteristics specified above.

While there is a related question, there was no accepted answer and other responses to that question and similar questions caveat their answers with "when properly used", i.e., when RSA is implemented with padding:  Finding Private key in RSA with public key, cipher text and plain text


texts:
I came up with a threat model where:

Alice and Bob agree on a shared key $K$
Alice sends a plain text $M$ and its $\operatorname{MAC}$ tag, $T = \operatorname{MAC}(K,M)$ to Bob over an untrusted network
Eve collects pair of $M$ and $T$, thus mount a replay attack

First of all, I am curious whether my threat model is reasonable.

Is it possible for Eve to collect a pair of $M$ and $T$, thus mounting such an attack?

Given that, is there any replay-attack-resistant MAC scheme that is widely used?


texts: Security of semantically secure ciphers when the attacker knows the relation between plaintexts

texts: This question is about the security of public-key ciphers when related plaintexts are encrypted by the same encryption key. Take Paillier for example. I know that Paillier is semantically secure under the DCRA. Now a sequence of related plaintexts are encrypted by Paillier with the same encryption key, but for each of the plaintexts, a fresh randomness is used in the encryption. The attacker does not know the values of the plaintexts, but he knows the relation between them. The attacker eavesdrops the ciphertexts of the sequence of plaintexts. An extreme case is that the sequence of plaintexts is the same one, in which case the attacker obtains multiple ciphertexts of a single plaintext and he knows this. Will security be reduced in this case where the attacker knows the relation between the plaintexts?


texts: how to implement order preserving encryption except cryptdb

texts: Which cryptographic algorithm is suitable  for implementing order preserving encryption with out using cryptdb


texts: References about a boolean function involving hamming weight

texts:
Some weeks ago, I read an article about an interesting boolean function with some applications to cryptography. Then, I forgot about the article and now I cannot find it. Hence here I am asking if someone is familiar with this function and can give me some references. Thank you in advance.
Fix a positive integer $n$. The function boolean function $f$, taking a $n$bits words $\mathbf{x}$ as input and returning a single bit as output is defined by
$$f(\mathbf{x}) = x_{w(\mathbf{x}) \!\!\!\mod\!\! n} ,$$
where $w(\mathbf{x})$ is the Hamming weight of $\mathbf{x}$ (number of bits equal to 1) and $\mathbf{x} = x_0 x_1 \dots x_{n-1}$ (with $x_i \in \{0,1\}$).


texts: Generating non-supersingular elliptic curves for symmetric pairings

texts: I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the Pairing Based Cryptography Library, there is only a single supersingular elliptic curve implemented, which is a Type A curve. However, he also mentions that type E curves provide the possibility of a symmetric pairing. I am unclear as to how this works, and how to generate such a curve that is a symmetric pairing to be used in schemes like CPABE, as the thesis only explains arbitrary Type E curves.


texts: How often to reseed the NIST CTR_DRBG with AES256_CTR

texts:
Even at a high consumption rate of 100,000 generations per second, it would take decades to exhaust the NIST recommended reseed interval of 2**48 invocations of DRBG _generate(). Should one even care to reseed?
(REF: NIST SP 800-90A, Rev 1.0)


texts: Is it possible to recover the seed used by Python's pseudo-random number generator?

texts:
I generated some random numbers using a Python script. I have the first 40 numbers of the sequence. Is there a way to recover the seed or find the next 460 numbers in the sequence?

The numbers were generated using the following code.

import random

i=1
mn = 1
mx = 2
while i<500:
    print(random.randint(mn,mx))
    mn=mn*2
    mx=mx*2
    i=i+1


texts: As of 2019, what are the most important questions in zero-knowledge research?

texts:
Important meaning; where the most research is being focussed. Maybe because a break-though seems possible or a break-through would have big consequences.

Any questions that are being researched vigorously?


texts: ZK proof that two short solutions are equal

texts:
Let $A_1$ and $A_2$ two $m \times n$ matrices defining SIS problems.
Does there exist a zero knowledge proof that two short solutions are the same, i.e.
$$y_1 = A_1 x $$
$$y_2= A_2 x $$
$$ \Vert x \Vert < \beta$$


texts: Update non-member witness in RSA accumulator

texts:
According to study of "Universal Accumulators with Efficient Nonmembership Proofs", I don't understand exactly how to update non-member witness in construction 4.2.

In the addition step, I understood the point until finding $r$. I can't understand why new non-member witness $d' = d \cdot c^r$.

Can somebody explain how to obtain this result please?

Here is the link: https://www.cs.purdue.edu/homes/ninghui/papers/accumulator_acns07.pdf (Construction 4.2: Update of Nonmembership Witness)


texts: Timestamps, sequence numbers, and nonces for replay attack

texts:
What are the best practices or standardized methods to prevent replay attacks in a simple server client setup (preferably where the server is stateless) ?

When should timestamps, sequence numbers, and nonces be used, and what is the main purpose/differences between them?


texts: Can you use a "power of 2" gate in the BGW protocol

texts:
I am learning about the BGW Protocol and I understand that for a MUL gate, you need to follow the degree reduction protocol. I am wondering if it is possible to implement a single input and single output "SQUARE" gate that computes the square of the input?
I imagine some sort of degree reduction protocol would be involved but when I try using it in the same way as for the MUL gate, it does not seem to be working. Does anyone know if implementing such a gate is possible for the BGW protocol?


texts:
Branching program is one type of NC1 circuit and can be used to compute encrypted data. So whether there exist other methods in the NC1 circuit to compute encrypted data. What's the advantage of branching program? Why we use branching program to compute the encrypted data?

I attached some related papers as follows:

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.182.4237&rep=rep1&type=pdf

https://eprint.iacr.org/2013/267.pdf

https://eprint.iacr.org/2013/541.pdf

https://eprint.iacr.org/2016/339.pdf


texts: Proof by reduction definition in "Serious Cryptography": Cipher reduced to hardness problem or other way around?

texts:
In Serious Cryptography by Jean-Philippe Aumasson on p. 46, paragraph "Provable Security", it says:

  Provable security is about proving that breaking your crypto scheme is at least as hard as solving another problem known to be hard. [...] This type of proof is called a reduction [...]. We say that breaking some cipher is reducible to problem $X$ if any method to solve problem $X$ also yields a method to break the cipher.

I am wondering if this is the right direction. Assume we reduce the problem of breaking a cipher $P$ to some problem $X$, $P \leq_m^p X $, as suggested by the book (if I understand correctly). Then if we have a polynomial-time algorithm for $X$, we also have a polynomial algorithm for $P$. But this does not guarantee that if no polynomial algorithm for $X$ exists, there should be no polynomial-time algorithm for breaking $P$. In fact, there could still be a polynomial-time algorithm breaking $P$ in some way unrelated to problem $X$.

So shouldn't the reduction be the other way around $X \leq_m^p P$. That is, if we can break $P$ in polynomial time, we can also solve $X$ in polynomial time? This way, if $X$ is hard (not polynomial-time solvable), then by contraposition $P$ must also be hard, thus $P$ is at least as hard as X?

What am I missing here?


texts: How to confirm my implementation is constant time

texts:
I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1.

A notable difference is that the BCH schnorr algorithm uses this variant: IETF - Variant for k calculation.

I'm in scala using bouncy castle from Java. I calculate k by using something i call here nonceRFC6979 which is the implementation what i showed on the link above

    def sign(unsigned: ByteVector, privkey: PrivateKey): Result[Signature] = {
      val d = privkey.toBigInteger
      val N = ecc.domain.getN
      val G = ecc.domain.getG

      /** Calculate k*/
      val nonceFunction = nonceRFC6979
      nonceFunction.init(N, new ECPrivateKeyParameters(d, ecc.domain).getD, unsigned.toArray, additionalData.toArray)
      val k0 = nonceFunction.nextK.mod(N)
      if (k0.equals(BigInteger.ZERO)) Failure(Err("Fail to generate signature"))

      /** R = k * G. Negate nonce if R.y is not a quadratic residue */
      val R = G.multiply(k0).normalize
      val k = if (hasSquareY(R)) k0 else N.subtract(k0)

      /** e = Hash(R.x || compressed(P) || m) mod n */
      val P        = G.multiply(d)
      val pubBytes = P.getEncoded(true).toByteVector
      val rx       = R.getXCoord.toBigInteger.toUnsignedByteVector
      val e        = Sha256.hash(rx ++ pubBytes ++ unsigned).toBigInteger.mod(N)

      /** s = (k + e * priv) mod n */
      val s = e.multiply(d).add(k).mod(N).toUnsignedByteVector

      /** Signature = (R.x, s) */
      val sig = rx ++ s
      Successful(Signature(sig))
    }

this is the nonceRFC6979 implementation its identical from HMacDSAKCalculator on calculating nextK the only difference as mentioned before is that we append some extra data here named additionalData

Now I'm trying to make this signing algorithm constant time to avoid timing attacks. My understanding is that multiplycould be an issue particularly kG. from looking at the above code and for those that know Bouncy castle, what should i bee looking into to check that this is indeed constant?


texts:
I'm studying for CISSP certification & am using Shon Harris Exam Guide. It states that there are 4 modes that Triple-DES can be used in:

DES-EEE3
DES-EDE3
DES-EEE2
DES-EDE2

I understand these modes. I also understand that EEE2 & EDE2 would be faster than EEE3 & EDE3. My questions:

What is the use-case for EEE vs EDE? Does this have something to do with the hardware that is used?
Does it matter which DES mode is used?

Thanks in advance!


texts: What does the server do on receipt of a one-time-password?

texts:
I'm trying to understand this question and I do not understand part of it. I have part of figured out, part of it not.

Considering the hash function h(i) = (i + 5) mod 7, used in an implementation of the S/Key protocol, with a seed value of 0, the first password the user returns after the initialization step is 4 (i.e. h(6) = (6+5) mod 7 = 4), and the user returns 1 on the third login, like so

 -h(4) = (4+5) mod 7 = 2
 -h(2) = (2+5) mod 7 = 0
 -h(0) = (0+5) mod 7 = 5
 -h(5) = (5+5) mod 7 = 3
 **-h(3) = (3+5) mod 7 = 1**
 -h(1) = (1+5) mod 7 = 6
 -h(6) = (6+5) mod 7 = 4

On receiving this password, what does the server do?

-computes the hash of the returned password and admits the user if the hashed value is equal to the last correct password returned by the user

-computes the hash of the last correct password returned by that user and admits him if that value is equal to the password just returned

-uses the initial key to recompute the 3rd password by repeated hashing and admits the user if the recomputed value is equal to the password the use returns


texts: What is the use of Mersenne Primes in cryptography

texts: There is an international search for Mersenne Primes. The project is huge. But what is the use of Mersenne Primes in cryptography? Do they have any other properties other than the $2^n-1$ form?


texts: What does it means the security parameter K for cryptographic signatures schemes

texts: Cryptographic schemes claim to use a security parameter K for deriving signing key and verification key. What does this parameter signify ? how can be chosen?


texts:
I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at https://diafygi.github.io/webcrypto-examples/ ... and RSA-OAEP is marked using red color (Discouraged, only use for backwards compatibility).

Is there any problem with RSA-OAEP? Should it be replaced by different algos?
Or do you think that the person who wrote the table was wrong by marking RSA-OAEP red? Thank you


texts: Standard serialization format for libsodium-based messages

texts:
Does anyone know of a standardized serialization format which can be (or already is) widely used for encrypted messages? For a variety of reasons (mostly complexity, age and poor support across a lot of languages) we don't want to use OpenPGP for this case.

The use case is fairly simple, we want to create "stateless" (from the server's perspective) authorization token across a wide variety of our web-based applications, without having to implement an OAUTH-handshake as users transition from application to application. The applications are written in a variety of languages, some .NET, some Java, some Node.js, and Python.

It seems a reasonable, modern solution to this problem is to use libsodium's crypto_secretbox_easy to authenticate a user and then encrypt a message of the form:

{identity: 'someuser@example.com', expires: '2015-02-27T09:45:35.886Z'}

...and send it to the client for cookie storage. Assuming secure configuration of keys in all the various applications, we could use the libsodium variants for each platform to authenticate a user based on this encrypted and authenticated token.

The problem, of course, is how to format the message? I need to transmit the nonce as well, but that isn't part of the output of crypto_secretbox_easy, and nothing I've found during research seems to indicate there is a standard serialized message format for use with libsodium. Lots of people are rolling their own.

So, is it safe to use a general cross-platform message serialization library such as MessagePack to transmit a message of the form:

{nonce_value: 0x44ec53c1235daa22d3e0322931ce2d2c47ece2a5ae46a00e,
secretbox_message: 0xa3ce9f0edb35a058eaf90d87f871ecdf6fb7f88ec547f377fdb27780716e1904ab8663dbce724d1bfcc7ee1f40108400}

I know enough about crypto to know "there be dragons" when inventing your own protocols, and assembling crypto primitives naively has repeatedly shown to be disaster. So if there is a standardized and secure way of doing this sort of encrypted and authenticated messaging (other than OpenPGP) I would of course like to use that. If there isn't a modern standard for this task, I ask:

do you think my proposed construction is secure?
are there any reasons that general structured serialization libraries are unsuitable for use in cryptographic protocols? Looking at various PGP, TLS, and PKCS specifications, it seems this wheel gets re-invented quite a lot, and I don't quite understand why.


texts: Why is "multiplying" $g^x$ and $g^y$ not possible?

texts:
The computational Diffie-Hellman problem states that for a cyclic group $G$ of order $p$ and a generator $g$, it is hard to find the value $g^{xy}$ given only $g^x$ and $g^y$ (but easy if either $x$ or $y$ is known); the easiest way being to compute the discrete logarithm of either $g^x$ or $g^y$ and then calculating $(g^x)^y$ = $g^{xy}$.

This is probably just a big misunderstanding of group theory and/or modular operations on my part, but why is it not possible to just calculate the product $g^x \cdot g^y$ as a "regular" group operation (multiplication modulo $p$)? Is this also computationally difficult, or would the result be wrong?


texts: Complexity class of an idealised version of Bitcoin's proof-of-work (hashcash)?

texts:
To formulate this question precisely, I will define an idealized hypothetical "perfect" hash function $H(n)$ which has nice scalability properties, and will formulate a problem PERFECT HASHCASH in terms of that, understanding that practical considerations may end up yielding only an approximation of this ideal.

To keep it simple, we will say that our hash function $H(n)$ takes as input a single natural number $n$. Then we say that $H(n)$ is a perfect hash function iff:

$H:\mathbb N \to \{0,1\}^\infty$; That is, $H$ maps each natural number to an infinite binary sequence, and which the time complexity to compute any initial segment $s$ is polynomial in the size of $n$ and $s$, (making it a sponge function).
For any initial segment of length $d$, the set of all natural numbers $n$ such that $H(n)$ shares that initial segment has natural density $2^{-d}$.

The first thing formalizes the scalability of our function, and the second thing formalizes the idea that we want all hashes to appear roughly "equally often" as an output. Other than that, our perfect hash function is a black box, and we don't care much about exactly how it works, so long as it meets the above properties, as well as the usual desiderata applying to hash functions (easy to compute, hard to invert, hard to find collisions, etc).

Predicated on the assumption that a perfect hash function exists, we can now define the problem PERFECT HASHCASH as follows: PERFECT HASHCASH takes as input a perfect hash function $H$, a natural number $n$, and the zero vector $0^d$ of length $d$, which can be thought of as a unary representation of $d$. A solution to PERFECT HASHCASH consists of an $n$ and $d$ such that $H(n)$ starts with $0^d$.

Given those inputs, it is clear that PERFECT HASHCASH is in the complexity class TFNP, since this is a function problem and a solution is guaranteed to exist.

Can we also identify PERFECT HASHCASH as a member of any complexity class finer than TFNP?

Could it perhaps be in PPP? PPA? PPAD? Something else?

For background, see Complexity class on Wikipedia.


texts: Can a 3rd party decrypt static Diffie Hellman?

texts:
Do cipher suites that use static Diffie Hellman (not Ephemeral) allow for the same 3rd party decryption ability as RSA cipher suites?

With RSA key exchange, 3rd parties can gain possession of the plaintext random numbers that flowed in the Client and Server Hello records.

If also in possession of the server's private RSA key, they can decrypt the pre-master secret in the Client Key Exchange, and therefore derive the same master secret and symmetric keys as the client and server.

Building on this question and the general Wireshark documents around DH, I am wondering if static DH allows for the same sequence of 3rd party decryption as RSA?

Is it only the DHE key exchanges that block 3rd parties from performing the above steps, thanks to there being no long-lived key to share with them?

Existing questions and documentation only seem to concern Ephemeral rather than Static DH.


texts: Why are the ciphertexts of Ansible Vault's AES256-encrypted files disproportionately composed of '3' and '6'?


texts: Is there a standard for hashing a list of strings?

texts:
I'm working in Python, and my goal is to hash a list of strings with a cryptographic hash function such as sha256. It would need the property that a change in any string, or the order of the strings, will affect the outcome. For example, this would not be sufficient.

sha256(''.join(['string1', 'string2'])).digest()

because ['string1', 'string2'], ['string1str', 'ing2'], as well as ['string1string2'] will all result in the same hash.

One idea I've had for this is to hash repr(strings), but I'm concerned this may be inefficient, as unprintable characters are converted to the 4-byte form \xAB.

strings = ['string1', 'string2', '\x00', '\\x00']
tohash = repr(strings) # tohash == "['string1', 'string2', '\\x00', '\\\\x00']"
result = sha256(tohash).hexdigest() # 2da24fba01c065fe1f33cb937dec2c865de20ebdbd8f172d59d82cd920d3266d

This method works, but I haven't seen it used anywhere else, and it seems inefficient. Is there a standard way to hash multiple strings?


texts:
A client wants to train an algorithm. A data provider encrypts its data and sends it to the client. The client operates on it and sends the result back to the data provider for decryption. Once decrypted,the data provider sends it to the client.
For this I am working with an asymmetric algorithm, public key, with fully homomorphic property: BFV.
I was wondering if there is any way for the client to verify if the decryption is performed correctly, since the cryptosystem has its share of randomness.


texts:
I want solve the next exercise. The author defined the experiment for the cryptosystem $\Pi$, the adversary $A$ and the security parameter $n$ as follows

$\mathsf{PRIV_{EAV}}(\Pi,A,n)$

The adversary $A$ get the input $1^n$ and choose two messages $m^{(0)}$, $m^{(1)} \in M$ with same length;
One key $k \in K$ is generated using $\mathsf{Gen}(1^n)$, and one bit is chosen uniformly at random. Then the message $m^{(b)}$ is encrypted and sent to $A$;
Eventually $A$ outputs b';
If $b=b'$, the experiment result is 1. Otherwise 0.

Definition A cryptosystem $\Pi$ has indistiguishable ciphertexts in the presence of an eavesdropper if for all adversaries $A$ there exist a negligible function $\mathsf{negl}$ such that

$$\Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1]\leq 1/2 + \mathsf{negl}(n).$$

My question:
How will I be able to prove that the cryptosystem described below is not secure under the definition above.

Cryptosystem $\Pi$:

$\mathsf{Gen}(1^n)$ chooses a bitstring $k \in \{0,1\}^n$ uniformly at random,
$\mathsf{Enc}(m,k)$ works as follows: The message $m$ is split into blocks $m_0, m_1, \dots ,m_l$ of $n$ bits. Each block is encrypted separately, as $c_i = m_i \oplus k$. The ciphertext is then the concatenation of the encrypted blocks $c_0, c_1, \dots ,c_l$;
$\mathsf{Dec}(c,k)$ is analogous to Enc, but permuting $c$ and $m$.

Notation

$K$ is the key space, $M$ the message space and $C$ the ciphertex space