texts:
I'm more of a visual person, so a chart or table layout usually works best to help me "see".

I'm just trying to locate a resource that shows me where the various ciphers fall in relation to each other based on the various configurations they can be used.

Same for file hashing (using SHA-1 vs HMAC SHA-1, etc).

NOTE: As I cannot yet "comment" I am adding clarification here:

The challenge I am facing is that I am trying to appreciate the scope of what a single view of how the different ciphers compare to each other, but based on comments below I think I see why one does not exist (yet).

So I am trying to learn how best to compare and contrast the various ciphers to know which is best - for the sake of argument let's say for SFTP encryption for data in transit.

Maybe what I should be asking for is the process or method by which I should go about determining which cipher to use in any given situation.

Not trying to be difficult or vague, just a middle aged veteran trying to get better at understanding cyber as a new career is all (less than 3 years) and looking for ways to grock it. The text books haven't helped much and I find that usually someone on a forum can phrase it in such a way that I "get" it.

Thanks in advance.


texts: How do you find the inverse degree of a hash function?

texts:
I am trying to learn cryptanalysis on the Keccak hash function. One of the papers on zero sum distinguishers talks about Keccak having inverse degree of 3.

I am unable to figure this out: how do you get an inverse degree of 3? For example one of the permutations Chi in Keccak does the multiplication in GF(2). So I would guess that means the image transformation for Keccak has degree 2, but am unable to figure out how they derive degree 3 for preimage or inverse or going backwards.

If someone can point me to a resource, that would be of great help, since I am unable to find one.


texts:
Is there any conformance tests/sequences to validate AES-GCM & GHASH() implementation?

Details: I'm implementing AES-GSM, that's just for better understanding of that stuff, nothing more. Well I need to validate somehow my result. There is 'openssl' and some python libraries to do encryption but they allow to check only final encryption result and nothing else in between. I haven't seen anything at all to validate 'GHASH()' or 'multH()'.

Thanks.


texts:
Suppose that Alice wants to send a message to Bob and wants to make sure that Bob knows he has received the correct message.

She sends the pair $(x,h(x))$ for some hash function (preimage resistant, second preimage resistant and collision resistant). Bob receives a pair $(x',y')$ he calculates $h(x')$ and if he has $y'$, he concludes that the message has not been tampered with.

But the attacker could also change $y'$. So is the hash of $x$ actually sent by another means?


texts: How to find the secret key and nonce from two messages encrypted using the same nonce?

texts:
As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken.

If I use NaCl's crypto_box http://nacl.cr.yp.to/box.html to encrypt two different plaintexts with the same secret key and nonce, can an observer of these messages recover the secret key and nonce?

If so, how?

P.S. Sorry, tagged as libsodium as there wasn't an NaCl tag.


texts: Encrypting between nodes that have RSA keys: Diffie-Hellman or random secret key?

texts:
I have two peers with RSA keys; they want to encrypt a non-trivially sized message between them, so I want a random AES symmetric secret key, which is encrypted with Bob's public RSA key, and sent along with the AES ciphertext.

I believe this idea is pretty standard. The question is: do I generate the AES key using Java's SecureRandom.getInstanceStrong(), or do I implement Diffie-Hellman between the two nodes?

I assume the main advantage of DH is forward secrecy. Are there any other considerations? How difficult is it to implement DH securely?


texts: What is the origin of the word "Keccak"?

texts:
Where does the word or acronym Keccak come from?

Guido Bertoni, Joan Daemen, Michael Peeters, and Gilles Van Assche. Keccak sponge function family main document. Submission to NIST (updated), 2009.
"NIST Selects Winner of Secure Hash Algorithm (SHA-3) Competition". NIST 10/2/2012.


texts: Why nobody considers counter re-keying as a standard Block Cipher Mode?

texts:
One of the simplest possible cipher modes is setting each successive key as a function F of the previous one.

K[0] = Master key
C[i] = E(K[i],P[i]), K[i]=F(K[i-1])

This is similar to the counter mode CTR, but the key is incremented instead of the plaintext.

Obviously this mode is slower than the others, since key schedule takes generally more time than encryption (2 times more for AES). Nevertheless some ciphers have very fast re-keying. Also there is the problem with related keys attacks, and some ciphers are not well protected to them — but still this is not a problem for all ciphers.

I wonder why it is not even mentioned as an alternative block mode nor it has a proper name.
Does it have any security drawback? Is it broken?


texts: Factorization or discrete logarithm is difficult for an attacker?

texts:
I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer factorization and Schnorr scheme, which is based on discrete logarithm problem.

My idea is to create signature based on any of these schemes. I am using this on embedded system, where the limitations are

Less computing power as compared to Laptop/Desktop
Amount of data sent between parties is less; may be 128 bits of messages
Data allowed for signature is also less; usually 64 to 128 bits

Considering this which ones is relatively difficult for the attacker?


texts: Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

texts:
Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org)

In particular, I want many Bobs to be able to get many public keys (for an offline identity Alice) which can later be used to verify the signing of some data by Alice, without anyone (apart from Alice) knowing that the public keys belong to Alice.


texts:
I am working on a password manager application that saves the user's passwords in a remote server. I need to use AES in CTR mode to encrypt the passwords before sending them to the server. The client is supposed to login/identify himself with a master password (which is already set in the server). This is what I've thought of until now:

Client connects to server.
Server sends a random value RAND1.
Client generates a random value RAND2, and calculates hmacKey = SHA1 (master|RAND1|RAND2).
Client calculates HMAC of RAND2, appends it to RAND2 and sends it to the server.
The server (who knows the master password) calculates its own hmacKey and verifies the client.

This hmac key would be used during this whole session. Is this secure?


texts:
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly the 128 bit that is needed. I had thought that one would just add zeros or repeat the password until the length becomes 128 bit. However, after implementing these options, I can see that the key doesn't look quite random.

I understand that one might use PBKDF2. From what I understand, one has to choose a hash function and that the SHA might be a good choice.

I would like to write my own block cipher from scratch, and having to write all the code for SHA seems a bit much for me right now.

(1) Is there a nicer simpler hash function that could semi-securely be used in PBKDF2? Or alternatively a simpler, but still nice way of padding a password that would be "easy" to do "by hand"? At least, I would like something simple so that I can finish an implementation of TEA.

[(2) Bonus question: I noticed that the hash functions SHA, MD5,... seem to produce a string that is made up of characters with ASCII codes in printable range. Is that a problem when hashing passwords that are used to encrypt plaintext?]

EDIT: I realized that I was wrong about what I had "noticed" in questions 2.


texts: Present an attack for the combination of OTP and textbook RSA

texts:
Let $N=p \times q$ where $p$ and $q$ are two primes.
  Compute $\Phi (N) = (p-1)(q-1)$.
  Choose $e$ s.t. $1 < e < \Phi(N)$ and $gcd(e,\Phi(N))=1$.
  Compute $d = e^{-1}(mod  \ \Phi(N))$.
  Set $pk = (N, e)$ and $sk = (N, d)$.
  Let $m \in Z_N$ be a plaintext message. A random $r \in Z_N$ is selected, such that $|r|=|m|$, and the plaintext $m$ is encrypted: $E_{pk=(N,e)}(m; r) = ((m \oplus r), (r^e\ mod\ N))$.

Present an attack against this scheme assuming the weakest possible attacker capabilities.

I couldn't think of any easy attack here. The random key for the OTP is encrypted using textbook RSA, and aside for the "usual" textbook RSA attacks, I don't see anything special in this scheme that can be attacked. This is a question from a past exam, so I don't think the meaning is to simply state the known textbook RSA attacks. Any help would be appreciated.


texts:
First of all sorry if this question could be trivial, but I did some researches and it seems to me that this is a standard approach, but I want to be really sure.

I'm developing a signed/encrypted communication block channel. And, to encrypt/sign it, I chose the ECC.

Now, in order to send a message, I will do this

Download the server's public key
Generate an ECC key on the client
Create the shared secret between the server's public and the client's private keys
Calculate the hash of the shared secret (e.g. SHA-384)
Divide the hash in two parts; one will be the communication key (e.g. 32 bytes for AES-256), the other the IV (if AES, 16 bytes)
Encrypt the message with the appropriate algorithm and symmetric key
Sign the message with the client's private key
Send the client's public key, the encrypted message and the signature

Now, I have three questions about this:

Is this approach secure or there is some naive issue?
Is it better to sign the plaintext message or the ciphertext message? I'd sign the plaintext (so the server can verify if the message is correctly transmitted), but this would give the attacker a way to understand if the attack was successful
What is the suggested ecc key size for this? If I calculate the SHA-384 of the shared secret, is the same ecc key size (so using curve P-384) a good choice? Should I use the biggest key possible (P-521)? Is even a smaller one enough (P-192)?


texts: Which compound algorithms would weaken cipher, not strengthen it?

texts:
OK, in school, some of the lecturers always say "if you compound the crypto, it may make the cipher weaker".

So, which combinations of algorithms would do this? Why? Can anyone show the mathematical proof?

For example, would RSAk1(AESk2[AESk3[x]]) make the encrypted x weaker? Assuming all keys used are different and randomly generated using a SecureRandom function.


texts: Why is the simulation required in these identity-based encryption security proofs?

texts: In identity-based encryption papers (i.e.this) it is very difficult for me to understand security proof. I don't know why they prove assumption (BDH, BDDH) for security of their scheme. Some uses random oracle and most of them try to simulate the scheme. Why is the simulation required in these security proofs?


texts:
I'm trying to construct a no-query-secure MAC $II=(Gen,Mac,Vrfy)$ without using any cryptographic primitives such as PRF, PRG, has function, etc.
My-attempt:
I learned that a message authentication code (MAC) is no-query-secure if in the security game the adversary is not allowed to query for any MAC.
I tried to get the Gen, Mac, and Vrfy as follows
Gen$(1^n):$ Sample $k←\{0,1\}^n$ and output $k$.
Mac$_k(m):$ where $m∈\{0,1\}^n:$ and Output $t$
Vrfy$_k(m,t):$ Output 1 if and only if $?$
I couldn't figure it out what Mac will output i.e. $t=?$ and Vrfy will output?


texts: Does AES specify error messages when using the wrong password to decrypt?

texts: I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do these errors come from the original AES spec or not?


texts: I have a question about security of FE1(Page 16-18) in paper "format preserving encryption". Can anyone explain me, why we are allowed to replace PRF with random function in security proof? And also, why is game $G_0$  the same as game $SPI_1$ (explained in page 6) and is game $G_1$  the same as game $SPI_0$?


texts:
I am looking at ways to speed up modular reduction for the polynomial

$$2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1$$

I have read the paper "Generalized Mersenne numbers" by J.A. Solinas, but it does not seem to list this form of polynomial as a candidate for fast modular reduction (see section 10).

Using the definitions in that paper, this polynomial would seem to be a) proper (second largest degree is negative), b) irreducible c) has an odd constant term (-1)

Its weight is 36.

I could not find any other specific reference in the literature.

So my question is: is this a candidate for fast modular reduction using Solinas suggested method?

Other possible reference is this master thesis: https://crysp.uwaterloo.ca/software/gmnt/gmz_mcs_thesis.pdf . However, the examples and explanations appear to be drawn directly from the Paper by Solinas.


texts: Does an encryption algorithm exist where encrypted data can be decrypted by multiple private keys?

texts:
Suppose I have Company1 with their own Public/Private Key Pairs and another Company2 with their public/private key pairs and yet another Company3 with their public/private key pairs.

Is there any way/algorithm to encrypt a piece of data, given we provide Company1 and Company2 public keys to it, such that the encrypted data can be decrypted by EITHER ONE of their private keys. i.e. upon receiving the encrypted data, Company1 can use their private key to see what it actually is, and so can Company2, without them knowing each other's private keys. Also, Company3 should in no way be able to decrypt that data.

I've also been looking at Shamir's Secret Sharing algorithm. It works somewhat for our use case, assuming we encrypt each share using PGP and share it to the companies. In our specific use case, the bottleneck is that any data sharing between the companies happens on a shared ledger/database -- so by default everyone sees everything. Also not sure what the maximum number of shares are in this case, as its possible the list will grow to hundreds of shares being generated.


texts: What role does RSA play in DHE_RSA cipher suite?

texts:
I've read in this article, that encrypting a premaster key with a RSA public key is not safe from forward secrecy attacks. If an adversary, records all communication between a client and a server. And the server later is decommissioned and retrieved by the adversary and the adversary also retrieves the private key stored in the server. He can decrypt the premaster key and generate a master key and decipher all recorded communication between the client and server.

To prevent forward secrecy attack, one can implement Diffie-Hellman Ephemeral Mode for the premaster exchange.

Now to my question. What role does RSA play in this if DHE is used? Because I've seen cipher suites with RSA and DHE in it.


texts: Is it possible to guarantee a SHA-256 hash will begin with a certain 3 bytes?

texts:
I've found this online currency someone has built as a project and it's "miner" / Proof of Work algorithm is as follows:

Generate 32 bytes of random data and hash it, store the original value and the hash
Test if the hash begins with a "server key" which is the 3 bytes the hash has to begin with to be valid
Submit the value to the server and it will award you with some of the currency and change the server key if the value that you sent's hash begins with these first 3 bytes.

Since a SHA-256 hash is 32 bytes, and I would only need to guarantee the first 3 bytes to mine the currency, would it be possible to get values that produce a hash with these first 3 bytes, but faster than just random hashing?


texts: What are the consequences (and potential mitigation) to poor entropy/RNG on server-side during ephemermal key generation and DH exchange

texts: I am using a hardware TRNG feeding the entropy pool on the client side. But, in a world of virtualized, headless server hosts, what are the cryptographic/security consequences for random numbers (or a RNG) of possibly poor quality (entropy) being used on the server side of ephemeral key generation and DH key exchange? Are there any mitigation strategies from the client side when server side operation is out of client's control?


texts:
I often read that MAC's provide a proof of authenticity of a payload 'in transit'.

I'm wondering though is there any special definition of "in transit" that would prevent it from being reliable over a long period of time - for example proving the data was not simply corrupted by a storage medium.

if the meaning is 'over the wire where an attacker only has a short amount of time to successfully modify the payload and MAC', then the implication would be that it is unsafe to store the payload and MAC long term to provide authenticity at a later date.

The meaning I'm guessing is 'end to end' authenticity, say between Alice and Bob independent of time.

This may be a silly question that simply boils down to are MACs secure, then that would be dependent on the specific HMAC, GMAC or what ever is used.


texts:
In ECDSA, $f(G)=r$, where $r$ is the $x$-coordinate of group element $G$. My question is, how to prove this $f$ is not uniform? In other words, how to prove that, given a random element $G$ with different x-coordinates on an elliptic curve, $r=f(G)$ is not uniform over $\mathbb{Z}_q$? I would like to stress that here we see the group elements that share the same x-coordinate as the same ones.
I know in the paper ''On the Provable Security of (EC)DSA Signatures'', the author has talked about this. But I could not understand what they mean("On elliptic curves, for only about every second $x$-value a corresponding curve point exists; this is responsible for a
huge bias of the $x \bmod q$ function"?). Can anybody give a more clear explanation?


texts:
I feverishly searched the web and couldn't find a clear explanation about what exactly is "Ephemeral diffie-hellman". Let's briefly recall how diffie-hellman basically works:

Bob and Alice agree publicly on a generator ($g$) and a prime modulo ($p$)
Bob selects a private integer ($b$) and computes $B=g^b \bmod p$. He then passes $B$ publicly to Alice
Alice selects a private integer ($a$) and computes $A=g^a\bmod p$. She then passes $A$ publicly to Bob.
Bob computes $K = A^b\bmod p$
Alice computes $K = B^a\bmod p$

So now Bob and Alice both have $K$.
The explanations I see on the web are all sorts of:

Ephemeral Diffie-Hellman (DHE in the context of TLS) differs from the static Diffie-Hellman (DH) in the way that static Diffie-Hellman key exchanges always use the same Diffie-Hellman private keys. So, each time the same parties do a DH key exchange, they end up with the same shared secret.

First to verify some issue: Are "private keys" in the context of diffie-hellman refer to the private $a$ and $b$ that Alice and bob privately select respectively? I'll assume they do, if not - correct me please.
Now, what I don't understand here is, what does it mean that "static DH exchanges always use the same Diffie-Hellman private keys."? I mean:

What is considered an exchange? A session of information exchanging between to parties?
If so, does static DH refer to exchanges between the same two parties?
If not so, considering that, seemingly, using static DH also requires the use of the same $g$ and $p$, how does using static DH will always generate the same $K$?

It'll be great if someone could clarify this whole subject. Thanks


texts:
I'm looking around for publicly published work on factorization of large numbers using distributed systems of any kind. So far I've come across the PDF "Mapreduce for integer factorization" by Javier Tordable" which looks like an interesting read.

Are there any papers in particular that I should be reading?


texts:
Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password.

Additionally, when entering the password a second time, it should be checked for validity, meaning whether the same encryption key was derived as for the first time.

A possible approach would be:

During key generation:

Derive a 256-bit key from the initial password using Argon2i
Invoke Argon2i a second time using the output of the first "round" as its input
Save the result of the second "round" to persistent storage
Use the result of the first round for encryption

During key regeneration / verification:

Perform steps 1./2. above for the re-entered password
Check the result of the second round against what was previously saved to persistent storage
Use the result of the first round for decryption

Is this approach "safe" when for each invocation of Argon2i the same parameters, but different salts are used? Could there be unintended side effects when chaining Argon2i invocations together? Is it safe to assume that it is impossible to compute the result of the first round given only the result of the second round and all salts? Can the approach be safely extended to use even more rounds?


texts: What is the meaning of the overlapping region on OTP-perfect secrecy diagram?

texts:
I'm new to cryptography. I want to ask about OTP-perfect secrecy diagram like figure below:

On the overlapping region (middle), notated by R(X;Y;Z). R can be calculated by I(X;Y) - I(X;Y|Z). That region is symmetric in X, Y, Z and can be negative. For example when X and Y are independent bits, and Z = X xor Y, then I(X;Y) = I(X;Z) = I(Y;Z) = 0, but I(X;Y|Z) > 0.

What is the "meaning/philosophy" of that region? I mean when the region is negative, when the region is positive, and how to describe that?

I have been trying to find the answer but no result.


texts: How does hash speed vary based on string length?

texts:
Surprisingly I have not been able to find an answer to this question on Google.

If I have a function that is based on any of the popular hashing algorithms used for password generation, by what percentage/magnitude does the speed change when the string length increases? Assuming the salt is retrieved from the function.

Function GetHash("CAT")

Function GetHash("I like cats, cats are great, I am a longer string")

I am looking only for the most approximate of answers, for example the difference might be tiny (<1% increase in time for a longer string), or it might be twice as slow (100% increase), or it might be more.


texts:
I am working on securing DICOM medical images, and the proposed approach is to use selective image encryption based on a segmented Region Of Interest (ROI) and Region Of Background (ROB) of the DICOM image. However, I could not find the answers to the following questions, which are:

Why we need to encrypt DICOM images' pixel data if the DICOM provides mechanisms to encrypt the DICOM header data (patient and clinical information) using AES? As I found many researchers encrypt DICOM images' pixel data in the literature.
Does the PACS system have any requirements to have a readable DICOM image format, even if it is encrypted?
Which of the following two scenarios can be applied? Why? Are both applicable to the PACS system? what's the difference?

The complete encryption of the DICOM file (image pixel data + metadata (header data))
Encrypting only the pixel data (where will appear as distorted image) which preserves the header information (codec information) of the encrypted image.


texts: How many low-order bits of an RSA modulus can we safely fix to 1?

texts:
It's easy to generate an RSA modulus $n=p\,q$ of $k$ bits with $n\equiv-1\pmod{2^\ell}$, for $\ell$ up to about $k/2$: we can choose $p$ as usual, fix the $\ell$ low-order bits of $q$ to $-p^{-1}\bmod2^\ell$, and choose $q$ with this constraint. This fixes the low-order $\ell$ bits of $n$ to 1, and thus appreciably simplifies Montgomery arithmetic when using the public key.
As an aside, that could be used to halve the storage requirement for $n$.
Up to what $\ell$ is that safe?
Some $n$ (in hex) for $k\in\{256,512,1024,2048\}$, $l=k/2$, generated using this TiO.
f0e32fe555bf8c5027734fcb32b6d51bffffffffffffffffffffffffffffffff
dec79757c4b1ca15fbe0854a75f38749df4768884c9e9c24af0f09d61a3d1811ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
af8c7235e1938b869a28c310c362444331f19c9b9cc578751a1a8f0859e1ae72916abd7351d82f0ffcb9b84eca441ee37f3646e5890c4ba94f9d6811d4b7f708ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
b22220297783289475800ddba5f2e9cfbdf64f2de3a23f10ac7d191d2f4fee2bba4d01dee6c851e8ed42fa1c4d5cafbec97e19e1735d1350f6b5ec1e26d9ef557c3c8938dc1b831a917337903977f15573f35be50607e6080dac8f967c6e3f1bea171870205d64f8b7263ed7ff20585c38d62505c77d0206dcc4dabeda45dd11ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff


texts: Why would one split HKDF output into multiple parts instead of expanding it multiple times

texts:
Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC:

  HKDF is used (...) to generate 80 bytes of output.
  (...) HKDF info is set to an application-specific byte sequence
  distinct from other uses of HKDF in the application. The HKDF output
  is divided into a 32-byte encryption key, a 32-byte authentication
  key, and a 16-byte IV.

So the following is proposed

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info', 80) -> OKM

What is the advantage over expanding PRK 3 times for IV, AES-Key and MAC-Key by using the info parameter? e.g

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info_iv', 16) -> IV
HKDF-Expand(PRK, 'distinct_info_aes', 32) -> AES Key
HKDF-Expand(PRK, 'distinct_info_mac', 32) -> MAC Key

The only thing I see is that the former approach is slightly more efficient by doing only a single expand (e.g. only 1 HMAC = 2 hashes) instead of 3. On the other side, as far as I understand HKDF, expanding multiple keys from the PRK is exactly the point of the 2-step approach and is also clearer to read and understand for developers who are less familiar with implementing security relevant protocols.


texts: How do I invert the final round S Boxes during linear cryptanalysis

texts: I'm using Howard Hey's tutorial on linear cryptanalysis, however I don't understand the final stages. I understand using exhaustive partial subkeys to turn the ciphertext into the final round output, however I don't understand how to invert and pass these values back through the final round S Boxes. I'm not looking for an exact answer, just a generalisation on how to invert the final round S Box thanks


texts: Deterministic generation of secure private keys from parent private key

texts:
is it possible to generate set of child private keys from one parent private key, generated by ECC for example, securely? So that new private key (and derive public key) could be used for encryption or signing/verification?

The process of generation of a new private key could be relatively slow (up to a few seconds), so that even if attacker obtains some of the child private or derived public keys, he would not be able to derive parent private key - by lets say making some statistical analysis on them.
My intuitive take on this would be to basically encrypt the padded (deterministic)index of the child and then use some pwd hashing algorithm/technique like:

Key Stretching (bcrypt, scrypt, ...)
recursively calling HMAC multiple times

To obtain the child priv key. For the next child you should just increment the index. So in essence and without any other optimizations it could look like this:

function getChildPrivKey(index, parentPrivKey, parentHMACKey) {
  encryptedPaddedIndex = aes.encrypt(index, parentPrivKey)

  return recursivelyCallHMAC_X_Times(parentHMACKey, encryptedPaddedIndex, 'blake2b')
}

parentPrivateKey = ...
parentHMACKey = getRandomNumber()
firstChildIndex = 000....0 // 256x0

firstChildPrivateKey = getChildPrivKey(firstChildIndex, parentPrivateKey, firstChildIndex)
secondChildPrivateKey = getChildPrivKey(firstChildIndex+1 , parentPrivateKey, firstChildIndex)
// ...

My questions are:

general: Is this a right direction?
hmac: Would HMAC be considered convenient in this context over Key stretching with a salt (like in bcrypt or scrypt)?
optimization: Would introducing many more recursive rounds of hashing make this better?

Thank you very much and I am sorry if this question is silly/trivial/mixing some concepts - I consider myself a relative newcomer to cryptography


texts: System parameters in identity-based encryption


texts: Soundness idea of basic zero knowledge prood

texts:
I am having a hard time figuring out the soundness proof of the bellow zero knowledge protocol.  As it is a typical proof, I would love to deeply understand it.

zero knowledge argument that $h \in <g>$

Lets $G = (\mathbb{Z}/n\mathbb{Z})^{\times}$.  The prover wants to show to the verifier that $h \in <g>$.  The common inputs are $G, h, g$ and the prover has the value $a$ such that $h = g^{a}$.

The protocol goes like...

         Prover                         Verifier
--------------------------------------------------
y = g'^k mod n           y
                 --------------->  choose challenge c
                         c
                 <---------------
s = k + c*r mod |G|
                         s
                 --------------->  check if g^s mod n = y*h^c mod n

In the case the protocol was poorly explained her, here is another version of it Non-interactive proof that an element is in a subgroup

Many thanks!

didier


texts: Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

texts:
I am trying to prove that:

"If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken."

Can you help me to prove it? Is there any proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

My related question: Can you help me design a simple communication protocol?


texts:
I need to store passwords for a web application, and was looking at Bcrypt for a possible solution. After some research, it appears only the first 72 bytes influence the final hash output. While it is possible for the application to limit input to 72 characters, this hurts users with password managers that produce very long passwords.

While it is well known that hash1(hash2(x)) only serves to increase collisions, there doesn't seem to be much information about the implications of using bcrypt(hash1(x)), as indicated by this answer.

First idea

If the password p is p > 72 bytes, SHA512 [64 bytes] the password and then Bcrypt the hash.

Possible cons:

hashing a hash
the input to Bcrypt is only ever as big as the output of the hash function (64 bytes)

Second idea

If the password p is p > 72 bytes, calculate the hash with (pseudo-code):

bcrypt(p[0:8] + sha512(p))

This Bcrypt's the concatenation of the first 8 bytes of the password (which is 72 - 64, where 64 is the bytes of the SHA512 hash) with the SHA512 [64 bytes] digest of the entire password. By this, the Bcrypt function hashes an entire 72 bytes, instead of just 64 like with the plain old SHA512 [64 bytes] hash.

Probable pros:

full 72 bytes are Bcrypt'ed
does not Bcrypt just a hash; this may make it so that if a collision is found in the SHA512 [64 bytes] hash, there are still a leftover of 8 bytes of entropy needed to crack the password

Possible cons:

still involves partially hashing a hash

I'm under the impression that the second idea is the best and most secure way to go, but I'm not sure if that, at all, decreases security for passwords > 72 bytes in length. I'm asking if there are any obvious (or non-obvious) security implications with choosing this method.


texts: What causes first block of AES decryption to be garbled, even with correct IV?

texts:
I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server.

The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA

I wrote a utility that takes apart the packet captures using libpcap, and so far can match what the logs from wireshark say they have in terms of MAC keys, Write keys, and IV's; printing out the binary data as hex characters.

Visually, I can confirm that the keyblock and ciphertext are identical to what wireshark's log display.

However, after I perform the following decryption steps:

... decrypt pre_master_secret, generate keyblock
... initialize cipher context

EVP_CIPHER_CTX_init(&myevp);
if (!EVP_CipherInit_ex(&myevp, cipher, NULL, wKey, IV, 0))
    LogError("evp_cipherinit_ex:", ERR_error_string(ERR_get_error(), NUL));

dec = EVP_DecryptUpdate(&myevp, outb, outlen, data, datalen);
totalcount += outlen;

if (!dec)
    LogError("evp_decryptupdate:", ERR_error_string(ERR_get_error(), NUL));

if (dec && blocklen != 1) {
    dec = EVP_DecryptFinal_ex(&myevp, outb + totalcount, outlen);
    totalcount += outlen;
}

...get padding from last bit of outb, and remove padding from outb (plaintext)
...remove the MAC from the plaintext

The resultant plaintext I get is identical to what wireshark spits out in their logs, with the execption of the first block of decrypted data.

I know that in general, this is usually caused by not having a correct initialization vector when you begin the decryption.  However, all my computed keyblock values seem correct (that is to say, they jive with what wireshark is spitting out).

here's the first few blocks of what wireshark shows...

Plaintext[432]:
47 45 54 20 2f 68 65 6c 6c 6f 2e 68 74 6d 6c 20
48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20
31 37 32 2e 31 36 2e 32 34 34 2e 31 39 36 0d 0a
...

and mine

plaintext_update[432]
e1 a2 f4 b3 2a 93 d1 c4 1b f4 60 d8 c9 92 03 25
48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20
31 37 32 2e 31 36 2e 32 34 34 2e 31 39 36 0d 0a
...

It's just that first block.  I can verify before the Decryption step that the evp context has the correct original IV value and the current are there.

LogData("evp oiv", &myevp->evp.oiv, &myevp->evp.cipher->iv_len);
LogData("evp iv", &myevp->evp.iv, &myevp->evp.cipher->iv_len);

here's the one from wireshark

Client Write IV[16]:
8b 55 c0 c5 3c 77 dc 91 09 22 18 8b 0c 53 16 66

here's mine

evp iv[16]
8b 55 c0 c5 3c 77 dc 91 09 22 18 8b 0c 53 16 66

Likewise, the keys are the same. I don't think I need to illustrate those values, as the remaining blocks do decrypt correctly.

I've also checked to make sure that first block isn't gzipped, or whatever.  I checked the wireshark code, and they are doing the same equivalent stuff I'm doing, albeit in libgpgcrypt.

Anybody ever seen anything like this?


texts: encrypt message with one digest 0-9 instead of 01-26

texts:
How much will the security of one-time pad decrease if I use one digit from 0-9 instead of 1-26?

for example plaintext = "blue" and key = "5 9 4 6":

 b  l  u  e  -  plaintext
02 12 21 05  -  plaintext in numeric form
 5  9  4  6  -  key
07 21 25 11  -  ciphertext in numeric form
 g  u  y  k  -  ciphertext

so blue + 5946 = guyk

Is that as secure as if I use numbers from 1-26?

And will blue + 5946 be the unbreakable one time-pad?


texts: Name of an archaic type of RSA padding (0BBBBBBB...)

texts:
In some legacy code, I encountered RSA signature padding in the following format (hexadecimal):

0B BB BB BB BB BB BB ... BB BB <hash>

Is there a name for this simple type of RSA padding?  I would think that the original developers got this design from something.


texts: Homomorphic & Functional encryption: Mapping unencrypted outputs to encrypted outputs using existing data

texts:
Let's assume I have datapiece A which, after being put through a model or neural network, has a known output X in the unencrypted space. When I move datapiece A into an encrypted space, and put it through an encrypted model, it becomes datapiece e-A. Now, it has output e-X. In this way, I am using a known (unencrypted) data to map X into the encrypted space (e-X).

The model in the unencrypted space has only two possible outputs: X and Y. When I encrypt this model, I'd like there to still be only two possible outputs: e-X and e-Y.

When someone else sends me an encrypted input data, datapiece e-Unknown, I plug it into the function, and I also get output e-X. Since datapiece e-unknown produces e-X in the encrypted space, can it be assumed that datapiece-Unknown also produces output X in the unencrypted space? In other words, does the map from the first paragraph enable deciphering outputs for the anonymized input datapiece-Unknown? Assume datapiece unknown and datapiece A are different (i.e. not exactly the same).

Eval(Enc(f),Enc(dA))=Eval(Enc(f),Enc(dU))⇒f(dA)=f(dU)

where Eval(f,c) stands to "apply f homomorphically to the ciphertext c" .... "f" is the model, "dA" is datapiece-A, "dU" is datapiece-unknown.

If this can be done without encrypting the model, that would also work.

Eval(f,Enc(dA))=Eval(f,Enc(dU))⇒f(dA)=f(dU)

For an unusual use case, I want this to be true. How can I make it work?

Does this hold true for homomorphic encryption? Since h.e. is probabilistic, are there any tricks to make it hold true for homomorphic encryption (e.g. re-seeding with each new input)? If not, why? I am asking specifically about H.E. because a number of libraries already exist that make it easy to use.

Does this hold true for functional encryption? I have heard it does, but there are not many libraries available for functional encryption.


texts: What is different between G1×G1→GT and G1×G2→GT in the bilinear pairing?

texts:
It is an implementation of the bls12-381 algorithm known as pairing-friendly, at GitHub.
Looking at this, the pairing parameters are $G_1$ and $G_2$,
$G_1$ is the point of $F_q$, $G_2$ is the point of $F_{q^2}$.
However, some papers describe it as follows.

Bilinear Map Let G1, G2 be two cyclic groups of prime modulo p. Let g
be a primitive root (i.e. generator) of G1. A bilinear map [10] or
bilinear pairing „e‟ is an effectively calculable task e : G1 × G1 →
G2 such that it satisfies the below two conditions,

Non degeneracy: e(g, g) ≠ 1.
Bilinearity: e(gx, gy) = e(g, g)xy for all x, y ∈ Z.

Setup: Let E(Fq) be an elliptic curve above the fixed field Fq where q
is large prime number (at least 160 bits) and G be a point on elliptic
curve E of order n. Let G1, G2 be two multiplicative cyclic groups of
prime modulo n. Let e : G1 × G1 → G2 be a bilinear map, z = e(G1, G1)
∈ G2.

$$z = e(G_1, G_1)$$
Here, both parameters take the point of $F_q$. How are they different?


texts: Guessing encryption algorithm based on key and ciphertext

texts:
Is it possible to tell which encryption algorithm was used, assuming I have a key and a encrypted text?

To not complicate the situation let assume we are speaking about symmetric algorithms only.

Are there any common methods to discover encryption method?


texts:
In a stream cipher like RC4, a message is xored with a random stream of bits, hence a n bits message will result in a n bits random-like ciphertext.

So it's a bijection, it's invertible, the output looks like a random element in {0,1}^n...

Why are stream ciphers not considered as PRPs?


texts: If I encrypt a file of a known format that has a lengthy header (e.g. an XML Excel file), does that render the encrypted file susceptible to a "known plain text" attack?  In other words, if the first X bytes of the decrypted text are known, does that weaken the encryption for the remaining data?


texts:
This question is similar to Leak Information?, but with new settings.

Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at random from $\mathbb Z^*_q$.

is there a P.P.T adversary $A$ such that gets information about values a,b,c,d,e,f or Their relations, when the adversary $A$ has given the following information:

$$u_1=(r_1\cdot a,r_2\cdot b,r_3\cdot c,(r_1+r_2-r_3)\cdot d),$$

$$u_2=(z_1\cdot c,z_2\cdot d,z_3\cdot e,(z_1+z_2-z_3)\cdot f).$$

$$u_3=(p_1\cdot a,p_2\cdot b,p_3\cdot e,(p_1+p_2-p_3)\cdot f).$$


texts: Why do cryptographic hashing and symmetric encryption use different functions?

texts:
Something about encryption and hashing has always bothered me.

Given a cryptographically secure hash function $H$, I can produce an arbitrarily long key from any seed $s$ by recursively applying $H$ to the seed $(s, H(s), H(H(s)), ...)$.
Then I can XOR the resulting array with any plaintext $x$ to produce my ciphertext.

Similarly, given an encryption function $E$, I can produce a hash of any input $x$ by simply encrypting each block of $x$ with itself, and then XORing the results together.

So why, then, do we use different functions for hashing and crypto (say, SHA-256 vs. AES)?
If one of them is secure, shouldn't it work for the other purpose too?


texts: Openssl & RSA : how many public exponents are possible?

texts:
I would like to know if it is possible to set the public exponent we want with "OpenSSL RSA" or if it is really limited to 2 possible exponents:

3
65537

If yes, why ?


texts:
Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305?

This question is especially interesting considering...

  "The security of Poly1305[...] is very close to the underlying [...]
  block cipher algorithm." -Wikipedia

So... why not reconfigure chacha as a Merkle–Damgård like construction. (Or a  HAIFA construct, as is done with BLAKE.) Then do a standard H(key || H(key || message)) for effective HMAC? Then, from here, you have CHF, MAC, and AEAD, all from one cipher.


texts:
This may be a naive question:

LWR assumption states that for ${A} \stackrel{$}{\leftarrow} \mathbb{Z}^{m \times n}_q, s \stackrel{$}{\leftarrow} \mathbb{Z}^n_q$, given $(A, \lfloor A\cdot s \rfloor_p$), it is indistinguishable from $(A, u)$ with $u \stackrel{$}{\leftarrow} \mathbb{Z}^m_p$.
There seems to be no specific condition on $m$ and $n$ except $m,n \geq 1$.

My question is does this hold true for $m = n = 1$? It does not seem right to me, kindly explain.


texts: Finding a solution to a (sort of) discrete logarithm by asking questions

texts:
Let $p = kq + 1$ and $q$ be primes such that $log$ $q = n$, $log$ $k = n$ and such that the bit size of every prime factor of $k$ is bounded
  by $log$ $n$. Let $g$ be a generator of the unique subgroup of $Z^*_p$
  of order $q$.

  $x \in$ $Z_q$ is picked randomly and you get $y = g^x$.

  You may ask any number of questions of the form $u \in Z^*_p$, which
  will be answered by $u^x$ $mod$ $p$.

  How would you go ahead to compute $x$ efficiently?

Solving the discrete logarithm problem would be nice, but I guess that's out of the question.. :)

I don't get which properties that's given to use, (probably all of them) Any ideas/hints? Appreciate it!


texts:
Goal
We want to find the most secure way to encrypt message of arbitrary length M with AES such that the recipient can only decrypt if they have both AES keys K1 and K2.
Preconditions:

AES keys K1 and K2 are independent and randomly generated, 256-bit keys
Assume we'll be running AES-GCM
Key exchange for the valid recipient has already be performed
Performance is not a concern (operation is performed less than once a couple of seconds)

Options (I could think of)
Option 1: XOR
Derive a new key K3 = K1 ^ K2 and perform encryption on M using K3.
Given that there are no known weak keys or known weaknesses in AES, only practical way for deriving K3 is by having pre-existing knowledge of K1 and K2.
Option 2: KDF
Compute $K_1\mathbin\|K_2$ (concatenation of the two keys) and feed the result to a KDF (perhaps HMAC based KDF) and use the resulting key as the AES key to encrypt M. I don't think this is significantly different from Option 1, but I'm listing it as an option anyway.
Option 3: Encrypt twice
Perform two layers of encryption:
C1 = Encrypt(M, K1)
C2 = Encrypt(C1, K2)

Send C2 as the cipher text. My intuition is that this should be no less secure than Option 1.
Additional Information/Clarifications
This question is gear towards the two keys being used as something similar to the cryptographic equivalent of "Multi-factor Authentication". In particular, the user has to obtain two different keys (through different means) before being able to decrypt the data.
This question could be extended to the case where there are N keys. The constraint is that all N keys will always be required to decrypt the data.


texts: Regarding security of blind signature schemes

texts:
I'm new to blind signatures, trying to understand security notions of it: blindness and one-more unforgeability.

I found out that in the security game for blindness property, the adversary $\mathcal{A}$ interacts with two users (each with messages $m_0$ and $m_1$). Without knowing who signed first, $\mathcal{A}$ gets a list of signatures in order $\{\sigma(m_b),\sigma(m_{1-b})\}$. Then $\mathcal{A}$ would try to guess which of them came first. That is, to guess a bit $b'$. So  $\mathcal{A}$ succeeds if $b'=b$.

My question is: why do we need to interact with two users (or twice)? Can't we just give $\mathcal{A}$ a signature of randomly selected message ($m_0$ or $m_1$)? In that case,  $\mathcal{A}$ would try to guess which of those two messages were signed.

Can anyone give me the reason why do we need two interactions in the security game?

Thanks in advance.


texts: Why Stream Ciphers can be slower in software than Block Ciphers

texts:
I made some tests on virtual environment (Virtual Box) using StrongSwan, a VPN based on IPSec. I had latency results using ping command saying that Chacha20 (stream cipher) had poor performance comparing with AES and BLowfish (Block ciphers).

How is this possible since stream ciphers should be faster than block ciphers?


texts: What is the purpose of using different hash functions for the leaves and internals of a hash tree?

texts:
I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the internal hashes (hashes of hashes).

  In order to protect against collisions between leaf hashes and
  internal hashes, different hash constructs are used to hash the leaf
  nodes and the internal nodes. The same hash algorithm is used as the
  basis of each construct, but a single '1' byte in network byte order,
  or 0x01 is prepended to the input of the internal node hashes, and a
  single '0' byte, or 0x00 is prepended to the input of the leaf node
  hashes.

By contrast, the proposed (though not yet widely adopted) Simple Merkle Hashes extension for BitTorrent just uses unmodified SHA-1 for all hashes. It's conceivable that this was a trade-off of security for simplicity, but that wasn't mentioned in the proposal.

What is the benefit of using two different hashes in this scheme?


texts: Are modified implementations of cryptographic algorithms a good idea?

texts:
Are modified implementations of standard cryptographic algorithms better that the standard versions?
Since the algorithm is not standard, is it harder to break? Is it safer?


texts: Why do the boolean functions used in cryptographic hashfunctions have 3 inputs (and not more)?

texts:
I'm learning about cryptographic hash functions and know why certain boolean functions were chosen to be used in the compression function of cryptographic hash functions (older question).

Hash functions like MD5, SHA-1 and SHA-2 all use boolean function with three inputs. However, SHA-2 uses two functions per round.

SHA-2 uses the following functions in every round:

$f_{1}(B,C,D)=(B\wedge C)\lor(D\wedge \lnot B)$

$f_{2}(B,C,D)=(B\wedge C)\oplus(B\wedge D)\oplus(C\wedge D)$

I do not understand why boolean functions with three inputs are used. Why not use a boolean function with 4, 5 or 6 inputs? Why does SHA-2 use two three valued functions per round, why not one six valued function? If the functions are balanced, good for diffusion and not fully linear, it should not make a difference.


texts: What are the weaknesses of Shamir's Secret Sharing?

texts: We just learned about this in school but i don't quite get the weakness of this method. If we let's say have used a 64-bit secret key to encrypt a file and then we split the key into 2 pieces of 32-bit. If the enemy managed to find one half and he can use brute force on the other one. Will he manage to find it? Or does it depend on how times the enemy can try per second? What if he can try $10^6$ times per second? but does that mean that trying also counts as trying to combine the two halves? I mean that does he in every time he brute forces, also try at the same time to sum the two parts and unlock the key?


texts: What is a u-coordinate within Elliptic Curve Diffie-Hellman using the Montgomery ladder

texts:
I am trying to understand the below paragraph.

  Elliptic curve Diffie-Hellman is often calculated using the Montgomery
  ladder. This gives a simple and efficient calculation that is
  naturally resistant to timing side channels. The Montgomery ladder
  also allows each party's public key to be a Montgomery u-coordinate.
  Using a single coordinate instead of the whole point makes public keys
  smaller without the expense of point decompression.

I read about Elliptic curves and Montgomery ladder at Wikipedia. Can someone please explain this paragraph in naive language.Also please answer below questions.

What is Montgomery u-coordinate.
A brief explanation of requirement of point decompression.


texts: Will the contents of a password protected Zip 2.0 file be safe for a week

texts:
I will need to distribute a file to people for a challenge and I need them to open the file at the same time. The file will be provided a couple of days before the challenge. For maximum compatibility (so no need for 3rd party software, just OS supplied tools) I was thinking of using a password protected Zip 2.0 file.

After some reading I think this will be OK, but I'm not sure. I can't seem to find information on my specific use case (the file only needs to be secret for a short amount of time).

There will be only one file and I will use a 5 word diceware password to make it easy for entering the password while keeping quite a bit of enthropy.

Will this keep my file secure for about a week, assuming people don't have access to big computing clusters?


texts: Cryptanalysis on Kasumi in A5/3 GSM algorithm-- why is it broken in 2G and not in 3G?

texts:
I have read the Wikipedia article that states Dunkelman, Keller and Shamir managed in 2010 to mount a related-key attack in a pretty decent time (2hrs) with a Core 2 Duo.

Why was Kasumi breakable in 2G (A5/3), but not in 3G?


texts: Assume that we have a message $m$ of size $n$, and it is padded with two 01 bytes in front. Then  the signature $s$ is computed using a private key $ks$. Can we still use the Known Message Attack to create a signature for message $m^2$ or $pad||m||pad||m$ by multiplying the signature with itself? Or will the padding stop this despite being weak?


texts: Hamiltonian Path Zero Knowledge Proof using Commitments to a Series of Edges

texts:
Commonly, Zero Knowledge Proofs based on the Hamiltonian Path or Cycle problems are given as follows:

The Prover has a graph $G$, for which he knows a Hamiltonian Path (or Cycle). $G$ is also known to the Verifier and constitutes the public key.
The Prover generates $G'$ which is isomorphic to $G$ via a permutation $\pi$.
The adjacency matrix of $G'$ is individually committed, i.e. a cryptographic commitment for every possible edge is created which holds $1$ if the edge is in $G'$ and $0$ otherwise.
The Prover also sends a commitment to $\pi$ (it could be argued that this step is obsolete due to a recent improvement in graph isomorphy solving)
After receiving all commitments, the Verifier makes a binary choice
When choosing 0: The prover opens all the commitments for all edges that are part of the Hamiltonian path in $G'$ so that the Verifier sees a Hamiltonian path (or cycle) exists
When choosing 1: The prover opens all commitments so that the Verifier can see that the commitments indeed refer to $G'$ and that $G'$ is isomorph to $G$

The biggest problem with this Zero Knowledge Proof is that $O(n^2)$ individual commitments are required. We have recently been wondering if this could not be worked around by committing to a series of edges (in the spirit of adjacency lists) instead would not be more efficient with the same security guarantees.

This would create $|E|$ commitments of 2-tuples of two points each instead of $n^2$ commitments of single bits. (Plus one for $\pi$ in either case.)

For Example: "(commit(1,2), commit(1,3), commit(2,3)" is a valid set of commitments for the 3-Clique

It should be noted that the commitments must not only be for some random permutation $G'$ of the original Graph $G$, but also in random order, or one could potentially derive knowledge about the degree of nodes from the position of the opened commitment (and therefore identify individual nodes when only opening those corresponding to the Hamiltonian path/cycle).

We believe that this should still constitute a Zero Knowledge Proof, as a trivial simulator can be given:

When Prover will choose 0: Create a "Hamiltonian Path" commitment tuple "commit(1,2), commit(2,3), ..." and enough bogus commitments to have $|E|$ commitments in total. Randomly permutate everything. Reveal the "Hamiltonian Path" when Prover asks for it.

When Prover will choose 1: Just follow the protocol, as no knowledge of a Hamiltonian Path is required.

Are there any reasons (beyond tradition) why the literature would always use a version with adjacency matrices?


texts: If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

texts:
I was studying OAEP and see we introduce a random value $r$ when computing the padding. See the figure below from Wikipedia

So if we are adding randomness to encryption, how could this ciphertext be mapped to plaintext? I understand a plaintext $m$ being mapped to numerous $c_i$ ?

Also to decrypt, don't we need to know $r$? In that case $r$ becomes a key


texts: Cryptocurrency for quantum computers that is physically impossible to double-spend?

texts:
Could a cryptocurrency running (at least partially) on a quantum computer (and/or on a quantum network) be developed in which it is physically impossible to double-spend? In other words, a coin in which it would be physically impossible to create two transactions that transfer the same coin from one address to two different addresses? Is there any published work on the subject, peer-reviewed or not? For example, if a coin is represented by an uncollapsed quantum state then according to No-cloning theorem it would be physically impossible (or only unlikely?) to transfer said coin to two different recipients, correct?

Edit: accepted the only answer. I don't think it applies here but at least this question shouldn't get deleted automatically...


texts: PRF and deterministic polytime function implie PRG

texts:
I'm struggling while trying to resolve this exercise. I already read all questions about PRG and PRF here and some proofs around the internet but none of them helped me.
let's consider a function $C$ as follow: there exists a polynomial $p$ for every $n$ in natural numbers, $C(1^n)$ is a sequence $\langle s_1,...s_m\rangle $ such that:

$2<= m <= p(n)$
for every $i \in \{1,...,m\} , s_i \in \{0,1\}^n$
$s_i = s_j $ implies $i = j$

Let's consider a length preserving partial function $F: \{0,1\}^* \times \{0,1\}^* \rightarrow \{0,1\}^*$ and let's define $F_C$ as a function on binary strings such that
$F_C(r) = F(r,s_1) || ... || F(r,s_m)$
where $C(1^{|r|}) =  \langle s_1,...s_m\rangle$ and || is string concatenation.
Prove that if  $F$ is pseudorandom and $C$ is deterministic and polytime  $\rightarrow F_C$ is a pseudorandom generator.
Studying from Introduction to modern cryptography, I'm trying to prove that $F_C$ is a PRG following this definition:

Definition 3.14: Let $\ell$ be a polynomial and let $G$ be a deterministic polynomial-time algorithm such that for any $n$ and any input $s\in\{0,1\}^n$, the result $G(s)$ is a string of length $\ell(n)$. We say that $G$ is a $\mathsf{pseudorandom\ generator}$ if the following conditions hold:

(Expansion:) For every $n$ it holds that $\ell(n) > n$.
(Pseudorandomness:) For any PPT algorithm $D$, there is a negligible function $\mathsf{negl}$ such that:
$$\left|\Pr[D(G(s)) = 1] - \Pr[D(r) = 1]\right| \leq \mathsf{negl}(n)$$
Where the first probability is taken over uniform choice of $s\in\{0,1\}^n$ and the randomness of $D$, and the second probability is taken over uniform choice of $r\in\{0,1\}^{\ell(n)}$ and the randomness of $D$

and I understood that...

Expansion holds because $l(r) > r$ since, looking at how $C$ is defined and remembering that $F$ is length preserving , we can deduce that $l(r)$ is always at least 2 times $r$'s length because $m$ is at least 2 and each $|s_i| = r$ and they're all distinct.
Our assumption says that $F$ is a pseundorandom function and $C$ is deterministic and polytime. Concatenation is also polytime so I think $F_C$ is polytime too because it concatenates $r$ with output from $C$ but I don't know how to wirte down a formal proof about it.
I have to prove that there's no PPT algorithm $D$ such that its probability to distinguish between a random input $r$ of lenght $l(n)$ and a $F_C$ 's output of the same lenght is larger than a negligible function but I don't really know how to proceed...I read also some reduction proof but I don't know if is the right way for me because all of them proved that a new defined G is a PRG starting from another PRG.

Please can someone help me with this three points?
Thank you a lot for reading my question!


texts: Bruce Schneier, encryption, public keys and digital-signature.

texts:
In his book "Applied Cryptography" Bruce Schneier, when talking about public key cryptography, says that:

  If the same algorithm is used for both encryption and digital-signature verification there is a possible attack. In these cases, the digital signature operation is the inverse of the encryption operation: Vx = Ex and Sx = DX.

I'm not sure how that is possible, could you further explain what Bruce is proposing here?


texts: How can I retrieve data embedded in an image with steganography?

texts: I want to know is there any way to retrieve data embedded in a steganalised image by just scanning the image with mobile scanner? Just like qr code scanning


texts: Exercise: recognizing Hawaiian plaintext

texts:
I was given the following exercise to solve:

  The Hawaiian language consists of 12 letters. There are 7 consonants: HKLMNP and W  and there are five vowels: AEIO and U. In a word, no two consecutive letters can be consonants and all words end in a vowel. Suppose you are given, without spaces, a very long list of putative decrypts of a given cipher (where you know the plaintext is Hawaiian). Let’s say you have $2^{50}$ decrypts. The decrypts may only use the 12 letters. How would you analytically recognize the answer? Quantify how efficient your method would be - and how long a text you would require to be able to (probabilistically) differentiate between the correct answer and random “noise” (where you can assume that you don't read or speak Hawaiian)?

I don't know where to begin solving this. Any sense of direction would be great.


texts: Will hashing over and over eventually give the same hash?

texts:
There are many cases in maths where doing the same thing over and over again will bring you closer to a value. Derivation of polynomials is the striking example: no matter what you start with, you end up with 0. In a series expansion, the longer you continue the sequence the closer you get to the real value.

This concept applies in areas other than math (Wikipedia's everything-leads-to-philosophy phenomenon, for example). It's a little unrelated but it just proves the concept.

Hashing algorithms are just special math. Following logically, hash entropy supposedly decreases the more you hash a value. So is there a point at which any input value will give the same hash as any other?

(Let me just specify that we're not re-injecting any new data every time we hash, as if we're trying to increase the security of the hash by salting and re-hashing. It's strictly a matter of md5(md5(md5(... if that's the algorithm we're using.

I can see some problems with this already. Algorithms like md5 are designed to change their output radically when the input changes only by one bit of information. So even if a common hash for two values appears along the way, it itself will start changing. But then, does the fact that the output appears to be very different actually mean the possibilities are still many?


texts: Why doesn't preimage resistance imply the second preimage resistance?

texts:
Let the preimage resistance be defined as »given a hash value $h$, it is hard to find any message $m$ such that $\operatorname{hash}(m)=h$«, and let the second preimage resistance be defined as »given a message $m_1$, it is hard to find any message $m_2$ such that $\operatorname{hash}(m_1)=\operatorname{hash}(m_2)$«.

Then if you are given a preimage resistant hash function $H$, what modifications could we do in order to make a hash function $H'$ that is preimage resistant, but not second preimage resistant?

Someone suggested that we could do the following:

  Take a preimage resistant hash function; add an input bit $b$ and replace
  one input bit by the sum modulo 2 of this input bit and $b$.

But I am not sure if that will work, could anybody explain to me why that makes $H'$ not second preimage resistant?


texts: How to generate a key using any $m$ passwords out of total $n$?

texts:
My application requires an AES-256 key K for some secure operation. In order to avoid saving this key in application, I have implemented following scheme:

There are 5 individuals who enters their passwords in application. Lets call them PW1..PW5
Using these passwords, I have generated the key as:

K = KDF(PW1 || PW2 || PW3 || PW4 || PW5)

The problem is that now I need to modify the application such that it works even if only 3 out of 5 passwords are available (but no less than 3). This is required because even if we lose one or two passwords (accident, person refusing to enter password etc.), we are able to recover from that situation.

Please can you advise how it can be achieved?


texts: Java - What are the additional 8 bytes of output generated by AES/CCM/NoPadding?

texts:
What are the additional 8 bytes of output used for in Java's (Bouncycastle) AES/CCM/NoPadding? I do not believe this is padding as I am requesting "NoPadding," and the block size is not 128, 192, or 256 bit. Is this some sort of Message Integrity Check (MIC)?

For example:

Encrypting 16 bytes yields 24 bytes of output.
Encrypting 20 bytes yields 28 bytes of output.
Encrypting 31 bytes yields 39 bytes of output.

BTW.: The reason I ask is that I am trying to send/receive encrypted data from a bluetooth node. The bluetooth's firmware, written in C, encrypts data with AES/CCM with the same first 16 bytes of output as I get here, but only produces a 4-byte MIC (total of 20 bytes). I'm working on finding a solution to this. Apparently Bouncy Castle isn't supported in C?


texts: Clarifications regarding ciphers and Nmap scan

texts:
I'm running the below Nmap command to test the strength of the cipher suites I have used in my host

nmap -sV --script ssl-enum-ciphers -p 443 <host>

The Nmap doc says that Each ciphersuite is shown with a letter grade (A through F) indicating the strength of the connection and the output line beginning with Least strength shows the strength of the weakest cipher offered

When I ran the command against the host I got the output as shown below

| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (dh 768) - E
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 768) - C
|       TLS_DHE_RSA_WITH_DES_CBC_SHA (dh 768) - E
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - C
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       64-bit block cipher DES vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|       Ciphersuite uses MD5 for message integrity
|       Key exchange (dh 768) of lower strength than certificate key
|   TLSv1.1:
|     ciphers:
|       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (dh 768) - E
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 768) - C
|       TLS_DHE_RSA_WITH_DES_CBC_SHA (dh 768) - E
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - C
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       64-bit block cipher DES vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|       Ciphersuite uses MD5 for message integrity
|       Key exchange (dh 768) of lower strength than certificate key
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (dh 768) - E
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 768) - C
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - C
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|       Ciphersuite uses MD5 for message integrity
|       Key exchange (dh 768) of lower strength than certificate key
|_  least strength: E

My questions

As per the doc, the Ciphers marked as "E" is the weak cipher and in another way can I consider the cipher marked as "A" as the strong cipher?
TLS_RSA_WITH_AES_128_CBC_SHA is marked as "A" here, but in some discussions, I have observed it is mentioned as WEAK. Is it because of the SHA1 usage? if so why this is rated as "A" in NMAP?
I have configured the below cipher list on my server.

  ciphers="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_WITH_DES_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"

but the ciphers such as SSL_RSA_WITH_RC4_128 is not available in the Nmap output, instead, there are ciphers like TLS_RSA_WITH_RC4_128, what is the reason for this? Can we use SSL and TLS interchangeably in the Ciphers?

Even though I have added the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 as a cipher in my server, it wasn't available in the Nmap results, what might be the reason for this?

PS: I'm using JDK 1.7 as the underlying JDK version for the server


texts:
I am studying an encryption scheme which is Elgamal-like where I think CRT can help optimise the encryption and decryption but I am not sure if I am applying CRT the correct way.

I have a cyclic group $G$ of order $n=p_1p_2q$, generator $g$ of $G$, an element $h=g^x$ of $G$ where $x$ is a random integer and the secret key,  and a message $m\in\mathbb{Z}_{p_1p_2}^*$. This group $G$ has a cyclic subgroup $F$ of order $p_1p_2$ generated by $f$. Computing discrete logs in $F$ is easy which we use to recover our message $m$ as follows:

Encryption -- Compute ciphertext $(c_1,c_2) = (g^r,\ f^mh^r)$ where $r$ is a random integer

Decryption -- Compute $c_2/c_1^x = f^m = l$. Recover $m$ by computing $$m = l^{-1}\pmod{p_1p_2}$$.

I am applying CRT in the final step by computing $$l^{-1}\pmod{p_1}$$ and $$l^{-1}\pmod{p_2}$$ and then combining them both using CRT to recover $m$. I have a feeling this is stupid because I am not really optimising anything, infact making it more computation heavy as single inversion modulo is faster than two inversions modulo + CRT. This is also visible when I time these two methods -- single inversion modulo $p_1p_2$ is faster.

So how should I properly apply CRT in these type of schemes?


texts: Differential & linear characteristics for integer multiplication

texts:
What are the probabilities of differential & linear characteristics for the function that XORs the high and low bits from a $n \times n \rightarrow 2n$ bit multiplication?

I remember reading somewhere that this function (which seems very fast in software) has excellent non-linearity.  This suggests applications in (say) a Feistel network (where invertability is not required).


texts: Generating irreversible unique id based on fingerprint template

texts:
I'm a student who follows software engineering. I'm looking for method to generating irreversible unique id based on fingerprint for a software competition. What kind of encryption method can we use?

Please, Can anyone give some terms, topics or suitable references to study our selves to take our project to the success?


texts: Determining if at least 1 bit is set in the output of SHA256

texts: Given the SHA256 hashing algorithm, is there any shortcut to determine whether 1 bit will be set in the output in a given position (or set of positions)? Relaxing the question a little bit, is there any probabilistic test (simpler than performing a full hash of course) to tell if a bit will be set (with probability 1) or not set (with probability <1)?


texts:
I have an assignment to decode a permutation cipher based on a key. But on the internet I found only ONE website talking about it. Things are not very clear.

I understand that I have to reorder the key characters alphabetically and then permute the columns accordingly, but it doesn't seem to make sense when I decode. Here it is. Maybe I got the wrong definition of it ...

IRUHA AIFAI SHIEI PLDEY EENIT
SIOFH OCPED OASLS EREUC RSMHL
RESOT SROPI RDFSN DIOVB IRAYA
MNBKM OAIRR OANAS REDIC YNSSO
ELNYG HDMSE ODHCO MHAND FOCNI
IMBIE LCUPI APEOE IIINP APPRA
RKPSS EVNBS SIRHH ODOVM AICSA
ALTOM NHTON AMOFP RYHVS LNRCN
NCIHP ATTTT EENED HDNLI AOTTO
UHCTL SPITM CTAAT SENVN ETOTR
DHESV INPON TTATN YACRL DTOSL
ETHDH AANSL RMERI GMIOP SIECE
SEOLS CCTPI IRETE ETEYE DCTAH
PEEAI OTFOE TCTLS EIOAR CSCEU
GDAFU OHLGI RAYAR NEERO PNSUR
VETEI FAIIE YCIOD RNTHH RHTIN
TLECN CHBTI ELLAE EEEES SGNIU
SNCEF HRETL LTHUS EDBSF OOSAR
ASNHO YGHCO UUATU ORIRS YNSTP
GRGAD NPSIR RDMSY GBNHP AIAMN
ETPRY IIEIL IEUNA ANTRU NTAMS
EONEY ER

with the following key:

key=water

Here is what I tried:

WATER
12345
AERTW
24531

RHAUI
IFHOS
EOTSR
NKMBM


texts: How do adversary models and security types relate [from InfoSec SE]

texts:
I have been told to move the question to this forum in order to get a better insight, so here we go:

Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement for ciphers. It got me thinking about this paper I recently read, where a formal model of the Honest-But-Curious adversary is given, in order to automate the analysis of whether certain protocol has the indistinguishability property. And I have this way realized I am missing a piece in the puzzle.

As far as I remember, in a Cryptographic System, we have:

Attacks like

Ciphertext-only (Passive Attack)
Known Plaintext Attack (Passive Attack)
Chosen Plaintext Attack (CPA)
Chosen Ciphertext Attack (CCA)

And Notions of Security like

Semantic Security (SS, SEM)
Indistinguishability Security (IND)
Non-malleability (NM)

And for stating the notions preserved under certain attacks we end up with combinations like the well known IND-CPA.

Now, how do adversarial models like Dolev-Yao, Honest-But-Curious or Byzantine fit in this scheme? ( If they do at all and I am not mixing up things)


texts: What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?

texts:
If I'm hashing alphanumeric strings (chars in the set 0-9, a-z, and A-Z) with a CRC-64 hashing function, how long can my strings be while guaranteeing no hash collisions?

Stated differently: If I have a set of all CRC-64 checksums computed from alphanumeric strings  $0$ to $N$ bytes, how large can $N$ be before I see a collision in the set?


texts: Homomorphic encryption in social networks

texts:
I want to gain some experience with homomorphic encryption, specifically possible applications in social networks.
I am thinking about using a HE library (such as Microsoft SEAL) with a graph database to simulate the scenario of a client encrypting their data in a social network.
Do you have any ideas of possible real life scenarios where something like this can be used?


texts: Is "reused one time pad" safe to encrypt a message like "random number + mod"?

texts:
I want to encrypt a message that contains a fixed length random number and a long mod.
i.e. 1234564284 (created like this 123456 + (123456 mod 9931))

I assume that reusing the same key is not a problem if the message is purely random but is the fact that the message is always given with a mod is opening a hole to find the key?


texts: What are the properties of random involution? What is the difference between random involution and random permutation?


texts: Do I need a salt for Scrypt if the data is client-side?

texts: I have a web app, in which I am encrypting user data client side. Each client has their own password, which is used to derive an encryption key (via Scrypt) for encrypting their data. Since the data is client side and a hacker has full access to the (encrypted) data, would it be necessary to use a salt for Scrypt? The reason why we use a salt for KDFs is to reduce rainbow tables affecting web servers. Since there is no web server in play here, and the attacker can attack however they like, then a salt would provide no additional benefit, am I correct?


texts: The length of the shortest vector in Lattice

texts: In Micciancio and Regev's paper "Lattice-based Cryptography",the length of the shortest vector is at least $\min\{q, 2^{2\cdot\sqrt{(n\cdot \log{q}\cdot\log{\delta}})}\}$ . I want to ask why the paper chose the latter as the length of the shortest vector rather than $q$ when considering concert parameters. In addition, whether the $q$ is normally more than $2^{2\cdot\sqrt{(n\cdot \log{q}\cdot\log{\delta}})}$?


texts: Proving that two points on elliptic curve are within range

texts:
Is it possible to prove that a point on an elliptic curve falls within a given range of another point, without revealing the distance between them. For example:

Let's say $X$ and $Y$ are two points on an elliptic curve such that $X = x \cdot G$ and $Y = y \cdot G$, where $G$ is the generator. The proover knows values of $x$ and $y$, and wants to prove to the verifier that $|x - y| < z$, where $z$ is some value supplied by the verifier.

Another option: prove that $\frac{x}{y} < z$, where $z$ can be a relatively small number (e.g. 2).

Is either of these possible?


texts:
I have learned that SHA-1 and MD5 are one way hash functions, which means that it is not possible to obtain the original value by performing the reverse calculation.

There however some online websites that 'decrypt' the hash function to the original value. I tried decrypting in the Linux command line but it seems that the input can only be hashed using sha1sum command.

I'm just curious if the reverse calculation is possible or not.


texts: Could FHE scheme like BGV could be used many times, or fully homomorphic encryption could be used continuously？

texts:
Currently I was working with FHE scheme and used HElib to do homomorphic logical operation like the formal question described Homomorphic encryption methods that could support logical XOR, AND?.
But now I'm facing a new problem. When I do multi times calculation (the situation is a circuit calculation that has to be used many times), the result is getting wrong. For instance: there are 3 bits a,b,c, and the formula is a = a*b+c, each time 'a' is updated, b , c is fixed value. When the process is repeated many times, the final 'a' is decrypted to a wrong value. Could someone tell me the reason, and are there any methods that could skip this problem?
By the way, this is one of the problem mentioned in the terminal:
Ctxt::bringToSet called with capacity=-101.861, likely decryption error
Ctxt::bringToSet called with empty set and capacity=63.5502, this is likely a bug


texts: If we can find prime numbers larger than 17 milion digits, why can't we find all 1024bit primes?

texts:
"Largest Known Prime Number Discovered; Has 17,425,170 Digits"
http://www.sciencedaily.com/releases/2013/02/130213225424.htm

If we can find prime numbers larger than 17 milion digits,
why can't we find all 1024bit (just 309 decimal digits) primes?


texts: Questions about a SHA3 cipher stream encryption scheme

texts:
I have written an encryption implementation using a hash as a cipherstream for demonstration purposes. I know it is slower than more sensible options such as AES but I am interested in several things, which I will list at the bottom of this message.

NOTE: I am writing this in a pseudo-language that resembles C++ and using string for simplicity, I know that in practice the stream can output null character and cause trouble with string reading. SHA3 is assumed to be the 512-bit flavor.

SHA3_Sym_Enc(key,message)
{
base_key=SHA3(key); //not really needed, but in case we will ever allow the key to be "anything", we'll standardize the initial value like this

keystream="";
int counter=0;

for(read_message=0;read_message<message_length;read_message+=base_key.length()) //work in blocks of SHA3 outputs
    {
    hash_block=SHA3(base_key+string(counter)); //H(base_key+#) -> block#
    keystream+=hash_block; //add blocks into one big pseudorandom output
    counter++;
    }

keystream=keystream.Left(message.length()); //our keystream works in blocks, and might output bigger than the message, so trim any excess

return message^keystream; //XOR the keystream with the message, output
}

void main()
{
scanf(key); //input user key

nonce=generate_random_bytes(sizeof(SHA3)); //generate a nonce, SHA3-length should be enough

message_key=SHA3(key+nonce); //build the actual key that is going to encrypt the message via concat and hash

ciphertext=SHA3_Sym_Enc(message_key,plaintext); //output the encrypted message via the function described earlier

final_message=ciphertext+SHA3(ciphertext+message_key)+nonce; //append a MAC and the nonce to the message, note that we are not doing HMAC because SHA3 is supposedly immune to length extension attacks
}

final_message is [ciphertext][MAC][nonce].

Decryption:

Break up final_message, extract the MAC and nonce, their lengths are predetermined and they are known to be at the end so this will be easy
Take key+nonce and hash, reach message_key
Hash ciphertext+message_key, if they = MAC, the message is untampered
parse the ciphertext back through the function to rebuild the original message

Now my questions:

If given a large enough password, does this system appear secure?
The hash function used here has a 512bit output and 1066 bits of internal state; does it really provide 512 bits of security? Also because hashes produce wildly different and unrelatable outputs for even tiny incremental changes, would this mean it's immune to a related key attack, even without a nonce? I ask these because AES only goes up to 256 bits and has some known issues with related keys, and as far as these two points go, this stream would be superior?
If I were to chain only half of the output instead of the full H(base_key+counter), in order to further hide any vital info about the keystream's origins that an attacker would try to obtain, how many bits of security would I lose? Would I go down to 511 or 256? I think it would be really nice because the stream could, in theory, at some point output a block identical to a previous block, and this in full implementation would mean that the stream has reached an interval and starts repeating, but this one would not because the out-of-sight bits are still different, further confusing an attacker.


texts: What is gpg2 algo 1 and 8 concerning its signature-procedure?


texts:
http://tools.ietf.org/html/rfc3447#appendix-B.1

id-sha256    OBJECT IDENTIFIER ::= {
      joint-iso-itu-t(2) country(16) us(840) organization(1)
      gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1
  }

How to read this definition? In another word, how to convert this into a bit stream? Thanks.


texts: On Program Verification Through zk-SNARKs

texts:
Can you provide an example use case of program verification using zk-SNARKs that explains:

What it actually means to verify the execution;
What are the implication of this new technology;
How does it work, because at moment I still haven't understood the difference between zk-SNARKs and proofs that can be generated with asymmetric cryptosystems, since they also are zero-knowledge. Are zk-SNARKs just more general? If so can you provide an example use case that highlights what can be done with zk-SNARKs that instead can't be done with asymmetric cryptosystems?


texts:
As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. Now, since RSA keys are so large (often 1024 bits and above), the primes have to be at least half that (at least 512 bits then). Such large primes would be difficult to generate (you'd have to check many, many numbers and try to factor each of them), so I understand that the typical approach is to use pre-generated lists of large primes.

But doesn't that make the key very easy to crack? Even if the list container 1,000,000 primes (which I find unlikely), checking all the combinations would only take a couple of hours on a typical desktop computer.

Which part have I misunderstood?


texts: Appending hexadecimal string for MD5 algorithm

texts: I followed the algorithm step by step in MD5 Algorithm but in the first loop of the 64 loops, I got my A as 10325476, B as 35E4F8C4D, C as EFCDAB89 and D as 98BADCFE in hexadecimal. A, b, C and D will be appended in the end to become the md5 checksum. This makes me confuse as in the first loop, the length of hexadecimal is already 9. I believe that by continuing the algorithm, B will become bigger and bigger. This means that I will not get exactly 32 hexadecimal number in the end as 8+9+8+8!=32 Am I on the correct path or my hexadecimal length of B is indicating that I am calculating wrongly?


texts:
Consider the following problem: given  $g_1 \ldots g_i,h_1 \ldots h_i  \in G$, $\forall i$ find  $x_i$ such that $g_i^{x_i}=h_i$

For $i=1$ this is the discrete log problem and  is assumed to to have some level of security based on the order of $G$ for certain groups. Let's call this security level $\lambda$.

What happens to $\lambda$ as $i$ increases? Best case, it scales linearly with $i$. That is, its twice as hard to solve two DL instances in the same group $G$ as it is to solve one. Worse case, its no harder.

Im particularly curious with what happens when $G$ is a Schnorr group, though composite groups might work too.

At least on a nieve quick glance, neither Pohlig–Hellman nor Baby-step Giant-step seem to benefit much from being run multiple times in the same group. I'm worried, however, that there are overlapping sub problems that if properly leveraged, perhaps using dynamic programing, would lead to a sub-linear scale up. The question is, how effective these techniques are.

I'd imagine someone has examined this before and I just need to find a paper on it, but as of yet I haven't found one.

UPDATE
The Pollard Rho algorithm can apparently solve $i$ dl instances in the same group in $O{\sqrt{Ni}}$ where $N$ is the order of the group. So $\frac{1}{2}\lambda\sqrt{i}$.[1]

The real question appears to be  how index calculus methods handle it.


texts: Verify product without revealing multipliers

texts:
Situation:

Several participants contribute encrypted random numbers. These numbers will be used to generate community-agreed random (by simple multiplication).

Question:

Is there any way to detect same products values without revealing multipliers? Maybe it is possible to use some homomorphic encryption?

What I originally want to do:
The task is do eliminate same random values (results), generated in different rounds. There should be some history log and we should regenerate random result if we already generated equal one.


texts: Why SSH does not use a certificate authority in the same way as SSL

texts:
SSL requires the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client.

SSH on the other hand relies on the client having the server's public key by some other means (e.g., by accessing it physically from the server and saving it at the client).

Why do these protocols have such a difference in operation mechanisms? I mean they could both use the third party approach which to me seems more user-friendly and possibly more secure.


texts:
I can't understand how Niederreiter cryptosystem
works. If $c=mH^{'T}$ than why we cannot compute $m$ directly by multiplying $c$ with the $(H^{'T})^{-1}$? Can you give me an example of a "fast decoding algorithm"?

Thank you!


texts: Residue requirements of Rabin-Williams primes?

texts:
I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs:

  An RW public key consists of a modulus n, which is the product of two
  odd positive prime integers $p$ and $q$, such that $p\not≡q\pmod8$, and an
  even public exponent $e\;$ ($2≤e<n$), which is an integer relatively
  prime to $(p – 1)(q – 1)/4$. [Note that these conditions imply that
  $p≡q≡3\pmod4$; moreover, one of the primes is congruent to $3\pmod8$
  and the other is congruent to $7\pmod8$.]

I think Bernstein provides a survey of more relaxed conditions in RSA signatures and Rabin–Williams signatures: the state of the art. For example, in Section 4:

  State-of-the-art systems use exponent 2 rather than exponent 3. This
  speeds up verification, and improves the signature-compression and
  signature-expansion features discussed in subsequent sections. The
  signer’s secret primes p and q are chosen from 3 + 4Z to simplify
  signing.

Eventually, Bernstein converges on the IEEE P1363 paper (and then surpasses it in Section 6 when he forgoes Jacobi symbols).

What are the minimum requirements for p and q in Rabin-Williams? Is it p, q ∈ 3 + 4Z; or is it p ∈ 3 + 8Z and q ∈ 7 + 8Z?

The practical problem I am facing is I don't know when to accept or reject a set of parameters during validation. I know p, q ∈ 3 + 4Z is less efficient, but I'm not sure it's forbidden.


texts: Is it ok to send part of digital signature if we have bandwidth constraints?

texts: When creating digital signatures is it ok to send part of it when we have bandwidth constraints?


texts: Clarification questions about timestamp servers

texts:
I am reading the bitcoin white paper, and I came across the concept of timestamp servers in it. Unfortunately the description of the usage of a timestamp server leaves me with more questions. And unfortunately googling has not helped much.
The paper has this:

The solution we propose begins with a timestamp server. A timestamp server works by taking a
hash of a block of items to be timestamped and widely publishing the hash, such as in a
newspaper or Usenet post [2-5]. The timestamp proves that the data must have existed at the
time, obviously, in order to get into the hash. Each timestamp includes the previous timestamp in
its hash, forming a chain, with each additional timestamp reinforcing the ones before it.

Okay I have questions:

What is the format of the artifacts published by a timestamp server? Is it like an hash? or signature? or something else? How is the date attached to such an artifacts?

Each timestamp includes the previous timestamp in its hash How is it possible to include a previous timestamp in another timestamp? Does timestamp have some form of verifiable identity? How does this look like?

Where does a timestamp server publishes to? A URI of some sort?

Anyone knows an example of a timestamp server? Preferably being used outside the context of bitcoin? I ask this so as to better get a feel of how timestamp server works and used.


texts: Why is 2048-bit RSA always paired with 320-bit ECC?

texts:
You may already have noticed that most smart cards ship with 2048-bit RSA support and 320-bit ECC over GF(p) support. You may have already asked yourself "why exactly 320-bit?". Now I remember having read a while ago (I can't find the reference sorry), that you can use the 2048-bit RSA to somehow hack together 320-bit ECC.

Now my question is:
Is there actually any relation between maximal RSA and ECC key length and if so how can you get 320-bit ECC from 2048-bit RSA and why is it limited to 320-bits when the RSA engine can do 2048-bit?

Please note: I'm pretty sure they are not paired because of equivalent security, because they provide vastly different security.
320-bit ECC provides roughly 160-bit security and RSA-2048 provides roughly 112-bit security, so this can't be the reason.
I'm suspecting this to be related to the functional large (RSA) integer units of the smart cards which are somehow used to do 320-bit ECC, however the interesting part here would be "why not 512-bit or 1024-bit ECC?" and it should be some technical limitation because it's shared across many different smart card manufacturers.


texts: Function to polynomial equation in GF(2)

texts:
Let F(a,b,c,d,e) be a function that returns the ith bit of 0x3A5C742E, where i=a*2^4+b*2^3+c*2^2+d*2+e and i is the offset from the least significant bit.
The author Page 33/200, chapter 2.3.4 states that in order to find the polynomial for the equivalent output you can use k-maps.
Later he states that the equation after the calculations is:

NLF(a,b,c,d,e) = d+e+ac+ae+bc+be+cd+de+ade+ace+abd+abc

Here is my k-map calculation:

     00   01   11   10
000   0    1    1    1
001   0    1    0    0
011   1    1    0    1
010   0    0    0    1
110   0    1    1    0
111   1    1    0    0
101   1    0    0    1
100   0    0    1    1

Where rows are abc, and columns are de

Now from this figure I cannot see how it is possible to generate the given equation. There are elimination of only 1 variable. So all the generated equations should have been at least of 4 degree.

So the question is, how is his equation generated?


texts:
Let us consider $E$ an encryption algorithm that encrypts a message $m$ into a ciphertext $c$ using a key $K_e$. i.e $c = E(K_e, m)$. Similarly, decryption is achieved by $m = D(K_d, c)$.

Is there any public key encryption scheme where the encryption process is the same as the decryption process (i.e. $E=D$ )?


texts: Is there any existing cipher capable of scaling from a 1 bit key up to a one-time-pad?

texts:
We have ciphers that handle small amounts of entropy, such as a 256 bit key for AES; and we have one time pads for enciphering 1:1 entropy, such as a 1GB key for a 1GB file if you could ever harvest enough decent random noise.

Now in theory you would imagine that there is a universal class or model of cipher that can scale smoothly from a single bit of entropy all the way upto a 1:1 one time pad.

If such an algorithm or cipher already exists - what is it called?


texts: How do single use passwords work for an encrypted message

texts:
LastPass encrypts its data before sending it to their servers. The key for the data is generated using a combination of the master password and username.

How then can a one-time password be used to decrypt this data? The data on the server has been encrypted with the master password and username. Does this mean that LastPass stores a new version of encrypted data for every (single-use) password?


texts: Does the Paillier system remain secure if it is used to encrypt only binary values, i.e. {0, 1}?

texts: Is there any security compromises if the Paillier system was used to encrypt only binary message in {0, 1}? i.e., plaintexts are either 0 or 1.


texts: When using the Back propagation Algorithm for Machine Learning, it is often said finding the global minimum of a cost function over $\mathbb{R}^n$ is very hard, and as $n$ increases it gets even more complex. I was just wondering if there are any schemes that utilise this property.


texts: Certificate validation on an IoT device using few bytes

texts:
I'm trying to validate if an IoT device is authentic or it's a fraud. The problem is I only have 17 bytes to do that verification.

What if I let the IoT device sign the message with the private key and the client will check in a server if that message was signed with the correct private key like the RSA algorithm.

But the problem is that I don't think only 17 bytes is secure. I'm asking if you guys know some method/algorithm to do this verification with only 17 bytes max, thank you for all your help.


texts:
In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? The distribution of the keyword would pose no problems since I would distribute it to other people in person, therefore avoiding interception.

Just to avoid confusion, by keyword I mean a random string of bits as long as the message.


texts: Second Preimages on n-bit Hash Functions by John Kelsey and Bruce Schneier

texts:
I read your https://www.schneier.com/academic/paperfiles/paper-preimages.pdf

And found there:

«3.2 A Generic Technique: Multicollisions of Different Lengths»

    «Finding a Collision on Two Messages of Different Lengths.»

        «ALGORITHM:»

            «Steps:»

THIS:
"Build lists A and B as follows:"

– for i = 0 to 2n/2 − 1:
• A[i] = F(hin,M(i))
• B[i] = F(htmp,M(i))

There «i» takes value from 0 to 2^(n/2), BUT numbers of M’s blocks much less «2^(n/2)»
Maybe correct go through the cycle [0, 2^k] ? Otherwise, many of M(i) simply don’t exist.

or I'm wrong and something i don't understand?

P.S. Is there a chance, that won't find a collision in a range [0, 2^k]?

Thanks!


texts: AES-CTR vulnerability to cryptographic oracle

texts:
I am new to cryptographic issues and from what I googled so far I could not retrieve the information I need.

Consider the use of AES-128 in CTR mode.
Let M be the set of possible plaintexts, for example M can be all the bytes sequences of a length lesser or equal than a specific integer n.
Let K be the private key and SK the symmetric ciphering/deciphering function.
Given an IV i and a plaintext p, we have (I see the initial counter value as an IV there) :

  c = SK(p,i)

And symmetrically :

  p = SK(c,i)

If an attacker has access to an oracle O that can perform the decryption, given a specific ciphertext :

  ∀m, i ∈ M, O(m) = SK(m, i), where i is an arbitrary IV, fed by the attacker

In other words, the attacker has access to a system that can encrypt/decrypt data using the private key K, which he wants to break (obviously, only the oracle system knows the key, the attacker can only use the system to encrypt/decrypt messages).

I would like to know to what leaks about the plaintext and/or the private key this kind of oracle can lead.
Are these leaks critical ?

EDIT :

The counter is made according to the RFC3686 pattern :
$(NONCE|CNT)$.
The $CNT$ part of the counter is 8-byte long and the counter is incremented once every 16 bytes.
A given $NONCE$, which is also 8-byte long, is never used twice.
Finally, $n$ can be from a few kilobytes to a few megabytes. But since an overflow will occur only if $n \geq 2^{128}$, there is no overflow.
The attacker has access to both the ciphertext and the counter scheme used to build it (the NONCE + the pure counter value). With the oracle, he can obviously decrypt the ciphertexts he intercepted. To sum up, here is what the attacker knows :

The ciphertexts
The counter scheme used to generate the ciphertexts
The corresponding plaintexts (because he can feed the oracle with the good (ciphertext, counter scheme) couple)


texts: Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

texts:
PFS suites suffer from the same defects as any other salt-less password hashing scheme.
Why is everyone promoting Perfect Forward Secrecy (PFS) ciphersuites so fiercely?

Namely, when the group/hash weakens, then the attacker can invests into a massive pre-computation, after which individual connections/hashes can be broken with minimal additional cost. This property allows the big players to amortize the cost of the massive pre-computation over the massive ammount of cracked connections. Consequentially, it promotes mass snooping over targetted attacks.

This question is motivated by the WeakDH/LogJam paper.

EDIT, thanks @steffen-ullrich, It does not make sense to include the salt in "the secret", so the DHE equivalent of salt-less is "everyone uses the (few) same groups".


texts: Does the transposition cipher have a network application?

texts:
So I'm reading a chapter in my networking book, and it talks about substitution and transposition ciphers. I know that most network security uses public key or symmetric encryption, but I wonder whether a simple transposition is also used. I ask because I'm not sure how they would quickly decode the message on the other side. It would seem they would need to use something like the DH Key Exchange, and even then, they could just use the traditional symmetric encryption at that point anyway.

If “transposition” and “substitution” do have applications, what are they and how secure are they?