texts: How to interpret a specific mathematical notation in "FIPS 202" (SHA-3 / Keccak)

texts:
tl;dr  What does "d <= |Z|" mean in the context of bit array manipulations?

As a learning exercise I'm working on an implementation of SHA-3.  I am not a cryptography specialist in any way but I have implemented similar algorithms in the past such as MD5 and SHA1, so I am roughly conversant with the kinds of operations that happen in such algorithms.

I have been working through the document "FIPS PUB 202" (freely available as a PDF here: http://dx.doi.org/10.6028/NIST.FIPS.202).

I am finding this a hard document to understand but I'm getting near to completing the program and I'm unsure about the meaning of the following line of text in section 4, algorithm 8 (page 19)  the SPONGE function...

My problem is with step 9.  I do not understand what "|Z|" means in this context.

This algorithm deals with truncating and concatenating an array Z of bits (which could be several hundred bits long) until this condition is met at which point the first "d" bits of Z is returned to the calling function.

My first thought was that |Z| means "the length of Z in bits", but that would be inconsistent -- they are using "len(...)" for that purpose in steps 1 and 2 (and elsewhere in the document).  This is the only place in the document where this "|...|" notation is used.
I don't think it would mean "Abs(Z)" in the mathematical sense of converting Z to a positive value because the resulting number would be extremely large in almost all cases.  Converting Z (effectively a list of random bits) into an integer seems pointless and arbitrary.
The "|...|" syntax is not mentioned in the glossary section. ("a || b" is mentioned but that's for array concatenation, which this is definitely not).
I was also a bit puzzled by the use of "<=" in this condition.  Why bother to truncate if the length is equal, just return it as it is?  Further suggestion that it doesn't mean "length of Z".

So, how should I understand this slightly weird bit of text?  I doubt it's a mistake in the document because it's such an important algorithm and will have been stringently vetted by thousands of people much smarter than me.


texts: On CPA & KPA security of $\boxplus$-Feistel

texts:
I am interested to identify the effect of replacing $\oplus$ with $\boxplus$ on basic balanced Feistel structures over $r$-rounds. Given:
$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$ where $f$ is a PRF
$[L,R] \in \left\{0,1\right\} ^{n} $
Q1 . In terms of CPA and KPA security, does $\boxplus$ replacement add security over 3 rounds, with proof?
Q2 . If   $\boxplus$-Feistel structures have better security bounds than  $\oplus$-Feistel, why are they not commonly used?


texts: Security of authenticated encryption modes GCM & CCM

texts:
I have two questions for Clarification for AE mode choice criteria

GCM : it  appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly sensitive (more than other AE modes ?) to IV uniqueness requirement and completely fails if such requirement is not respected'. I personally in regard with planned target domain of application consider this as a weakness . So such weakness should not weight in the criteria for AE mode selection ? Remain GCM the one of most powerful AE mode despite this weakness ? Isn't EAX or OCB if no more patented a more efficient & secure choice ?
CCM : I understood via such mode review that it is based on MacThenEncrypt procedure (CBC-MAC then CTR ) . So why is  such mode always presented as candidate AE mode if only Encrypt-Then-Mac procedure seems actually recommended by cryptography experts ?


texts: What is the maximum number of messages that can be encrypted using the same key for CTR mode?

texts:
In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key?

The maximum length of messages that can be encrypted using the same key under the counter mode is $2^{39} - 256$ bits.
I want to make sure am I correct?


texts: Is the "Hash Tree" described in this paper the same as a Merkle Hash Tree?

texts:
I'm implementing an algorithm from a paper, and part of it calls for using a "hash tree". Since I'd never heard of that data structure I looked it up on Wikipedia. It turns out that the name hash tree is ambiguous and can be used to refer to three different types of data structures. They are:

Hashed Array Tree
Hash tree (persistent data structure), an implementation strategy for sets and maps
Merkle Tree

After reading about each type of data structure, I'm pretty sure that the paper is using a Merkle tree, but I want to get a second opinion. The only thing that makes me doubt that it might be a Merkle Tree is that it seems like I can find lots of examples of it being used in Cryptography and I only see it mentioned a few times in the data mining papers that I'm reading.

The paper in question is Fast Algorithms for Mining Association Rules and the specific section that I'm referring to can be found on page 4 in section 2.1.2.

I've quoted a section of the relevant text below.

  Candidate itemsets Ck are stored in a hashtree. A node of the hash-tree
  either contains a list of itemsets (a leaf node) or a hash table an (interior node). In an interior node each bucket of the hash table points to another node. The root of the hash-tree is defined to be at depth 1.  An interior node at depth d points to nodes at depth d+1. Itemsets are stored in the leaves. When we add an itemset c we start from the root and
  go down the tree until we reach a leaf. At an interior node at depth d we decide which branch to follow by applying a hash function to the dth item of the itemset. All nodes are initially created as leaf nodes. When the number of itemsets in a leaf node exceeds a specified threshold the leaf node is converted to an interior node.

It should also be noted that this particular data structure is mentioned in other data mining papers that are based off of the apriori algorithm such as in this paper on cyclic association rules. Since it is a data structure that is used often, I'd like to read more about is than simply two paragraphs in a few papers.


texts: Securely generating passwords based on a secret and a public identifier

texts:
I'm trying to create a good scheme for generating passwords in my systems management scripts. What I'd like to do is have a secret key (let's say hello123), which I keep only on trusted management machines. I'd then like to combine that with a "password identifier" (for example testing-db-pass), and produce some ASCII text that can be set as the password in the service's config.

I've read about key stretching, PBKDF2 and HMAC, and it seems like using bcrypt  and passing hello123, testing-db-pass as the salt and key for those would work - but is that vulnerable to attack? Do I need to do something like HMAC-bcrypt? Is there a better way?


texts: Zero-knowledge proof that a group element is a quadratic residue?

texts:
In a paper it says: "To convince a verifier that a group element is a quadratic residue, the prover executes the following proof with the verifier":

$PK \left\{ (\alpha) : y = \pm g^\alpha \right\}$

Does someone know how such proof is implemented by a signature proof of knowledge? The group is an RSA group $\mathrm{G} = \mathrm{QR}_n$ with $n = p \cdot q$ and two safe primes $p$ and $q$. I have found an implementation as part of a bigger protocol but although the $\pm$ was in the $\mathrm{PK}$ statement, they ignore it in the implementation. Now I am a little bit confused.


texts: Ring (or Ideal) version of Boyen's signature

texts:
Boyen's signature is a well-known post quantum digital signature scheme. It's a lattice based scheme that uses a trapdoor of the lattice $\Lambda^{\perp}(A)$ and it's security is based in the SIVP problem. In section 2.3 of this paper Ring Variant it's commented how to construct a ring variant of this scheme to improve the efficience (by reducing the size of the public key).

The idea is really clear, but it's not formalized and the citations mentioned there are quite tricky (it is written there that they you can easily find an analogue version of 3 algorithms but in fact you can just find 1). Does someone know if this ring variant is defined somewhere? It is still a work to do? I want to use this scheme in my thesis but I cannot find a proper formalitzation of this scheme anywhere.

I would appreciate any information, citation, book... that you can provide.


texts: How to find which padding method is used in block cipher (AES) encyption?

texts:
I have a cipher text which is encrypted using AES-128 Algorithm.
I want to know the following things to decrypt the cipher.

IV (Initialization Vector)
Padding Method
Encryption Key

How do I find the padding method used in the encryption?


texts: Random Oracle Model for an ideal block cipher vs Ideal Cipher Model

texts:
Some security proof involving an ideal function use the Random Oracle Model (ROM). They posit a thing that given integer $b$ and bistring $M$, returns what it previously returned for that input $(b,M)$ if it ever received it, and otherwise returns a random $b$-bit bitstring.
Some security proof involving an ideal permutation use the Bijective Random Oracle Model (BROM). They posit a thing that given a bistring $B$, returns what it previously returned for that input $B$ if it ever received it, and otherwise returns a random bitstring the same size as $B$ among those it never returned.
Some security proof involving an ideal block cipher could similarly posit a thing that given bitstrings $B$ and $K$, returns what it previously returned for that input $(B,K)$ if it ever received it, and otherwise returns a random bitstring the same size as $B$ among those it never returned for an input with the given $K$.
Is there a name+acronym  for that model? Otherwise, make that the Keyed Bijective Random Oracle Model (KBROM).
Could we say that the ROM is to random member of a Pseudo-Random Function family (PRF), what the BROM is to random member of a Pseudo-Random Permutation family (PRP), and what that KBROM is to a random member of a Pseudo-Random Block-Cipher family (PRBC)?
How do KBROM and PRBC relate to the Ideal Cipher Model used in e.g. J.-S. Coron, T. Holenstein, R. Künzler, J. Patarin, Y. Seurin, and S. Tessaro's How to Build an Ideal Cipher: The Indifferentiability of the Feistel Construction, in JoC, 2016?


texts: Differences between AEAD and ECIES when transmitting secret messages

texts:
I wonder what are the practical differences between using Authenticated Encryption and then ECIES. It looks like both require communicating the shared secret in some fashion between the parties and both provide encryption and authentication.

To make a concrete example, consider we have a party A, which receives messages {x1, x2, ..., xn} from various other parties, but needs to read the sender from the message itself, because upon receiving a message x, A doesn't know the sender otherwise. Using some AEAD scheme, A could have in an authenticated part the sender in plain text, consequently allowing A to choose the shared secret which to use to authenticate and decrypt the the message it received.

Can ECIES do this and if so, what is the practical difference? If not, well, what could be the purpose of ECIES? There seem to dearth of information on ECIES.


texts: What key length is required to keep simple keyed "hash" secure?

texts:
In a previous question, I described a particular keyed "hash" that mapped a 5-digit input code into a 5-digit output code. It used a 8-bit key which is very insecure - more than 99% of the time, you can infer the key given a single input/output code pair.

I put "hash" in inverted commas as although it has something in common with a hash, it always has an equal input and output length, and it is certainly not secure in anyway.

The input code to output code mapping is not one-to-one. It is possible for an output code to come from several input codes. A given input code only maps to a single output code.

Let's ignore the specific algorithm in the previous question and assume something secure has been developed.

The two most important security properties are:

The attacker should not be able to predict the output code when only given the input code.
The attacker should not be able to derive the key given multiple pairs of input/output codes.

I suspect this means that there are $100000^{100000}$ potential mappings between the input and output codes - essentially limitless. They key length cannot be limited by this constraint.

Does this mean that the key length should obey the normal "long enough to prevent brute forcing" rules that most current encryption does, and should be 128 bits or longer?


texts: 802.1X Radius WLAN protected by certificate 1024-bit key

texts:
I want to ask you a question.

I have WPA-2 (enterprise) network. Also called as 802.1x.
I use the Linux Zeroshell distribution, which is optimized for these services. Linux Zeroshell is provides a radius server. I also have a router.
I have entered accounts to Zeroshell, which can access the network. Each human, who wants to connect must have certificate, which I exported and installed to each computer. I there have the options for 1024 or 2048 bit keys. I use 1024 bit keys.
Is there connection encrypted by 1024-bit encrypting?
I think it is encrypted by 256-bit encryption and 1024-bit is key for digital signature for each message in LAN?
So is this ''asymmetric'' key used as symetric key?

I am using login based on PEAP + MS CHAP V2.
Certificate is in .PEM format.
Login is only available for WLAN users.


texts: Advances in Indistinguishability Obfuscation

texts:
I hear there's a recent advance in Indistinguishability Obfuscation, aka io, with emphasis on Aayush Jain, Huijia Li and Amit Sahai Indistinguishability Obfuscation from Well-Founded Assumptions (eprint and arXiv, August 2020).
For the applied cryptographer inexperienced in Indistinguishability Obfuscation, what's the big picture? What concrete problem does this aim to solve, preferably with orders of magnitude of the data and work required?


texts: Proof for, Vectors sampled from $D_{(L,r)}$ have Euclidean norm at most $r\sqrt{n}$ with a high probability

texts: For any $n$-dimensional lattice $L$ and $r > 0$, a point sampled from $D_{L,r}$  has Euclidean norm at most $r\sqrt{n}$ except with probability at most $2^{-2n}$ (where $r$ refers to the standard deviation of the distribution). I came across this statement in the paper On Ideal Lattices and Learning with Errors Over Rings, 2012 by Peikert, Regev, Lyubashevsky. Can someone give a proof for why it is so?


texts: Possibility to combine keys for asymmetric signature creation

texts:
There is an asymmetric algorithm which signs with a private key and verifies with a public key. Private and public keys are created in pairs.

Assume we have 2 pairs of private and public keys.

Is there a way to combine two private keys to one private key $priv_{comb}$, so that the produced signature $S$, computed with this $priv_{comb}$, could be verified with either of those two public keys?

It is possible to run the algorithm twice for each pair of keys and produce 2 signatures but it is not an option on resource constraint devices.


texts: Counting the number of binary solutions of quadratic system

texts:
I have a quadratic system of equations related to a balanced RSA modulus $n=pq$ (i.e. $\log p\approx\log q$), and I want to give an upper bound on the number of solutions. Indeed, let $p_i,q_i$ be binary variables, and let $c_i$ be integers such that $0\leq c_i\leq i+1$.

$$\left\{\begin{array}{ll}
p_0q_0&=c_0\\
p_0q_1+p_1q_0 &= c_1\\
p_0q_2+p_1q_1+p_2q_0 &= c_2\\
p_0q_3+p_1q_2+p_2q_1+p_3q_0 &= c_3\\
&\vdots \\
\sum_{i+j=k}p_iq_j &= c_k
\end{array}\right.$$

Given the fact that one solution to this system exists (i.e., the complete factorization $p,q$), I wanted to quantify the number of other solutions to this quadratic system.

I know that there are lattice representations that help in this direction, and probabilistic and deterministic algorithms that actually solve them. But I want just to have an estimate on the number of solutions, maybe taking into account the symmetry of the system. A hint or reference will be highly appreciated.


texts: What is the difficulty of DLP in GF(P^Q) with a subgroup with a prime order of L

texts:
Given a finite field GF(P^Q), having a subgroup with a prime order of L (P,Q,L are all primes), how difficult is it to find the discrete log, is it related to P and Q or is it related to L, or to both. What is the time required? O(sqrt(L)) ?

Does index calculus apply to Galois fields?


texts: Public key decryption mathematical analogy

texts:
To clarify, I'm talking about digital-signatures, not public key encryption.

When I encrypt something with a private key, then it should be decryptable with a public key, as I've understood how asymetric cryptography works.

So, if 654 * 987 * 123 = 79.396.254, there are countless sums that could lead to that 79 million answer, that explains private key encryption to me, and can be applied to superficially explain how digital signing works.

But how do you verify with a public key, that it was signed with their private key?

I'm looking for the simplest mathematical way to explain this, perhaps using a similar mathematical analogy.

I'm not looking for a super in-depth explanation, but a superficial analogy for it.


texts: How do I create a cryptographic signature and commitment scheme with accountable evidence?

texts:
This is a weird one... I am looking for a method which I don't even know how to call, nor whether it actually exists!

Given a pair of asymmetric keys $s_{k}/P_{k}$ and defining $Sig_{k} \dagger B_{i}$ as the signature of block $B_{i}$ using $s_{k}$. Is there a a function $\otimes$ with the following characteristics?

$Sig_{k} \dagger B_{1} \otimes X_{1} => D_{k}$
$Sig_{k} \dagger B_{2} \otimes X_{2} => D_{k}$
$Sig_{w} \dagger B_{i} \otimes X_{i} \neq> D_{k}$

, where $\dagger$ has precedence over $\otimes$.

If I sign a block with $s_{k}$ there should be a bitset $X_{1}$ related with the block $B_{1}$ and, when applying $\otimes$ gives a
$D_{k}$ that has a relation with $P_{k}$.
If any other $B_{2}$ is used there should be a $X_{2}$ that gives the same result.
If a different key pair is used $s_{w}/P_{w}$, we should not be able to find any pair ($B_{i}$, $X_{i}$) capable of resulting in $D_{k}$.

Finding $X_{i}$ from $B_{i}$ or $Sig_{k} \dagger B_{i}$ (to verify the condition) should be easy only if one has $s_{k}$.

We should not be able to infer $P_{k}$ from $D_{k}$ without having the inputs.

Application:

$D_{k}$ serves as a commitment scheme and has the requirement of being immutable for a $s_{k}$.

One can publish a proof of ownership of $D_{k}$ knowing $s_{k}$. This proof has a specific ($B_{i}$, $X_{i}$) pair that is delivered to a specific entity $I_{i}$ (also with the signature). In case that entity publishes the proof without authorization, it can be identified and accountable for the security breach.

The alternative I'm using now is to apply a deterministic signature function $H(Sig_{k} \dagger B) => D_{k}$. Where $H$ is a SHA-256 function and $B$ is static, always resulting in the same $D_{k}$. One cannot infer $P_{k}$ because the signature is hidden using the hash (assuming all $P_{k}$ are public). If I disclose $Sig_{k} \dagger B$ I can prove $D_{k}$ is mine. However, if I share this proof with multiple parties, I cannot use it to "point fingers" in an eventual security breach.


texts: Current day memory capabilities for cryptanalysis?

texts:
Out of interest, what would be the largest size lookup table which would be feasible to implement to attack a cipher (possibly  under a fixed key) or in a TMTO setting, for an organisation with a large but not arbitrary budget, say a global multinational.

Is $2^{64}$ within reach?

Edit: Mainly intetested in block ciphers. Let's consider, for concreteness sake, blocklength $n=64$ and a TMTO attack.

Edit 2: There were comments, before the question was put on hold, to the effect that an exabyte is probably not possible but a petabyte ($2^{50}$) is. Assuming this, I'd say that it would be possible to build a $2^{50}/8 = 2^{47}$ size lookup table.

The TMTO scenario is probably more interesting, so any answers/comments directed to that case, assuming a petabyte is feasible, will be interesting.


texts:
I'm dealing with a website that loads a javascript file which eventually sets an AES hash/value (whatever it's called) as a cookie. The file is heavily obfuscated making it hard to understand certain things within. Anyways, I have reversed enough of the file to understand that they are using the cipher block chaining mode (cbc) to generate this value. I also believe I have found the AES key needed to decrypt. However I'm wondering how I could go about decrypting an example cookie (set by the browser) using the AES without knowing the IV.
If it helps, I know for a fact that the AES value (cookie) is always a 48 int array in bytes. The key, from what I can see, ranges from 128-bit to 192-bit.
In summary, I have the encrypted AES value, I believe I have the key. How can I go about decrypting this to in turn be able to generate my own values? Thank you


texts: Encrypt-then-authenticate variant used in IPsec

texts:
I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter.

What I got so far is that the integrity and confidentiality computations cover different parts of the EPS packet. What I don't understand is what exactly is done and how this is different from the general EtA composition (i.e. what is modified in comparison to the general EtA composition).


texts:
I have a curious question.
Is Identity-based encryption used in the wild?


texts: Is the subset of hash digest collision-resistant if hash function is collision-resistant?

texts:
Let $H(\cdot)$ be a collision resistant hash function,
$H:\{0,1\}^{\mathsf{poly(n)}} \rightarrow \{0,1\}^n$,

We define a new $H':\{0,1\}^{\mathsf{poly(n)}} \rightarrow \{0,1\}^k$, where we randomly pick $k$ bit positions of $H(\cdot)$.

If we let the adversary, $\mathcal{A}$ , know those $k$ positions, does finding a collision for $H'(\cdot)$ still require $\mathcal{A}$ to ask $2^{k/2}$ queries to $H(\cdot)$ ? Can she do better? Also, if we hide those $k$ positions from $\mathcal A$, is it harder for her?


texts: What is the probability of attacking SHA1 used in RSA signature with small exponent?

texts:
There is RSA signature check which has following properties:

RSA modulus N which is 2048-bit
RSA public exponent equal 41 (0x29)
Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however the verifier only compares 20 least significant bytes which are the SHA1 hash. In order to trick verifier, forged signature needs to contain SHA1 of message on the 20 least significant bytes. All other bytes are ignored.

Due to broken check, there exists around $2^{48}$ (because $(2^{48})^{41}$ is smaller than modulus) SHA1 signatures that can have signature forged using algorithm described in Mathematics.

If I try $2^{32}$ different hashes (by trying all numbers in the last 4 bytes of the hashed message), what is the probability that I will encounter one of these $2^{48}$ easy-to-forge hashes?

Is there any other attack type that might be used for such broken signature check?

Adversary has 6 genuine signed messages (message and signature; message not chosen by attacker) and is not able to obtain more.


texts: Difference between encryption and decryption for Feistel Cipher

texts:
I have read that the only difference between enc and dec of a Feistel Cipher is the order of the subkeys. But on the following figure, the harves block are also inverted, no?

I don't understand why it doesn't count as a difference... To me, take the R block or the L block into the XOR has not the same effect.


texts: byte length and offset for k3d3/ed25519 byte[] variables?

texts:
I've discovered for myself that java's BigInteger is very slow, so I'm trying to weakly optimize this java implementation of ed25519 which I will fork and post if successful by substituting BigInteger with jscience's LargeInteger.

I'm almost done converting all of the BigIntegers to LargeIntegers, but I still need an equivalent to BigInteger's and, and I need to know how long some byte[] variables should be and their offsets to use valueOf with byte[]s.

I could keep some of the existing code and merely convert BigIntegers to LargeIntegers, but I'd prefer to fully replace BigInteger.

"length - the maximum number of bytes to read." sounds like I should use .length of the byte[] to be converted.  Is that correct?  If not, what should be used?

"offset - the offset at which to start reading the bytes." sounds like I should use 0.  Is that correct?  If not, what should be used?

I'm 100% new to binary and cryptography.


texts: The compression of the eliptic curve point coordinates

texts:
Some time ago I faced the problem of the unexpected format compression of the points on elliptic curve. I used ECDH procedure with a third party service on the base of the $\mathbb({F}_{2^m})$ curve in the polynomial $(m,k_3,k_2,k_1) = (431,5,3,1)$ representation.

As response I received a compressed point in the following format:

03 39000436 + "108 other digits"

My confusion was that I expected to see the compression format corresponding to X9.62 standard: Public Key Cryptography For The Financial Services Industry:
The Elliptic Curve Digital Signature Algorithm (ECDSA)

I expected to see 03 + "108 digits". Here 03 is a sign of the compression format and 108 is the size of the $X$ and $Y$ coordinates (54 bytes each) for $(431,5,3,1)$ curve.

Could you please help me to understand what does this 39000436 mean?


texts: What is the encoding protocol for passphrase protected RSA private keys?

texts:
What is the protocol used to encode an RSA key protected with a passphrase?

If I generate an RSA key with

ssh-keygen -t rsa -b 4096

and do:

head ~/.ssh/id_rsa

I get:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,83F1F6710FBD0610A70A04F5ABDE4114

<base64 data>

What encoding protocol does this use?

For RSA private keys not protected by a passphrase, they are encoded in Base64 ASN.1 and the structure is documented here: https://tools.ietf.org/html/rfc8017#appendix-A.1.2


texts: What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?

texts:
I'm working with the affine representations of points of the Secp256k1 elliptic curve (from Bitcoin).

I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed faster than the standard way. Other papers say that with some pre-computation, the field inversion can be amortized if $F^1(P) ... F^k(P)$ must be computed.

I need the fastest function $F(P)$ that, when applied to the last result iteratively, generates a sequences of points whose average period is large (I don't need any proof, it can be just large in practice).
To be fast I suppose it should be computed without field inversions. I don't mind to pre-compute some values.

For example, it could be $F(P) = 1.5P+4Q$ for a fixed $Q$. It doesn't matter which function it is, because I need it to generate random points in the curve. The probability distribution doesn't matter either.
(notation: $1.5$ is the point halving of $3P$)

Motivation: Solutions to this problem may be helpful for generating vanity addresses.


texts:
Recently NSA published two new algorithms, Simon and Speck. In the abstract they say

  The aim of SIMON and SPECK is to fill the need for secure, flexible, and analyzable lightweight block ciphers.

so as the question title says, what does 'analyzable' mean? BTW I found the publication through Schneier's blog post about it.

I haven't had time to read the entire document but haven't found any other references to that particular word. Do they mean the algorithms are easy to be 'proven secure'? Or is it something else? To conclude, this question does invite some degree of discussion, if you feel it doesn't comply with the site's policy, please flag it down. Cheers


texts:
I have started doing some reading about power analysis (SPA, DPA), and it is not clear to me in what Scenario one would have to fear such an attack.  It appears to me that a typical situation is

Scenario A: A key is stored in plain text on a smart card, the analysis is conducted while encryption/decryption request are sent to the card and in effect the key is obtained.

However I am more interested in

Scenario B: A key is stored encrypted on a device (smart card?). During normal operation one would send the passphrase (required for decrypting the key) together with an encryption/decryption request to be performed by the decrypted key. Now the assumption is that an attacker does not posses the passphrase.

Would it still be possible to obtain the passphrase by power analysis?
(From my imagination the only thing one could do is feeding wrong passphrases.) From my understanding scenario B is not susceptible to power analysis, or am I wrong?


texts: Generating child keys for a hill climb algorithm

texts:
As a little pet project I'm writing some code to do a little cryptanalysis. Starting with something simple I have created a hill climbing algorithm for solving a simple substitution cipher.

So I start by generating a parent key by shuffling letters A-Z randomly. For the first iteration I am generating a child key by randomly swapping 2 characters from the parent key, and in each subsequent iteration I am shuffling two characters from the previous iteration's key.

While this approach works, it seems very inefficient, as the randomness seems to generate the same key over and over again on each attempt at a solution.

So my question is, is there a better solution for generating child keys than random? A few things I have considered but not tried:

memorizing previous keys and checking a new random key has not already been tried
Some other means of shuffling characters, such as swap 1-2, 1-3, 1-4 .... 2-3,2-4... etc (This feels much too much like brute force)

But both of these strike me as making the algorithm less efficient not more (ie, the overhead in doing each outweighs the gain made by using random chance).

Any particular thoughts?

Edit: As the comments have quite rightfully pointed out perhaps the problem I'm facing is not actually how to generate better child keys, but how to avoid a local maximum. Other relevant details of my algorithm are as follows:

I am scoring based on the Sum of the Log10 probability of Quadgrams
I am running my algorithm until 1000 iterations have not provided a better score
I am running the entire thing until 20 tries have not produced a better score


texts:
I am working with this black box cryptography scheme.
I know the plain text, cipher text, and everything else except how they whiten the data (or key?). Everything is 128 bit, 16 bytes.

I have two keys, one is the called the 'WhiteningKey' and the other is called the 'AESKey.'
If I set the 'WhiteningKey' to zero bytes, then I can encrypt/decrypt data using AES-ECB and get the correct encrypted data (matches the ciphertext from the black box output). I think there is either an inverse s-box or something else because to decrypt data I encrypt it and vise versa. My crypto library does not support inverse s-box so I have yet to test this, but I also thought about it being AES-CFB, with the IV being the 'WhiteningKey.'

I have heard of XEX (XOR-ENCRYPT-XOR) and I don't think this would be how it incorporates the whitening because if you look at null byte blocks they are not the same (prevents replay) (note that they are the same if whitening key is null).

I do not think it would be CBC (or similar modes where whitening key is the IV) because the system needs random access read/writes. And to my current knowledge you have to encrypt/decrypt all prior blocks to obtain current plain/cipher text block.

Here is some data I collected that I used AES-128-ECB to reproduce results from black box:

  Whitening Key: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  AES-128-ECB Key: 74 50 74 60 E3 89 52 57 43 17 8D 9A 75 38 04 6E

    plain text: 4E 4E 44 5E 00 00 D8 1E 00 00 01 00 00 04 00 00

    cipher text: 2D 68 D9 8E 2C 06 6E 56 D1 8F B2 78 43 2B A7 23

Here is some data I collected from the black box where I do not know how the whitening key is incorporated into the algorithm (blocks 2 is right after block 1, they are consecutive):

  Whitening Key: 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55

  AES Key: 74 50 74 60 E3 89 52 57 43 17 8D 9A 75 38 04 6E

    plain text 1: 4E 4E 44 5E 00 00 D8 1E 00 00 01 00 00 04 00 00

    plain text 2: 07 60 00 00 78 2B 16 02 81 30 0D 49 C2 32 F1 45

    cipher text block 1: 05 D2 AB 98 31 A8 DD 3F 7F 04 1B B5 17 74 68 B6

    cipher text block 2: BE DB D3 8A A9 D3 80 4E FE EE DA 57 71 83 0F 74

Example of me encrypting data and an actual dump of encrypted memory.

All this makes me ask: How can I find or reverse engineer the whitening in an AES algorithm? Is there a general approach to do so?


texts: I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) while the ECC can be used instead, which has advantages over RSA?


texts: Is there a general way to crack this graph cipher?

texts:
Every coded message has a numerical key, it can be a number any digits long. Each decoded letter of the message is placed on separate points of a 10 by 10 coordinate graph. Each letter is represented by a 6 digit number. The first two digits show which letter of the alphabet the letter is. A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 10 20 30 40 50 60 70 80 90 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 The third and fourth digits represent the Y axis point. The fifth and sixth digits represent the X axis point.

To encrypt a letter, one takes the representing numbers and multiplies the 6 digit number by the key. If the key was 605, and one wants to place the letter 'H' on point Y: 5 X: 3, the equation is 805,030 * 605. This equals 487043150.

To decrypt the letter H, one divides 487043150 by 605. This would equal 805,030. Then the solver fills in the blanks. 80 shows that the letter is H. 50 shows that the letter goes on Y point 5. 30 shows that the letter goes on X point 3. The solver would then decode letters systematically until they spell out words on the graph.


texts: Why blinding integer $r$ needs to be co-prime with $N$ in blind RSA signature

texts:
According to blind RSA signature wiki the random value $r$ in $m^\prime=mr^e \bmod N$ needs to be relatively prime to $N$.

Why is this a requirement?

A follow up a related question: after $s$ (unblinded signature) and $m$ (original message) are revealed, can anyone (and not only the signing authority) check the validity of the signature by checking $s^e=m \bmod N$?


texts: Difference between INT-CTXT and INT-PTXT

texts:
I have read recently (here) about INT-CTXT and INT-PTXT and that INT-CTXT is strictly stronger than INT-PTXT. I wonder if there is any clear example of the situation when INT-PTXT is achieved but no INT-CTXT?

There are also examples of related situation in the original article (e.g. Encrypt-and-MAC and MAC-then-Encrypt schemes on pp. 25-31) but I haven't managed to understand them. How an adversary is able to produce a ciphertext which wasn't produced by the sender but is not able to produce a ciphertext decrypting to a message which the sender has never encrypted?


texts: Combining ECC And RSA for a Web Based Chat system

texts:
I'm a building a Web application chat message system(Over TLS) and i would like to know if the following theory is correct.
Sender

I'm generating keyPairs using RSA and another KeyPairs using ECC.
By using ECDH, I get $1$ shared Key from the ECC keyPairs.
Using the Shared Key $i$ encrypt the chat message using AES-256
I generate one random $256$-bit key
I encrypt AGAIN the encrypted message using the plainText of the key generated in 4)
I encrypt the key generated in 4) using RSA
I sent the encrypted chat message(5) along with the encrypted key(6) over socket

Receiver

Decrypts the encrypted key using RSA
Uses that key, and decrypts the chat message text
Decrypts the chat message text again, using the shared key from ECDH

I'm also providing an optional method to use a symmetric key to encrypt the Public RSA/ECC keys.
Is the above approach a good and secure way to build this system? What would you change?
Kind Regards


texts: One-time pad and perfect secrecy properties

texts:
I have a homework problem:

Explain how to find $m_{0}$ and $c$ such that $P[c=c': k \leftarrow K, c' \leftarrow E(k, m_{0})] > 0$

where P is probability and k is chosen uniformly.

I do not know if I understand the question correctly. The notation should imply that what is the probability of the condition $c=c'$ given a program that evaluates c' by selecting $k$ uniformly from all keys and encrypts the message $m_{0}$  with this random key. My understanding is that to get a probability of encrypting to $c'$ that is greater than 0, it would be sufficient to guess a $m_{0}$ and $c$ that are of equal length.

Any hints?


texts:
The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the adversary to compute session key, even adversary gets involved in the generation of messages.

An ID-based key-exchange has some differences with the traditional ones, such as it needs a KGC,

and public/private key generation is handled differently compared with the traditional ones.

Compared with the traditional authenticated DH protocol, what's the advantage of ID-based ones?

And if I want to design a ID-based key-exchange protocol with a bilinear pairing especially under eCK model, are there some ways to realise PFS against active adversaries besides using digital signatures?

Where should I pay particular attention?


texts: Explanation of trace function $\operatorname{Tr}_m(x) = x^{2^{m}} \oplus x$

texts:
The following statement is from a paper (Partitions in the S-Box of Streebog and
Kuznyechik) about S-Boxes:

  For all $ x \in \operatorname{GF}(2^{n})$, it holds that $x^{2^{n}} \oplus x = 0$.
  If $n= 2m$ then we define the trace from $\operatorname{GF}(2^{2m}) \to \operatorname{GF}(2^{m})$ as the function $\operatorname{Tr}_m(x) = x^{2^{m}} \oplus x$.

I don't understand why this works for all $ x \in \operatorname{GF}(2^{2m})$.
Why is it safe to say that this operation ends in the subfield $\operatorname{GF}(2^{m})$?


texts: Textbook RSA Signature attacks (without message padding)

texts:
I have been reading as much as possible, but I haven't so far found anything exactly like what I'm looking for.  I have a couple of questions (given what I know below):

One, is it possible to find d?
If not, is there a practical way to forge a signature for an arbitrary message?

We all know the textbook RSA signature is:

σ = m^d mod N

Now, typically m is padded to avoid specific attacks.  Also, I presume m is not normally known to an attacker (since it should be padded), only σ, e, and N.

In this case however, m is not padded at all - it's just an MD5 hash, which I can easily reconstruct.  Additionally, I have many other signatures that were created with the same key and exponent.  d is 1024 bits.

So since I know σ, m, N, and e=7, is it possible to reconstruct d?  It doesn't appear to be possible, but my understanding is fuzzy at best.

A few attacks so far I have read about (this is a vast subject, there were more):

Meet in the Middle
Signature forgery
Chosen Message (basically same as above)
Small Exponent attack
Common Modulus
CRT Theorem

And obviously, brute force factoring of n - which is still not possible.

It seems to me that a likely option is signature forgery.  The answer here seems like it's pretty complete, but I'm still trying to decipher it:
RSA 1024 bit forge a new matching signature from a chosen message

The other possible attack I could think of would rely on the fact that I have ~100 valid signatures for the same key.  The chosen message attack seems closest:
Chosen-Message-Attack RSA-Signature

But it doesn't seem like the message can be arbitrary.

edit: I have remembered something else that might be helpful.

One of the key flaws in this RSA implementation (other than the lack of padding) is the signature verification step.  I can change the definition of the size (and location in memory) of the message that the verification routine uses to calculate the MD5.

Indeed, this has already been used in some cases to permanently disable the RSA verification process from running in the future, by pointing it to a copy of the original message that already has a valid signature, fooling it into believing the actual message is valid.

The problem is that it's not always possible to alter the size/location of the message.  And sometimes it's also not possible to disable the RSA verification process - the only options are a forgery or recovering d.


texts: Finding non-zero coefficients in 8 bit polynomial LFSR

texts:
I have a following crypto problem and I have been struggling with for some time

An 8-bit linear feedback shift register with connection polynomial
C(X) = 1+aX +bX^2 +cX^3 +dX^4 +eX^5 + fX^6 +gX^7 +hX^8
is used to generate a pseudo-random binary sequence. This pseudo-random
sequence is used as the enciphering key of a stream cipher. It is known that
when the cipher is applied to the plaintext string
[0,0,0,1,0,0,0,0,1,1,0,0,1,0,1,0,0,1,1,1,0,1,0,1,1,0,1,1,0,1]
the corresponding ciphertext string is
[1,0,1,0,1,1,0,0,1,1,0,1,1,0,1,1,1,1,1,1,0,1,0,1,0,0,0,1,0,0]

What would be the approach to determine all non-zero coefficients in this polynomial? I have no clue how to start...

Thanks in advance


texts: What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0?

texts:
It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they support like SSL 3 or TLS 1.0.
Eric Lawrence has said that some version outright chokes on TLS 1.1 and 1.2.  Adam Langley points it out again:

Due to a different, common bug in SSL 3.0 implementations (nearly 12 years after SSL 3.0 was obsoleted by TLS 1.0), browsers still have to perform SSL 3.0 downgrades to support buggy servers. So even with a TLS 1.1 capable browser and server, an attacker can trigger a downgrade to SSL 3.0 and bypass the protections of TLS 1.1.

And there are significant notes in the TLS 1.2 RFC also.

Note: some server implementations are known to implement version
negotiation incorrectly.  For example, there are buggy TLS 1.0
servers that simply close the connection when the client offers a
version newer than TLS 1.0.  Also, it is known that some servers will
refuse the connection if any TLS extensions are included in
ClientHello.  Interoperability with such buggy servers is a complex
topic beyond the scope of this document, and may require multiple
connection attempts by the client.

And finally, Eric Rescorla who's somewhat 'up' on TLS adds:

First let's dispose of the TLS 1.1 angle. As has been apparent from the beginning, the ultimate fix is to upgrade everyone to TLS 1.1. Unfortunately, the upgrade cycle is really long, especially as many of the popular stacks don't have TLS 1.1 support at all. To make matters worse, due to a number of unfortunate implementation decisions which I'll hopefully get time to write about later, it's likely to be possible for an attacker to force two TLS 1.1 implementations to speak TLS 1.0, making them vulnerable. So, upgrading to TLS 1.1 is basically a non-starter.

Are all these notes about the same problem?  Is that problem as straightforward as a server choking on a 1.1 or 1.2 offering ( { 3, 2} or { 3, 3} ), or is there more to it?  Is there any documentation or notes about just what servers choke on TLS 1.1?


texts:
What is the point of the initialization vector in cryptographic modes like AES-CBC when it is sent in the public?
Cant any attacker just listen and reverse the IV? and as such defeating its purpose?
EDIT
I already know what has been said here. My question was: Can't any attacker just listen and reverse the IV? And as such defeating its purpose?
So, by using IV, the message 'hello' becomes (XXXX) and (yyyy), but since both have a copy of their respective IVs in the public such that (XXXX)123 and (yyyy)456, why can't I use 456 to make (yyyy) back to (XXXX) (to clarify)? I am assuming that the decrypter of (yyyy)456 transforms the message in the following ways (yyyy)456 -> f(456) -> (XXXX) -> f(key) -> 'hello'. So why an attacker can't just (yyyy)456 -> f(456) -> (XXXX) if 456 is already known?


texts: How is the zero-knowledge proof definition violated, here?

texts:
I'm confused about the definition of an interactive zero-knowledge proof (the simulator-transcript-thingy).

Assume the following setup:

$P$ and $V$ do a Diffie-Hellman key exchange to generate the shared secret S. They then both compute the hash $H(S)$.
$P$ computes $\sigma = sig(sk, H(S))$ and sends $\sigma$ to $V$.
$V$ checks whether $ver(pk, H(S), \sigma) = 1$ and iff it is, assumes $P$ to have proven its identity.

For simplicity, let's assume the base to be $2$.

$sig$ is defined in such a way that its output has $k$ bit and

$∀σ∈\{0,1\}^k, sk∈\{0,1\}^n : (∃S∈\{0,1\}^ℓ : sig(sk, H(S)) = σ)$

where $n$ is the length of the private key and $ℓ$ is the length of the secret created via Diffie-Hellman.

We actually need to require that

$∀σ∈\{0,1\}^k, sk∈\{0,1\}^n, a∈ℤ_q, S∈ℤ_q : (∃b∈ℤ_q : sig(sk, S \mod p) = σ, S = g^{a\cdot b}))$

where $g$ is the primitive root of Diffie-Hellman, $p$ is prime, and $q$ is the order of the group $<g>$;. I merely wrote the formula above so it's easy enough for everyone to understand. The jump from the weaker definition above to the one described by the second formula doesn't seem too big.

As with all signatures, an attacker who knows many $sig(sk, M)$ for different $M$ but the same $s$k can learn about $sk$.

This protocol therefore is obviously not zero-knowledge. However, it seems to fit the definition as I can't think of any argument as to why for any PPT attacker $A$ knowing only about $pk$ communicating with $P$, it's not possible to find a PPT $S$ only knowing about $pk$ which simulates the transcript between $A$ and $P$.

Furthermore, I don't see how the transcript contains information about $sk$ (which after all is what the zero-knowledge definition is about). What I think I have done (and am btw pretty sure I didn't do as the definition of zero-knowledge was created by smart people, so I'm quite aware that I made a mistake somewhere (and I want to know where)) is to give $V$ information about $sk$ without there being information about $sk$ in the transcript.

One could even just let $P$ send $pk \oplus H(S)$ to $V$, giving the secret to $V$ without anyone who can only look at the transcript being able to tell whether the entity {creating; participating in the creating of} the transcript knows the secret ($pk$ which can be regarded as a password, no signature function required).


texts: Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?

texts:
According to Bruce Schneier the constants used in the spec of DUAL_EC_DRBG may be related to a secret set of numbers, that could function as a master key for encryption using on this random number generator:

This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to define the algorithm's elliptic curve. These constants are listed in Appendix A of the NIST publication, but nowhere is it explained where they came from.
What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.

source
Is it possible to calculate these secret numbers given these constants? What would it take to calculate them?


texts: Why are these techniques not feasible to crack RSA?

texts:
For $d = e^{-1} \mod \phi(n)$

$$d\cdot e \operatorname{mod} \phi(n)=1$$
$$d = (e^{-1} \operatorname{mod} \phi(n))$$

With having $e$ and $n$, we can calculate the value of $d$ , the private key for cracking.
Why do people worry about factoring $d$ when this technique is available?
I would like to know some real insight into this.


texts: Retrofitting software: the biggest problem with Homomorphic Encryption?

texts:
In my experience, conversations around Homomorphic Encryption tend to focus on the narrative "HE is the holy grail of secure computations, but it's still too computational intensive to be practical".

While in the last years the performance of HE has improved dramatically, one point has remained fixed (and will remain fixed): computing on encrypted data requires an entirely new paradigm to write software. In particular, old software cannot easily be retrofitted to use HE, unless the workflow is a simple sequential computation over the data (no if/else, no actions according to specific values of the data, etc.) and the format of data is exactly known in advance.

Am I missing something? Is there a simpler way to use existing software than rewriting it from scratch?

An example use case could be a Software-as-a-Service solution to do genomics manipulations, such as DNA string matching, in an untrusted cloud instance.


texts:
http://eprint.iacr.org/2015/030 present several attacks of ASCON but does not have a conclusion section.

I'm having troubles estimating what are the consequences on the use of ASCON. What's your opinion about it ?


texts: What is the weakpoint of PRNG based encryption?

texts:
Let's say I used this encryption schema:

In words instead of images:

Hash the encryption key with SHA256
Split it in half, first half use as XOR key for first 128 bit block of plaintext
Hash the second half from previous step with SHA256
Carry the hash to point 2), rinse, repeat.

What are potential problems/weakpoints of such encryption algorithm?


texts:
In the implementation of RSA-CRT, the exponent d is reduced mod p-1 ($d_p = d \bmod {(p-1)}$). The only proof I've found for that, is the following (considering $d = k\varphi(p) + d \bmod {\varphi(p)}$:
$$c^d = c^{k\varphi(n) + d \bmod {\varphi(p)}}$$
$$(c^{\varphi(p)})^k * c^{d\bmod {\varphi(p)}} \equiv (1)^k * c^{d\bmod {(p-1)}} (\bmod p)$$
Source: https://www.di-mgt.com.au/crt_rsa.html
So $c^d \equiv c^{d(\bmod(p-1))} (\bmod(p))$ However, I can't see why is the Euler theorem valid here, as c is not granted to be coprime with p (as far as I know). Any hint on this?


texts: I am wondering if there's a polynomial time algorithm that, given a lattice $\Lambda$ with basis $\mathbf{B}$ and a point $x$ in space, it tells you whether $x$ is in $\Lambda$ or not!


texts: RSA: What happens to restrictions of plaintext n, dependent on p and q?

texts:
Ok - i will try to ask my question as clear as possible. Im getting a little deeper into the RSA-cryptosystem. At one point i'm a little confused.
We have a plaintext $x$ and ciphertext $y$, with

$x \in\Bbb Z_n = \{0,...,n-1\} $.

Additonally we choose $p$ and $q$ as primes. My source says $x$ must be less than $n$, which really makes sense to me. It proves that the RSA scheme works by using Euler's Theorem for:

$$
\\
$$

First case:
$gcd(x,n)=1$

$d_{k_{pr}}(y) \equiv  (  x^{\Phi(n)}  )^t \cdot x  \equiv   1\cdot\ x \equiv  x\  mod\ n     $

$$
\\
$$

Second case: $gcd(x,n) = gcd(x,p\cdot q) \ne 1$

So we can assume $x$ to be: $\qquad x = r \cdot p\ $ or $\ x = s \cdot q \qquad$ ($r\lt q$ and $s \lt p$)
Without loss of generality: $\qquad \ \ x=r\cdot p$
Implict we have: $\qquad \qquad \quad \ \ \ gcd(x,q)=1$

Euler's Theorem holds in the following form:

$\qquad 1 \equiv 1^t \equiv (x^{\Phi(q)})^t\ mod\ q. $

Substitution:

$\qquad (x^{\Phi(n)} )^t \equiv (x^{(p-q)(q-1)})^t \equiv ((x^{\Phi(q)})^t)^{p-1} \equiv 1^{(p-1)} = 1\ mod\ q. $

Using the definition of the modulo operator, we can show that:

$
\\ \qquad (x^{\Phi(n)})^t \quad = 1 + u \cdot q
\\ \qquad  x \cdot (x^{\Phi(n)})^t = x + x \cdot u \cdot q
\\ \qquad  x \cdot (x^{\Phi(n)})^t = x + (r\cdot p) \cdot u \cdot q
\\ \qquad  x \cdot (x^{\Phi(n)})^t = x + r \cdot u \cdot n
\\ \qquad  x \cdot (x^{\Phi(n)})^t \equiv x\ mod\ n .
$
$$
\\
$$
This proof seems plausible to me. Now my questions:

If $x \in \Bbb Z_n = \{0, ..., n-1 \}$ for $n=p \cdot q$, what happens to $n$ when $p$ and $q$ are not prime. Does this restrict the choice of an input $x$. For example, has $x$ to be less than $min(q,p)$? In this lecture Prof. Dr. Spannagel tolds the students that $x$ should be choosen always less than $min(q,p)$, to ensure that $gcd(x,n)=1$.
In addition, what happens if $p = q$ for $p$ and $q$ are prime. Does this affect our proof in case two?

The questions are not about argueing about the security of RSA and well choosen parameters $p$ and $q$. It's more about the restrictions on $n$ we will cause by choosing these factors.

Thanks in advance.


texts:
If Bitcoin can be forked, and the same address can exist on both blockchains, what stops the re-generation of a privatekey on one blockchain that would also work on the other?

For that matter, what stops someone from forking the technology, starting from the genesis block, and using a program to endlessly create addresses > Search those addresses on the Bitcoin blockchain > if the address on the Bitcoin blockchain contains funds > use the newly generated privatekey to access the funds on the bitcoin blockchain?


texts:
I am currently looking into RSA and have some questions. I am interested in theoretical answers, assuming there is infinite time for decryption.

Is it necessary to work out the private-key exponent for decryption? Are there no alternative options?
Can a message encrypted using RSA be decrypted using only the public key? If so, how? If not, why?


texts: How would one crack a weak but unknown encryption protocol?

texts:
I asked a question on security.stackexchange, but was told it would be a better fit here:

https://security.stackexchange.com/questions/32779/how-would-one-crack-a-weak-but-unknown-encryption-protocol

My question is: Assume I'm an attacker trying to break a weak-but-unknown encryption algorithm. i.e., someone not too bright made a home-brew encryption algorithm, and I'm trying to break it.

BIG FAT DISCLAIMER: Using home-brew security algorithms is very bad for many reasons. Everybody in the security community agrees about it. It's very hard to keep algorithms secret. Please don't answer this question explaining why it's a bad idea to use a home-brew algorithm. I know it's bad. Assume the algorithm is completely unknown.

Okay, now back to my question.

How would you approach a completely mysterious ciphertext when you have no idea what algorithm was used to make it? For me it would look like a meaningless stream of hex, but I'm very curious to know if there's a method to analyze such data and try to break the code.

Here's an example of such a ciphertext.

Is there a way to break it using a single ciphertext? If that's very difficult, I'll be happy to learn how to do it from multiple ciphertexts. I can create more ciphertexts using the same home-brew algorithm, if someone here thinks he can use that to figure out the algorithm.


texts:
Assuming a bit string is deemed cryptographically secure, e.g. PRNG using AES in counter mode, can we equally assume any permutation of said bit string is also cryptographically secure?

In a more practical sense, using a PRNG with AES in counter mode again (for instance), assume it turns out that AES can be more efficiently computed by permutating the input data and rearranging the implementation of the algorithm accordingly. Does the resulting pseudorandom bit string need to be permutated back to the correct order or can I use it directly as a cryptographically secure bitstring? (this is from a purely theoretical pov.)

PS: I used AES as an example, it could be any secure block cipher.

PS2: sorry about the sloppy use of technical terms, but I hope you will understand what I mean.


texts:
I have learned that there are two main test suitcase for randomness (reference):

AIS 31 - German Federal Office for Information Security (BSI)
SP 800-90B - U.S. National Institute for Standards and Technology (NIST)

I was able to run NIST tests on my data. I was wondering if there is any software (and documentation) available for AIS31. I was only able to find general information about it.


texts: Why do memory-hard functions rely on a time-space trade-off?

texts:
I was reading about memory-hard functions recently. In those papers I read, they almost always introduce a time-space trade-off like this:

$$
S(n) \times T(n) \in \Omega(\mathrm{Poly}(n))
$$

I understand memory-hard functions are trying to impose heavy memory usage to counter ASIC attacks. But I don't understand why heavy memory usage must be measured with a time-space trade-off.

There are problems proven to be memory-heavy (at least the most memory-heavy in its class). Search PSPACE and EXPSPACE will return a list of results.

Computational complexity tells us that if a problem requires a lot of memory to run, then it also requires a lot of time to run. Wouldn't these problems be better used as memory-hard functions than those with a time-space trade-off?


texts: Nonlinearity of a Boolean function with odd number of input bits

texts:
Highly nonlinear functions are used in combination generators and other stream ciphers.
We know that maximum nonlinearity (hamming distance to all affine functions) of $f$ is achieved when $f$ is bent function. This will be
$$NL=2^{n-1}-2^{(n/2)-1}$$ when $n$ is even. Also when $n$ is odd, this bound is not satisfied. What will it be?
The question is: Can we find $f$ with largest nonlinearity for an arbitrary odd integer $n$ case?


texts: What does 2-flat mean when discussing APN permutations?

texts:
I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means.

For example, the paper mentions in its definition of APN that for all distinct $a$, $b$, $c$ and $d$ in $V$,

$$a + b + c + d = 0  \implies f(a) + f(b) + f(c) + f(d) \neq 0$$

i.e. $f$ does not sum to 0 on any 2-flat.

It would be great if anyone could explain what 2-flat means here.

An APN permutation in dimension 6


texts: What's the consequence of having a short IV? Is one mode better in that case?

texts:
I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along value impact the strength of security?

Each user will have their own symmetric key that does get re-generated periodically (maybe only hundreds or thousands of messages for each key, each message maybe hundreds or rarely thousands of bytes). If I randomly generate 16 or 20 bits, hash that using SHA-256 and use the first 128 bits as an IV, how does that impact the overall security?  Is it now in effect 16 or 20 bits?

Would adding additional information – that both the server and the user know – into the hash help?  Are there modes that would be better than others for this scenario?  I've read about Synthetic Initialization Vector (SIV) mode being resistant even if there's no IV, however from what I understand it generates a tag of the block size which defeats my purpose. Can’t I send the tag and still encrypt, while only losing authentication?


texts: Rabin cryptosystem - How many solutions?

texts:
If in Rabin cryptosystem we have $n = p \cdot q$ where $p$ and $q$ is prime we have four solutions (roots) - exist four solution of $x^2 \equiv b \pmod{n}$.

However, when we have:

$n = p \cdot q \cdot r$

where $p$ and $q$ and $r$ is prime or:

$n = p \cdot q \cdot r \cdot z$

where $p$ and $q$ and $r$ and $z$ is prime

How much will we have solutions?

will they be $2^k$? where $k$ is the number of prime numbers?


texts: How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

texts:
Given a CBC ciphertext and IV, how can I find the encryption key?

We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{24}$ (about 4 million) different possible keys).

How would I go about finding the correct one though?


texts: Difficulty of breaking RSA for a given key size

texts:
Is it true that breaking a 1024-bit RSA key is as difficult as breaking a 128 bit symmetric key (e.g. AES)? I know that breaking a RSA key is equivalent to factoring the modulus $N$. To factor it, you  have to see if any number between $2$ and $N/2$ divides $N$, right? But that would still be much greater than $2^{128}$ trials (which is the worst-case scenario for cracking a 128 bit AES key).
Then, how is breaking a 128-bit AES key the same as a 1024-bit RSA key?


texts: Efficient protocol to give out N known items randomly to k>=3 parties without independent bodies

texts:
There are $N$ items which are to be uniformly randomly distributed (every possibility has equal probability) to $k\geq 3$ parties, such that no individual party can change the probability of getting certain items.

Party $0\leq i<k$ would receive $N_i$ items, such that the sum of all $N_i$ is $N$.

No party would want any other party to know any more things than their own $N_i$ items.

The only form of communication possible is a broadcast to all other parties.

You can assume an upper limit on the amount of computation possible during the protocol.

Question: Is there a method to give the $N$ items to the $k$ parties such that:

The probability of any party finding out another party's information is less than any chosen positive amount.
The method terminates in finitely many steps with probability 1.

I am particularly interested in alternative solutions which requires less computation (time) on average than my answer presented below.


texts: Can you explain partial private key extract algorithm in certificateless Public key cryptography?

texts:
Related to the algorithms of certificate-less Signature approach of Al-Riyami and Paterson…

Why is there a need for a "partial private key extract algorithm"?
Why should it be needed when calculating "user's private keys by user"?
Is "partial private key extract algorithm" further used in other algorithms?


texts: Why do SignTool/Authenticode Message Digests not match the direct hash of the file?

texts:
I'm attempting to validate an Authenticode signature (generated by signtool /fd SHA256 /f <code signing PFX> /p <PFX password> test.exe), and I've run into an issue that I've narrowed down to a single point of confusion.

For the command above, if I hash test.exe before running the signing operation, for example using Get-FileHash test.exe in Powershell, I get a SHA256 hash of the file. But after signing the file, inspecting the signature in windows (Properties -> Digital Signatures -> Details -> Advanced) shows a "Message Digest" value which is entirely different from the hash of test.exe as calculated before signing.

Windows reports this signature as valid, so there is clearly a consistent understanding of "Message Digest" that isn't the one I have in my head (hash of the raw file contents, excluding signature). Can somebody please explain to me what Message Digest means in this context, and how it differs from a regular hashing operation?


texts:
Oplop is an algorithm that generates account-specific passwords from a master password and user-chosen nickname (typically username@domain). From the website:

Concatenate the master password with the nickname (in that order!).
Generate the MD5 hash of the concatenated string.
Convert the MD5 hash to URL-safe Base64.
See if there are any digits in the first 8 characters. If no digits are found ...

a. Search for the first uninterrupted substring of digits.

b. If a substring of digits is found, prepend them to the Base64 string.

c. If no substring is found, prepend a 1.
Use the first 8 characters as the account password.

The author says MD5 is safe. Is this true? Are there any flaws in MD5 that make it insecure as a one-way function (instead of a "thumbprint" of a string)? Is it secure when the attacker can access all 128 bits of the hash, or does the hash need to be truncated (as it is in Oplop) in order to prevent collision attacks?


texts: What is the shortest type of text encryption?

texts:
I have the following text that I want to encrypt with a password:

"This is my secret password: 1234567890"

encrypted with AES:

SgAHzFc3vluxLqZuzZKg8dzhy918N41SUU1BfBXN8CoEDfVJ0R9hox8PT2jKYA==

pass: 12345

When I encrypt this with a password using AES, the encrypted string is 64 characters.

Is there another type of encryption that is less than 64 characters? Or maybe there is an encryption that also compresses the encrypted string?


texts: What ECDSA key is used to sign the ECDHE key exchange?

texts:
I have a server using TLS1.2 with an ECDSA certificate using secp256r1. The algorithms being used to connect to my browser are TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as I expect from my server configuration and browser.

The ECDHE key exchange group is secp256r1 as reported both by Firefox and Wireshark. The problem is that the signature algorithm for the key exchange seems to be ECDSA-P521-SHA512. (Firefox reports "Signature Scheme: ECDSA-P521-SHA512" in the developer tools, and Wireshark confirms that the Server Key Exchange record is signed using "Signature Algorithm" 0x0603 ecdsa_secp521r1_sha512).

My question is, what is that ECDSA-P521-SHA512 signature exactly? What public/private key pair is it using? Shouldn't it use the secp256r1 key in the certificate? In that case shouldn't it be ECDSA-P256-SHA256 or similar?


texts:
I read a CTF writeup about cracking 4 primes RSA numbers from here:
Given $p, q, r,$ and $p+q+r$ are prime numbers.

The challenge encrypts the flag with a modulus $N=(p∗q∗r)∗(p+q+r)$
and gives the output $n=pqr, k=p+q+r$. To totally break the
cryptosystem, we would want to find the totient of the modulus
$\varphi(N)=(p−1)(q−1)(r−1)(p+q+r−1)$
but we can simplify this when the encrypted message $m$ is small enough.
If we have $m<k$, we can instead find $\varphi(k)=k−1$, and find $e^{-1}\bmod{\varphi(k)}$, and
solve!

But how can they replace $p*q*r*(p+q+r)$ with only $(p+q+r)$ and somebody explains that part?


texts: Are there any security definitions for DNS?

texts:
Given a recent post on the Tor blog and the corresponding discussion on HN I was wondering if there are any security definitions for DNS or similar name systems.

So something similar to ACCE for TLS but for DNS.

Or at least a more structured treatment of security of name systems.


texts: Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

texts:
I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but the computational Diffie Hellman problem (given $g$, $g^a$ and $g^b$, find $g^{ab}$) is hard, and I know that if you can solve the discrete log problem (given $g$ and $g^a$ find $a$) you can do both.

But are there groups where you can fairly easily do the Computational Diffie Hellman problem but it's hard to find a discrete log?


texts: Authentication in Lattice PQC candidates

texts:
I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice space.
As I understand, GCM will also be broken by quantum computing and therefore may need investigating also.
Do the NIST finalists have some sort of authentication process that is comparable to GCM? Or am I misunderstanding some aspect of how lattice cryptography works?
(I am specifically interested in hardware implementations of these methods, so if there is anything specific to hardware I'd love to hear it!)


texts: flaw in perfect secrecy of shift cipher?

texts:
Why do we say shift cipher is perfectly secure when it is easy to break it (source)?
Let's say I have a plaintext.
"Australia is a big country";
I encrypt it using a shift of 2;
That ciphertext can be broken using brute force search over 26 numbers.


texts: CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

texts:
While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes.

I would like to know what drawbacks/insecure caused by AES-CMAC if length is not aligned in 16 bytes. Would the generated TAG value is easily tampered?

how and when the One-Key CBC MAC1 (OMAC1) is used? here what is the ONE-KEY stands for?( Normal CMAC Gen/Ver - Same single key is used for Generation and verification).


texts: Is it possible to do a known-plaintext attack with this set up of AES CTR mode?

texts:
Is it possible to perform a known-plaintext attack to extract the key from AES byte encryption?

The encryption is setup with the following two lines:

ctr = Counter.new(128)
crypt = AES.new(key, AES.MODE_CTR, counter=ctr)

And we have both the plaintext and the ciphertext


texts:
There are two main properties of an initialization vector (IV): Randomness and Predictability. In most cases, the IV is not kept secret and known to anybody.
Say for CBC mode, we need to ensure that the IV is unpredictable because of (adaptive) chosen plaintext attack. So, since the IV is already known, how does predictability address the attack? Rather, why would one still need to predict the value of the IV when it is usually known? I am confused and hope to understand better, thanks.


texts:
These are the steps:

Hash ECDH shared secret with SHA3-512
Concatenate odd bytes and rehash with SHA3-512 for AES-256 key
Concatenate even bytes and rehash with SHA3-512 for KMAC key

Is this key derivation secure? If not, what are the weaknesses?


texts: Can the same random number be used in encryption and signing?

texts: In several public key algorithms, the person running the algorithm must generate a random number (that's separate from the key). Can this random number be the same for an encryption and a signature? For instance, if I'm encrypting a message with ElGamal and signing with DSA, can I use my random number from creating the DSA signature as the random input to ElGamal?


texts:
I have an RSA private key (more specifically, an SSH key in Putty format, 4096bit) and want to use its SHA256 hash as an AES256 key, instead of using an independent newly generated AES key.

Are there any reasons why doing this might be a (very) bad idea?

In terms of entropy etc., it should be still sufficiently secure for real life (I think?). But are there any pitfalls, like certain properties of good RSA keys that would make the AES key much worse / easy to break (than one directly made by a properly used CSPRNG)?

Both keys are meant to protect the same thing, ie. if an attacker can get one, deriving the other doesn't make the situation worse.

(This not not an XY problem. And I know that this is not the usual use case.)


texts: Is it possible to truncate AES output and keep uniqueness (no decryption needed)?

texts:
I would like to hash numbers less than 1000000000, so generally they could be stored on 30 bits. The aim is to obtain numbers that are not reversible, so my initial plan was to use SHA256 (with some salt). However, I would like to keep the output as short as possible, but I want to be sure that there are no collisions. Hash functions do not guarantee me that-- especially when I truncate their output. Probably I could check if there are collisions for my numbers, but maybe there is some better way?

Is it possible to reduce the size of the output of AES and keep uniqueness-- assuming that I don't need to decrypt and it is even desired to not be able to do so? Maybe divide each output into four parts and XOR all of them to get a 32-bit output?


texts: Rounding down in the exponent of group element

texts:
I have been struggling to find the algorithm $\mathcal{A}$ in the following. Let $(G,g,q)$ be the group parameter, $p << q$, $x\in \mathbb{Z}_q$, can we build the following algorithm:

$$\mathcal{A}(g,g^x,g^{x^k},p,q) = g^{y^k} \text{ where } y = \bigg \lfloor x \cdot \frac{p}{q}\bigg\rfloor \in \mathbb{Z}_p$$


texts: How to map a handful of numbers in a large range to a much smaller range deterministically without collissions

texts:
I want to map a set of long integers (say around 100 different values) that can span the entire 64 bit integer range to a much smaller range such as from 0 to 25000 deterministically with almost zero collisions. This operation has to be very fast as well.

Please not that, generating random numbers in the expected range is not a solution, as the original numbers are created by an external system.

EDIT:
Would a pairing function such as following qualify above criteria. From this article, it seem to qualify, but I would like some expert advice.
http://en.wikipedia.org/wiki/Pairing_function

http://en.wikipedia.org/wiki/Pairing_function


texts:
Given two points $P$ and $Q = \sum_{i=1}^{n} x_i.P$ over $E_p(a, b)$ for $x_1,x_2,...,x_n \in \mathbb F_p$. The Elliptic Curve Factorization Problem (ECFP) is to find the points $x_1.P,x_2.P,...,x_n.P$

Is ECFP harder than ECDLP ? Can anyone provide me the proof ?


texts:
PERSON A sends messages to  PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is either "Yes" or "No", can she launch an attack that decrypts the first block of a given message?
  Hint: Chosen Plaintext Attack

My answer is I do not think it is possible to mount an attack that decrypts the first block because of the avalanche effect. Any changes, whether if it is the size or the content, atleast 50% of the content in CT changes.

Is there anything missing or totally wrong in my answer??


texts: Is this ECC encryption key sharing method okay?

texts:
Is this encryption key sharing okay to use?  Or is much better to use ECIES?

$G$ = base point
$a$ = Alice’s private key
$b$ = Bob’s private key
$A = aG$ = Alice’s public key
$B = bG$ = Bob’s public key
$C_x$ = x coordinate of $C$

Alice and Bob share an AES key:

Alice makes $C = aB$
Bob makes $C = bA$
The common encryption key is $C_x$

I can follow and have implemented ECIES.  But in the above method the common key can be computed locally leading to shorter message transmissions.  This could be a significant savings if most messages are short.  (I would use counter mode with the IV sent along with the ciphertext.)

But is there a problem using the above method?


texts: basic question regarding two-time pad attack

texts:
Dan Boneh's Crypto 1 Course includes a lesson on stream ciphers with the following slide:

He asks the question:

And the answer he gives is $m \oplus p$, which is why this is insecure.
But I don't see why this is correct.
If:

$m = 0011$
$k = 1100$
$p = 1010$

then
$$m \oplus k = 1111$$
and
$$(m \oplus k) \oplus p = 0101$$
and
$$m \oplus p = 1001$$
so
$$m \oplus p \neq ((m \oplus k) \oplus p)$$
What am I doing wrong in the above?


texts:
I'm trying to see how easy RSA malleability is.

I generate 2 ciphertexts with a public key:

cat file1 |  openssl rsautl -raw -encrypt -pubin -inkey public.pem >messageA.encrypted
cat file2 |  openssl rsautl -raw -encrypt -pubin -inkey public.pem >messageB.encrypted

Where file1 and file2 are filled with '1's and '2's resp. I assume -raw means no padding schemes. The files are 256 bytes and the keypair is a plain openssl generated RSA keypair of 2048 bits.

Then I read the files per byte and NAND them with a python script:

with open("messageA.encrypted", "rb") as f1, open("messageB.encrypted", 'rb') as f2, open("messageC.encrypted", "wb") as fb:
for i in range(256):
    b1 = f1.read(1)
    b2 = f2.read(1)
    out = (~ (b1[0] & b2[0]) & 0xff) # simple '~' is not enough
    outByte = out.to_bytes(1, 'big', signed=False)
    fb.write(outByte)

Afterwards I try to decrypt the file, however it fails as follows:

openssl rsautl -raw -decrypt -in messageC.encrypted -inkey private.pem
RSA operation error
139710772687296:error:04065084:rsa routines:rsa_ossl_private_decrypt:data too large for modulus:../crypto/rsa/rsa_ossl.c:411:

where file "messageC.encrypted" has a size of 256 bytes

Am I wrong to have expected the above to at least to not fail during decryption?

/update, I would have expected the 'O' (capital 'oh') to be in the decrypted "messageC.encrypted".


texts: State of the art low memory arbitrary-domain PRP?

texts:
I am wondering what the state of the art is on low memory arbitrary-domain PRPs.

That is, I'm looking for an algorithm that implements bijective function $PRP : \mathbb{Z}_n \times \{0, 1\}^b \rightarrow \mathbb{Z}_n$, where $b$ is an acceptable security level (say, 256 bit).

Such a function is trivial to construct by using a Fisher-Yates shuffle with an appropriate source of pseudo-randomness on a full array of size $n$. However, I'm looking for an algorithm that does not use $O(n)$ memory, but rather on the order of $O(\log n)$.

Even more ideally, I'm looking for an algorithm with a flexible key schedule, such that no precomputation for a certain key is needed. Does this exist, or is it impossible?


texts: Are there any information-theoretically secure verifiable secret sharing protocols with t=n?

texts: Disregarding matters such as efficiency and round complexity, can verifiable secret sharing be done in a way such that the secret cannot be decoded unless you have all n shares, and that this guarantee is information-theoretic?


texts: Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

texts:
I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology.

With the recent "breakthroughs" that everybody has been talking about concerning RSA I am a bit unsure whether to use it or not for future projects.

I looked at ECC and RSA alternatives such as ElGamal, but it seems like one could study that subject for the next 35 years and would still not come up with a decision.

In particular I looked at key exchange between two or more users via a server. After reading for a day or two and striking out OTR for a protocol, I got interested in Elliptic Curve Diffie–Hellman — and as it says on the Wikipedia article: "to derive another key which can then be used to encrypt subsequent communications using a symmetric key cipher."

However, it seems that ECDH is not advanced enough to satisfy my requirements of CIA & deniable encryption with regards towards MITM attacks.

Its suggested to use FHMQV for more advanced security. Sadly, as soon as I read the introduction I blacked out because I didn't understand anything.

I have about 1 year of deeper experience and understanding of cryptology, but I am by far no expert on this subject.
Still, I need to make a decision and would like to know from you whether to be concerned about RSA or not and if I should go down the DH route.


texts: Can a server's ECDSA fingerprint be spoofed during SSH?

texts:
I have read somewhere that Servers which have SSH access for users in the public can have their public key posted publicly (e.g., on a website), so that people who access such a server using SSH can use this key to verify the server's fingerprint.

My question: If the public key is accessible to the public, cant a malicious user get it and exploit it to 'man-in-the-middle' people who try to connect to this server?

What exactly is in this SSH fingerprint. Is it just a public key that has been hashed? Or is it server-specfic information that has been encrypted (or signed) by the server's private key?


texts: What is the difference between a hash and a permutation?

texts:
As defined by Wikipedia a hash function is

  [...] any algorithm or subroutine that maps large data sets of variable length to smaller data sets of a fixed length. For example, a person's name, having a variable length, could be hashed to a single integer. The values returned by a hash function are called hash values, hash codes, hash sums, checksums or simply hashes.

and when you search for a permutation you find:

  In mathematics, the notion of permutation is used with several slightly different meanings, all related to the act of permuting (rearranging) objects or values. Informally, a permutation of a set of objects is an arrangement of those objects into a particular order.

Interestingly none of the pages mention the other term when you quick-search for it.

As I understand it, a hash function will map a universe of preimages into a fixed set of outputs (fixed because they have a fixed length, therefore the group is finite) where a permutation will rearrange the input producing something of arbitrary length.

How fair is it to say that a hash is a limited permutation or that a permutation is an unbounded hash? I ask this because I haven't seen the comparison between the two anywhere so far and from my understanding, a permutation is more of a theoretical concept while a hash is more of a practical one.


texts: BN-Curves for 256-bit symmetric security

texts:
I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security.

So could you tell or link me to any information about this?

are BN-Curves efficient for this security issue?
which embedding degree is recommended?
what about ARM-Cortex M0-4 µC?

I'm searching for days now to get any information about this. But there is nothing that point out the usage of BN-Curves on that security-level.


texts: Could the reversibility of adding function be considered a weakness to secp256k1?

texts:
I have just started studying cryptography and secp256k1. I just wonder that adding two points can be easily reversible when the generator point is publicly known.

I mean that if $Q=\operatorname{adding}(P, R)$ then we can calculate $P$ as $\operatorname{adding}(Q, R)$, am I right? Would this be considered a weakness? I am not sure if there exists a known reverse function for doubling as well, Something that could recover P with having Q from $Q=\operatorname{doubling}(P)$.

Anyways, what point is the major strength of secp256k1? Does that rely on the functions we choose for adding and doubling? Or maybe it relies on the nature of the $IF$ statement we use in the calculations?

Taking any arbitrary functions $Q =f(P)$ and $Q=g(P, R)$ and then performing the multiplication function as long as the multiplication function is Surjective and Injective over the field $F_p$, will we get the same level of security?


texts: How AES treat string input to encrypt data and what will happen if the cipher key is less than that expected?

texts:
The official docs of AES have several example of how hexadecimal or byte input can be encrypted. I have some problem about the input text and cipher key. My question is:

How can encrypt string input in AES or how AES treat string input? If I use a string input [example: "Admin"] than how AES encrypt it? If I use the following hexadecimal input: 32 43 f6 a8 88 5a 30 8d 31 31 98 a2 e0 [which has 24 bits less than the expected input for AES-128], than how can it encrypt?
How the cipher key is scheduled if it is less than 128 bit (for AES 128), or less than 192 bit (for AES 192) or less than 256 (for AES 256)? If I use the cipher key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 [Which has 3 less hexadecimal input than the expected for AES-128], than how can it schedule for Add Round Key?


texts: Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings

texts: I'm building a system that has to take file paths, and generate a unique name for each one. I'm planning on using SHA1 as the hash function.  My question is: do I have to deal with possible collisions (2 different paths producing the same SHA1 value) or can I assume it won't occur?


texts:
The Curve25519 is defined over the prime $2^{255}-19$ with $A = 486662$, so that the curve equation is: $y^2 = x^3 + 486662x^2 + x$

I'm trying to understand, why the parameters are what they are.

First of all the Prime. I already have some ideas from the Bernstein Paper, why he chose this prime. Can someone say, if one of them is false, or if i'm not mentioning an important point?:

Faster field operations, when a prime is close to a power of 2
no space wasted, when having a key length close to $32 \cdot k$ for any $k$
pretty high security level because of 255 Bit key length (not sure, but is it equal to a 15000 Bit RSA system?)

Bernstein described the choice of the prime pretty well. But i dont unterstand why he chose A = 486662. I read his reasons for that choice, but i simply don't understand them. Can someone explain it to me, on a more basic level?

Edit:

I tried to understand the choice of 486662 an hopefully got questions that help me understand it:

How can a subgroup be created by a point ( So the base points creates a subgroup, which has a prime order. But this order is also the order of the curve25519. I'm a bit confused by that )
So the order of the subgroup is a prim, but the order of the Curve25519 is also a prime. I dont understand how A makes a curves, which has the order ${4 \cdot n, 8 \cdot n}$, when the order is in fact a prime
What are the attacks, that can't be used, when A is chosen this way? ( I think: only small subgroup attacks, e.g. Pohlig–Hellman. But Bernstein wrote in his paper, that there are various attacks )


texts: Shamir's Secret sharing for Key encryption

texts: I have studied Shamirs Secret Sharing(SSS) scheme. Now my doubt is to how to apply this in real time applications. I have an application which receives encrypted data from server and decrypts the data with the help of key which is stored in this application. I wanted to secure this key in the application with SSS. How can apply this technique to stored this key in application. Because once i encrypt this key with shares then those shares should be available in realtime. So please suggest how can i apply SSS in my case.


texts: For large prime P, how often is (P-1) evenly divisible by 65537?

texts:
When calculating prime numbers $p$ and $q$ for an RSA private key, one of the requirements is that $\gcd(p-1,e)=1$ and $\gcd(q-1,e)=1$, where $e$ is the RSA exponent (typically 65537).

I'm curious how often it happens in practice that a randomly generated prime number happens to not satisfy $\gcd(p-1,65537)=1$. Are the chances of this happening related to the size of the prime number?


texts:
If an RSA encryption uses a modulus $n$ of 15000 bits and $e = 3$ or $e = 2^{16} + 1$, how many squarings and multiplications will we need for encryption, and for decryption? Could you please explain the concept of square and multiply as well?

I'm thinking the number of squarings is going to be equal to the number of $e$, and that the number of multiplications will be roughly half of the number of $e$, but how does the number of $n$ bits factor into that?

Also, why is it different for encryption and decryption? I thought encryption is $m^e \bmod n$, and decryption is $m^d \bmod n$, so what does the length of $e$ have to do with decryption?


texts: Decode message $m = p * q$, where $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known

texts:
I been going through some cryptography exercises and stumbled across this problem.

  Discover message $m$. You know that $m = p * q$. Also $p ^ 5 \bmod N$,
  $q ^ 5 \bmod N$ and $N$ are known numbers.

I am really lost and don't know where to start. Could anyone give some hints or point me to right direction where to read up on this problem?


texts: Are there any differences between PIR, oblivious transfer and differential privacy?

texts:
I am trying to make a taxonomy of the different purposes of some cryptographic protocols. Generally speaking, the purpose of PIR, oblivious transfer and differential privacy--it sounds as if they were invented for the same purpose: "Give me the information I want without learning anything about this information".

Can we make the aforementioned generalization?


texts: Finding Vigenere's keys with part of decrypted text?

texts:
I have a text that was encrypted twice with two Vigenere keys.
However, I know the seven first characters of the decrypted text.

I have already implemented a function displaying for the five first characters the two keys that were possibly used but there are so many possibilities (265 if I am correct)...

I think the answer is no but I'd like be sure. Is there a way of finding the two keys that were used ? Can I use a statistical method even if I don't know the lengths of the keys ?

P.S.: The text is not in English but in German (not very important but for statistical methods, it obviously depends on the language of the text you analyze)

UPDATE: According to the analysis of the text, the LCM of lengths of the keys seems to be equal to 12. If the two keys have 12 characters then it is as if the author had used only one key with 12 characters right ? So if two characters are separated by 11 characters, then they have the same Caesar's shift, don't they ? And if the two keys have different lengths, does it mean that the lengths are either (4,6) or (2,12) or (3,4) ?


texts: Do these new insights into prime numbers affect encryption security?

texts:
Quanta Magazine reports:

Two mathematicians have uncovered a simple, previously unnoticed property of prime numbers [...]. Prime numbers, it seems, have decided preferences about the final digits of the primes that immediately follow them.
Among the first billion prime numbers, for instance, a prime ending in 9 is almost 65 percent more likely to be followed by a prime ending in 1 than another prime ending in 9.

Do these insights make breaking keys based on primes more mathematically plausible in a shorter amount of time?


texts:
I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function.

There are two places where random data is used in encoding a message:

A 20-byte seed which is passed to Mask Generation Function.
A variable amount of random data which left-pads the message, when the message is shorter than the block.

For these uses, is it OK to use an operating system rand function, which is probably a weak LCG; or should I use a CSPRNG such as ISAAC (which will have been seeded from the weak LCG)?


texts: PBKDF2 without salt on 16 digit password

texts:
How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique and randomly generated (there can't be two identical)?

Assuming an adversary with large resources and technical know how, How fast someone would be able to identify password using 10000 or 50000 iterations?


texts: Merkle tree to prove integrity of subset of data

texts:
I'm thinking up a scheme where a merkle tree is used to ensure integrity of a set of data items, and different parties are allowed to verify the integrity of different subsets of that data.

Let's assume a process where an operator measures a physical property of items that pass his workstation on a conveyor belt. Let's, for example, define the following properties that are collected for each measurement event.

operator id
timestamp
item id
parameters
measurements
workstation id

For reasons of data integrity and traceability the measuring device computes a signature over all the properties whenever it produces a measurement.

Now let's assume a hash of all these properties and the signature are to be stored publicly (for example on the Blockchain). Anyone with access to all properties can verify the publicly stored hash and signature. But what if we have multiple stakeholders interested in the integrity of different subsets of those properties, what if we want to let people verify a subset of the properties without disclosing others.

If we create a merkle tree of all these properties we could disclose the value of some properties (leaves in the tree) and only root hashes of some subtrees, allowing people to calculate the root hash and verify the signature.

But there is still a concern of confidentiality. For example, the same operator id will always hash to the same value. So what if a salt was introduced into the operator id subtree. I.e. the operator id subtree-hash would be H(operator id | salt) where | denotes concatenation. Thus, if we with to disclose the operator id, we disclose the operator id and the salt. If we do not wish to disclose the operator id, we only disclose the root hash of the subtree.

Let's assume the length of all properties and salts is fixed, or is prepended to the item in question.

If the hash function is cryptographically secure, noone should be able to come up with a different operator-id-salt combination that produces the same hash.

From the perspective of some verifiers, they only learn one or two properties, and a large number of random-looking subtree root hashes. Maybe some subtree root hashes don't belong to actual subtrees, but are just random data. Is there a scenario where this could be a problem for verifiers.

Is this a terrible idea?

(I'm aware that there is also concern of a length extension attack, depending on the hash function used, where someone could append another subtree on the right side and calculate a valid root hash).


texts: How can I create an RSA modulus for which no one knows the factors?

texts:
It's easy to create an RSA modulus where almost no one knows the factors: for example, I can generate two 1024-bit primes $p$ and $q$ and set $n=pq$.  If I publish $n$, I will be the only person in the world who knows, or can know, $p$ and $q$.

The (now defunct) RSA Factoring Challenge numbers were generated like this:

First, 30,000 random bytes were generated using a ComScire QNG
hardware random number generator, attached to the laptop's parallel
port.
The random bytes were used as the seed values for the
B_GenerateKeyPair function, in version 4.0 of the RSA BSAFE library. The private portion of the generated keypair was discarded. The
public portion was exported, in DER format to a disk file.
The
moduli were extracted from the DER files and converted to decimal
for posting on the Web page.
The laptop's hard drive was destroyed.

But all of this leaves me feeling unsatisfied because--despite claims that the laptop's hard drive was destroyed--I still worry about insiders who know the factors.

Is there a method which can generate an RSA modulus so that no one knows the factors?  This might seem a ridiculous question, but we do know composites of unknown factorization.  For example, many of the largest Mersenne composites have unknown factorizations (wikipedia).

I would be fine with a multi-party algorithm and an assumption that players do not collaborate.


texts: Are there any known inverse hash lookups for the zero string?

texts:
Just wondering, are there any known inverse hashes / hash lookups in common hashes (md5, sha1, sha2, etc.) for the zero string hash value? (i.e. bytes 0x00 00 00 00 00 ...)

Or more specifically, for a 128bit hash (like MD5 or SHA1):

HASH(x) = 0x00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Obviously it would take reverse hash lookup, or a rainbow table...