texts: Best differential attack on round functions with specific vulnerabilities

texts:
I got problem with my encryption functions. They have a repeating series of ones and zeros. It is 128-bit symmetric cipher.
Let's consider numbers divisible by $2.$ Let's count how many times are they divided by $2$. If number is divisible by $2$ exactly $n$ times, then make a block of $n$ zeros or $n$ ones.
Now put it into encrypted blocks. Every encrypting number of the form $2k$ which is even and divisible by $2$ just $n$ times will got first $n$ bits as $0$. And every encrypting number of the form $2k+1$ which is odd and $2k$ is divisible by $2$ $n$ times will got first n bits as $1$. Let's assume that all the rest of bits is indistinguishable from random. In these scheme zero-block always go into zero-block. And number $8$ will always got first three zeros and rest of bits indistinguishable from random.
Now let's shift this regularities aside. Let's say every encrypting number of the form $2k+a$ which is even and divisible by $2$ just $n$ times will got first $n$ bits as $0$ and every encrypting number of the form $2k+b+1$ which is odd and $2k+b$ is divisible by $2$ just $n$ times will got first $n$ bits as $1$. Numbers $a$ and $b$ are secret and can be understand as keys (every round got different pair).
Now let's move this regularities perpendicularly. Let's move every block by $m$ bits (with wrapping). So for example number $8$ can have first or last three zeros or somewhere in the middle. What's more until we don't know key $a$, we don't know how many zeros will there be in this block.
It is easy to find differentials if $a$, $b$ and $m$ are equal to zero. It is harder or impossible if we will choose $a$, $b$ and $m$ randomly. What is best differential attack against such vulnerabilities? And what is best differential probability? I was thinking about implementing $20$ rounds and according to my preliminary findings it should be enough if we are talking about differential attacks. But I have no idea if this can be attacked efficiently with linear cryptanalysis. Can it be?


texts:
I have recently gotten interested in cryptography, so I looked some things up.

I thought, why even use AES or DES or any other complex way for encrypting data when there are far simpler ways, like just generating a random (pseudorandom) bitstream, and XOR'ing it with the data or secret message? The point is, if you have a random enough bitstream, you can just XOR the data.

Of course, you're the only one who will know the stream.

So why use all sorts of encryption if you have these simpler, easier ways of doing things? I'm new to cryptography, so this question may sound a bit naive.


texts: What's the reason for Monte Carlo tests for block ciphers?

texts:
NIST specifies that implementations were required to create Monte Carlo test vectors for ECB and CBC mode for the AES competition.

What's the reason for these tests? The only thing I can think of is that it is some randomized testing of the block cipher in specific modes. However, in that case the difference between ECB and CBC would not matter.

It seems to me that this is a weird way to test for implementation errors. You'd expect things like bounds checking and such, but just performing the encryption over and over again may not actually hit the right results. And weird keys / input values are also covered by the other tests.

Finally, having the algorithm generate it's own input seems dangerous. If the block cipher doesn't behave as specified, then the input may be erroneous. So why use the block cipher as DRBG and not another well specified / tested algorithm?


texts: What are the potential security impacts of using CRAM-MD5 for Emails, when not using an SSL connection?

texts:
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. But something tells me that storing password in a database in plain text might not be the only security issue that comes up here and I'm not even sure if CRAM-MD5 can still be considered as "safe" from a cryptographic point of view. After all, I sure don't want to use something insecure for email traffic.

Whatever feedback you can give me - from a cryptographic point of view - about "using CRAM-MD5 for authentication while talking to an email server without the use of an SSL connection" will be highly appreciated. Thanks in advance.

edit : For an InfoSec point of view, check https://security.stackexchange.com/questions/36117/how-secure-is-using-cram-md5-for-email-authentication-when-not-using-an-ssl-con


texts: Are the values of Tate and Ate pairing the same?

texts:
Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup.
Do then the Reduced Tate and Ate pairings produce the same values?


texts:
WhatsApp offers end-to-end encryption. However, when I start using it on a second device such as a PC running Windows, I can decrypt incoming messages without providing any private key into my second device or application.

When a party sends a message to my account which has two clients receiving the incoming message, on PC and mobile device, they receive the same message perfectly.

If my private key is generated by my first device and stored on my first device, how is the private key being passed to my second device without any security flaw?


texts:
2.2 Prove that, by redefining the key space, we may assume that $\text{Enc}$ is deterministic without changing $\text{Pr}[\text{Enc}_k(m)=c]$ for any $m, c$.

After banging my head against this problem for a few hours, I honestly don't see a modification of the key space that gives the desired result. For all $k,m,$ and $c$ we have $\text{Enc}_k(m)=c$ with a certain probability $p(k,m,c)\geq 0$. What can we do with that?

Note: Katz/Lindell assume that $|\mathcal M|<\infty$, and $\mathcal C$ is defined as the set of as possible outputs of $\text{Enc}$.


texts: How to meter and limit number of files encrypted?

texts:
First my apologies if this isn't the right forum for this but here's my problem :

I have a black box that takes an input file and produces an output file.
I want to sell this black box to a customer but I want to meter/limit the number of files the customer can use with this box. A counter would not be fair to the customer since they might use the box multiple times with the same input file.
I could request the customer to send me the input file every time and I can encrypt it so that the black box would only work with my encryption. The problem with this is that the customer may not want to give me the input file.
I could ask the customer to generate some sort of key based on each input file; I can then generate another key for the black box and send it to the customer to use. This seems like a workable solution and I would guess this kind of scheme has a known name and has been studied before.

Encryption is not my area (I'm into building black boxes) so I would appreciate if someone can point me to the right terminology to use to search for this kind of metering scheme.


texts: Why is the discrete log problem easy when the exponent comes from a binomial distribution?

texts: I read in http://epubs.surrey.ac.uk/7219/2/esorics06.pdf that in exponential El Gamal the discrete log problem for recovering $m$ from $g^m$ can be made tractable when $m$ is drawn from a binomial distribution. Why is this?


texts: IND-CCA insecurity of modified CBC encrypt + MAC scheme

texts:
I've been puzzling over the following proof for the past couple of days.

Since a block cipher in CBC mode can be used to build both an IND-CPA secure
encryption scheme and a EUF-CMA secure block, a common mistake made in “roll-your-own”
cryptosystems is to try to use the last ciphertext block to compute a MAC on the plaintext,
e.g. to encrypt the message m, we compute the ciphertext $c = \verb|CBCEncrypt|^E
_K(m)$, let $c^∗$ be
the last block, compute tag $\tau = E_K(c^*)$. and use $⟨c, τ⟩$ as an “authenticated encryption”
scheme. Prove that this scheme fails to provide chosen-ciphertext security.

I'm making the assumption that an encryption oracle for $\verb|CBCEncrypt|^{E}_K(m)$ uniformly chooses an IV and then makes it public after encryption. Also, $E_K$ is the block function.
One security issue that comes to mind is that the tag of a message in this scheme relies only on the last block of ciphertext, not the rest of the message. However, since each IV is random and unpredictable, I don't see how an adversary could exploit this.
Another thought I had was if an adversary could compute a valid tag $\tau_{\tau}$, then they could decrypt $⟨\tau, \tau_{\tau}⟩$ and check whether or not the resultant decryption (with IV=0) is equal to the last block of the corresponding ciphertext $\tau$ was generated from. But again, I can't see how an adversary could compute $\tau_{\tau}$.
Any help would be appreciated.


texts: Share Conversion between Different Finite Fields

texts:
Let us have any linear secret sharing scheme (LSSS) that works on some field $Z_{p}$, where p is some prime or a power of a prime e.g., Shamir Secret Sharing, Additive secret Sharing.
The problem at hand is simple, for any secret shared value in $Z_{p}$, is it possible to convert it (and its shares) to elements on $Z_{q}$, where q could be either greater or smaller than p? Note that I do not need conversion from $Z_{2^n}$ to $Z_{2}$.

I am aware of the results on PRSS, and well as in this 2008 work, however the former does not address field conversion, and the latter, have explanations that are not clear nor it offers perfect security.

Any help is more than welcome!


texts:
Who calculates the private exponent $d$ in RSA? Only $(n, e)$ are public and to calculate $d$ (with $d$ being the multiplicative inverse of $e$ with respect to $\phi(n)$), the receiver need $\phi(n)$.

So how is the receiver getting $\phi(n)$ and if the receiver is not getting $\phi(n)$ then who is calculating $d$?


texts: Background: Secret Sharing and Multiplication Triples

texts:
I know that a nearly identical question was asked in (Secret Sharing and Multiplication Triples), but I am a few points shy of asking follow up questions in the comments, so I understand if this is closed soon afterward.

First and foremost, just to clarify, the use of a multiplicative triple in this secret sharing problem is solely as a vehicle for the sharing no? I cannot see any other motivation for the triple other than facilitating the protocol.

Second, in @Guut boy's comment he mentions that the previous asker was mistaking the "notation for XOR'ing with a public value", but I don't see how this is true. The previous asker seems to imply that:
$d_a = x_a \oplus a$ and $d_b = x_b$, similarly for $e$.
If this is so then the XORing with the public value $a$ was done correctly and I still get the extra $ed$ at the end of the calculation because:
$$z_a = c_a \oplus ex_a \oplus dy_a \oplus ed$$
$$z_b = c_b \oplus ex_b \oplus dy_b \oplus ed$$
because $ed$ is not defined in $[z]$ with XOR notation brackets it is given as
$$[z] = [c] \oplus e[x] \oplus d[y] \oplus ed$$

Basically, I don't understand why the last $ed$ still exists any help is appreciated and I apologize in advance for the follow up to a previously asked question.


texts: JSON AES-128: Security against known plaintext attack

texts:
I have a system where I am transmitting JSON messages securely (using for example AES-128), where each message has the same format.

For example:

{"d":{"status":"success"}}

{"d":{"error":"Message length too long"}}

Where every plain-text message is guaranteed to start with {"d":{ and end with }}

Suppose the attacker knows this fact.

Does this reveal information that could lead to a security exploit (the attacker finding  the key)?  If so, what would prevent this?
If there is no security risk, what property of encryption prevents it from being an issue?

EDIT

This is related to my other question about the attacker knowing parts of the plain-text, but I would like to know why it isn't a problem.


texts:
I have a school project about cryptography. The question is the following (will only give a short phrase as example, just want to know the method).
A text has been encoded with Vigenere 2 times. The ciphertext is FXFCKDKFCLMHOSPERVBOPDJ (it's Dutch btw, you won't really get plausible words because I cut it off). It has first been encoded with a cipher of 3 letters, and then with a cipher of 2 letters. The first letter of the 2nd cipher is an O.


texts: Why does Rijndael with a 256-bit block require the bottom two rows to be shifted one more space than usual?

texts:
From Wikipedia:

  For a 256-bit block, the first row is unchanged and the shifting for the second, third and fourth row is 1 byte, 3 bytes and 4 bytes respectively.

Why the change? Is there any difference than in using 0, 1, 2, 3 like the other keysizes?


texts: Is there any implementation of scrypt that allows a specific limit on memory?

texts:
The answerer has commented that scrypt's memory use is "only a function of r". $\:$ However, he has

not addressed my argument that it also depends on N, in one of my comments from over 5 days ago.

I had somehow gotten the impression that scrypt offered a separate memory-factor in addition

to its main work-factor. $\:$ However, the (original?) scrypt paper does not have such a parameter.

  Do any implementations of scrypt offer a way to limit

  its memory usage without that limiting its runtime?

Looking at that paper, I see that there would be an obvious way to do so: in the definition of

ROMix (on page 6), add an input M and replace the instances of N in steps 2 and 7 with M.

Alternatively, one could replace those two Ns with max(M,N) and replace

the N in step 6 with max(N,(2*N)-M), or with something similar to that.


texts: Tell me about non-MD5/SHA1 key fingerprints

texts: I understand there are specifications for public-key fingerprints that use modern hash algorithms like SHA2. What are they?


texts:
Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples.

Are there any public ciphers produced by other states, China or Iran for example? Do you really think they trust AES?

EDIT: List of ciphers from different nations:

USA: Skipjack
Japan: Camellia
Russia: GHOST
Korea: SEED
China: SMS4


texts: monoalphabetic substitution perfect secrecy

texts:
I have this question that I'm trying to answer:

  Consider a monoalphabetic substitution cipher applied to plaintexts
   consisting of just a single letter. That is, $$M = \{0, 1, . . . ,
 25\}$$ The keyspace $K$ is the set of all permutations of $M$. (As
   usual, we identify the letter $A, . . . , Z$ with this set of
   integers.) Show that this is perfectly secret.

I understand that to show perfect secrecy it suffices to show that $|K|\ge |M|$. I'm just not understanding how to answer this question. Would it make sense to say $K = \{0, 1, ..., 25\}\Rightarrow |K|\ge |M|$?


texts:
I have calculated the affine points on the curve $x^2 + y^2 = 1 − 3x^2y^2$
over the field ${\mathbb{Z}}_{11}.$

Using $y^2 = \frac{1-x^2}{1+3x^2}$ I got the following points:

$(0,1),(0,10),(1,0),(2,2),(2,9),(9,2),(9,9),(10,0)$

Total comes to be 8 points. But what I know is that total points should come 11-1 = 10.

So I am not getting other 2 points.


texts:
It is known that the two prime factors $p$ and $q$ of an RSA modulus $n$ should not be too close to each other, otherwise an attacker may factor the modulus. In other words, $\Delta = \left| p - q \right|$ should not be too small.

However, "too small" is a somewhat subjective measure. "Too small" with respect to what? And why?

I do realize that it is considered a best practice - given a modulus $n$ of $k$ bits - to pick $p$ and $q$ as random primes with bit length $k/2$ (see also HAC, section 8.8, note ii).

On the other hand, Section B.3 of the Digital Signature Standard standard recommends $\Delta > 2^{k/2-100} $ when generating an RSA key. That is, $p$ and $q$ should simply differ by a number which is at least 100 bits long somewhere in their 100 most-significant bits (thanks poncho!), independently of the bit length. That is not in contrast to the best practice above, and it could be deemed a redundant check.

However, both approaches seem to imply that a dangerous $\Delta$ is much, much less than $2^{k/2}$. Is there any formal proof of that? And is there any quantification for such dangerous $\Delta$?


texts:
Z/11Z[X] is the finite field
P(2) = 4
P(3) = 3
P(5) = 7

How can I solve my congruence system with polynoms?

I made my system of congruence like that :

X = 2 [4]
X = 3 [3]
X = 5 [7]

And it gives me 54 = 10 [11]
So, X is 10 [11]

But i still don't know how to find P(X)...
Can you help me ?


texts: How to avoid side channel attacks when handling large numbers?

texts:
For cryptography, the platforms have limited size as 32 or 64-bit operations. We definitely need big numbers to implement the encryption/decryption and digital signatures for cryptosystems like RSA, Elliptic Curve, etc.

We have seen lots of side channel attacks due to timing differences or power usages analysis.

How are large numbers handled in cryptography and cryptanalysis?
What are the good libraries against side-channel attacks, including time and power analysis?
Can we have a countermeasure to Acoustic cryptanalysis by a specific big number implementation?


texts:
I have an API that accepts plain-text and IV as input and I'm trying to identify the encryption mode for that API. I have already tested this API for ECB, CBC, OFB, CFB and CTR and it doesn't seem to be any of these modes. Though on first glance it appears to be padded CBC mode but if you look at my Step 3 (see below) it isn't CBC because for padded CBC mode the Step 3 output should be C1 (first 16 byte of Step 1 ciphertext)|| C2(Step 2 cipherxtext) where || means concatenation. Any guidance on what this mode could be will be appreciated!
Step 1: curl "http://dev/api/v1.0/test-1?iv=00000000000000000000000000000000&text=00000000000000000000000000000000"
{"ciphertext":"e910b119321663b062ca59d3f09a95f6282397de97904f8267638c5f234b1ee7"}

Step 2: curl "http://dev/api/v1.0/test-1?iv=e910b119321663b062ca59d3f09a95f6&text=00000000000000000000000000000000"
{"ciphertext":"b793f834eeb36c0eac275df3ba53c6e50de0df8f9b31afcb8b5eb89ebaaf3ad8"}

Step 3: curl "http://dev/api/v1.0/test-1?iv=00000000000000000000000000000000&text=0000000000000000000000000000000000000000000000000000000000000000"
{"ciphertext":"e910b119321663b062ca59d3f09a95f6282397de97904f8267638c5f234b1ee75bd4c7fbd2cdd9b658507be2dec68429"}```


texts:
There are several methods of making a strong password, making it longer is one of them. now we also have hashing algorithms which have outputs of 512,
so i wonder, would it be safe to basiclly use a simple password like dog, and then use the for example 512 bit hash output as the password.

EDIT: out off all the answers i think i thought out something that would be secure so consider the following: if i write a program which hashes a word with a number that comes out of a cryptographiclly secure pseudorandom number generator(having a minimum of 5 hashes, and then use the out put as a password, for example: i use the word dog as word, then number generator provides me with a random number of 5 or higher which defines how many times it needs to be hashed. in this case, we got the numer 30 for example, then we hash the word dog 30 times with a secure hash function. then this would be a secure password against dictornary attacks right? because if they dont know how many times you hashed it, then trying a dictornary attack should become a much harder task to achieve, and for brute force: trying to crack  a 512 bit password with letters and numbers should be madness, and if you use a salt along side of it, it should become really secure. so if someone is able to write something like this, and combine it with a secure and encrypted password vault, then it should be a pretty powerfull tool for password creation and management. so this is basically the idea, feel free to point out things i missed or possible weaknesses :)


texts: Does anyone know an example of an Elliptic Curve of caracteristic $p$ ($E_p$) that has a point generator $G$ that generates a subgroup of order $q$, with $p$, $q$ being prime numbers and $p = 2q + 1$?


texts: Do trinomials weaken the Alternating Step Generator?

texts:
The Alternating Step Generator was proposed by Christoph G. Günther: Alternating step generators controlled by de Bruijn sequences, in proceedings of Eurocrypt 1987. It's perhaps the conceptually simplest CSPRNG producing bits at a constant rate. Its best-known cryptanalysis is by Shahram Khazaei, Simon Fischer, and Willi Meier: Reduced Complexity Attacks on the Alternating Step Generator, in proceedings of SAC 2007.

The ASG combines three Linear Feedback Shift Registers. To produce a bit:

advance LFSR2
according to its low-order bit, advance LFSR0 or LFSR1
output the XOR of the low order bits of LFSR0 and LFSR1

The key is the initial state of the LFSRs (assumed to be random and independent bits, save for the state of each LFSR not being all-zero). It is customary to use primitive binary polynomials of distinct degree $n_i$. In the initial exposition, LFSR2 is modified to generate a de Bruijn sequence, that is the output sequence has an extra zero inserted after $n_2-1$ consecutive zeroes. But this detail makes no cryptanalytic difference, since that point in the sequence is reached with negligible probability for $n_2$ large enough for security.

Would using binary trinomials sizably reduce the cryptanalytic resistance of the ASG?

The rationale to want to use trinomial:

it minimizes implementation cost in hardware (each additional coefficient cost an XOR gate), and the number of reads in a software implementation using indexes in circular buffers;
it reduces the choice, allowing to make the primitive trinomials "nothing up my sleeve";
we can use the compact table of primitive binary trinomials compiled by Jörg Arndt.


texts: Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key?

texts:
Since ECC over P-256 provides only 128 bits of security, I'd like to cut corners and generate a private key using HKDF to generate 32 bytes of key material from an input secret that's only 16 bytes long, on the theory that it's no harder to brute-force the KDF than it is to break the key using Pollard-rho.

This seems like a bad idea, but I can't prove it!


texts: Rivest - Time Memory Tradeoff Using Distinguished Points

texts:
A while ago, Hellman introduced a time-memory tradeoff for chosen plaintext attack on block ciphers.

There is an innovation due Rivest using a concept of 'distinguished points'. I am looking for the original reference to Rivest's contribution. All references I have found to Rivest point me to the book

D. Denning, Cryptography and Data Security , p. 100, Addison-Wesley, 1982

which gives only a few sentence description of Rivest's idea and no citation to any paper of Rivest on this topic.


texts:
In my notes, there are 2 definitions of perfect security:

"For $M \in \{0,1\}^m$, define the distribution $D_M$ on strings as follows: to choose a random member of $D_M$, choose a random $K \in \{0,1\}^n$ and output $Enc(M,K)$.  Then $Enc,Dec$ is perfectly secure if $D_M$ is exactly the same for every $M$.  That is, for every $\alpha \in \{0,1\}^*$, the probability of $\alpha$ according to $D_M$ is independent of $M$.

For every two messages, no function can tell which one has been encrypted.  That is, $Enc,Dec$ is perfectly secure if for every $M_0,M_1 \in \{0,1\}^m$ and for every $f: \{0,1\}^* \to \{0,1\}$, the following holds: consider the experiment where $b$ is randomly chosen from $\{0,1\}$ and $K$ is randomly chosen from $\{0,1\}^n$; then the probability that $f(Enc(M_b,K)) = b$ is equal to $1/2$."

I have two questions:

Could someone clarify the definition of $D_M$ (the distribution of strings?). I'm not sure I get what is meant by the "distribution of strings" and how it differs from $M$
If $M_0$, and $M_1$ are any two $m$-bit messages, how is it possible that their encryption be equal $b$? Wouldn't the number of bits in the encrypted message be $m$? if that number is for example 10 then how does $P \left ( f( \mathrm{Enc} (M_b, K)) = b \right ) = 0.5$?


texts:
Referring to the following URL: http://cryptowiki.net/index.php?title=Goldwasser_Micali_cryptosystem

The decryption of the message is based on wether the bit is a QRn or not, but how do we know/verify (the mathematical operations) if it is a QRn or not.


texts:
"Optimal Prime Field is a family of 'low-weight' prime fields that allow for efficient software implementation of all operations requiring a modular reduction, in particular the field-multiplication. More formally, an OPF is a finite field defined by a prime of the form p = u · 2^k + v, whereby the two coefficients u and v are “small” (in relation to 2^k)".
Eg: p = 0xCD3E000000000000000000000000000000000001
Only the 4 MSB words are non-zero and rest are always zero, except the last bit.
I have read in the literature, OPF can be clubbed with ECC to speed up the computation involved. However, wouldn't a 160bit OPF with hamming weight 16bit used as key, make it vulnerable to brute force attack. I couldn't find any mention of it in literature. Please comment.


texts: Suppose you have a secret list of n distinct integers. How would you sort this list in a way that is not vulnerable to timing attacks? I tried looking up "constant time sorting" and other related queries but that expectedly lead nowhere.


texts:
I started reading "Cryptography: theory and practice" by Stinson, and I am trying to understand the reason behind the choices for the different components of AES since they seem quite arbitrary.

In the beginning ADDROUNDKEY is performed, why does this not allow for perfect secrecy: the key and plaintext are same key length and xor'd one at time in a stream cipher manner, why is the condition $P[c|p]=P [p]$ not met?
Why does finding the Galois field inverse of an element in the field provide non-linearity, is there a reason behind this type of design?
I read that the reason for block ciphers having rounds is due to the theory behind product ciphers, by why is this secure and how does it counteract the issue with question 1.

Thank you


texts:
I'm trying to understand cryptographic protocols, and I've started with the DES algorithm.

DES specs: it uses 64 bits for the plaintext, 56 bits for the key, with a result of the same 64 bits of ciphertext.

But encrypting on online websites I see a totally different thing.
Encrypting the string "hello" with the key "key" will get me the cipher text "ar635N/LqmY=".
Now, I used https://ethproductions.github.io/bytes/ to count the number of bits in a string, and seems like:

"hello" has 5 chars, totaling 10 UTF-16 bytes, which is 80 bits
"key" has 3 chars, totaling 6 UTF-16 bytes, which is 48 bits
"ar635N/LqmY=" has 12 chars, totaling 24 UTF-16 bytes, which is 192 bits

So, as you can see, we have here an input of 80 bits with a key of 48 bits and an output of 192 bits.


texts: Verifying signature of plaintext using encrypted message only

texts:
I'm looking for an algorithm which allows verifying a signature of a plaintext message but while only having the encrypted message.

The requirement is for Alice to send Bob a plaintext message (M) which is signed (S) by central authority (CA), the message should be encrypted (E) to Bob.

Anyone should be able to verify (V) that each of the encrypted messages (E) matches its signature (S).

CA = Central authority signing plaintext messages

M = Plaintext message

S = Signature of M by CA

E = Encryption of M

V = Function validating S against E. V(E,S) is in {true,false}


texts:
Which version of ChaCha is more secure?

XChaCha20-Poly1305-IETF

ChaCha20-IETF-Poly1305

ChaCha20-Poly1305

I am looking for 256bit strength for large datasets.

I am having trouble disambiguating the delta between these ciphers available in libSodium.


texts: Security analysis of encrypting a matrix after homomorphic encryption by the random mask

texts:
Problem Definition

Alice has two private matrices $M_A$ ($N*M$), $M_a$, where $M_a$ is the binary matrix of $M_A$
Bob has a private matrix $M_B$($N*M$)
Alice and Bob are semi-honest server and communicate via a secure channel
$M_A, M_a, M_B$ are integers, there are no zero values in $M_B$, but zero values are in $M_A, M_a$.

Problem Objective
Alice wants to obtain the result of the matrix $M_A*M_B$ divided by $M_B*M_a$, where * means dot multiplication, dividing operation is position-to-position, whereas both of the Alice and Bob's raw data cannot be exposed.
Proposed Protocol

Homomorphic encryption (satisfy multiplication and addition homomorphism like BFV and CKK)

Bob generates the public key and private key, then uses public key to encrpyt $M_B$, $Enc(M_B)$ then sends $Enc(M_B)$ and the public key to Alice
ALice computes $Enc(M_B)* M_A = Enc(M_B*M_A)$ and $Enc(M_B) * M_a= Enc(M_B*M_a)$ and then generates random matrix $R_1$ and $R_2$ from uniform distribution U(0,1),
Alice computes $Enc[(M_B*M_A))·R_1]$, denoted by $Enc(A_1)$  and $Enc[(M_B*M_a)·R_2]$ denoted by $Enc(A_2)$, where · means position-to-position multiplication.
Alice sends $Enc(A_1)$ and $Enc(A_2)$ to Bob
Bob decrypts $Enc(A_1)$ and $Enc(A_2)$ to $A_1$ and $A_2$
Bob computes $A_1$ divided by $A_2$ denoted by $A$ sends it to Alice
Alice makes $A$ divided by $R1/R2$ to obtain the final results, where / means position-to-position division.

Note
It is obvious that Alice cannot send $Enc(M_B*M_A)$ to Bob directly since Bob has private key and $M_B$.
Actually, there is no clear reason why $R_1$ generates from uniform distribution $U(0,1)$, I just see some papers adopting this method but there is no security proof found.
My question

The random mask is introduced in step3, which intends to mask the $M_B*M_A$, but actually I could not find any formal security analysis. By multiplying with $R_A$, whether there is no information disclose. Although $R_A$ is random and makes results of $M_B*M_A$ noisy. But whether there are some multiplication results will be obtained in a limited way. That is， some results can be factored into some very limited situations？

Is there any effective way to securely compute results in problem definition?


texts: Improve security of transposition ciphers

texts:
As we know, breaking a Transposition Cipher is quite trivial and can be easily done by either exploiting single letter frequencies (not $d$-gram frequencies though, given that $2 < d < L$), or by employing a simple CPA, thus deriving the snippets length $L$ and the transposition matrix (key).

If we imagine to encrypt the plaintext twice, employing two different keys, would this help improving security?

If we employ the same snippet length $L_1 = L_2$, this clearly won't improve security as an attacker could easily find the key $k_3 = k_1 \times k_2$ (where $\times$ is the matrix product), without even bothering about $k_1$ and $k_2$.

However, that's not the case if $L_1 \neq L_2$. So I guess there's some kind of improvement; can you show me if and how this is true?


texts:
I want to generate a small 30 or 32 bit PRP. I am going to use that PRP in an open web service and anyone will be able to get any number of plaintext-cyphertext pairs.

I've found an algorithm called FastPRP and the problem statement fits my requirements perfectly. However the performance seems quite low for 30-32 bit range.
I need a high-performant point evaluations for both PRP and an inverse PRP.

Are there any 32-bit PRP algorithms (less secure probably) that allow a faster point evaluations?


texts:
In RSA you choose $n=pq$ where $p$ and $q$ are large primes with similar length. Then you choose $e$ that is coprime with $\phi(n)$ and find $d$ that is modular multiplicative inverse of $e$ modulo $\phi(n)$, so $ed \equiv 1 \mod \phi(n)$.

Then $(m^e)^d \mod n = m$ for any natural $m$ less than $n$.

As far as I have researched it, the exponentiation to the power $ed=k\phi(n)+1$ where $k$ is an integer relies on the Euler's theorem that states $a^{\phi(n)} \equiv 1 \mod n$ which is true if $a$ is coprime to $n$.

This leads me to a question, what happens if you choose $p$ as the message? Does RSA handle it in any way? I would like to know both about Textbook RSA and the Deployed RSA.


texts:
Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in $\mathbb{G}_1$ or $\mathbb{G}_2$?

It is obvious that the only way to forge is to extract the randomness $r$ such that you forge with $k\cdot e(g,g_1)^{rx}\cdot e(g,g_1)^{rx'}$ for a valid forged tag $k\cdot e(g,g_1)^{r(x+x')}$.

But it is not obvious how to build the reduction from Dl. Assuming $\mathcal{B}$ receives $g^a$ either in $\mathbb{G}_1$ or $\mathbb{G}_2$,then it gives to $\mathcal{A}$ tags $k\cdot e(g,g_1)^{ax}$.

At some point we assume $\mathcal{A}$ forges with $e(g,g_1)^{ax'}$. How this can help $\mathcal{B}$ to output $a$ at his DL challenge?


texts:
I need to crack a stream cipher. I have a set of plain text and encrypted text pairs.

The hint to the question asks me to use entropy analysis and look at the hex dump of the encrypted text. However, I couldn't find anything useful in either of them.

What should be the approach to solve this cipher?


texts: Is it possible to reverse the birthday attack calculation?

texts:
I find that for every 100 password salts in our database, we only average 94.73 distinct salt values (averaged over a total of around 18 million). Is there a way to take that observation and calculate the amount of effective entropy (or whatever is the correct term) we have in our salts?

Clearly we need to improve how we generate salts. But, meanwhile, I'd like to better understand the theory behind the observation.

EDIT: I have asked this question aimed at correctly generating our password salts.


texts: Is it possible to convert a selective secure broadcast encryption scheme to an adaptive secure broadcast encryption scheme?

texts:
I was reading the paper, entitled "Multiparty Key Exchange, Efficient Traitor Tracing, and More from
Indistinguishability Obfuscation", by Boneh et al. On page 23, the authors have claimed the following.
"Remark 6.2. We note that for private linear broadcast, there are only a polynomial number of
recipient sets, meaning selective and adaptive security are equivalent."
How can we prove this Remark? Is it possible to transform a selective secure private linear broadcast encryption scheme to an adaptive secure scheme (for the system which can accommodate at most a polynomial number of users)?


texts: I have a blockchain wallet with a single signature wallet, is there a way of making this wallet "multi-signature"? F.e can we use some secret sharing scheme to distribute the single private key among custodians? What I need in the end is to make several users control access to a single wallet.


texts: How rare are 1024-bit $B$-smooth numbers?

texts:
What is the probability that if I choose a random $1 < r < n - 1$, $r^{65537} \pmod n$ will be $B$-smooth?  $n$ is a 1024-bit RSA modulus.

The Wikipedia pages on smooth numbers and the Dickman function are too obtuse for me to understand enough to calculate for my particular case.

I was contemplating an attack on something that uses a broken PKCS #1 v1.5 signature padding check.  I figured that if I found find many such $r$, I could forge signatures by manipulating the unchecked parts of the "message representative" to make it factor over the factor base $B$.  The signature then would be calculable as a linear matrix.

This all resembles parts of the quadratic sieve algorithm.  Quadratic sieve would be too difficult to do on a 1024-bit number, so it's quite possible that this attack idea is infeasible just from the rarity of smooth numbers.


texts: How long it takes for new cryptographic results to become generally accepted?

texts:
Suppose there is a new scheme, for the sake of argument let's call it a CEPQSS - CryptoEnthusiast's Post-Quantum Signature Scheme. Now most practitioners aren't convinced that using this is a good idea let alone that it works. But the results are completely valid.
How long would it take until most practitioners evaluate and peer review it to the point where it would be generally accepted?


texts: Do I need to generate unique IV for CBC encryption of a file if I encrypt multiple blocks of data?

texts:
The situation is that I download a mp3 file (song) and I encrypt blocks of data (4096 bites for example).
The output of every encryption operation I save it in a new file.

When I play the song (encrypted file) I work with buffers. If I seek near the end of the song, for example, I need to somehow extract the IV that I used for encryption.

How can I generate a safe IV for encryption  and be able to decrypt in this situation ?


texts:
I'm trying to self-learn the AES-128 algorithm and ran into a snag while following these slides I found online: https://kavaliro.com/wp-content/uploads/2014/03/AES.pdf

For the sixth round in the example given, during the AddRoundkey step, the third word of the matrix after MixColumns (F0) is XOR-ed with the third word of the 6th RoundKey (B7). This apparently results in (77) which doesn't correlate with my calculation of 47. However, the process seems to proceed with this error and still gets the right ciphertext in the end (I put the ciphertext through an online decoder and got the original plaintext back).

I'm very confused as to what I am missing here?


texts: Why RSA uses {d,n} as private key instead of {e,n}?

texts: While studying the RSA algorithm I referred to some books and some sites such as RSA (wikipedia) and all of them chose {d,n} as the secret (private) key and release {e,n} as the public key but as d and e are multiplicative inverse of each other, can't we keep {e,n} as private key and use the other as public key? Is it a standard rule to choose the {d,n} as the private key?


texts:
I have read a lot about the discrete logarithm problem of ecc, but I still do not understand the problem as follows:

We have domain parameters: (p, E, P, n, h), where n is the order group of P.

The process of creating privatekey - publickey is as follows:

Select a random number k under [1, n - 1]
Calculate Q = kP
Return Q is publickey, k is privatekey.

As far as I know, domain paramters and Q will be public. But, suppose I was the eavesdropper, I know P produces 1000 points (as the parameter n), because Q = kP so Q will be a point in point set generated by P, so I can generate order group P and see the position of Q for privatekey k (since k is in [1, n-1]).

For example: P generate 0P, P, 2P, 3P, ... 1000P. I choose k under [1,999] is 120 -> Q = 120P -> position of Q in the order group P is 120 -> k = 120.

So if I know P and Q, then I know privatekey then ??? So where is it safe?

I suppose so because NIST gives you some recommended domain parameters and I think the order group has to be pre-calculated to save on computational cost.

Thank you for everyone's help!


texts: How do we know a cryptographic primitive won't suddenly fail?

texts:
It took more than a decade from when MD5 looked like it was going to break to the point when it was actually broken. That's more than a decade of warning. One might suspect that we were fortunate that we got all that time. Even so, it took a long time for the world to move away from MD5.

How can we be sure that when our cryptosystems are flawed, that we'll have enough warning time to change them?

How can we be sure that, say, ECC won't get broken overnight?


texts:
In Information Security Class I learned a non-adaptive chosen ciphertext attack using "blinding" but I just can't follow the proof and therefore can't reconstruct it. From what I've found out, it seems to be based on this Wikipedia entry (although not entirely I think): http://en.wikipedia.org/wiki/Blind_signature#Dangers_of_blind_signing

The idea is that an attacker intercepts a ciphertext, replaces it with a blinded ciphertext, and sends it to the recipient. Upon decrypting, the recipient complains because the message is corrupt and returns the decrypted, corrupt "plaintext". So far, so good. Now, if the attacker intercepts the corrupt plaintext, he is supposed to be able to decrypt it to obtain the original message.

Assuming that the corrupt message $m'$, the encryption keys $c$ and $n$ (where $n$ = $p$ * $q$) are public, and $d$ is the recipients' private decryption key, the proof is supposed to be:

 $$1) \ m' = (m^c * z^c )^d\ mod\ n = m^{c*d} * z^{c*d} \ mod\ n $$
$$ 2)\  c*d\ mod\ n = 1$$
$$ 3)\ m' = m^1 * z^1 mod\ n\ \ \ \ \ (edit:\ because\ of\ 2)$$
$$ 4)\ m = z^{-1} * m' $$

I understand that the attacker can intercept the corrupt message $m'$ in step 1). What I don't understand is step 2). Shouldn't it be $c*d\ mod\ \phi(n) = 1$, where $\phi$ is Euler's totient function? After all $d$, which is the multiplicative inverse of $c$, is calculated $mod\ \phi(n)$, which only the recipient can calculate because he has $p$ and $q$.


texts: Applying Vigenere on small strings with sorting capability

texts:
I am new to cryptography and have a question about a use of Vigenere cipher in the case of small strings. I'd like to encrypt keywords that are smaller than 10 characters.

If I use Vigenere separately for each keyword I can have a key longer than 10 characters, and making each string impossible to break (if I use a different key each time).

But I would also like to be able to sort the encrypted keywords to avoid processing them in the clear (sorting is necessary which made me think about a polyalphabetic cipher. I have hundreds of keywords).

For this, I would need all the keywords to be encrypted with the same key. And now I have an issue with the length of the key. Because I will never use more than 10 characters of my key. And somebody could concatenate all the keywords.

I have read that encrypting a vigenere several times doesn't provide more security. That the only way to make vigenere more secure is to extend the key. In this case extending the key is of no use, as I have small strings (so only the first chars of the key will be used).

Do you see any technique that could be used to improve the security, while still providing sorting capabilities?


texts: Delayed tag checks in AES-GCM for streaming data

texts:
There is currently a GitHub discussion on .NET not supporting AES-GCM for any streaming data since releasing decrypted data prior to tag checks somehow reveals the plaintext or the AES key (or some such undocumented catastrophic failure). A lot of chatter between two choices:

1. Allowing AES-GCM for streaming data

Release data as it is decrypted and alert caller if / when tag check fails. Most popular AEAD constructs (e.g. AES-CBC-HMACSHA256) are encryption and authentication as two separate pipelines. So one can at least momentarily downgrade to privacy-only mode during decryption (i.e. AES-GCM => AES-CTR mode) but upgrade back to privacy and authentication mode after the GHASH tag checks out. The caller is responsible for alerting users or buffering data if situation demands.

2. Permanently disallow AES-GCM for all streaming data

This eliminates AEAD (or specifically AES-GCM) from streaming and limits them to regular privacy-only mode permanently. Or forces users to bolt-on authentication themselves, which revisits the original problem. Or worse, users consider streaming as a dead-end case and skip any encryption at all.

Question: Assuming everything else is ok (fresh keys, unique iv, long tags, under GCM limit etC), is allowing streaming (#1) with AES-GCM ok? If not, what's the catastrophic failure and what choice other than AEAD does streaming have? If the case for AES-GCM differs significantly from generalized AEAD, please address that too.

The Windows 'kernel' crypto layer (bcrypt), OpenSSL, Bouncy Castle (C#) and Java Cryptography Architecture all allow for streaming/continuation.

Also, the scope of this is the crypto API itself, NOT a high level protocol.


texts: Please explain parameters of RFC5639 Elliptic Curves including brainpoolP160r1

texts:
RFC 5639 brainpoolP160r1 has

p = E95E4A5F737059DC60DFC7AD95B3D8139515620F (Wolfram Alpha says prime)

A = 340E7BE2A280EB74E2BE61BADA745D97E8F7C300

B = 1E589A8595423412134FAA2DBDEC95C8D8675E58

x = BED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3

y = 1667CB477A1A8EC338F94741669C976316DA6321

q = E95E4A5F737059DC60DF5991D45029409E60FC09 (Wolfram Alpha says prime)

h = 1

I do not understand why h = 1 yet q < p. I thought that if you had a prime field size then there is only one cyclic subgroup in size equal to the field size (c.f. Lagrange). This doesn't seem to be the case for brainpoolP160r1


texts: Whether ramp secret sharing possess additive homomorphism?

texts: Ramp secret sharing replaces the random coefficients in original Shamir secret sharing with original data to be shared. In such a case, all the coefficients in the polynomial evaluation will be secrets. If such ramp secret sharing supports additive homomorphism, how these secrets are reconstructed. Can the coefficients other than constant term can be reconstructed through Lagranage interpolation.


texts:
In one of my assignments, I came across this line

  Due to MD5’s length-extension behavior, we can append any suffix to both messages and know that the longer messages will also collide. This lets us construct files that differ only in a binary “blob” in the middle and have the same MD5 hash, i.e. prefix || blobA || suffix and prefix || blobB || suffix.

I am not quite understanding what "binary blob" means in this context. Does the blob have to be something in particular to ensure that the two files will continue to have MD5 collision?


texts: How to symmetrically encrypt 64bit values?

texts:
I'm curious about an algorithm that would be good for the following scenario:

32-bit "plaintext" input, taken from a counter
32 or 64-bit "ciphertext" output
It should be possible to decrypt the output with the key (and possibly a few other hidden parameters, like an offset and current counter), and return the original 32-bit counter value
A user never observes the input, but may receive any number of outputs, possibly sequential. Even so, they should not be able to know which indices they have.
It should be difficult to guess other outputs that correspond to valid counter values.

My untrained intuition is that since the key and outputs are larger than the input space, it should be fairly easy to have "good" results, at least for the first few outputs. However, it also seems logical that with enough samples the key and indices could be computed easily, but I expect most instances to use less than 100 values.

My questions are:

Are there any existing algorithms that work for this scenario?
How hard would it be to crack? I.e., compute values that decrypt to valid indices.
How much does the possession of more samples affect the efficiency of cracking it?
What's wrong with a naive approach like:

u64 output = input
repeat 64x
  output = ((output ^ key) + key) rotate-left 37

Assuming addition wraps around 64bit integer boundaries.
It seems as though it would thoroughly mix the random key with a single input, but possessing more than one output could quickly increase the information an attacker possesses, though I wouldn't know how. Obviously it's going to be broken, I'm just trying to learn.
Would using a key-dependent value for the left-rotation, like (((key & 0xFFFE)+1) * 37) be better? How much does it help and why?
What approaches, resources, etc. would you use to both analyze the algorithm, and design a better one?


texts: What is transaction capacity of a POS using 3DES DUKPT?

texts:
I am looking for the transaction capacity of a Point-Of-Sale device using 3DES DUKPT. Once all keys derived from the future key set are exhausted (1M or 500K?), how will the POS be reloaded with a new set of future keys.  Have not seen many topics on this online.

Is changing the KSI number a widely used industry practice?


texts: Why is an IV used in Merkle–Damgård transform?

texts: In Merkle–Damgård  transform, a fixed vector IV is chosen at the beginning, and it is hashed together with the first block x1. I wonder why we don't use x1 straightforward, i.e. hash x1 and the next block x2 at the very beginning.


texts: Integrated Signatures and Encryption Scheme

texts:
Suppose we have a scheme ISE that combines $n$ signature schemes and one encryption scheme, where the same keys are used. It is composed of the following algorithms: Setup, KeyGen, $Sign_1,...,Sign_n, Verify_1,...,Verify_n$.
Can we prove that the ISE scheme is secure if the $n$ signature schemes are zero-knowledge proofs and the encryption scheme is secure?
This can be generalised to other schemes. My point is: can we prove by contradiction that a scheme composed of $n$ schemes is secure if $n-1$ of those are zero-knowledge proofs and the remaining is secure? Otherwise, we could construct an adversary that would break the secure "subscheme", right?
If yes, how is this kind of proof called and where can I find it in the literature?


texts: The length extension attack and security on length shortening of a hashed message by one byte

texts:
MD5, SHA1, SHA2 are vulnerable to length extension attacks Wikipedia:Length extension attack.
Could is also be possible to generate $H(\text{message}[1..n-1])$ from $H(\text{message}[1..n])$ if I know the last byte?
It's essentially the same question as md5: is reverse length-extension attack possible?
Might it become possible, when I just want to shorten the message by just one byte in any of MD5, SHA1 or SHA2? Or could I at least reduce the computational cost of a brute force attack?


texts:
Why don't we use hill cipher of 100 × 100? or even bigger. That would be closely unbreakable.
The number of keys possible 2 × 2 hill cipher is 157248. for 100 × 100 number is beyond limits.


texts:
I am looking for a modern cipher to encode morse code, ie. input is [A-Z 0-9] (base36 as I learned in the comments below) and output is the same, one character at a time. The old enigma does a good job at doing this, but is obviously broken.

The cipher doesn't necessarily have to be usable "by hand" (as the "classic ciphers" per definition do), yet it would be interesting if it would.

Is there such a cipher that maps input to output 1:1 and which keeps the output within the above bounds (or maybe ASCII 7bit)?

Of course I know about base64 and codegroup, yet the first uses small letters and the latter doesn't map 1:1.

If such a cipher doesn't exist or is not feasible I'd be interested in "why" - why can't we map 1:1 and why can't the output stay within certain "bounds"?


texts:
Let's consider that Alice and Bob both know a shared secret $secret$ and don't know each other DH public keys. They want to authenticate each other and their keys using only $secret$. Let's also forget about an existence of SMP. Can the following scheme be considered secure?

First, Alice and Bob perform Diffie-Hellman KE:

$Alice: send(g^a)$
$Bob: recv(g^a);\ send(g^b)$
$Alice: recv(g^b)$ // Now both Alice and Bob has a shared $dh\_key$

Next, they want to be sure that their companion:
a) Knows a shared secret.
b) Is the owner of the corresponding DH private key.

$Alice: send(HMAC(g^a, secret))$
$Bob: recv\_and\_check(msg, secret); send(HMAC(g^b, secret))$
$Alice: recv\_and\_check(msg, secret)$

If all checks are passed Alice and Bob can start a secure data exchange. They also can save DH-public keys for future conversations.

So:

Is the scheme secure?
If the answer to the first question is 'yes' what are pros and cons in comparison with SMP (like in OTR SMP)?


texts: Does the problem of noise growth exist in the Paillier homomorphic scheme ?


texts: If I know an element and it's inverse, can I learn the modulus?

texts: If I know an element $x$ in a group, and it's inverse $x^{-1}$, can I guess the modulo, or with a probability?


texts: Cryptanalysis open source framework/tool

texts:
Recently I was watching one episode from IBM Soc analysis online course and the instructor mentioned something I did not know.

President Ronald Reagan after watching the movie "WarGames(1983),
asked some of his staff, that is I possible some kid that can do such
a thing?

and some months later "NSDD-145(National Security Decision Directive Number 145)" was born.
The screen-shot I posted, is from the movie "Mile 22", it may seem like a graphical work.
Is there anyone who had experience with an open-source Cryptanalysis framework or tool project?


texts: What does "Inverting the RSA function is as hard as factoring" mean (a rigorous explanation or intuitive will do)?

texts:
I was reading that a current open problem is if inverting the RSA function is as hard as factoring.

Does this mean that, its an open problem whether, if given a subroutine that computes in probabilistic polynomial time (i.e. in BPP) the inverse of the RSA function, then its not actually known if we can factor numbers in (probabilistic) polynomial time (i.e. if an algorithm in BPP exists)?


texts: Generate $4\times 4$ Sboxes with a given branch number

texts:
Say, I want to generate a lot of $4\times4$ Sboxes with linear (or differential) branch numbre of $3$. One idea is to take all the $302$ affine classes, expand each of those classes and check if any of the Sboxes has the desired branch number.

Is there any better way/known result (such as, this particular class does not contain any Sbox with linear branch number $3$) that can be used to reduce the search space?


texts: How can I multiply an additively homomorphic encrypted value by a float number?

texts: As we all know, if $E()$ is an additively homomorphic encryption, we can multiply $E(a)$ by an integer $b$, then we will get $E(ab)$. But what if $a$ is a float number? Can we still get $E(ab)$? Which scheme can support this?


texts: Any real world implementation using message recovery?

texts:
During my master thesis I came across RSA-PSS-R which is in my opinion a quite elegant way of saving bandwidth and space using digital signature.
But I didn't find any information about any real world implementation out there. I have the feeling that it's exactly like the Schnorr Signature scheme. Everybody says that it is very efficient, but no one actually uses it.

Maybe I didn't dig deep enough but is there anyone out there actually using message recovery AT ALL in any real world implementation?

Thank you for your feedback


texts: What is a pre-shared key in TLS/SSL and why does master key is not used instead of session key?

texts:
i have understood  the SSL handshake flow .The confusion are -

What is the pre-shared key here ? Is it the pre-master key or it is the random number that is generated by server and client.?

2.I get it that the session key is used to maintain the session but how does it      so that in TLS/SSL
how master key is different than session key


texts: What is the main difference between CFB and CFB8 modes in 3DES?  Is it only a change in block size from standard 8 byte to 1 byte when doing 3des and XOR? I cant find any pseudocode for this CFB8 mode?  any pointers?


texts: Are there any online, single pass, AE with associated data auth?

texts: AE comparison summarizes features of nine AE ciphers and none of them combine features online, one pass, AD auth (see table below). Are out there such ciphers or such combination was proved to be unsecure?


texts: Pseudorandom function outputting a field element VS pseudorandom function outputting a string

texts:
Assume we have two pseudorandom functions $PRF$ and $PRF'$ defined as follows:

$PRF: \{0,1\}^{n}\times \{0,1\}^{m}\rightarrow \{0,1\}^{n}$

$PRF': \{0,1\}^{n}\times \{0,1\}^{m}\rightarrow \mathtt{F}_p$

where $p$ is a large prime number, $|p|=l$, and $l$, $n$ are security parameters.

Question 1: Is $PRF'$ secure and does it meet the standard definition of pseudorandom function?

if yes, then

Question 2: Are these two pseudorandom functions are different in terms of the level of security and the probability that collision occurs?


texts:
Given a modulus $N$ and a number $a$, a multiplicative inverse exists for $a$ if $a$ and $N$ are coprime. Why isn’t there a cryptosystem that uses this as a computational problem?

Example

Alice and Bob agree on a public modulus $N$ and a public number $p$ such that $p$ and $N$ are not coprime. Then Alice sends Bob $a \cdot p \bmod N$ and Bob sends Alice $b \cdot p \bmod N$. Where $a$ and $b$ can be any number. Then they compute the shared secret: $a (b \cdot p) \bmod N \equiv b (a\cdot p) \bmod N$.


texts: Homomorphic Encryption Arithmetic Operations

texts:
I am looking to do arithmetic operations on encrypted values that will decrypt to be the result of the value decrypted. Does anyone know of any code examples of this in use? Usage of the equation would be nice as well.The psuedo from the below link is rather obscure. The specific reason behind asking the question is that I am having difficulty implementing this programmatically in a secure application I am working on. I understand math lingo somewhat but would like a working example involving real data.

Homomorphic Multiplication/Addition

So ideally given v1 and v2

v1 = 5; v2 = 4;

Decrypt(v1Encrypted + v2Encrypted) = 9;


texts:
Got some theoretical questions about PRGs to solve (given by lecturer for self-learning, no score involved).

Tried to find on the internet but couldn't figure out how to solve them, so I will mention my own intuition but I would appreciate a formal answer to the questions to fully understand.

$G_1$ , $G_2$ are safe PRGs in range $\{0,1\}^n \rightarrow \{0,1\}^{2n}$, s.t. $G_1 \not = G_2$.
Is $G$ necessarily a PRG? Prove your answer.

$G(s) = G_1(s) \oplus G_2(s)$
$G(s) = \overline{G_1(s)} \oplus G_2(s)$
$G(s) = G_1(s) \oplus G_2(s \oplus 1^{|s|})$
$G(s) = \overline{G_1(s)} \oplus G_2(s \oplus 1^{|s|})$
$G(s) = G_1(s) \oplus G_2(0^{|s|})$
$G(s) = \overline{G_1(s)} \oplus G_2(0^{|s|})$
$G(s) = \overline{G_1(s) \oplus G_2(0^{|s|})}$

Now $G$ is in range $\{0,1\}^n \rightarrow \{0,1\}^{n+1}$.
Is $G'$ necessarily a PRG? Prove your answer.

$G'(s) = G(s \oplus s^R)$ ($R$ is reverse)
$G'(s) = G(s \oplus G(s)^{1,...,n})$ ($G(s)^{1,..,n}$ stands for $G(s)$ first $n$-bits).

Intuition:

I belive XOR maintains the PRG attribute, so a. (and therefore b.) is true.

In 3. we essentialy flipping the bits of $G_2$ input, can't see any harm at this, same goes for d. but we flip bits of result.

Well, I think I should stop the guessing now and get a true answer for the questions, since I really have no clue.


texts: Can (EC)DH keys be used as the signed content in X.509 certificates?

texts:
From Wikipedia's article on ECDH:

  The public keys are either static (and trusted, say via a certificate)…

Also see this question on this very site.

These indicate to me that a certificate (maybe an X.509 certificate) can have a(n) (elliptic curve) Diffie-Hellman public key as the data that is authenticated by it. Is this true?


texts:
I am trying to perform simple power analysis on RSA. In particular focusing the
modular exponentiation module and for this I have implemented left-to-right variant of binary exponentiation.

pseudo code of the implemented algorithm is as follows:

Result = a^b mod N
k = length(b);

Result = 1;
for i = k-1 to 0 do
  Result = (Result X Result) mod N;   // SQUARING

  if b[i] == 1
    Result = (Result X a) mod N;     // MULTIPLICATION
  end if

end for

From the acquired power trace, I cannot differentiate between square and multiplication samples just by looking at the trace.

I also tried by performing a correlation test between the first operation(i.e. square) and all the other operations but i get the same level of correlation peaks for all the operations.

So from these observations can I conclude that my implementation is SPA resistant at least with respect to the regularity between the patterns of both operations.

My second question is, if it is SPA resistant then why in some of the cases which I read on internet have different pattern for both operations. Even though in practice they also use same multiplication algorithm for both squaring and multiplication as I did.


texts:
For RIPEMD hashing algorithm on hardware
I am not exactly getting how padding works

So as per my understanding padding will work like explained below:

For ripemd 160 message should be multiple of 512 bits. So, along with message to make it 512 bits, after message we pad 1 following zeros. Last 64 bits of 512 block are reserved for length of the message.

Suppose message is a which I have to send it for hashing. So first it will go through padding. So for message a asci value 61 will be send for padding which is nothing but 61 hex.

So after value 61 there will be 1 and followed by zeros and last 64 bits will be length of message. So as per little endian conventions, byte wise representation of a after padding will looks like below right?

512'h08000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008061

(MSB side last byte 08 is nothing but length of message a LSB side 61 is actual message then followed by 1 and zeros) as ripemd is little endian based.

Please correct me if I am wrong. Is my description correct? If not, how does RIPEMD160 pad the message?


texts: Security of very simple XOR with random?

texts:
I am currently trying to implement a very fast and simple encryption algorithm in Lua for the purpose of using it with ComputerCraft.

The main problem is that bitwise operations in Lua (5.2 at least) are very slow and the implementation ComputerCraft can only handle 32 bit integers in their bit-library, so implementing standard algorithms isn't easy.

On the other hand this is only a game and encryption is merely used to keep others from simply controlling your devices or reading your messages. There is no critical data associated with this, so the encryption can be very weak.

I currently implemented a combination of XOR and random in the following form (pseudo-code):

random.seed( hash(key) ) -- 32 bit seed
for i = 1 to str.length do
  result[i] = str[i] XOR random.nextByte()
end

The good thing about this is that it only uses a single bit-operation and is guaranteed to never exceed 32 bit. Also this is very fast.

Aside from external problems like random entropy, what is an approximate time someone would need to decrypt this using a standard desktop PC? (sophisticated guess is ok, I just want to get an idea)

And if this is just too weak, is there any other algorithm that is more secure, but fast and can be implemented with a minimum amount of bit operations fitting in 32-bit?


texts: LLL - Lattice Reduced Basis Algorithm question?

texts:
I have two related questions:

Version 1: Let $B=\{b_1,b_2,\dots,b_n\}$ be an orthogonal basis for $R^n$. What is the associated reduced basis obtained by applying LLL algorithm to $B$?

I know how to apply LLL algorithm and I can apply it for  $R^3$  case.  (Since for $n=3$ it takes reasonable time in the exam, this is an exam question by the way.)

But this case is general case for $n$, so I don't know what to do? is there a shortcut to find the reduced basis when the vectors are orthogonal ?

another version of this question is the following:

Version 2: Let $B=\{b_1,b_2,\dots,b_6\}$ be an orthogonal basis for $R^6$ .

Having $||b_1||=||b_3||=1$, $||b_2||^2=||b_6||^2=2$, $||b_4||^2=3,||b_5||^2=4$

What is the associated reduced basis obtained by applying LLL algorithm to this ordered basis $B$?


texts: Can a zero knowledge proof (or MAC) be generated from human-typable input?

texts:
Edit: My goal is to create a voting scheme that doesn't require a lot of crypto infrastructure to be deployed on the client side.  Smartcards, and tokens are impractical for these purposes.  I envision a user typing a "code" into a web browser (which is imperfect) and submitting the inputs.  The code is either static, or with minimal circuitry that can be covered in epoxy and embedded in a card.
Ideally this code could manifest itself in a way that is non-linkable to the original voter.  I would like these anonymised ballots to be publicly acessible for verification.
If I can somehow "convert" a human typeable code into Microsoft's UProve, then all my requirements would be solved.

Is it possible to create a ZKP (or comparable MAC scheme) that can be typed by a human with relative ease?  What would that crypto system look like?
If I were to design a crypto system around what can be typed easily by a human, say  26 uppercase ASCII letters, or 16 mixed case letters I believe that leaves me with security of 2^92 bits of security.

How should I take this design detail and turn it into something that can be used into a ZKP?

For example, take an ECC key with n bits and simply sign data with my key.  Or use that crypto material in a comparable standard such as UProve or PGP.


texts: Is there a problem with constructing a CSPRNG using MD5 or SHA1?

texts: Is there any security concerns with building a CSPRNG using a broken hash function like MD5 or SHA1?  The design is such that a CRC-like function is used for mixing entropy and MD5 is used as the output function.  If this is a security concern, what is the technical reason?  What would be a better replacement when efficient is a concern?


texts: Is a second preimage attack on MD5 feasible?

texts:
What's the practical status of MD5 w.r.t. second-preimage?

Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. The adversary can change the data, and wants to do that while leaving the hash identical. Denote the data size as $K$, in 512-bit block increment, and assume that could be sizable (e.g. $K\approx2^{35}$, which is less than one big hard disk). The original data could follow some pattern (e.g. repeated 512-bit blocks). To some degree, the adversary could even choose some data in the original (e.g. embedded in some innocent-looking file); but we must assume that the adversary can't predict some of the data before what it injects, else the now classic collision attacks against MD5 apply.

A generic second-preimage attack is applicable to Merkle–Damgård hashes, with cost $2^{129-k}+2^{65}$ hash rounds for MD5, where $k=\log_2K$, but that's not exactly cheap (it is attributed to R. D. Dean in his 1999 thesis sect. 5.3.1, and also exposed by J. Kelsey and B. Schneier in their 2005 paper).

Has anything more practical surfaced?


texts: Encryption scheme that requires fewer keys for decryption than for encryption

texts:
I want to attempt creating a decentralized dead man's switch, so I'm looking for an asymmetric encryption scheme, with the following properties (ideally), or something close to them:

There is a group of n people, each with their own public and private key.
Any one person can, at any time, encrypt a message using all public keys.
The catch that I'm looking for is that you wouldn't need all n private keys to decrypt the message, but only some number k < n.
It MUST be unfeasible to decrypt the message even if you have k-1 keys, but very easy with k keys.
Once k-1 receivers have comitted to the decryption, it MUST be impossible for the kth one to complete the decryption privately and obtain the message without publishing it. I intend to use it in an Ethereum contract, so there might be a way to avoid the impossibility of fair trade without a trusted party, using the blockchain.
(optional) The sender can choose the number k arbitrarily during encryption.
(optional) None of the receivers need to reveal their actual private keys during decryption.

Layered RSA (or any other asymmetric cipher for that matter), wouldn't do. It a) doesn't have property 5, and b) requires encrypting your message in $\binom{n}{k}$ different ways, which is unfeasible for large numbers.

Does such a thing exist? Is it even theoretically possible?


texts: Why are the indicator drums of a Bombe machine labelled from A to Z clockwise?

texts:
I am researching the Bombe Machine, having just completed a project on the Enigma Machine. I visited The Rutherford Journal - The Turing Bombe, and it claimed that

  The scales on the three indicator drums are designed to show the ‘rotor core starting positions’ at a ‘stop’ when measured in terms of the corresponding Enigma ring-settings for the Enigma rotor settings: ZZZ. This is the reason why the letters on the scales on the indicator drums are in the reverse order to those on all the other drums.

I don't understand this explanation, though. Aren't the indicator drums used to determine the rotor core offset? And I thought that the rotor core offset was calculated by the rotor position minus the ring setting. As the Bombe tests the rotor positions from A to Z, shouldn't the indicator drums also run from A to Z, since the Ringstellung is assumed to be a constant ZZZ?


texts: Calculate the RSA private exponent from the CRT parameters

texts:
I am trying to make the RSA structure of Openssl manually, knowing
the public key ($n$, $e$) and the CRT parameters $p$, $q$, $d_P$, $d_Q$, and $u = q^{-1} \mod p$.

That is, I want to get the $d$ value (private exponent) of the RSA structure by using Openssl API. If there are already any implemented functions, it would be great to me.

Bonus question: is it possible if I have $p$, $q$, $d_P$, $d_Q$ and $u$ but not the public key? I know that $n = p q$, but what about $e$?


texts:
I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, Lecture Notes in Computer Science, 7:47--53, 1984.

However I am stuck with generating the private key for a certain identity. The paper states that "the only difference between users is the value of i, and the secret key which corresponds to i is the unique number g such that

$g^e = i (\mod n)$.

This g can easily be computed by the key generation center, but if the RSA scheme is secure, no one else can extract e-th roots mod n." Where:

$g$ is the private key belonging to $i$.
$i$ is the ID for which the private key is to be generated.
$n$ is the product of two large primes $p, q$.
$e$ is a large prime which is relatively prime to $\phi(n)$

However, I am lacking the number theoretic background knowledge to derive the formula for the private key, given the knowledge of $p$, $q$, $\phi(n)$. I guess I have to apply Fermat's little theorem somehow. Please give me a hint for a solution.

PS: A question for the ID based crypto pros - do you recommend any more modern approaches? Shamir's paper the to be most suitable for my purpose and should be secure given a suitable bitlength is chosen.

Addendum: So concluding from DrLecter's answers, I have tried to map the needed functionality reusing as much as possible from an existing RSA implementation (RSA functionality denoted by *).

pk_i = (e, n) => public key of id i (i = m denotes master key)
sk_i = (d, n) => private key of id i (i = m denotes master key)
sig_mi = (s, t) => signature of message m signed by i
hash'(x) => hash function making full use of Z_n
hash''(x) => hash function with bitlength l such that 2^-l sufficiently small (e.g. SHA256)

Pseudocode:

//Generate private key sk_i for identity i
sk_i getPrivateKey(i, sk_m) {
    return sk_i(decrypt*(hash'(i), sk_m), sk_m.n) //hash' making use of full range of Z_n
}

//Receive public key pk_i for identity i
pk_i getPublicKey(i, pk_m) {
    return pk_i(hash'(i), pk_m.n) //hash' making use of full range of Z_n
}

//Sign a message with private key sk_i
sig_mi sign(message, sk_i) {
    r = rnd()
    t = r^e (mod sk_i.n)
    s = sk_i.d * r^hash''(t, message) (mod sk_i.n) //sk_i.d = g as generated by function getPublicKey
    return sig_mi(s,t)
}

//Verify a message with signature sig_mi
boolean verify(message, sig_mi, pk_m) {
    return (sig_mi.s^pk_m.e (mod n) == hash'(i)^pk_m.e * t^hash''(t, message) (mod n)) //hash'' with bitlength l such that 2^-l is sufficiently small (e.h. SHA256)
}


texts: Discrete logarithm modulo a smooth number

texts:
I am solving the discrete logarithm problem modulo $N$. $N$ is a composite number, I found its factors — lots of small primes and two big primes ($> 2^{50}$).
Does the factorization of $N$ somehow help me? I think I could compute the logarithm modulo each prime and then combine it, but I do not know how to do this exactly. It seems similar to problems for the chinese remainder theorem, but I cannot find the way to do it.


texts: How the degree reduction in BGW protocol works?

texts:
In the BGW protocol given in the original paper http://groups.csail.mit.edu/cis/pubs/shafi/1988-stoc.pdf

It says the after the randomization step every party $P_i$ finds its share $s_i = \tilde{h}(\alpha_i)$ on the polynomial $\tilde{h}(x) = h(x)+\sum^{n-1}_{j=0}q_j(x)$, and then it applies degree reduction on $\tilde{h}(x)$.

It defines vector $S = [s_0 s_1 \cdots s_{n-1}]$ and a constant matrix $A_{n\times n}$, such that $R = S.A$. where $R$ is the vector of shares of each party $P_i$ on polynomial $k(x)$ which is $t$-degree and $k(0) = \tilde{h}(0)=a.b$.

So, what is want to know that how this matrix multiplication is evaluated among the parties t-privately ? Because each party holds $s_i$ not known to any other party. How the whole $\mbox{truncate}(\tilde{h})$ is done ?


texts: Decrypting an already sent encrypted file in PGP

texts:
I am a novice in cryptography and need few clarifications.

If I am SenderA, sending document to Receiver using PGP encryption. Let's say, SenderA shuts down and SenderC takes on the role of SenderA. SenderC gets hold of the secret key from SenderA (to minimize disruptions of adding new keys and involving Receiver).

If I only have list of encrypted files that SenderA sent earlier, how can I as a SenderC decrypts those files back into original?

Any help will be much appreciated.


texts: What exactly is "Plausible Deniability in Internet Protocols"?

texts:
I am trying to understand the meaning of "Plausible Deniability Feature of Internet Protocols". To be specific, I am not able to understand what "Plausible Deniability" exactly means.

Could someone explain what these terms mean and give some examples?


texts:
As an 17-year old highschool student with some interests into cryptography I developed following block cipher:

Let $H$ be an irreversible hash function with the block length $L$, which also is the block and key length.  (I used SHA-256 for my example implementation below).

$O$ is the original key while $K$ is the expanded (and mutated) key.

First, the key is expanded to the length of the plain text $P$ using following scheme:

$K_0=H(O)$

$K_n=H(H(K_0,n) \oplus O)$  ($K_0,n$ should be the n'th byte of $K_0$)

Next, the ciphertext $C$ is set to $P$ and following modification of the feistel round is being run 64 times, please note that $C_0$ are the first 64 bits of an block, $C_1$ the second 64 bit, etc.

$C_2 = C_2 \oplus ((C_3 \oplus K_3) \lll 41)$

$C_1 = C_1 \oplus ((C_2 \oplus K_2) \lll 29)$

$C_0 = C_0 \oplus ((C_1 \oplus K_1) \lll 13)$

$C_3 = C_3 \oplus ((C_0 \oplus K_0) \lll 5)$

After each round, the key mutates by $K_n = H(K_n \oplus O)$, this key mutation is not shown in the graph below.

To decrypt, you'll just have to calculate the round keys and apply the rules above in reversed order. Functional java code can be found here.

Sadly, I'm not able to perform an any "modern" cryptoanalysis due to lack of mathematical knowledge, but here are some thoughts on my cipher:

You shouldn't be able to get $O$ unless you are able to break $H$.
Since key expansion and mutation make use of $O$, you shouldn't be able to predict another round key given you already have one and don't know $O$.
An attack vector could be predicting $H$ outcome even without knowing it's input.

I hope you have more idea's when it comes to attacking this algorithm and / or are able to perform known cryptoanalysis.

Thanks in advance

// Edit: Updated algorithm and added graph


texts: If I have two ECDSA signatures that use the same k (nonce) but different secret keys, can the secret key be computed?

texts:
I have two ECDSA signatures $(r, s_1, z_1)$ and $(r, s_2, z_2)$
where $s_1 = (z_1 + r*x_1) / k$, and $s_2 = (z_2 + r*x_2) / k$.

Can $x_1$ & $x_2$ be computed?


texts: sign data and append certificate VS sign data and certificate

texts:
I am currently writing my masters thesis in which I need to develop a licensing module for an application.

The license itself is a JSON Web Token which is signed using a RSA private key.

Since we have the requirement that resellers should also be able to create  and sign valid licenses I thought about using a PKI where my company owns the root CA and creates an intermediate certificate for each reseller (so that they can sign their licenses). The root certificate will be part of the final binary ("hiding" the root certificate in that binary is a totally different story). In order for the application to verify the license it needs to check the license's signature and needs to verify the whole certificate chain - that means that the certificate chain (except the root certificate of course) needs to be part of the license.

To my actual question: Should I

only sign the JSON Web Token and then append the certificate chain to the license or
include the certificate chain into the JSON Web Token and then sign everything altogether?

I have read through some articles that say that one should not hash secrets / through some articles that discuss about MAC-then-encrypt vs encrypt-then-MAC, but none of them can be applied to my problem (since there is neither a secret, nor an encryption involved).

Even if it makes no difference whether I sign only the JWT or the combination of both (JWT + certificate chain) I need to provide some arguments that support and explain the final decision.


texts:
I've posted this question over at superuser, but haven't had any success at getting answers. That's why I've posted it here. Furthermore, I believe this is a more appropriate place for it as it is questions about design of the encryption system and not about its usage.

How is LUKS dm-crypt secure if the key is stored with the encrypted data? To me, this seems like hanging a door key on the door it locks. Is a passphrase enough to secure it?

And a continuation: If it is secure to keep the key with the encrypted partition/container, am I correct in assuming that LUKS header backups can also be treated as normal files and not secret data?


texts: Vulnerability in the Digital Signature Algorithm. Can I calculate k and x?

texts:
I feel DSA is vulnerable if k is randomly selected over a small set, example, {1,2,...,2^16 -1}.
I am trying to come up with a program where I assume I have the public parameters (p,q,g) , public key : y, message m and its signature pair (r,s) signed with x and k. We also have hash value h (where h=SHA-1(m)).
I want to construct an attack where I can get k by brute force and then use it to get x from s. How do I code an efficient program for this attack ?What modular arithmetic do I need to perform to make the program as efficient as possible ? What crypto libraries are the best for this sort of brute force attack ?


texts: Is it safe to generate ECDSA keys from the hash of the previous, over and over again?

texts:
I have memorized a very long and secure passphrase, that when hashed with sha256, I can use the result as an ECDSA private key, and use it as a brain-address for Bitcoin.

Now I need more bitcoin addresses, and instead of memorizing a new long and secure passphrase, I am thinking about just hashing the previous hash, over and over again to create new keys.

So I can build a simple software to which I type the passphrase and I tell him I want the key of the address number 58, so it just has to sha256 the passphrase 58 times to get that key.

If the greatest hacker ever had for example the first 500 bitcoin addresses that were generated with my passphrase, and if that hacker knew how those private keys where generated, would he have any chance to hack this system?

I am pretty sure he wouldn't but I want to make sure, because this is for a project at my job.


texts:
I intend to authenticate small packets of data, between 16 and 256 bytes each. For some of them encryption will also be required. This will be used on small micro controllers, with RAM sizes ranging in 1 KB to a 64 KB.

My initial approach was to use AES-128 as the base cipher for a block cipher mode with MAC (GCM for instance). However, given the small packet sizes I was wondering if this is secure. So I was considering prefixing to the plaintext, a 32 bit number that is the concatenation of the plaintext CRC16 code and a 16 bit nounce. Then encrypting the result (CRC16 || 16 bit nounce || plaintext) with AEs in block counter mode.

Authentication would be done by decyphering the cyphered packet and validating the CRC16. This approach seems so obvious, but I can't find any implementations of it and I fear that I am overlooking something important.

My question: is encrypting a the CRC together with the packets as secure (meaning as hard to break) as appending a MAC to the packet ?


texts: Does it make sense to use slow hashes in digital signatures?

texts:
For storing passwords, it seems that the use of intentionally slow hash functions (like PBKDF2 and bcrypt) is now recommended. This is because most hashes are designed to be fast, which also makes certain attacks on them parallelizable on GPUs.

Now I'm wondering if it would make sense to use slow hash functions for digital signatures. Are collision attacks slower when the hash function is slower? And are collision attacks the only kind of attacks you need to guard against?

(If it matters, the context involves authors that publish messages to the general public, at a rate that may vary from hourly publications to a handful of messages in a month, and the general public needs to be able to tell those messages originate from those authors.)


texts: Are factorization algorithms parallelizable?

texts:
I was reading about the Blum-Blum-Shub random number generator, and its security depends on the hardness of factoring very large numbers (like many things in crypto do).

I'm just wondering, if I have 10 computers, can I break Blum-Blum-Shub 10 times faster? Or is it impossible to factor numbers more quickly using parallel computation?


texts: Can CBC-encrypted files be modified in-place?

texts:
When changing a (small) part of the plaintext of a CBC-encrypted file, how much of the file will have to be rewritten?

My suspicion is that everything after the modified block will have to be decrypted and reencrypted as well, due to the changes of the ciphertext blocks cascading through the rest of the file.


texts: Is there a point to having a large IV in AES

texts:
I've always known that the IV should be 128 bits, because that's the block size of AES, regardless of the key.
However, I just saw one vendor advertising AES-256 with a 256 bit IV.
Is there any point to that? Does a 'double' IV bring additional guarantees? For example, reducing the probability of having the same IV with the same key?
Will it even work with standard AES implementations, or they'll reject it? The Java implementation rejects it, for example.
Effectively, it adds another block of plaintext to throw away, but if it works, does it have negative effects (apart from having one more block to process)
Or is it just a marketing mistake...


texts:
In normal LFSR, the state is a function of the initial seed, taps positions and time, nothing else. I've seen a modification of LFSR that works like this:

TAPS = const
MASK = (1<<L)-1 #L=bitlength of state

def parity(x):
    return (number of ones in x)&1

def tick(state):
    b = parity(state & TAPS)
    return (state<<1 | b) & MASK

while True:
    i = 0
    k = [...] #elements smaller than bitlength of state
    while True:
        state = state ^ (1<<k[i%C]) #C<=length(k)
        state = tick(state)
        i += 1

I can't find any mention of that variant in the literature. Does it have a name, or is it completely custom?


texts: Is there another group structure that is suitable for RSA other than $U_{pq}$?

texts:
I know that calculating the cardinality of $U_{pq}$ is infeasible and therefore it is extremely hard to break a code using Lagrange's theorem. But later on my studies i realized main principle of RSA can be generalized to any abelian finite group. Is there another group structure $G$ that is suitable for RSA (i.e. it is infeasible to compute $|G|$)?

Of course in such cases, we wouldn't be able to do padding, hence our algorithm would be deterministic and unsafe. But i am just asking out of curiosity.

For expressing my thoughts more formally:

Given a finite abelian group $(G, \cdot)$, every function $f:G \to G$,

$$f(x) = x^n$$
is an automorphism (structure-preserving permutation) of $G$ for $(|G|, n) = 1$. Since it is an isomorphism, it does have an inverse isomorphism $f^{-1} = x^m$ for $m$ being modular inverse of $n$ in modulo $|G|$.

So, summing up:

$$f: x \mapsto x^n$$
$$f^{-1}: x \mapsto x^m$$

We can treat each element of $G$ as a message. We can encrypt this message with $f$, we can decrypt resulting code with $f^{-1}$, as we did in RSA. All difficulty to break this algorithm is the difficulty of calculating $|G|$.

This is a generalization of the main principle of RSA. Is it suitable for a group structure other than $U_{pq}$?


texts: What should I use for consequent AES key derivation?

texts:
I am writing a small chat program to explore some methods and concepts in cryptography and currently I am using a shared AES key tunneled with RSA which upon further reading revealed many flaws both in the mode choice and the concept itself.  So after some more videos, articles and posts I decided to implement 2 ECDH pairs which will be used to derive 2 different AES-GCM keys which in terms will be used for message encryption in both directions. On top of that I would like to implement a key derivation per request so that every message is encrypted with its own key derived from the previous. (Synchronicity problems will be handled by the protocol)

Since the initial AES key is not a human password but a high entropy string (which eliminates bruteforcing) is it enough to just hash it with SHA-256 and get the first 128 bits for the seed of the new AES key for efficiency and ease of use? This would prevent decryption of previous messages if the key is compromised which in combination of re-establishing the ECDH pair every so often will limit the threat of a compromised key to minimum in both time directions.

Edit:

Just to make it clear because i added too much context around the question: I am asking if a simple hash function as SHA-256 would play a sufficient role of a KDF in a double ratchet?

This is the proof of concept that I am going to use: https://netnix.org/2015/04/19/aes-encryption-with-hmac-integrity-in-java


texts: My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound connection is encrypted using TLS 1.0 with RC4-MD5 weak hash algorithm. By industry standards TLS 1.0 is insecure. Although other controls exist such as a firewall, are there are risks pertaining to this connection with the current encryption? Please help explain what are the potential attacks that can occur. Can lease lines with socket protocols instead of web protocol be encrypted?


texts: Which program/language was used to plot the point at infinity of these images? (See the images)

texts:
The code of the first image was provided by Squeamish Ossifrage in this answer. In wich language/program was plot? In JavaScript or GeoGebra?

Also, I found in YouTube the image below with the point at infinity (north pole) plot in a projective plane using stereographic projection. The YouTube channel is Trustica. I copy the picture from the website attached in the description of the video. What language/program was used? Any ideas?

I tried to replicate the graphs in Mathematica but failed.


texts: Data switching on one time pad and Data leakage

texts:
Assume all the values and operations defined over $\mathbb{F}_p$.
For the sake of simplicity assume all the values are non-zero. Let $(-r)$ denote additive inverse of value $r$.

We have one fixed value $a$. we compute $v_1=a+r_1$ and $v_2=(-r_1)+r_2$, where $r_i$ are picked uniformly at random from the field.

We give $v_1$ and $v_2$ to a semi-honest adversary and ask him to do:

$v_1+v_2=a+r_2$

Question: Given $v_1$ and $v_2$ can the adversary learn anything about $a$ in above scenario (when it performs modular addition operation)?


texts: What does a vertical bar mean in this context?

texts:
I'm doing a few exercises regarding Schnorr's identification scheme.
I have the exercise starting off like this, with the values defined:

Let $p = 311$ and $r = 31\ |\ (p - 1)$. Let $g = 169$, which has order $r$.

I just really can't figure out what the vertical bar means here?
Sometimes in discrete maths, a vertical bar means absolute value, sometimes two them are cardinalty? Programming would suggest that it means a logical or?
One place I saw something indicating that it might be xor, but I really have no idea.


texts: How would using only one s-box affect security of Blowfish?

texts:
Schneier says:

  Fewer and smaller S-boxes. It may be possible to reduce the number of
  S-boxes from four to one. Additionally, it may be possible to overlap
  entries in a single S-box: entry 0 would consist of bytes 0 through 3,
  entry 1 would consist of bytes 1 through 4, etc. The former
  simplification would reduce the memory requirements for the four
  S-boxes from 4096 bytes to 1024 bytes, the latter would reduce the
  requirements for a single S-box from 1024 bytes to 259 bytes.
  Additional steps may be required to eliminate the symmetries that
  these simplifications would introduce. Additionally, four different
  10- or 12-bit indexes into a single large S-box could be used instead
  of the current series of S-boxes.

Just theoretically, how would using same s-box instead of 4 different affect the security of Blowfish (considering no other change is made)?

By "eliminate the symmetries", he probably means rotations? Is this really required, since round keys already break the symmetries?


texts: UOV signature scheme, how does the affine transformation work? What does the composition of the core map and the affine map yield?

texts:
I am having trouble understanding part of the UOV scheme, i get how it works except for when it comes to composing the core map F with an affine transformation say T, which i understand to be an invertible square matrix? I understand F to be composed of the o number of oil-vinegar polynomials where o is the number of oil variables. So does this mean that each multivariate equation in the core map F is multiplied by a square matrix representing the affine map T? What exactly would be the product of this multiplication? Is each multivariate oil vinegar equation treated as a 1x1 matrix and multiplied with T?
I know that the map T is used to do a change of basis on the system but the public key is supposed to be a system of multivariate equations so could someone help clarify what the composition of the core map F and the affine map T actually yields? Perhaps with a small example if possible?  For example in the case where o = 2 if i say the core map F is given by

$F = [3x_0^2 - 4x_0x_1 - 4x_1^2 + 8x_0x_2 + 11x_2^2 - 2x_0x_3 - x_1x_3 + 9x_2x_3 + 12x_3^2 + 7x_0x_4 - 11x_1x_4 - 9x_2x_4 - 2x_3x_4 + 3x_0x_5 + 5x_1x_5 + 14x_2x_5 - 11x_3x_5]$

$[-6x_0^2 + 10x_0x_1 + 10x_1^2 + 13x_0x_2 + 4x_1x_2 + 7x_2^2 - 7x_0x_3 - x_1x_3 - 13x_2x_3 + 4x_3^2 + 6x_0x_4 + 15x_1x_4 - 11x_2x_4 - 12x_3x_4 - 12x_0x_5 + 7x_1x_5 - 13x_2x_5 - 9x_3x_5]$

And an affine transformation $T$ given by:

$\begin{bmatrix}
18 & 23 & 14 &  1 & 6 & 21 \\
24 & 3 & 3 & 0 & 2 & 0 \\
17 & 25 & 2 & 16 & 23 & 8 \\
8 & 21 & 16 &  5 &  1 &  9 \\
14 & 28 &  8 & 17& 12& 12 \\
6 & 24& 18& 19&  3&  1& \end{bmatrix}$

what would the public key/the composition of the core map F and the map T be?


texts: Are there public slow-but-strong algorithms out there that resist brute-force attacks better?

texts:
I'm reading that AES uses 4x4 bytes (4*4*8 = 256 bits key) matrix for performances matters (since it's a requirement for common standard encryption algorithms), but are there implementations with choosable key size for this particular algorithm, so I can make brute-force attacks harder with a good password ?

Also, if I'm worried that I can't make user use good passwords (it's a shame, but lets imagine that), can I make an algorithm deliberately slow to make brute-force attacks infeasible with weak passwords, but really secure ?

Could we one day make users switch to key files instead of passwords to completely forget about brute-force, even with the potentially theft of those keys ?


texts: Why is Min-entropy significant in cryptography?

texts:
Let $H_{min}$ = Min-entropy and $H$ = Shannon entropy.

Unless you're gaming the system or deliberately trying to be obtuse, very rarely is $ \frac{H}  {H_{min}} > 10$ from any conceivable physical source. To achieve a ratio of >10 in hardware/ real life would be quite a feat of engineering and tantamount to a joke/NSA conspiracy.  For  worldly context, lift engineering commonly uses a safety factor of 7.  If the lift gear fails, real people die. Since arbitrarily, $ \frac{H}{100} << H_{min} $ in the overwhelming majority of cases, why is $H_{min}$ significant in cryptography?

I know the definitions.


texts: Is it possible to create a "proof-of-upload" system for BitTorrent ratio tracking?

texts:
One issue that private BitTorrent trackers that track users' share ratios often run into is how to keep track of people who are screwing with their upload statistics, something known as "stat-hacking". As it is, because uploading and downloading is entirely peer-to-peer, there is no reliable way for the tracker to know purely through the BitTorrent protocol itself how much a client has uploaded or downloaded, except to trust the numbers that each client forwards. While somebody who uploads 1 petabyte in 2 days is an obvious impossibility, somebody simply augmenting their upload by 10% at a time could go unnoticed for a very long time.

Can we devise a cryptographic protocol to ensure that stats about upload and download are accurately reported to the tracker? In particular, it should be resistant to the following related attacks:

The uploader cannot claim empty upload credit - that is, to be able to report to the tracker that a piece was uploaded to a person, without having actually uploaded the piece to that person.
A downloader cannot repudiate their download - that is, the downloader cannot download a piece and then refuse to verify to the uploader that the piece was actually downloaded.


texts: AES s-box – How do I calculate the inverse of this field equation?

texts:
I want to implement AES algorithm,instead of LUT based S-box, but I’m stuck at point creating "Inverse of equation" during implementation.

In creation of S-box I am using the following steps:

($a_7a_6a_5a_4a_3a_2a_1a_0$) bits converting in to field equation.
Calculating the inverse of the field equation modulo($x^8 + x^4 + x^3 + x + 1$).
Doing the affine transformation.
Return the 8 bits.

In these steps I did not find a way to calculate inverse of the field equation.

Can anyone help me in calculating inverse of equation in Galios field mod($x^8 + x^4 + x^3 + x + 1$)?


texts:
Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the definition of the actual protocol, i.e. which massages are passing between the partners, in the source quoted, i.e. ITU-T X.509. Can any one help with this?
Thanks


texts: Default mode of operation in TLS cipher suites

texts:
I've been trying to evaluate the security of a list of cipher suites and I've come across cipher suites, not explicitly featuring a mode of operation.

Form this list (openvpn --show-tls), one of such cipher suites would be:

DH-RSA-AES256-SHA256

As the cipher suites are provided by the underlying SSL library (OpenSSL 1.0.2g), I assume there must be a default mode, if not explicitly defined.

What mode would be used in this case?


texts: Embedding SHA256 inside SHA1 for BitTorrent

texts:
BitTorrent uses SHA1 for its hashes, but SHA1 is unsafe and people can tamper the preimage and still obtain the same hash, right?
So imagine I want to be very sure the file I'm sharing on BitTorrent will be correctly downloaded by who is downloading it. Does it work to include 2 files, being:

The file I'm actually sharing;
A file containing the SHA256 of the file I'm sharing.

Then the receiver must just check if the SHA256 matches (plus check if the SHA1 matches, which will be done automatically by the BitTorrent client).


texts: Key cracking: Prefer many small texts over one large text?

texts:
If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to see cryptotexts of many IVs than of a single IV?

Does the answer change if also the plaintexts (many small, possibly similar, plaintexts or one large) are available to the cracker?

Does the answer differ per (approved) crypto algorithm and mode?

I assume perfect implementations, IVs etc. but assume nothing about the properties of the plaintext, except that the attacker does not get to choose it.

If these are too many questions, requiring too long an answer, focus on the first.