texts: In a paper it says "In the generic group model, the PRF is adaptively secure for inputs of $\mathbb{Z}_q^n$". Maybe a stupid question, but what does "adaptively secure" mean exactly?


texts: What happens if an RSA key pair has identical public and private exponents?

texts:
Rather, is it possible for big prime numbers?

Classroom examples usually involve smaller primes, so for example if you are given a prime number pair $p = 3$, $q = 13$ you would get $n = 39$ and $e = d = 5$, making encryption and decryption the same for a message $x$ or ciphertext $x$.

This can be a big problem, e.g. if a server sends you cipher $x$, you can decrypt it and get the message, then you encrypt the cipher $x$ itself and if you get the message again then you know the public key is the same as the private key.

Is this possible in industry?


texts:
Having a "rotating" square Cardan Grill with sides long n cells, how could i determinate the cost of a brute-force attack?
How many configurations should be considered to perform an exhaustive search?

EDIT FOR MORE DETAIL:

This was an exam question so these are all the information given to me, but i think i can suppose that the grille has $(n^2)/4$ holes, the plaintext has $n^2$ letters, letters are not visible in more than one orientation and the grille have to be rotated 4 times.

Are these informations more helpful?


texts: What is the difference between "Linkable" and "Traceable" Ring Signatures?

texts: In particular, both papers on Traceable Ring Signatures and Linkable Ring Signatures propose they are fit for the creation of ballots. The Wikipedia Article on Ring Signatures, though, suggests Linkable Ring Signatures can't be used for that purpose. Which is right?


texts: How does a chosen ciphertext attack work, with a simple example?

texts: Can someone please explain - using a simple example - how a chosen ciphertext attack works?


texts: How much of Probability do I need to know to study Cryptography?

texts:
I have just started MSc in Computer Security. I didn't study probability before. Now, I have some short time to complete my MSc semester.

What are the minimum topics from 'Probability' do I need to know to complete my Cryptography course?


texts: Using negative values / unsigned integers to implement SHA-2

texts:
What happens if we allow implementation of SHA-2 using negative values?

What happens if a negative value was used in the first round? Would the algorithm still result in a secure value?

I have a basic understanding of how the maths work. However, before I go writing my own function - could somebody indicate if they have any experience using negative values?


texts: Fake non-membership proof in RSA accumulator

texts:
As explained in this answer, if one knows the trapdoor (factorization of modulus $N$) in an RSA accumulator, one can generate fake membership proofs. Does the same apply to non-membership proofs? More specifically:
Given $A$ is the value of an RSA accumulator and $x$ is a value present in $A$, if I know $p$ and $q$, where $N = p \cdot q$, could I generate a non-membership proof saying that $x$ is not in $A$?


texts: How can I show, that RSA with OWP is IND-CPA secure by using H function?

texts:
How can I show, that RSA with OWP is IND-CPA secure by using H function , a random oracle model.

The Encryption goes like: $\text{Encryption_H_PK}(M)\gets(C_1,C_2)\gets(f(x),H(x)\oplus M)$

Decryption goes like: $M\gets H(x)\oplus C_2$


texts: Why initialize SHA1 with specific buffer?

texts:
SHA-1 is initialize with a specific buffer:

h0 = 0x67452301
h1 = 0xEFCDAB89
h2 = 0x98BADCFE
h3 = 0x10325476
h4 = 0xC3D2E1F0?

Why?


texts: What is the difference between a Stream cipher and a Symmetric Encryption algorithm?

texts:
According to the Tag definitions:

Stream Cipher: A stream cipher is an encryption algorithm which encrypts arbitrary length plaintext, using a key. Some stream ciphers generate a keystream from only the key, which is then XOR-combined with the plain text, others feed back plaintext or ciphertext into the algorithm to create the keystream.

Symmetric Encryption: Symmetric cryptosystems assume two communicating entities share a pre-established secret key.

What is the difference between these two terms? Is there a particular situation that would be more ideal for a Stream cipher instead of a Symmetric encryption algorithm (or vice versa)? Or are these two simply different terms for the same concepts?

Follow up: ChaCha20-Poly1305 is identified as a stream cipher. Is AES/3DES also a Stream Cipher?


texts: Example of a universal one-way hash function that is not collision resistant hash function

texts:
In collision-resistant hash function, first, a hash function is sampled and the adversary is allowed to pick a collision $(x, x')$ s.t. $H(x) = H(x')$ and $x \neq x'$.
In a universal one-way hash function, first, the adversary picks $x$, and then a hash function is sampled, and then the adversary is supposed to find $x'$ s.t. $H(x) = H(x')$.
Is there any example of a universal one-way hash function that is not collision resistant?


texts:
For example, RSA relies on a mathematically hard problem, factoring, while ECDSA or similar rely on discrete logarithm problem.

What makes SHA-256 and similar hash functions, of the same family, secure against pre-image and collision attacks? What's the math behind it?


texts: Crl files are growing linearly. I wonder with 10 revoked certificate, what is the storage size of crl file and so on. For every revoke certificate, how much increase the size of the crl?


texts: What is the difference between online and offline brute force attacks?

texts: I read some papers saying a certain scheme is secure for offline brute force attacks, but vulnerable to online brute force attacks. I wonder the difference between the online and offline brute force attacks.


texts: TLS handshake with client later on acting as a server

texts: Is it possible that a client which gets the Digital certificate of the Server during the TLS handshake then acts as a server? Because a server only needs to have a valid digital certificate which it already possesses.


texts: Crypto hash function vs encryption algorithms

texts: Why is a cryptographic hash function generally faster to execute in software than conventional encryption algorithms such as DES?


texts: How do you prevent the risk of damage to the security of Fully Homomorphic Encryption?

texts:
In this paper on pg. 1248 in the "preprocessing phase" section the authors say:

  In the preprocessing phase, the parties run a (standard) MPC to
  collectively generate a key pair (pk,sk) for the FHE scheme, and to
  secret share sk in such a way that (a) learning the shares of
  corrupted parties, and leakage on each remaining share, does not
  damage the security of the FHE, but (b) collectively, the shares can
  be used to evaluate the decryption circuit in a leaky environment

Part (a) above makes me believe there is a risk with FHE security being damaged.  Is it possible to use another encryption scheme where this risk is mitigated ?


texts: Why can you reverse a modulo function when knowing its primes

texts:
We are dealing with cryptography in school right now and superficially went over the Rabin cryptosystem with the (apparently usual) example of p=7 and q=11 etc (we didn't do RSA).

I understand that there are many results when you try to reverse $15 = m^2 \pmod{77}$. E.g. $m^2 = 77+15, 77*2+15,77*3+15$ and so on.

What I don't understand is how it gets easier to reverse this function when you know the primes that you used to calculate the divisor (/the thing with which you did the modulo operation)?

Is this advanced mathematics or is it really quite easy, because for me whether I write $15 = m^2 \pmod{77}$ or $15 = m^2 \pmod{(7*11)}$ doesn't really matter, they're both the same equations.

Of course it apparently matters, so that is why I'm asking.


texts: How secure is the AES master key if Round Keys are found

texts:
If an attacker finds some round key of AES256, is it possible to find the master key?

How safe is the master key if an attackers finds multiple round keys?


texts:
When using DHE_RSA, the prime $p$, the generator $g$ and the public keys $A$ and $B$ are transmitted in plain text. If I know the private key of the server $a$, I can calculate $k=B^a\ mod\ p$ to receive the pre master secret (correct me if I'm wrong). According to RFC 5246, this pre master secret is then combined with some random values sent in the server and client hello messages and hashed to receive the master secret.

Now, my question is how this calculation of the master secret is done in practice (which hash function is used, how are the parameters combined,...).


texts: Why has the sponge construction's generic collision finding attack a complexity of O(min(2^(-n/2) , 2^(-c/2)))?

texts:
I'm trying to learn about sponge function for creating hash functions and generic attacks on it.

I'm looking for the collision finding attack scenario which leads to $O(\min(2^{-n/2} , 2^{-c/2}))$ time complexity, where $n$ is the sponge output length(hash output length) and $c$ is the capacity length of sponge state.

I know that $2^{-n/2}$ comes from a traditional birthday attack on the output, but what is the attack scenario for $2^{-c/2}$ complexity?


texts:
I have started reading

"How to Exchange Secrets with Oblivious Transfer" (PDF)
"On the impossibility of fair exchange without trusted parties" (PDF)

I found the abstract of those these two work to be contraddicting.

Are we saying that exchange of secrets is possible and fair exchange is not without a trusted third party?
What is the difference of exchange of secrets or just fair exchange?


texts: Elliptic Curve Blind Signature Implementation

texts:
I have seen this prior post: Elliptic Curve based blind signature implementation

Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm working on.

I did see this posting from @DrLecter which was very informative.

How difficult is it to implement an ECC Blind Signature Scheme? is there anything out there already to start with? What schemes are considered reputable and secure? I'm trying to determine if I need to start with a whitepaper, develop an algo and code.

An RSA scheme is probably not to useful for me due to signature sizes.


texts:
I read some materials about MS u-prove and IBM Idemix.

But according to these materials, the opinion about revocation is different.

Some materials say that u-prove and idemix do not provide revocation, but others say that they provide.

I tried to read technical papers about both but it was too hard to read.

Am I correct in understanding that only a user (not issuer or IdP) of both schemes can revoke it voluntarily?

Can anyone explain about specific details of revocation in u-prove and idemix?

Thanks

U-prove: https://www.microsoft.com/en-us/research/project/u-prove/

Idemix: http://www.research.ibm.com/labs/zurich/idemix/


texts: Is it safe to use unauthenticated AES CBC when encrypting random bytes?

texts:
I am studying an application with an AES crypto implementation that works that like the following:

PBKDF2 is used with X iterations and SHA-256 to generate a 256-bit "master key" from a user-provided password and salt.

master_key = pbkdf2(
    password,
    salt,
    iterations,
    alg: SHA256,
    size: 32)

A crytpo-safe RNG is used to generate 512 bits of "key material" .

key_material = random_bytes(
    size: 64)

The key material is then encrypted with the 256-bit master key, unauthenticated.

encrypted_key_material = encrypt_aes(
    data: key_material,
    key: master_key,
    hmac_key: null,
    mode: CBC)

The encrypted key material is persisted on the device for later encryption use. The application user only needs to provide the PBKDF2 generated master key to decrypt it.

It should be noted that the encrypt_aes function generates and uses a standard 16 byte random IV with every operation which is part of the returned encrypted bytes (along with the computed encrypt-then-mac HMAC data).
When the application needs to encrypt some data, half of the key material is used as the encryption key and the other half is used as the HMAC key.

key_material = decrypt_aes(
    data: encrypted_key_material,
    key: master_key,
    hmac_key: null,
    mode: CBC)

encryption_key = key_material.split(0, 31)
hmac_key = key_material.split(32, 64)

And now encryption of other data can be performed in the application, which is authenticated.

encrypted_data = encrypt_aes(
    data: "Hello World",
    key: encryption_key,
    hmac_key: hmac_key,
    mode: CBC)

decrypted_data = decrypt_aes(
    data: encrypted_data,
    key: encryption_key,
    hmac_key: hmac_key,
    mode: CBC)

// decrypted_data is now "Hello World"

I understand that CBC mode should always use HMAC authentication to protect against oracle attack vectors. As we can see here, an HMAC is used for encrypting data in the application (step 5), but it is not used when encrypting the random key material (step 3 and 4) that gives access to all of that data. This is presumably this way because PBKDF2-SHA256 does not produce enough bits to supply a 256-bit HMAC key for protecting the key material (step 3), hence why 512 bits of key material is derived separately for further encryption operations.

Is this a safe implementation? Does the fact that the key material is random byte data change its need to have HMAC authentication to protect it from attacks? Is the key material decryption from step 4 subject to the same attack vectors as standard string decryption, as in step 5?


texts: Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$

texts:
Suppose, for some security parameter $n$ you choose a prime $p$ such that $p = 2^n+c$ for some relatively small $|c| < 2^m << 2^n$. I have seen such primes being called Pseudo-Mersenne Primes (if $c < 0$), Barrett Primes or Crandall Primes.

Does choosing such special primes $p$ as the group modulus for Discrete Logarithm Problem based Finite Field schemes in $Z_p^{*}$ in any way weaken the hardness of any known Discrete Logarithm based problems? I have seen the answers to this related question, which imply that if $|c|$ is small enough, the magnitude $n$ has to be doubled to counter the improved efficiency of the Special Number Field Sieve, but how small does $|c|$ have to be for that to apply?

For instance, suppose $n = 2048$ and $m = 512$, and the Hamming Weight of $c$ is approximately $256$. Is this sufficient to counter the SNFS, while still retaining the possibility of Barrett Reduction implementation optimizations?


texts: Is there a complete summarized list of attacks on Diffie Hellman? In RSA, there is https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf, so I was wondering if there is such a list somewhere. I have been looking everywhere for a list like the one I showed above, for Diffie Hellman, but I can't find it and I believe that such a list must exist somewhere. Could you please tell me if such a list exists?


texts: Zero knowledge proof of the sum of two values

texts:
Given $v \in Z$, a prover knows $v$ and the verifier knows an encryption of $v$.

The prover provides the verifier with the encryptions of two values $m$ and $n$

How can the verifier verify that $m+n=v$ ?

I cannot find any scheme/algorithm in the literature I have searched, other than range proofs, and I am looking for pointers.

To illustrate, here is a naive (and wrong) approach to the problem.

Assuming a generator $g$ in a group of order $p$, co-primes.

The verifier knows $g^v$, the prover can provide $g^m$ and $g^n$. The verifier then verifies that $g^mg^n=g^{m+n}=g^v \pmod p$.

However if the prover provides $m'$ and $n'$ such that $m'+n'=m+n+k(p-1), k \in Z^*$ then the equation above verifies although $m'+n'> v$

(according to Fermat little's theorem $g^{k(p-1)}=(g^{p-1})^k \equiv 1 \pmod p$)


texts: Modes of operation for Public Key Encryption schemes

texts:
Symmetric key encryption schemes have well defined modes of operations for achieving deterministic (ECB) or Randomized (CBC, OFB, CTR ) etc. and other applications of the same. But are they defined for public key encryption schemes also ? i could not find on google.

Also are they applicable for PKE schemes ?


texts: Monoalphabetic cipher using different languages in the same plaintext

texts:
Today I learned the principle of the monoalphabetic cipher. It's simple to decrypt a ciphertext written all in the same language (english for example) because I can use the syntactic properties as well as letters' frequency. What about writing a message using different languages in the same text?

  Il gatto è salito sull'albero. I don't know how to bring it down!

In this way I don't have any clues on how to decrypt the message, right? The only information that could help me should be the knowledge of which languages are in use.

Thank you very much for your time.


texts: Why should $a,b < N$ for Montgomery Reduction?

texts:
In Montgomery reduction, when calculating $a \times b \mod N$, it is required that $a \lt N$ and $b \lt N$.
I think $0 \le T \lt N \times R$ is enough for the Montgomery Reduction.

Rationale:

Let $a' = a \times R \mod N$,
let $b' = b \times R \mod N$, and
let $T = a' \times b'$.

Then $T \times R^{-1} = ((T + ((T \times (-N^{-1}) \mod R) \times N) / R) \mod N$.

$T \lt N^{2} \lt N \times R$ as $R \gt N$. Also remainder of $\mod R \lt R$, so $(T + ((T \times (-N^{-1}) \mod R) \times N)/ R \lt (N \times R + R \times N)/R = 2 \times N$.

As such, $a$ and $b$ can be greater than $N$. Is that correct? If it isn´t, what´s wrong with my rationale?


texts:
Can someone please tell me why in R-LWE we always make use of Cyclotomic fields, and specially those with degree equals to a power of $2$?
Can we use another fields without losing in hardness of the problem?
What about Quadratic fields for example?
Thank you!


texts:
Authenticated encryption is said to be achievable with either of these three things:

Use a separate algorithm that ensures authentications such as HMAC.
Use one of the several block cipher modes of operation that generate/verify an authentication tag like OCB, CCM, or GCM.
Use a cipher that is dedicated to authentication (in addition to confidentiality, that is).

Some of the entries in the CAESAR competition are of the second solution while the rest are of the third. My trouble is that, after looking at the specifications of the entries that fall into the third category, I'm left wondering a dedicated authenticated encryption algorithm is. Except for possibly the ones based on sponges, in the ones that I looked over, it seemed to me as if the authentication and encryption mechanisms are easily untangled and that you could use one without using the other, just like how block ciphers and block cipher modes of operation are interchangeable. The only ciphers I can think of that I can undoubtedly say are dedicated are Helix and Phelix. I'm unsure as to whether or not to classify sponge-based schemes as dedicated ones, but if I were to decide that they are dedicated schemes, then it would be with less certainty than for Phelix and Helix. Aside from a block cipher that maintains a state that is updated between successively encrypted/decrypted blocks, I can't think of anything else.

So, what would a cipher dedicated to authenticated encryption look like to the cryptographic community at large?


texts:
For a "Murder Mystery Party", one person is chosen anonymously to be the murderer
(i.e., only the murderer knows who the murderer is) by shuffling cards with
everyone randomly taking a private card (one card has "You Are The Murderer!"
written on it).

How can I do this cryptographically over an open communication channel without
trusting any third party?

I'm hoping this simple problem has a simple solution that doesn't involve full
mental poker or
oblivious transfer methods.
Is there a trick that somehow combines inputs from everyone (which include the
randomness used for the selection so that everyone can trust that the process
was random) to publish something that only one "winner"
would recognize?


texts: Why is it not possible to tap into the HTTPS traffic specifically going from the server to the client?

texts:
How I think HTTPS works when sending data from server to client:

-Server has 1 public, 1 private key.

-Client has access to the server's public key and not it's private key.

-Client has no keys of its own.

-Server uses its public key to encrypt data and sends it to the client. Client then uses the same public key to decrypt the message.

Is this how it works when the server sends data to the client? How does a server encrypt the data it sends to its clients? Are there a set of public and private keys for both devices?

I understand how the data sent from the client to server would be secure. Client encrypts data with the public key which then can only be decrypted with the private key and nothing else. But from my understanding, the client has no private and public keys of its own, so how does HTTPS work again?


texts: ECDSA Signing and verifying signatures between Python and JS

texts:
I create a signature on js, here jsrsasign
Signatures are obtained in the format:

3045022045c61e649ca9f6011a8d34ac865c4780421de08ff50ac3dad0da36043b6de478022100b19208d1ec51f6dd6f6b725342618f55f9fc90c96c5b5409998d66774749a0b

Always start with 30 ...
In Python, I use the python-ecdsa library.
In this library, the signature format is

a8c7dd7e9b669b1bc841ddf66bc08b10bc1112fa14fce2a5a2246edf997c577450af6b9edfe373546e17ab7363c097ab468db04ed707fb65992e20eabfd1bf40

Therefore, verification does not occur.
How to bring signatures to one format?


texts: Is it ever OK to to sign RSA messages with padding random bytes?

texts: If a message is padded with cryptographically secure random bytes, is there any reason why this would be less secure than the standard signature padding schemes (PKCS1 v1.5 and PSS)? To give context to the meaning of the word "secure," I would note that my only intention is to prevent others from being able to forge the message signature.


texts:
I want to use hash function on some data, and part of this data, might be constant for a certain period. The output of the hash function is used as authentication data (MAC).

I want to know if there is:

Reason to use/not use this data as input to the hash? (In the context of authenticity of data…)
Impact on the "strength" of the hash function – can this constant help attacker to find out the source data of the hash function? (Help him do some smart brute force or something.)


texts: What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

texts:
I would like to seek confirmation/clarification of the following statements about IKE:

IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more correct) would be the following

IKEv1 aggressive mode, IKEv1 main mode and IKEv2 are pretty much the same if the attacker knows the PSK and is man-in-the-middle (i.e. he can decipher the entire flow)

this is always possible if the attacker is man-in-the-middle and can authenticate itself as real to both sides

IKEv1 aggressive mode sends the identifier of both sides in clear text, but

the identifier does not carry any real secrets, i.e. the strength of IPsec does not conceptually lie on keeping identifiers secret
an IKE identifier is like a TCP port number: it helps to select the right service/configuration, it has no influence on integrity of the authentication
IKEv1 aggressive mode always sends those IDs in clear text, independent of the fact that PSK or pubkey is used for authentication

IKEv1 aggressive mode, IKEv1 main mode and IKEv2 are equally good if the attacker is man-in-the-middle (but doesn’t know the PSK)

he can not successfully authenticate → he can’t decipher the flow
but he can see the identifiers
and he does see “the hash”, in which the only unknown component is the PSK

he can do an offline (dictionary) attack on the PSK now

only IKEv1 aggressive mode reveals “the hash” to passive attackers (i.e. eavesdroppers)

→ possible offline (dictionary) attacks


texts:
I have seen in various papers like in this one page 4, that the AES s-box equation is:

$S=A \circ φ^{-1}(φ(x)^{254})$ where $φ$ is the isomorphism from $\mathbb{F}_2^{8}$ to $\mathbb{F}_{2^{8}}$ with its basis and the reduction polynomial and $A$ is the affine transformation defined in AES.

I am kind of new to this area, but what I would say is that $φ(x)^{254}$ is the inverse of $φ(x)$ since their multiplication generates the $φ(x)^{255}$. The degree with the reduction polynomial is 255 right? (Since it's irreducible, but I am not sure if we should include zero as well)

So, what I would expect is:

$S=A \circ φ(x)^{254}$

How did the first equation come up?


texts: Implementation of Post-quantum Authenticated Key Exchange from Ideal Lattices

texts:
I am implementing the  Authenticated Key Exchange from Ideal Lattices on sage maths.

On page number 3 the full key exchange scheme is presented. In this key exchange scheme, they are using the Hash function $c=H_1(i,j,x_i)$ and $d=H_1(j,i,y_j,x_i)$ that will output the elements that are invertible in $R_q$, where $R_q=Z[x]/(x^n+1)$.

On page number 10, there is short note at the bottom of the page, that says to create such hash function one can   use  SHA-2 algorithm to obtain uniformly random string and then use it to sample from $D_{Z^n},\gamma$ and hash function will output the sample if it is invertible in $R_q$. I have created the following code to do this task:

def Hash1(message):
    from Crypto.Hash import SHA256
    import base62
    output=SHA256.new(message)
    print output
    c=generate_error2(len(str(output.hexdigest())))
    return c

def generate_error2(len):
    f = DiscreteGaussianDistributionPolynomialSampler(ZZ['x'], len, sigma2)()
    return Y(f)

sigma = sqrt(8/sqrt(2*pi))

R.<X> = PolynomialRing(GF(modulus),sparse=True)     # Gaussian field of integers
Y.<x> = R.quotient(X^(dimension) + 1)   # Cyclotomic field
c=Hash1(str(i)+str(j)+str(xi.list()[0]))

This code will generate the elements in $R_q$, but how do I check if elements are invertible in $R_q$ or not?


texts: How does encryption work in elliptic curve cryptography?

texts:
So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted.
So my questions are

How are messages encrypted and decrypted?
How are the public and private keys determined?

Thanks for the help


texts: For a one-time pad, which MAC method is information-theoretically secure?

texts:
In the the main post about MAC methods it mentions a few methods:

Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ciphertext.
Authenticate Then Encrypt: The sender computes a MAC of the plaintext, then encrypts both the plaintext and the MAC
Encrypt Then Authenticate: The sender encrypts the plaintext, then appends a MAC of the ciphertext.

I would like to know which of the last two methods (listed above) is better to provide integrity and authentication for a one-time pad message using HMAC. The method would need to be information-theoretically secure. I do not think it matters if the HMAC method wastes parts of the one-time pad to encrypt the MAC tag.

This paper which is linked in the post above Sadeq Dousti  mentions:

  On the positive side we show that the authenticate-then-encrypt method is secure if the encryption method in use is either CBC mode (with an underlying secure block cipher) or a stream cipher (that xor the data with a random or pseudorandom pad). Thus, while we show the generic security of SSL to be broken, the current practical implementations of the protocol that use the above modes of encryption are safe.

If HMAC was applied to a one-time pad message using the Authenticate then Encrypt method, would this be more secure than using Encrypt then Authenticate method?

My thoughts on this are that the Authenticate then Encrypt method is information-theoretically secure because the MAC tag is encrypted by the one-time pad as well. Are there any actual attacks against Authenticate then Encrypt when used with the one-time pad? The paper above claims it is still secure. Also when providing input into the HMAC function, the attacker is missing two key parts of the equation (the plaintext and the key) to be able to create a forgery. There could be any combination of message and any combination of key. It would be impossible for an attacker to determine the real message.

The general consensus in the post earlier seems to be that Encrypt then Authenticate is more secure method when using standard encryption methods. However this would leave the MAC tag unencrypted so it is not information-theoretically secure. The attacker is already provided with the ciphertext, so perhaps a computationally unbounded adversary could brute force key combinations using HMAC to find the pad/key which matches the MAC tag and available ciphertext, therefore eventually they would find a matching key and be able to decrypt the message.

Maybe one method to use the Encrypt then Authenticate method in an information-theoretically secure way would be to split the one-time pad into two parts. One part to encrypt the ciphertext message and the other to encrypt the MAC tag. First the message would be encrypted with the first part of the pad. Then the HMAC computed on the ciphertext using the full one-time pad as the key. Then the MAC tag would be encrypted with the second part of the pad and appended to/sent with the ciphertext. For verification it means you can verify the MAC faster by only decrypting the MAC tag first which is a simple xor operation. Maybe it provides just enough speed boost to fend off a Denial of Service attack?

Which is the better option to use? What alternatives are better for an information-theoretically secure MAC to be used with a one-time pad?
Is there any rule where the MAC tag output length should be related to the length of message or key which is input into the HMAC?

For example, if the message was 64 bytes in length, should the HMAC tag length be 1/4 of it (16 bytes/128 bit), 1/2 of it (32 bytes/256 bit), same length (64 bytes/512 bit) or something else? Given that the MAC tag will probably be encrypted with one-time pad anyway, is it possible to get away with a shorter tag length and still be information-theoretically secure?


texts:
I've read the following paper and have one question on it.

M. Luby and J. Staddon, "Combinatorial Bounds for Broadcast Encryption", EUROCRYPT'98.

On page 523 (12th page of the paper) the authors say

  …there are at most $2^{tm}$  petals in $\mathcal{F}$ which don't split any of the blocks, $L_i$.

However, I don't know how they can derive the number $2^{tm}$.  Probably I missed something very easy, but anyway I can't understand.  Anyone here can help me?


texts: Mathematical definition of deterministic and non-deterministic random bit generators

texts:
Can anyone give the mathematical definition of deterministic and non-deterministic random bit generator?

Providing a reference will also be very helpful.


texts: What is the benefit of applying the tweak a second time using XTS?

texts:
I tried to understand the inner working of XTS. What I understood is that it is applying  the tweak two times: once on the plaintext and once on the output.

What is the benefit of applying the tweak on the cipher text also?


texts: Encryption algorithm that produces dummy output on incorrect passwords

texts:
Background:
  I've been thinking about using encryption in the context of backing up files to untrusted locations (to the point of making the file publicly and widely distributed for practically failsafe backup).

  The problem is, once a file is publicly available, it will forever remain so. And in 20 years, when computing power is unpredictably faster, AES256 bit encryption might be practically useless - and my private backup file readable to all.

I was thinking, as a deterrent to brute force attacks on encryption, what if when the wrong password was tried the algorithm returned dummy data that would require human examination to assert that the data is not what the attacker is looking for.

Example:

I encrypt the plain text (say, an account number) '123456789' with the password 'pass'.

Attacker attempts to brute force the encryption and tries the password 'a'.

The result is '987654321'.

Now, how is the attacker to know that this is not the value I encrypted, and that the password I used was 'a'? Additionally, even if the attacker guesses the password 'pass', how are they to know that '123456789' is the correct value?

This of course is a simple example and most people encrypt somewhat recognizable artifacts; human language text, files recognizable by headers, etc. So this idea could be expanded to not just scramble data upon output, but also to include a variety of generated 'dummy' artifacts (common file formats, samples of language text, etc) not necessarily included in the core algorithm (the dummy data could be user defined). The dummy data output on incorrect passwords could then possibly include valid JPEG files, WORD files, PNG files, and samples of valid text from a variety of languages.

The result would make the encrypted file very hard to brute force without either a huge amount of computing and human power, or specific knowledge of what is encrypted.

Are there any algorithms out there that work like this? Are there any flaws in the idea itself?


texts:
I'm new to cryptography in general, and have this basic question.

Provided  H(x) means a hash of x
and z = H(H(x) + H(y))

given y or H(y), how do we prove that y or H(y) is a part of z? How do we "split" z into H(x) and H(y) so that we can compare H(y) to our y?

Help is greatly appreciated.


texts: Key Derivation Functions offering better than 2^hlen security?

texts:
On page 21 of his HKDF paper, Krawczyk criticized one of the stated desirable features of KDFs from the paper “On The Security of Key Derivation Functions” (Emphasis mine):

  Due to the way the hash function is used by these schemes, their
  strength (measured by the work factor it takes to guess the output
  of the KDF) is never more than $2^k$ where $k$ is the output length of
  the hash function, and this is the case even when the entropy of the
  source key material is (much) larger than $k$. Indeed, in these
  schemes it suffices to guess $Hash(SKM)$ to be able to compute all the
  derived key material. While we agree with this fact, we do not agree
  with the criticism. If a work factor of $2^k$ is considered feasible
  (say $2^{160}$) then one should simply use a stronger hash function.
  Counting on a $2^k$-secure hash function to provide more than $2^k$
  security, even on a high-entropy source, seems as unnecessary as
  unrealistic.

This seems like good advice in general: If you want a KDF with a strength larger than $2^k$, then make sure the output length length of your hash is greater than $k$. (You should also, of course, make sure the SKM is stronger than $2^k$)

However, in some highly constrained environments the use of a hash with a larger output length (Like SHA512) is computationally infeasible due to a lack of a hardware implementation, such is the case on many smart cards.

Is there any formally-defined KDF which allows for an output strength larger than $2^{hlen}$ (where $hlen$ is the hash output length), while only using a common hash function like SHA1 or SHA256?


texts: Should DES be avoided when developing new systems?

texts:
According to wikipedia…

  DES is now considered to be insecure for many applications

However, since it can be broken relatively easy, should it not just be avoided for all applications?


texts:
In Ring-LWE polynomials are chosen from the ring $R_q=\mathbb{Z}_q[x]/(x^n+1)$, where $n$ is a power of two.

As far as I understand, to create a ring the polynomial $x^n+1$ has to be irreducible (see the page 2, second paragraph, of this paper). But if we select $q=1\pmod{2n}$ (as done in many cases for efficient NTT multiplication), the field has $n$th roots of unity and the polynomial can be factored.

As an example let's take $q=17$ and $x^4+1$ can be factored in $(x+2)(x+8)(x+9)(x+15)$. Real implementations with $q=7681$ and $n=256$ can be factored similarly.

I can't understand where I am making a mistake. Thank you for your help.


texts: Difference between MAC(key, msg) and SHA(key || msg)

texts: I know that SHA(key || msg) is vulnerable to string concatenation attack. However, what if we specified key bit-length and msg bit-length? For example, key bit-length is 256 bit and msg bit-length is 256 bit. If msg or key bit-length is longer than 256 then we simply don't do anything. In this situation, will there be any differences between SHA(key || msg) and MAC(key, msg)??


texts: How to generate whitebox AES decryption algorithm and code, with existing WB-AES encryption code?

texts:
I can find several whitebox AES 128 implementations on Github, such as wbaes-1, wbaes-2, wbaes-3, etc. All of them are developed based on WB AES encryption. Ideally, most implementations include two parts:

(1). Table_Generator.c  (or .cpp, .h ...). Input: 16-byte key; Output: a big lookup table (e.g., table.h), where the key information is already hidden in this lookup table

(2). AES_Encrypt.c. Input: plain text & table generated from (1); Output: cipher text

But I need decryption implementation as well.

First, let me confirm one basic question:

Encryption table & decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption.

Then, the main questions:

What are the important steps to modify an WB encryption project into
a WB decryption project?
Is there any WB AES decryption implementation for me to read?


texts: How many perfect secrecy systems are there?

texts:
How many non-trivial*, interesting perfect secrecy systems are there other than the one-time-pad?  Does it seem that the one-time-pad and perfect secrecy are synonymous, but are there any other cryptosystems that have perfect secrecy aside from the trivial examples?

*Here the non-trivial means; the simple type that may be created by, say, picking a set of integers, and randomly corresponding each of those integers with a 0 or 1 (the key), then sending some permutation of the integers as cipher-text.


texts: Families of public/private keys in elliptic curve cryptography

texts:
I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could generate a series of public keys. From the master private key, you could generate the corresponding series of private keys.

Ideally, without the master public key, even given a number of public keys in the series, it would be impractical to determine any other public keys in the series or the master public key.

I've been told that it's possible, and have just the following description of how it would be implemented:

  S = Random number
  RootPrivateKey = Random number
  RootPublicKey = RootPrivateKey*point

  Master Private Key = RootPrivateKey, S
  Master Public Key = RootPublicKey, S

  PrivateKey(n) = RootPrivateKey + Hash(n|S)
  PublicKey(n) = RootPublicKey + Hash(n|S)*point

I understand the first five lines. But I am, unsure about the implementation details in the last two lines. Is the + supposed to be addition? If so, is it modular? In the public key, is + adding the two EC points? If anyone knows of any example code, ideally using OpenSSL, that would be the most helpful.

The typical use case for this kind of thing is creating deterministic wallets for crypto-currencies like Bitcoin.


texts: Other than brute force, are there any attacks on Threefish-512 using only a single known plaintext block?

texts: As per title, other than brute force, are there any attacks on Threefish-512 using only a single plaintext block? Are there any attacks like this in any other cipher?


texts: Elliptic Curve Cryptography Encryption and text representation implementation

texts:
I'm writing a coursework and right now I've implemented the ECDSA algorithm, but I also need to encrypt and decrypt small text files (.txt) using elliptic curve cryptography.

The problem is that I do not know how to represent the message in the file.


texts: Is it possible to calculate the private exponent when only the RSA public key (e;N) = (9292162750094637473537; 13029506445953503759481) is given?


texts: why is FPGA suited for Cryptography applications?

texts:
FPGA is suited for acceleration of algorithms that can be pipelined, or for network acceleration (in-line processing).

Why is FPGA suited for cryptography / security applications? For example AES, SHA... what features of those workloads makes then adequate for FPGA?


texts:
There exist certain attacks that can be used against RSA keys whose prime factors are of specific forms, such as one by Coppersmith.

How common are these RSA keys?  If you generate primes randomly, is there a realistic risk of choosing a weak prime number?  Does this risk, if realistic, vanish if you always choose $p$ and $q$ to be safe primes?


texts: I am new to cryptography, i know essential part of asymmetric cryptography but is it possible to decrypt 617 decimal digits (2,048 bits) with RSA ? How it can be factored?


texts:
Suppose I have a service in which I allow users to share their WiFi connection. When sharing their connection, users provide their WPA PSK password to my service.

Now if somebody wants to use this shared WiFi connection, is it possible for the service to get the user connected without him actually coming to know of the password?

Further, is it possible that I can get the user connected to the shared hotspot with my service knowing only an encrypted form of the actual password?


texts: Advantages and possible usages of encryption schemes with probabilistic decryption

texts:
We can define deterministic and probabilistic encryption;

Deterministic $c = E(k,m)$, and

Examples are textbook RSA, block ciphers in ECB mode.
Deterministic encryption fails to achieve CPA security.
Deterministic encryption is insecure and we don't want to use/advise to use ( there are bad exceptions for this like SIV mode doesn't have CPA security if you keep the nonce fixed don't ever do that ((see note 3)), however, AES-GCM-SIV is a non-misuse resistant scheme that prevents the IV-reuse problem of the AES-GCM )

Probabilistic $c \stackrel{R}{\leftarrow} E(k,m)$

Public schemes like Elgamal, RSA-OAEP, Pailler, and private schemes like CBC, CTR, CGM, SIV, etc.

In the case of deterministic, there is one ciphertext that decrypts to the message and in the case of probabilistic, there are many to be expected.
From the correctness requirement, we want

for deterministic case $m = D(k,E(k,m))$
for probabilistic case $c \stackrel{R}{\leftarrow} E(k,m)$, $m' = D(k,c)$ with probability 1.

The probabilistic encryption is preferable since it can provide semantic security or its equivalent and easy to use version is the indistinguishability.
Now, what if set the definition for probabilistic decryption to more than :$$\Pr[D(k,E(k,(m))=m] = 1 - negl(k)$$
instead, making it:
$$\Pr[D(k,E(k,(m))=m] = p$$
An example of this is the Rabin cryptosystem (see note 2) where $p = 1/4$ since we end up with four possible $m$. It is suggested to add some auxiliary data to plaintext to resolve. Note that Rabin cryptosystem is not randomized encryption where an IV/nonce is usually needed to achieve that. The decryption still produces randomized decryption.

Are there any other examples of randomized decryption schemes other than the half randomized Rabin Cryptosystem?

Is there any advantage or usage of randomized decryption schemes?

Notes:

This is asked as a fundamental question for clarification of the probabilistic decryption which is simply discarded in the textbooks.

Actually, Rabin has not defined an encryption scheme on their seminal paper. They defined the first secure signature scheme and hashing is a part of it. The Wikipedia article is misleading about this.

One should never use the AES-GCM-SIV with fixes nonces, one should use unique/random nonces and AES-GCM-SIV and it doesn't fail like AES-GCM if the nonce repeats under the same key.


texts: Advantages/disadvantages of using symmetric encryption function as hash function?

texts:
Next to the traditional MD5 and SHA-1, other hashing algorithms exist based on symmetric encryption algorithms. An example is the Matyas–Meyer–Oseas construction.

What are the advantages/disadvantages of this approach instead of using traditional hash functions, such as MD5 and SHA-1?


texts: Converting a pre-image resistant hash to second pre-image resistant

texts: I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?


texts:
i have generated an ed2215 private key as follows:

$ ssh-keygen -o -a 100 -t ed25519 -f id_ed25519

and it looks like

-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----

where ... is truncated data.

although it feels like base64, i see that each truncated line has at most 64 characters, where regular base64 encoding does not hold that charactristics.

what is the format (or encoding) of the private key? (if i have the private key in byte array, which transformation do i need to apply before i write it to a file that coincide with openssh output)


texts: How to choose the appropriate public (i, m) and private (j, m) keys?

texts:
I studied some encryption and decryption and I have found some very interesting problem to solve on the internet. I hope I am writing to right site - there are so many in StackExchange otherwise I hope some moderator will move it.

So, how to choose the appropriate public lets say (i, m) and private (j, m) keys which could be subsequently used to (de)encrypt in RSA when there are primes lets say p = 17 and q = 5?

I tried something like:

17*5=85

(17-1)*(5-1)=64

64 should be magic number but still do not know what to do next, can anyone help me here?
 I would really appreciate how to choose and in which way these keys ...


texts: Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?

texts:
In one of the exercises in [KL] Book I need to tell whether an encryption scheme is secure under an eavesdropper of only one message.

Given a PRG $G: \{0,1\}^n \rightarrow \{0,1\}^{n+1}$. The encryption scheme encrypt $m \in \{0,1\}^{2n+2}$ by $c= <G(k) \oplus m_1, G(k+1) \oplus m_2>$

where $m_1$ and $m_2$ are the first and second halves of $m$.

Clearly, this is not CPA-secure. But if I could say that there exist PRGs such that for each even $k$: $G(k)=G(k+1)$ I would say that it's even not secure against an eavesdropper of only one message since the adversary can check if $m_1 \oplus m_2= c_1 \oplus c_2$ which will be true whenever $k$ is even which happens with probability of $1/2$.

So: how can I prove that such PRG exists?


texts:
I'm going to give a small talk on the mathematical background of RSA. My audience will consist mostly of software engineers and to make the mathematical stuff tangible, I wanted to demonstrate how to calculate the private key from the public key and the modulus in some reasonably realistic scenario.

What I was planning to do is to set up a simple server (Spring Boot inside Docker) which has one POST-endpoint and this endpoint should only be accessible via https.

Then I wanted to use tcpdump to capture the communication between some client and this server. Since I want to be able to decrypt this communication, I want the key exchange between client and server to be performed over RSA with the modulus so small that it can be easily factorized.

However, I fail in creating a (self signed) server certificate with decryptable RSA because the tools I know all require the primes to have some minimum size.

Does anyone know some good way to create such a certificate? Or, maybe, has someone already set up a similar scenario?


texts: Generally in RSA we encrypt as $m^e \pmod n$. Will RSA work if we replace the power by normal multiplication? $E = (m \times e) \mod n$  and decryption as $c \times d \mod n$. What will be $d$ disadvantage if it works ?


texts: Security analysis of a "one-time pad" type hill cipher

texts:
Suppose the Hill cipher were modified to something like a one-time pad cipher, where Alice wants to send a message to Bob, and she chooses a key matrix randomly everytime a new message is sent (and the inverse of the key matrix is sent to Bob by other means everytime - just as in the one-time pad). Would this yield perfect secrecy or at least $\mathsf{IND-CCA}$?

Any thoughts on how to proceed with the security analysis of this?


texts: Question about the Proof of "Pseudorandom generators imply one-way functions" in "Foundations of Cryptography"

texts:
In "Foundations of Cryptography, Volume 1" by Oded Goldreich, chapter 3.3.6 states the following theorem:

  Let $G$ be a pseudorandom generator with expansion factor $l(n) = 2n$. Then the function $f\colon \{0,1\}^* \to \{0,1\}^*$ defined by letting $f(x,y) \stackrel{\text{def}}= G(x)$, for every $|x| = |y|$ is a strongly one-way function.

The theorem is proved by reduction, with given an inverter $A$ construct the following distinguisher $D$:
$$D(\alpha) = 1 \quad\text{iff}\quad f(A(\alpha)) = \alpha$$
 (where $D$ distinguishes between $U_{2n}$ and $G(U_n)$). There is one part of the proof I do not understand:

  [...] by $f$'s construction, at most $2^n$ different $2n$-bit-long strings (i.e., those in the support of $G(U_n)$) have pre-images under $f$. Hence $\Pr[D(U_{2n}) = 1] = \Pr[f(A(U_{2n})) = U_{2n}] \leq 2^{-n}$.

Why don't all $2^{2n}$ possible $2n$-bit-long strings have preimages under $f$?


texts: Encryption scheme like RSA where encryption is the inverse of decryption

texts:
In RSA, it is basically equivalent to use the private key $d$ to encrypt as it is to use the public key $e$ to encrypt. They are exactly inverses: $e=d^{-1}$.

I need to know, are there other public key schemes like this? E.g., I do not think Diffie-Hellman is like this.


texts: How does FileVault2 Recovery actually work?

texts:
I'm a crypto-enthusiast but no expert at all, that'll explain why i didn't understand. Also please consider english isn't my native language :)

I am about to enable FileVault2 FDE on the new macbook of my users.
I checked how it worked and my conclusions are :

user pw --> PBKDF2 --> DEK --> unwrap KEK --> unwrap VEK --> Unlock Boot Volume
OR for corporations : X.509 digital identity --> DEK --> unwrap KEK --> unwrap VEK --> Unlock Boot Volume

Then user password is forwarded so that he has access to his Desktop.
OR for corporations : I guess user types his password at the standard login.

I then saw there are 2 ways of recovering from a lost password (1st way personal and 2nd way for corporations, again) :
The PRK (Personnal Recovery Key) and the IRK (Institutional Recovery Key).

On one hand, I saw that PRK is wrapped by another DEK, derived from the concatenation of the answers hash to 3 different secret questions.
On the other hand, IRK seems to consist in a copy of the private key used to unwrap the original KEK wrapped by the X.509 public key.
Actually, both the X.509 certificate (that also contains the public key) and the private keys are stored in FileVaultMaster.keychain. The private key is also wrapped by another DEK derived from a Master Password. So to access the private key, one must know the Master Password that unlocks the locked part of FileVaultMaster.keychain.

I learned all this theory from WP_Filevault2.pdf, the Apple Technical White Paper.

In another website (https://derflounder.wordpress.com/2014/08/13/filevault-2-institutional-recovery-keys-creation-deployment-and-use/) I learned that in a deployment like what I'm about to do, keeping the private key somewhere else (from the keychain) is a requirement.
What I understand is that the IRK is actually THE one and only private key isn't it ???? Since it's not anymore in the keychain... How can it be called "recovery" then ?

The other part I don't understand is the relation between DEK, KEK and VEK and how it can impact PRK in a personnal use of FileVault2.
For example PRK : Since FED crypto algorythms are mostly symmetric, the algorythms that create a key (which in turn locks a drive) are non-reversible.
As a consequence, I assume the PRK can only be the original KEK (or the VEK) since it is not possible (not that I'm aware of) to have 2 different keys unlocking a drive (or this would be called a collision and is a problem for cryptographers)
However, I learned that the PRK is generated randomly... So I assume it's never identical to the original KEK is it ???

And again, speaking about symmetry and non-reversibility, I red about the KEK that "This intermediate key allows for indirection to support the requirements mentioned earlier in the design approach. This indirection allows derived encryption keys (DEK) to be changed independently of each other and the VEK. It also allows the VEK to be changed independently of the DEKs.

How is this even possible ???

It's really frustrating not to beeing able to get the whole idea.
So thanks a lot to help me go through the full understanding of this. It'd be really appreciated.

Cheers


texts: Where in the FIPS documents is it stated that SHA-1 is not secure?

texts:
SHA-1 has not been secure for a very long time, but I still can see
it here.
Where in the FIPS documents did it state that SHA-1 is not secure?


texts: Proper way of doing encryption and authentication (PBKDF2 + AES)

texts:
I'm currently in the planning phase of an authentication and storage-ish service.

The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on the server.

In order to authenticate and download the file, and decrypt it, the user will need:

A username
A password

The server must never have access to the password, since it will also be used to decrypt "ENCFILE" stored on the server, yet, the user must still be able to authenticate to the server somehow.

In order to decrypt the file, the client will need an IV, the AES256 key, and some HMAC-bits. So, that should be doable with a regular PBKDF2 SHA512 I guess.. (256 bits for AES, 96 bits for IV and 160 for SHA1 HMAC). Username for salt should be good? Then all things can be generated client-side.

Suggested solution for authentication to the server? SRP? But without risking the server to know/lower the security of the key for AES, so.. how to generate the shared secret? PBKDF2 in some other way/salt?


texts: Padding schemes for asymmetric encryption with provable security in the standard model

texts: Most padding schemes for asymmetric encryption (OAEP, OAEP+) are only proven secure in the random oracle model.  Although no attacks are known, it would be nice to find a padding scheme with provable security in the standard model.  Are such padding schemes known?


texts: Are ciphertext-only attacks on LFSRs possible?

texts:
Reading about LFSR, I know that breaking an LFSR by knowing it's design and having enough (plaintext, ciphertext) pairs is an relatively easy task but let's assume we know the design of LFSR and a just a long ciphertext, which is the result of xoring plaintext and LFSR output. Is there any way to decrypt the ciphertext?

For example suppose we have an LFSR with primitive characteristic polynomial $x^{51}+x^{9}+1$ and a 5600 bit ciphertext, is there any way to obtain plaintext which we already know is an English plaintext?

One brute-force approach is to try all $2^{51}$ possible seed values, xoring ciphertext with LFSR output and check if resulting plaintext has normal english letter entropy, but this approach gets harder and harder having a larger LFSR degree.


texts: Generating a recovery phrase for a RSA key-pair

texts: What is an optimal way to associate a RSA key-pair with a recovery phrase/seed for access recovery purposes? I've seen a lot of cryptocurrency wallets provide this feature, however, I'm not looking to create a blockchain or anything. Just a wallet/key-pair with a recovery seed.


texts:
I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, this would prevent decrypting of the password without the password... right?

I've read articles and other SO questions/answers on hashing passwords, but was wondering if this would actually work.


texts:
AES is secure, but compared to other encryption algorithm which are marked as secure, it's slow. For example, ChaCha20 is faster than AES, but still secure.

Also other standard-algorithms like SHA were upgraded in the last few years, so can we expect a AES upgrade in the near future?


texts:
I have the following data where all the inputs are Big Integers,

group size $p$,
group generator $g$
public key of the receiver $y$
$c_1$ and $c_2$
Random Number as well

I am trying to execute an EL Gamal Attack (On a Weak Number Generator) without knowing the secret key $x$.

$$y = g^x \bmod p\quad  \text{where } x \text{ is the secret key.}$$

As we know $y,g$ and $p$. I am trying to compute $x$.I tried as follows $m$ as,

$$m = c_2 \times (c_1^x )^{-1}$$

By converting $m$ as ByteArray, I am not getting the desired output!

What I am missing out? What's the advantage of having this random number as input?

Actually,I tried finding x by taking log on both sides,

  log y = x log g mod p

Each y, g, and P are of 1024 bits. Java is not supporting this BigInteger computation. How can I solve this equation involving such a big number?

Or is there any other shortcut available to compute the secret key, if the public key and g are given? Also, how can I take advantage of the given random number?


texts: What is the MD5 collision with the smallest input values?

texts:
I am interested in MD5 collisions for small input messages.

The collision examples given at http://www.mscs.dal.ca/~selinger/md5collision/ show two different strings, where only a tiny amount of data has been changed to give the same md5, but it feels more like just changing values that are not factored into the calculation. I've yet to come across an example where two seemingly random things reach the same value. I did try a small script to find out, but obviously it didn't get anywhere near far enough.

One formalisation of my question would be:

What is the minimal $b\in\mathbb N$  such that there exists $a\in[0,b)$ with $\mathbf{MD5}(a)=\mathbf{MD5}(b)$


texts: How can I verifiably announce a choice without revealing its content?

texts:
Here is the simplified problem:

Alice chooses from a small set of possible values.
Bob guesses which value Alice picked.
Alice reveals what value she picked.

Alice's choice must stay secret initially, until after Bob has made his guess.
However, to make sure Alice does not cheat, her choice must be verifiable once it is revealed.

My idea would be to publish a salted hash of the choice at first and publish the salt along with the choice. As far as I understand, there are two possible attacks on this:

Bob could try to find the secret choice using the hash: the salt should make up for the small set of valid choices, so this should be equal to a normal a preimage attack.
Alice could pick two values and search for two salts so that each pair will generate the same hash. Due to the small number of choices, this should be similar to a birthday attack.

From what I can tell, both attacks do not yet pose a realistic risk to e.g. SHA 512. Would this be a valid approach? Did I miss anything? Is there a better solution?


texts: Are there AES-128 keys such that first round key equals last round key?

texts:
I am looking for AES-128 keys such that the last round key is exactly the first round key (which is simply the key). Any pointer to a proof that they exist or that they don't would be welcome.
In the same line, I am looking for last round keys which are the bitwise inverse of the key or some similarly simple relation with the key.


texts: Ciphertext-only attack on Simplified DES

texts: Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit confused.


texts: Which is the most secure steganography technique?

texts:
Just like we have AES in crypotography, which is the most secure technique in Steganography?
I am looking for a technique in which the standard image characteristic modifications it does go undetected(as yet).
This question is regarding image steganography and I want to store few bytes of information.


texts:
It may seem that this is a programming question, but I just need advice on the cryptography side of the question. I want to implement the Diffie-Hellman key exchange algorithm on iOS (since no free library with easy integration exists). I'm wondering how the implementation would be if the parameters would be – for example – 128 bytes of data, instead of integers.

I'm looking for instructions so that I find out how I should implement it because performing such operations on non-integers is quite ambiguous to me.

Sorry if it's a newbie question, but I'm new to this concept.

Any suggestions is really appreciated.


texts: MD5 - What happens if message is exactly 64bit block size message?

texts:
Based on RFC 1321 after we recive a message if message size is less than 64 Byte we will append it with a 0x80 and message length + zeroes until it's 64 bit and then generate the digest.

The question is what will happen to exact 64 Byte? based on specification:

  Padding is always performed, even if the length of the message is
     already congruent to 448, modulo 512.

But how is that possible?
You can't append length and other things to it? if it's for example 128 byte
then I think 64 byte message digest would be same as 128 bit digest?


texts: Is it safe to encrypt random data using ECB mode?

texts:
If I have 48 random bytes, is it safe to encrypt them using ECB mode? Or is there still a good reason to use another mode like CTR, CBC, etc.?

Context is this: I am creating something like a TLS session ticket where the master secret is encrypted using a server side key and sent down to the client.

I will still use HMAC. Basically, I use ECB of these 48 bytes followed by HMAC-SHA256 of the ciphertext. I have nothing against CBC, CTR, etc. But a colleague mentioned that for completely random values you can use plain ECB too and I fail to see how he's wrong.


texts:
How to derive a 4096 bit or 8192 bit RSA private key from a (BIP39) mnemonic seed?

Any tool available for this?


texts: Are there post-quantum cryptosystems with a gap between classical and quantum security?

texts:
Is there a gap between classical attacks and quantum attacks against some post-quantum security assumptions? (I'm particularly interested in asymmetric cryptography.)

I understand that there is no polynomial-time algorithm against these problems (otherwise it will no longer be considered as a PQ security assumption). But is it sometimes the case that we know more efficient quantum attacks than classical attacks (even if it's still exponential)?


texts:
Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity?

My reasoning is that the attacker doesn't know all the plaintext, so by having a hash, the attacker will be able to change the message, but will be unable to recalculate the hash.

Are there any flaws in my reasoning, besides the case where the attack knows the whole plaintext?

To be clear, this is $\text{E}(\text{data})|\text{H}(data)$, it is not $\text{E}(\text{data}|\text{H}(data))$


texts: Estimating the Security of SIS-Based Signature, by verifiying a subset of coordinates?

texts:
As I understood, the GPV signature scheme works as follows:
KeyGen($1^n$) : Generate a Lattice with public $A \in Z_q^{n.m}$ and a secret trapdoor $t$.
Sign $m$: compute $\vec y = H(m) \in Z_q^n$ and output short vector $\vec u \in Z_q^m$ such that $A.\vec u = \vec y$ using the trap $t$. The signature is then $\sigma = (\vec u)$.
Verify $(\sigma, m)$ : Compute $\vec y = H(m)$ and verify that $A.\vec u = \vec y$ and that $\vec u$ is "short".

This scheme was proven existentially unforgeable in the GPV Article (page 24-25) based on the collision resistance of the hash function $H$ with a certain probability $2^{-\omega (\log n)}$.

I was thinking of an example, that instead of verifying that $(A.\vec u) [1\dots n] = H(m) [1\dots n]$, we will verify that $(A.\vec u) [1\dots l] = H(m) [1\dots l]$, ($l = n/2$ for example). This means that in order for an adversary to forge a new signature, he only needs to output a vector $\vec u'$ that verifies the equality for the first $l$ coordinates of $H(m)$, instead of all of its $n$ coordinates$.

Will this verification be also existentially unforgeable with a certain probability less than that of the full verification, with a function of $l$, or will it be much simpler for an adversary to output a vector $\vec u$ that verifies the desired verification?


texts: Acceptable condition for dictionary search

texts: I am trying to write a program to break transposition cipher using dictionary search. But I cannot understand the finishing condition of the search. Is there any theory that the maximum number of valid word can only be generated by decripting the cipher text using the valid key only? If not what can be a good finishing condition?


texts:
I asked a question about using 16 different Sboxes in AES each for one state byte instead of using same One Sbox for substituting 16 state bytes (See the Question Increase in AES SBox). The answers i got are like given below

  at least one disadvantage of using 16 S-box to change the 16 bytes. The size of the code and the look up tables (should you use such implementation) would increase the size of the code. This increases the surface of exposure for cache timing attacks.

Now i wonder, why Cameillia designers used 4 Sboxes with almost similar properties? What is the main advantage of using more than one? Even Twofish uses 4 key dependent Sboxes.


texts: RSA smaller number work-out-by-hand not working - I think I made a mistake

texts:
I tried out the paper/pencil explanation @ http://sergematovic.tripod.com/rsa1.html, and it seemed to make sense just fine until I came to decryption. Here is what I worked out:

Key Creation:

Choose two different prime numbers p and k:

p = 23
k = 29

Find n by calculating p * q:

n = 23 * 29
n = 667

Find z by calculating (p - 1) * (q - 1):

z = (23 - 1) * (29 - 1)
z = 22 * 28
z = 616

Pick a number k that is coprime to z:

616 % 2 != 0
616 % 3  = 0
k = 3

The public key consists of n and k:

Public Key:
n = 667
k = 3

Find a number j where (k * j) % z = 1:

(3 * 411) % 616 = 1
j = 411

(The work for this one is a bit long, so work: http://sprunge.us/HeXg, code: http://sprunge.us/YDFF?c, command: ./tiny-RSA-j-finder 3 616)

j is the secret key:

Private Key:
j = 411

Encryption:

Public key from earlier:

Public Key:
n = 667
k = 3

Choose a number p to encrypt (with the obvious requirement that it be smaller than the modulus n):

p = 13

Find the encrypted result E by calculating E = (p ^ k) % n:

(13 ^ 7) % 667 = 492
E = 492

(Again, work is long, so work: http://sprunge.us/DBFF, code: http://sprunge.us/TRdC?c, command: ./tiny-RSA-modexp 13 7 667)

Decryption:

Public Key:

Public Key:
n = 667
k = 3

Private Key:

Private Key:
j = 411

Encrypted Result:

Encrypted Integer:
E = 492

Recover the integer p by calculating p = (E ^ j) % n

(492 ^ 411) % 667 = 144
p = 144

(Same modexp algorithm, same code, work: http://sprunge.us/NiAi, command: ./tiny-RSA-modexp 492 411 667)

?:

Now here is the issue: I input 13 as p and recovered 144 instead. At first I thought I had messed up the modexp part, but I got the same results when using the University of Minnesota modexp calc @ http://www.math.umn.edu/~garrett/crypto/a01/FastPow.html.

So did I mess up somewhere, were the original instructions wrong, and/or something else?

And more importantly, if I messed up, where did I mess up and which instruction(s) is/are wrong if the instructions were wrong?

Any help is appreciated.

PS: Yes I understand that the keysize is waaaaaaay to small to be secure IRL, however I just wanted to learn how the algorithm works.


texts: RSA - Compare two values for encryption exponent, both are relatively prime and $e < λ(n)$

texts:
So we have $q = 311$, $p = 163$, $e = 101$, I found $d = 39281$ using Euclidean Algorithm and checked by encrypting and decrypting a message.

Next it is asking if $e = 101$ was a good choice or would the value $e = 9131$ be better.

What I know:

$101$ = prime
$39281$ = not prime ( $23 x\times 397$)

Both options for $e$ are relatively prime to $(p - 1) \cdot (q - 1)$ and both options for $e$ satisfy $ < λ(n)$.

Are there any other things I need to consider for $e$ to answer the question? I have looked around the forum and web but I'm stuck right now.

Hints preferred not a full answer!


texts: How to break an unknown ciphertext - transposition of some kind

texts:
I've been challenged to crack a code. All I know about it is that is was hand-enciphered, and that it is a transposition cipher of some kind. When I was given it, I started plugging it into my permutation decryption engine. As you can guess, when I realised that the ciphertext was 26 letters long, meaning permutations numbering $26!$ I stopped the program and scratched my head. What would the most efficient way to crack this be?

Unable to find an answer, I turned to Crypto.SE. Can anybody explain an efficient way to crack the cipher?


texts: Can nesting different ciphers with different keys ever decrease security?

texts:
Very related to this question but not addressed there.

Does the following construction risk introducing any vulnerabilities that render it less secure than using either of its individual components in isolation?:

EncryptAB(K1||K2, PT) = EncryptA(K1, EncryptB(K2, PT))

EncryptA and EncryptB may be different algorithms. K1 and K2 my be of different lengths. The result need not be more secure than the better of it's components, just not less secure.

A related question is: are there any potential problems with interleaving the rounds of two or more independent algorithms?

(BTW: I'm not planning on doing either, it's more a matter of curiosity.)

Edit: I'm only thinking of the bare block cipher primitives rather then chaining modes and such.


texts: How does compression before encryption leak info about the input?

texts:
Apparently current best practices recommend that you do not compress before you encrypt.

For example in this blog entry (*):

http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/

It is written:

  Developers shouldn’t compress plaintext before encrypting.

Or in this question here on crypto.se:

Is compressing data prior to encryption necessary to reduce plaintext redundancy?

several people answer that compressing before encryption is actually harmful.

What I really don't understand is that apparently the explanation is that the compression algorithms used leak information about the size of the plaintext input!?

But in which way does not using compression before encryption not leak info about the length of the input too?

What additional infos are leaked by compression algorithms that wouldn't be leaked by not doing compression?

If padding is used on plaintext encrypted without compression, couldn't paddding be used too before encrypting compressed data (or data to be compressed)?

Also: is it really a given that the attacks you make possible by using compression before encryption are more of a problem than the attacks made possible by not compressing before encrypting? (the latter being the reason for which, during more than two decades, it was always advised to compress before encryption).


texts:
I am confused about the content of ClientKeyExchange in case if the key-exchange is static DH. The TLS 1.2 standard says under section 7.4.7 in https://tools.ietf.org/html/rfc5246#page-57:

  If the client is sending a certificate containing a static
        DH exponent (i.e., it is doing fixed_dh client authentication),
        then this message MUST be sent but MUST be empty.

Is it always the case that static DH means that the client will send the static DH in a client Certificate? What is the client does not have a certificate?


texts: Single public key for NaCL signing and encryption?

texts:
Bob wants to use NaCL (specifically the Python NaCL library) to both a) sign some publically available plaintext for anybody to authenticate as being written by Bob and b) encrypt some other secret plaintext for Alice.

NaCL encourages signing and encryption with different keypairs. Bob would like any recipient to be able to prove that the same person controls the NaCL signing key and the NaCL encryption key used in the two above cases. What is a safe way to do this?

Is there some safe way to sign the private key used for encryption with the signing keys?
If Bob computes a derived keys from some master key can he give out the master public key, and then have people verify that the signing public key and the encryption public key are derived from it?
If (2) what is a safe way to derive keys from some master key?
If (2) how can somebody verify the signing and encryption public keys are derived from the master public key?

Ideally Bob would be able to give out a single NaCL public key and then anybody receiving a signed or encrypted plaintext would be able to verify that the corresponding private key was used.

I've read the relevant documentation on djb's site and this post and the Python NaCL library documentation. In the latter all of the examples use completely unrelated keys for the two different functions.


texts: What's the appeal of using ChaCha20 instead of AES?

texts:
I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general.

What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions on various architectures to make it so efficent?


texts: How does linear vs. non-linear operations relate to cryptographic security and differential cryptanalysis?

texts: I understand what a linear operation is and what a non-linear operation is, but I would like an explanation of specifically how a non-linear operation on input data mitigates differential crytanalysis attacks. Please note that I am asking this question in the context of developing a cipher rather than simply understanding generically linear vs. differential cryptanalysis.


texts: Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

texts:
I am still not very clear on how AES-256-CBC can use SHA-512 bit keys, but I assume that it just truncates the 512bit hash down to 256bit.
In software like GnuPG and OpenPGP, is there any real benefit using a SHA-512 key over a SHA-256 key with the AES-256-CBC block cipher?


texts:
I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0's to fill it if needed.

If the message is intercepted, why can an attacker easily create another message with the same MAC tag for the same key as the message that was intercepted?

If another message is intercepted that does not contain any padding (so it completely fills the last block), how does this make it more difficult for the attacker to create a tag that matches? Does the message need to meet any conditions for the attack to work?

If this padding method is not secure, what is a better method to secure against these attacks? Would it be more secure if the padding was just random? Not sure how that would work.


texts: Composing two one-way functions such that the result is not a one-way function

texts: Is it possible to have two distinct one-way functions (called, say, $h$ and $g$) such that their composition $h \circ g = [\, x \mapsto h(g(x)) \,]$ is not one-way?


texts: Is it possible to ensure security with zero pre-shared information?

texts:
Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information?

I know that this isn't possible using "traditional" asymmetric crypto, since an active attacker could create its own public keys and relay the information on both sides. A trusted third party implies pre-shared information, since at least one party must provide their public key to the third party.

Are there any schemes that make this viable, or is it completely impossible?

Update: By "zero information", I mean other than the "address" of the other person, e.g. their computer's IP address, or even their mailing address.


texts: What are the standard procedures in cryptanalysis to analyze unknown ciphertext?

texts:
What are the "standard procedures in cryptanalysis" to analyze unknown ciphertext?

In other words: Are there any protocols, officially acknowledged checklists or something like that which represent a "standard" approach in cryptanalysis to analyze unidentified ciphertext? If yes, which ones would that be and what would be the path to follow?

Clarification

I am well aware of cryptanalytic procedures like detecting algorythms etc. My question was: is there any “officially acknowledged protocol” in cryptography to follow when doing cryptanalysis?

To get one point very clear before anyone goes down the wrong road: this has nothing to do with "only a bad guy would ask something like this…." since the situation is actually the other way around. That's why I asked for "officially acknowledged protocols" as in "legally accepted by authorities as evidence and/or proof". Think "whitepaper", not "reverse engineering".

The goal is the "capturing and identification of digital evidence coming from communication streams" to then forward that information to authorities in a way they will accept it. I know how to gain the rough information I want to pass on (like the identification of the crypto-algorithm used), but I want to follow the correct path/order/procedures which authorities accept as "correctly collected digital evidence".

There has to be some protocol that governments, (security) companies, and institutions follow. When it comes to "evidence", there's always a "specific way to do it". Question is: which one would that be when it comes to analyzing unknown ciphertext?

So, to wrap it up: I'm not asking how to analyze unidentified ciphertext, I'm asking what protocol to follow when doing so because I need to pass on the collected evidence later on!

I think my comment-reply to @mikeazo wraps up my question rather perfectly:

  Collected evidence was captured in internal company network. We secured full access logs and identified source and target of transmission. Currently, source denies it's anything else but random text. Doing a quick analysis of copies of the captured data shows different encryption algorithms. As proof it's not random text I would like to add my findings to the other evidence collected. Do do so, I want to be sure they accept the way I identify the algorithms etc. That's why I would like to know if there's an "official protocol" to follow that's "officially accepted" (by authorities).

Addendum to the accepted answer

After getting a tip via twitter, it turns out that there are several pointers in publications from the National Institute of Justice (NIJ):

Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition
(April 2008, NCJ 219941)
Forensic Examination of Digital Evidence: A Guide for Law Enforcement
(April 2004, NCJ 199408)
Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors
(January 2007, NCJ 211314)

Those provide some hints, but even those don't really handle the details of standard procedures to follow in cryptanalysis. Like the accepted answer already implied, cryptanalysis obviously isn't enjoying any standard protocols (yet).


texts:
I understand the way $\textrm{PBKDF2}$ can be used to 'stretch' a password/passphrase that does not provide full entropy.

My question: how does one choose the PRF? A common choice is any well-known cryptographic hash like $\textrm{SHA256}$, and I understand why that works. Some systems, however, use $\textrm{HMAC}_{\textrm{SHA256}}$, where the password is used to key the MAC.

Why would one use $\textrm{HMAC}_{\textrm{SHA256}}$ over $\textrm{SHA256}$ as the PRF? I don't see any advantage to this. Surely the weaknesses of Merkle-Dåmgard hashes adressed by $\textrm{HMAC}$ are irrelevant when the password is a secret used to derive another secret?


texts: How do RSA and ElGamal key sizes compare?

texts: I have a rather silly question regarding the comparison of RSA with ElGamal over integers. If you want to compare their performance in the same level of security, does the modulus of both of them need to be the same size, or does RSA have to be double the size of ElGamal?


texts: How can we prove that the scrambled G matrix in McEliece cryptosystem preserves the minimum distance properties of G matrix?

texts:
In McEliece cryptosystem, G matrix is scrambled using S and P so that scrambled G matrix is G' = SGP. Here G is the generator matrix of a linear code and after scrambling it is converted into another matrix G' of the same size. How can we ensure that G' is another possible G matrix of the code with same distance properties? Is there any proof for that? If G' satisfies all the properties of G, will this hold any linear code other than Goppa code also?

edit

Encryption

c = mSGP + e

Here mS will give you another k element vector which forms the message for the permuted version of the G matrix, GP.
Now my question is whether the permuted G matrix results in another valid G matrix.
Are there any properties to be satisfied by P matrix?


texts:
In the section 2 (page 42) of the book "Post Quantum Cryptography", it says:

  Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key $X_s$, $s\in\{0,\dots,2^H-1\}$.

My question: Is $s$ chosen in random form? Is it possible to have $s$ collisions to the signature process?


texts: Combining multiple cryptographic keys to generate an encryption key

texts:
We have a system that has several SecretKeys (for example, one for a user, and one for us). We want to encrypt data in a way that requires all of those keys to be available in order to decrypt.

I think that the correct way to do this is to use a key derivation function of some sort to merge the source SecretKeys together, and use the result a the encryption key.

Given that all of the source keys are cryptographically generated SecretKeys using the following (apologies in advance if this isn't the right :

KeyGenerator generator = KeyGenerator.getInstance("AES");
generator.init(256);
return generator.generateKey();

is it safe to just use a cryptographic hash of the source keys, or is that potentially introducing a vulnerability somehow? Like this:

SecretKey secretKey1 = ...
SecretKey secretKey2 = ...
SecretKey secretKey3 = ...

MessageDigest md = MessageDigest.getInstance("SHA-256");
md.update(secretKey1.getEncoded());
md.update(secretKey2.getEncoded());
byte[] digest = md.digest(secretKey3.getEncoded());

SecretKey mergedSecretKey = new SecretKeySpec(digest, "AES");

The database we are working with doesn't support native encryption, and we are only encrypting a very small number of fields.

Related (but no helpful responses): Using multiple cryptographic keys for encryption?


texts:
It seems like the Keccak permutation is reversible, which is not making the output of SHAKE forward-secure. In the sense that if one state is leaked, everything can be recovered.

I wanted to know the reason why the permutation was not one-way. Or rather why they do not use a one-way function in place of the permutation.


texts: Crypto++ benchmarks cycles/byte vs. megacycles/operation

texts:
With respect to Crypto++ benchmarks: https://www.cryptopp.com/benchmarks.html

Why is it that there are different metrics collected for block ciphers(i.e. cycles/byte) than for public key cryptosystems(i.e. megacycle/operation)?

Why can't the RSA operations be benchmarked by using cycles/byte as well?


texts: How does "one-pass" authentication differ from "two-pass"?

texts:
The meaning of "one-pass authentication" as well as its difference from "two-pass authentication" has not been explained to my satisfaction. CCM mode, EAX mode, and HMAC are examples of the first type; OCB mode and GCM are examples of the second type. How do the two differ?

Suppose we have a block cipher mode of operation that has $\Phi$ and $F$. $\Phi$ is a value that is initialized to some value prior to encryption or decryption. $F$ is a function that takes $PT_i$ (a block of plaintext), $CT_i$ (a block of ciphertext), and $\Phi$ as parameters. After each encryption/decryption of a block of data, $\Phi$ is updated to equal $F(PT_i, CT_i, \Phi)$. After updating $\Phi$ for the last time, the message authentication code is calculated by encrypting $\Phi$. Is this a one-time mode of authentication? Is it as strong as the underlying block cipher?


texts: Showing that security of a elgamal invariant is insecure

texts:
Original Elgamal signature is defined
$S(m, \alpha) = (r, s)$, where

$$r = g^k \bmod p$$

$$s = (m – r\cdotα)k^{-1} \bmod (p – 1)$$

more information on Elgamal signature can be found here.

Variant of a Elgamal signature scheme is defined as

$$s = (r\cdot\alpha + k)m^{-1} \bmod (p-1) $$

I was stuck in the question that:
"Show that attacker Eve who has observed the signature of a message m can obtain the signature of any message she likes."


texts: How do “modes of operation” with block ciphers like (eg) DES work?

texts:
When trying to understand how “modes of operation” are applied when using block ciphers like DES, I noticed I must be missing something. Maybe I simply misunderstood or mixed up things somewhere.

How are (keeping the DES example) Feistel structure properties achieved, when a mode of operation such as ECB is used?


texts: What is the relation between hash chaining and chosen prefix attack

texts:
I read that hash chaining can be used to prevent hash collisions, while the chosen prefix attack allows hash collisions for algorithms like MD5.
How are they related? Does hash chaining prevent the chosen prefix attack?


texts: How does the GCM encryption limit affect TLS connections?

texts:
According to the Wikipedia article on Galois/Counter Mode, GCM is limited to encrypting $2^{39} − 256$ bits of plain text (64 GiB) for any given key and initialization vector. In light of this limit, what considerations should be made for a TLS 1.2 connection with an AES GCM cipher suite?

Should the session/connection be renegotiated or manually closed when the limit is reached? Or does the TLS protocol specify that the connection will be automatically closed or generate a new IV when the limit is reached? Or is it implementation dependent?
Does the limit apply separately to each peer (server and client) or does the limit apply to the total of all data encrypted on both sides of the connection?
Will resumed sessions use a new key/IV combination thus resetting the count against the limit?
Do AES key size or other cipher suite options affect the encryption limit or answers to the above questions (as long as it's AES GCM)?

Note: Using TLS 1.2 with AES-256 GCM encryption and ECDHE-ECDSA key exchange/agreement via SslStream for .NET 4.6.2.


texts: Can any message be decrypted using a given ciphertext and an appropriate key?

texts:
Does the following proposition hold for any deterministic, symmetric cryptosystem $(\mathcal{M}, \mathcal{C}, \mathcal{K}, Enc, Dec)$?
$$\forall C \in \mathcal{C}: |\{M'| \exists K \in \mathcal{K}: Enc_K(M') = C\}| = |\mathcal{M}|$$
My reasoning until now is that this should be equivalent to
$$\forall C \in \mathcal{C}~ \forall M \in \mathcal{M}~ \exists K \in \mathcal{K}: Enc_K(M) = C$$
And if this was false, the opposite must hold:
$$\exists C \in \mathcal{C}~ \exists M \in \mathcal{M}~ \not \exists K \in \mathcal{K}: Enc_K(M)=C$$
Since all messages $M \in \mathcal{M}$ and keys $K \in \mathcal{K}$ can be used to create ciphertexts in $\mathcal{C}$, this would mean that there exist messages $M_1, M_2, M_1 \ne M_2$ which, given a key $K$, are encrypted to $Enc_K(M_1)=Enc_K(M_2)=C$, which defies the required injectivity of $Enc$. Therefore, the proposition must be true. Is it?


texts: Algorithm or closed form solution that lets me directly compute the $n^{\text{th}}$ state of an LFSR?

texts:
I have a large linear feedback shift register with a known state and taps.

Now I want to compute the state of the LFSR after $n$ iterations.

The problem: $n$ is in the order of $2^{256}$ so just brute forcing is not an option. Is there an algorithm or closed form solution that lets me directly compute the $n^{\text{th}}$ state?


texts: Crafting secure block ciphers that lack key expansion

texts:
There was some article published by on the IACR's website that outlined a block cipher that only used the "master" key and no round keys. I can't recall the cipher's name, not that it matters, nor do I know if it had been subjected to cryptanalysis.

If one has a block cipher that has an $n$-bit key and an $n$-bit block size, what would be some ways that a secure one could be made that does not use key expansion?


texts: Adding a Password Hash (key derivation) function to existing password storage solution

texts:
As always we are trying to improve password storage; before just adding new ways of storing our password we need to define what threats we will mitigate by adding in a new way to store our password.

Currently we store passwords with HMAC (using SHA-1), individual salts generated with a PRNG

(RSA X 9.31) function, the HMAC key also generated with the PRNG function.

So, currently each user password is generated as follows

securePassword = CSPRNG Salt + (HMAC-SHA1-256Function(HMAC-KEY, CSPRNG Salt+Plaintext))

So, adding a slow hash, KDF or Bcrypt etc as follows

securePassword =

CSPRNG Salt + PBKDF2 ((HMAC-SHA1-256Function(HMAC-KEY, CSPRNG Salt+Plaintext)))

What does this give us in addition to our existing solution?

All I can say it gives us is:

Makes brute force more difficult i.e. slows down the brute force by significant factor.
provides a way to increase the iteration counter for when computation becomes faster.

Does adding this slow hash add any other additional

security measures or prevent any other security threats?

Currently our HMAC key is held in the same database as the password,

I know not ideal, though this is outside my control.

HMAC already helps prevent against brute force so adding in the

slow hash really only provides point two above. Any other thoughts?


texts:
I know that Vigenère can broken using auto-correlation (as explained at cryptool-online.org). Now my question is: Why does this also work with autokey (tested it using crypttool)?

To prove that I have already put work into this, I have read Simon Singh: “The Code Book”, F.L.Bauer: “Decrypted Secrets”. Though the latter book said in does not work the same way in autokey than it does in Vigenère. Why is there still a maximum of coincidences when the text is shifted by the key length?


texts: Trying to Understand Ring Learning With Error Encryption


texts:
I have an encryption service in which the user decides the length and the type of key, so I would like to build a tool that educates the user on the brute force times for the key they created if using machines like: "A normal PC", "The most expensive graphics card on the market", "The Tianhe-2".  There will also be the potential for an extra integer input to say "What if you had N number of those machines".

But in order to do all this I need to know how fast each of those machines can do one AES decryption and validate whether it's successful or not.

I've always understood computer speed in terms of FLOPS, but I've read multiple places that FLOPS are not a great metric here since AES works on integer or bitwise operations.

So I want to know what my alternative is?  What other benchmark can I use?  How can I even begin to estimate the AES decryptions per second of the aforementioned machines?

I keep assuming there would be some sort of constant like "1 decryption per X number of Units"  And then I could look up and see "the Tianhe-2 is capable of Y Units per second."

And if the above doesn't exist, would it be possible to just come up with a fair and optimistic number for FLOPs per Decryption?  I've only seen two numbers mentioned: 200 via Page 10 of this paper; and 1000 via this EETimes article.


texts: Is this symmetric key MAC-then-encrypt auth token methodology secure?

texts:
NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be read as a "MAC".

I'm experimenting with auth tokens and I'm trying to wrap my mind around the best method.

Goals

Upon successful login, a token is created containing the users accountID, a nonce, and an expiry. The token is then passed back to the client to be used for the next request.
The client passes the token back to the server with each request to identify the origin (accountID) of any given request.
The token contains a nonce that's changed with each request.
A MAC is created from the plaintext value to ensure it's not been tampered with.
The plaintext value of the token (including the MAC) is then encrypted to ensure it's securely obscured.
The client is never privy to the macKey or the encryptionKey. The client is not intended to ever have access to the plaintext contents of the token.

Current Method

///process.env.TOKEN_ENCRYPTION_PASSWORD = '13sd4089f-268c-483d-9e82-jk3c1b47c77a';
///process.env.TOKEN_MAC_KEY = '1fde05f4-268c-483d-9e82-85fc1b42321';

/// Successful login by user ...

var token = {
    nonce : 'SOME-UUID-GOES-HERE',
    accountID : 'account-12345',
    expires : 1234567890
};

token.mac = crypto.createHmac('sha512', TOKEN_MAC_KEY)
                  .update(JSON.stringify(token))
                  .digest('base64');

var encryptedToken = cryptoJS.AES.encrypt(JSON.stringify(token), TOKEN_ENCRYPTION_PASSWORD).toString();

response.send({
    message : 'Created, MAC'd, and encrypted an auth token.',
    authToken : encryptedToken
});

Questions

Is it secure, in this case, to employ a MAC-then-encrypt method? I've read several opinions on this and walked away more confused than when I started.
I've read that cbc-mode should be used when employing a MAC-then-encrypt method. Is this the default mode for CryptoJS.AES.encrypt()?
CryptoJS.AES seems pretty generic. Is this defaulting to AES256? Or is that something that I need to explicitly declare in my code?
When passing a string to CryptoJS.AES.encrypt() I've read that it automagically generates a key and and iv 'behind the scenes'. Would it be more secure to generate my own key and iv, or should I just let CryptoJS handle that?
Is there more security to be had by employing a MAC-encrypt-MAC method, or is that just adding complexity to my app logic?


texts:
This paper explains an attack on TLS 1.3. This was published way back in 2015 when TLS RFC was in draft stage.
My question is now TLS 1.3 RFC is finalized, is this attack got addressed?


texts: How to generate 1000 prime number of 1024-bit with much less time?

texts:
I am generating  thousand prime number of 1024 bit each. But it takes lots of time. My procedure is as follows.  Generate prime number using

SecureRandom rnd=new SecureRandom();
BigInteger num=num.probablePrime(No_of_bits,rnd);//here no_of_bits=1000

How to reduce the time so that 1000 or 2000 or 3000 prime numbers of 1000-bit are generated quickly. In this paper, this process of generating prime number is done in very quickly. I want to match keygen timing of this paper. More as you will see remark 3.1 on page 492, the author generate rough $q_0$ using different technique in which large prime number  of $\lambda^2$ bits  (nearly 1000-bit) are multiplied to generate $q_0$. The author choose 4 schemes

toy $\longrightarrow$ keygen time 4.38 seconds-->As in remark 3.1 $q_0$ product of 90 prime number of nearly 1000-bit.

small $\longrightarrow$ keygen time 36 seconds $\longrightarrow$ As in remark 3.1 $q_0$ product of 317 prime number of $52^2$ bits

Medium $\longrightarrow$keygen time 5min 9 sec $\longrightarrow$ prdouct of 1092 prime number of $62^2$ bits

Large $\longrightarrow$ keygen time of 43 min $\longrightarrow$ product of 3665 prime number of $72^2$ bits.

How such large prime numbers are generated in such sort time. They have written that they use sage 4.5.3 and GMP4.3.2 for on single core2 DUO. As a note in result, they have also written that whole time of keygen is spent in primality testing.


texts: I'm studying about differential cryptanalysis in DES. I need to make the DDT through python

texts:
I just made DES algorithm(encryption, decryption) using python.
And I want to attack 1,2 4,8 .. round DES.
For that, I need to make the DDT code.
Could you guys help me to make the DDT?
Thank you.


texts: Is K=1 a valid random integer in ElGamal signature?

texts:
In the ElGamal signature scheme, in addition to the public/private keypair, a random integer $K$ such that $\operatorname{gcd}(K,p-1)=1$ is chosen in the range $[1,p-1]$.

This clearly excludes $K=p-1$, because $\operatorname{gcd}(x,x)=1$ for any $x$, but not $K=1$.

However, if $K=1$, the first part of the signature is $S_1 \equiv g^1 \bmod p\equiv g \bmod p\equiv g$, and the attacker knows it. Even worse, the attacker can use $S_2$ to obtain the private key.

Why is $K=1$ a valid choice? No source that I know of mentions this. Is it something considered so trivial that is not worth mentioning, or did I miss some mistake in my reasoning?

I understand that the probability to choose $K=1$, for a large prime, is vanishingly small, but in my opinion one shouldn't leave these things to chance.