texts: Crypto system design : How to design Encryption for Zero width characters

texts:
Zero width character's can be used to hide text in plain sight.I am building a system where user's can provide their secret message , cover message and a password (key) which I would encrypt and give an output back with only the cover message which has encrypted secret message embedded as zero width characters invisible.When the receiver provides the key with the message, the system would decrypt and translate the zwc's back to the original secret message.

The cost of zwc's is that every two bits can contain one zwc as there are only 4zwc's available in unicode.So to represent a character 'b',it takes 4zwc's (ZWJ,ZW-NJ,ZWS,ZW-No break space).

I have been using AES with ebc mode and I encrypt the secret message with the key given by the user,but due to padding even if the user's secret message is 'hi' its padded as 16bytes when encryption due to aes block size.This means to convey 'hi', I needed 16bytes and due to zwc inclusion its 16*4 =64chars.So I researched more to find cipher text stealing where len(p)=len(cipher text) eliminating padding which is exactly what I needed.But during this process I came to know that EBC mode is insecure and CBC should be used (pretty late realization).CBC requires an IV which takes one byte again imposing more restrictions on my zwc situation.If I don't use a fixed IV, every message is suddenly two bytes 128 characters with zwc.

According to my research,fixed IV's can be used if you key changes in my case user's give the keys to encrypt so technically key changes but as its a password two messages from the same user is encrypted with the same key cause same password.Is it safe to use a fixed IV In my situation.

And I dont understand according to wiki,len(p)=len(ct) for cipher text stealing but if a fixed iv is not used len(p) is never equal to the length of the cipher text?

Can I use cbc with fixedIV and cipher text stealing for my situation?

Is this the right way to design this ? Cause this is my first crypto project


texts: Homomorphic Encryption: how does the equality test on ciphertexts work?

texts:
Let's suppose we have a asymmetric crypto-system $H$ which is homomorphic with respect to some function $F$.

Alice encrypts a message $m$ with her private key $e$ in the crypto-system $H$ and obtains the ciphertext $C = H(M)$
Alice sends $C$ to Bob
Bob computes $F$ over $C$ and obtains $C' = F(C)$
Bob sends $C'$ to Alice
Alice wants to check whether $C'$ is equal to some number $n$.

Let's suppose the decryption operation is costly, much more costly than the encryption. Can Alice check the equality by comparing the encryption of $n (H(n))$ and $C'$? Is that possible? With which homomorphic crypto-system(s)?


texts:
Consider a scenario where a message is sent encrypted and signed using public-key cryptography.

When using asymmetric encryption, you end up also using symmetric encryption if the message is large (hybrid encryption), which raises the question: is a MAC required?

I'm aware that not using a MAC when using Encrypt-then-Sign can lead to vulnerabilities such as the one described in the "Dancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage" paper.

However, if you use Sign-then-Encrypt, are there any known attacks when not using a MAC?


texts: Two untrusted party want to exchange data: how to ensure each one gets the data it needs?

texts:
Possible Duplicate:
  Two untrusted party want to exchange data: how to insure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing.

Alice has file A and Bob has file B. Alice wants B and Bob wants A. Each party is untrustworthy and will try to rip off the other party. Each party has an hash of the file it wants (therefore they can tell if the other party sends junk).

How can I make an algorithm to exchange A and B, where it is not possible for the parties to rip off the other party during the exchange.


texts: Is there any hardware available to calculate single sha256 hash?

texts: I'm looking for a hardware that can generate sha256 hash of the input.


texts: How does recovering a message from a signature, as described by RSA, prove that the message was signed with a private key?

texts:
In the original RSA paper, in the section that describes digital signatures, the authors write, “He [Bob] need not send M as well; it can be computed from S.” Then, a few sentences later, “Bob cannot later deny having sent Alice this message, since no one else could have created S = DB(M).”
But Bob’s encryption procedure EB can be applied to any S to produce some M. That is, S could be manufactured from whole cloth, and you’d still get an M from EB(S), albeit gibberish.
How then does merely recovering M from S, as described by the authors, prove that DB was applied to M to produce S? Is legibility alone a strong enough proof of M having been signed by DB?
If M (or a hash of M if you want to nitpick) were included in the message alongside S, then you'd have something to compare the result of EB(S) to. But if only S is given, I don’t understand where the proof comes from.
This question is purely academic. I have no intention of using digital signature as conceived in the original paper in a practical implementation.


texts: I need a 64-bit cryptographic hash for 96 bits of data

texts:
I have a situation in which I need to combine a 32-bit datum, G, and a 64-bit datum, I, to produce a 64-bit datum.  No two tuples with the same I value will have the same G value, and vice versa.  Collision resistance must be very high (data corruption will result if not).

Technically, I don't need encryption, but most decently collision-resistant hash functions happen to come from the field.  Some questions:

I have considered using a cryptographic hash such as SHA-256 and either slicing (i.e., subset of bits) or folding (XOR'ing subsets of bits).

Question 1: is this a reasonable approach (i.e., can anyone recommend
something simpler with comparable collision resistance)?
Question 2: slice or fold?  Folding might help with issues of non-uniform
distribution in the subsets, but does it weaken the result?  I think not,
but I am not certain…

Thank you!

To the responders…  Thank You!

@ChaosInCodes: right – collisions are very problematic, maybe fatal.  This is why I am also soliciting any other ideas about how to do this (i.e., without the use of cryptographic hashes).  The I datum, in particular is sparse (being a composition of a bunch of other, smaller data, including a little slice of G).  I am continuing to work on whether I can recompose (G,I) pairs as a 64-bit datum without using hashes…  Pointers to information on the probability of collisions (given uniformly distributed, random inputs - which I don't really have), that would be helpful.

@poncho: I mean unlikely.

@RichieFrame: thanks, I'll check into these.  As mentioned, I really don't need a cryptographic checksum, just a very good hashing technique.

@fgrieu: OK, the problem I am trying to solve is to represent a filesystem's inode's generation and inode number as a unique 64-bit datum.  The values of I are not unique (by which I mean that at any point in time, an inode points to unique data, but the file system reuses inodes over time); the values of G are also not unique (by which I mean that there are many inodes deployed during a given generation).  The pair (G,I) is guaranteed to be unique, but its too big!

I expect ~billion pairs, and this approach is only workable if the probability of collision is sufficiently low that I will likely retire before the first one occurs. ;-}

The tone of these responses lead me to believe that perhaps a cryptographic hash is insufficient to the need, i.e., may have too high a probability of collision given the input data.  I have some background in data de-duplication, so my head went there, but perhaps it isn't the right approach.


texts: BLAKE2: What is the difference between the salt and the personalization?

texts:
Libsodium builds their KDF on top of BLAKE2b:

BLAKE2B-subkeylen(key=key, message={}, salt=subkey_id || {0}, personal=ctx || {0})

Besides the key, the function has two additional arguments: The subkey ID (a 8 byte value which is 0-padded and becomes the salt) and a personalization context. They document those two values as follows:

  subkey_id can be any value up to (2^64)-1

And:

  Similar to a type, the context ctx is a 8 characters string describing what the key is going to be used for.
  Its purpose is to mitigate accidental bugs by separating domains. The same function used with the same key but in two distinct contexts is likely to generate two different outputs.
  Contexts don't have to be secret and can have a low entropy.

If I understand this correctly, both the 8-byte subkey ID (which becomes the 16-byte salt) and the 8-byte ctx (which becomes the 16-byte personalization) are used for "namespacing", don't have to be secret and may be of low entropy.

In BLAKE2b, what is the difference between the salt and the personalization context? Can the personalization context be considered the "second part of the salt", introduced only for semantic purposes? And if yes, wouldn't using a single 32-byte salt be simpler to understand and less error-prone to implement?


texts:
So I have $H: \{0,1\}^* \rightarrow\{0,1\}^n$ a hash function resistant to the second preimage and to collisions. Let there be a function $H' : \{0,1\}^* \rightarrow \{0,1\}^{n+1}$ with the following properties:

$$H'(x) = \{0||x\; \text{if}\; x∈\{0,1\}^n;\quad 1||H(x) \text{ otherwise}\}$$

Is $H'$ preimage resistant $∀ x$ ?

I know that I have to find an $x$ for which this property fails, but I cannot think of one, could you please help me and explain how to demonstrate this?


texts: How is the root certificate transmitted to pc?

texts:
i understand that the purpose of root certificates and CA's is to ensure that the communication parties are who they say they are.

But how is the root certificate acquired? Is it not possible that during the acquisition someone is pretending to be the CA and i get a fake root certificate?

Thanks!


texts:
Say you were to generate a 512 bit AES key, then encrypted a message by running it through AES CTR 256 twice, with the first and last parts of the key respectively.

Would it be as secure as modifying an AES implementation to increase the rounds to 28?


texts: Why is AES resistant to known-plaintext attacks?

texts: At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?


texts: Is this a correct understanding of Universal Hash Functions?

texts:
I'm studying universal hash functions and have been reading several papers but now i'm focusing on Wegman and Carters original paper from 1979 (Universal classes of hash functions) and the H1 class.

Choose a prime $p$ that is $p >= a$
Let $g$ be residue modulus $b$ ($g(x) = x \pmod b$)
Then the $H1$ class is the set of:

$$\left\{ f_m,n \middle| m,n \in \mathbb Z_p \text{ and }m \neq 0\right\}  $$

Formal Definitions:

Let $A=\{0,1,\dots,−1\}$ and $B={0,1,\dots,b−1}$, with $|A|=a>b=|B|$.
Define $h_{m,n}:A\to\mathbb Z_p$ and $f_{m,n}:A\to B$ such that
$$h_{m,n}(x)=(mx+n\pmod p ) \quad\text{and}\quad f_{m,n}(x)=g(h_{m,n}(x))$$

For the scheme to work, we also require that $p$ is sufficiently large, which we quantify by requiring that:

$$\forall i \in B, \quad |\{ y\in \mathbb Z_p | g(y)=i \}| \leq \lceil \frac{p}{b} \rceil$$

I have been trying to work through the following example:

={0,1,2,3,4,5,6,7,8,9}→=9

={0,1,2,3,4,5}→=4

≥→=11

Then we need to fulfill the requirement:

The number of y that would be mapped by g to i must be less then ⌈/⌉ = ⌈11/4⌉ = ⌈2.75⌉ = 3 ?

I understand that $h_{m,n}:A\to\mathbb Z_p$ maps from $A$ to $\mathbb Z_p$ and $g$ map from Z_p to B but what elements are in Z_p if A and B is like in my example ?

And i not sure how to continue my example, do i need to do g(x) for all elements in Z_p and check how many map to i ?


texts: What is the number of fixed plaintexts of RSA

texts: Considering RSA, $n=p\,q$ with $p,q$ odd primes and the public key $(n,e)$,  where $\gcd(e,\phi(n))=1$,  I need a hint on how to show that the number of plaintexts with $E_e(x)=x$ equals  $\gcd(e-1,p-1)\cdot gcd(e-1,q-1)$. So we are searching for the number of plaintexts that remain unchanged by the encryption function using the public key.


texts: Security Consideration on The Use of Random Number in Digital Signature

texts:
key-exchange protocol allows two parties to establish a shared key over public network. Lacking  of authentication the original Diffie–Hellman key exchange is insecure  under man-in- -the-middle attack. Later the concept of authenticated key exchange protocol is proposed.In the family of authenticated DH protocols,there are two method of authentication, there are implicit authentication(example: the HMQV) and explicit authentication(example:SIGMA).Implicit authentication is more efficient , while explicit authentication often needs digital signature, so it's less efficient. when signing a message, a random number is used.

When implement a key-exchange protocol authenticated with digital signature, two parties($\hat{A}$ and $\hat{B}$) need to generate their public and private key pairs and ephemeral keys. To party $\hat{A}$, private key is $a$, public key is $A=g^a$($g$ is a generator of a cyclic group), and ephemeral key $x$. Both $x$ and $a$ are choose randomly from a set. The same with party $\hat{B}$($b,B,x$).

My doubt is that when the party $\hat{A}$ is going to sign a message, if he can use the random number he has generated such as the $a$ or $x$, while generate a new random number specify for the signature ? Are there any security threat ,if he uses $a$ or $x$ to sign a message ?


texts:
I have a message $m$ that I wish to send as a blinded message for approval (a signature) to then unbind and use as authority.

Should I preform the procedure like so:

pad $m$ using EMSA-PSS (encrypting it)
then blind the now padded $m$ using RSA blinding
then have the signer sign using RSASSA-PSS and then send it back - Also, should the signer check the message before signing it to make sure it hasn't already been signed?
then upon receiving the now signed blinded padded $m$ back, sender unblinds the $m$ according to RSA Blinding
decrypt the unblinded $m$ using RSAES-OAEP
verify the signature, before using the now signed $m$ further in the process.


texts: Key generation for AES-GCM-256 file encryption

texts:
I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement.

So far, I have come up with the following process:

User supplies password or key file.

Then, per file that is to be encrypted:

Password/key file from (1 above) is hashed via SHA256 once.
The result from SHA256 is base91-encoded and sent through scrypt (N=2^15, r=8, p=1) with a randomized 16-byte salt to derive a 32-Bit key for AES-GCM.
The file is encrypted and authenticated using AES-GCM with the key from (2) using a randomized 96-bit nonce as iv.
Scrypt-values (N, r, p, and salt) and the AES-GCM nonce (=iv) get stored (unencrypted) in the file header for decryption.

The program does make sure it doesn't process files larger than 2^39 - 256 Bits (size limit for AES-GCM encryption from NIST 800-38D).

Is this design flawed in any serious way?


texts: Guidelines for cryptographic key generation

texts:
I was wondering whether you know can point me to some general (basic) principles/guidelines one should follow for generating cryptographic keys? I have looked at NIST 800-133, but was hoping for some principles a bit more general and less technical.

Specifically I’m thinking of asymmetric key pair for use of RSA and symmetric key for use of HMAC. For example, I assume that the key should have some randomness to it.

Thank you.


texts: Validating file type via magic of an AES encrypted .ts file

texts: would it be impossible to validate the file type via magic (file command for example) of an AES encrypted ts file? asking since the magic tests are looking for the sync byte (value of 0x47) each 188 bytes.


texts: Distributed key generation (for discrete-log based cryptosystems) with fake shares

texts:
Under the definition of Gennaro et al (link), a DKG protocol needs to satisfy “correctness” and “secrecy”. Correctness is divided into three sub-properties:

C1. All subsets of $t+1$ shares provided by honest players define the same unique secret key $x$.

C2. All honest parties have the same value of public key $y = g^x$ $mod$ $p$, where $x$ is the unique secret guaranteed by (C1).

C3. $x$ is uniformly distributed in $Z_q$ (and hence y is uniformly distributed in the subgroup generated by $g$).

Secrecy means that no information on $x$ can be learned by the adversary except for what is implied by the value $y = g^x$ $mod$ $p$. In terms of simulatability: for every (probabilistic polynomial-time) adversary $A$, there exists a (probabilistic polynomial-time) simulator $SIM$, such that on input an element $y$ in the subgroup of $Z_p$ generated by $g$, produces an output distribution which is polynomially indistinguishable from $A$'s view of a run of the DKG protocol that ends with $y$ as its public key output, and where $A$ corrupts up to $t$ parties.

They then continue and say: “The above is a minimal set of requirements needed in all known applications of such a protocol. In many applications a stronger version of (C1) is desirable, which reflects two additional aspects: (1) It requires the existence of an efficient procedure to build the secret $x$ out of $t+1$ shares; and (2) it requires this procedure to be robust, i.e. the reconstruction of $x$ should be possible also in the presence of malicious parties that try to foil the computation.”

The question:

We are looking for a DKG procedure that satisfies the first aspect of the stronger version of (C1), but not the second one. This means that in the presence of $t+1$ honest shares, reconstructing $x$ should be possible efficiently. However, in the presence of malicious parties, it is impossible to distinguish honest shares from malicious shares and reconstructing $x$ boils down to checking all the combinations of $t+1$ shares until one that comprises only of honest shares is found.


texts: Will SHA1 or Other Hash Functions Ever Contain Quotes

texts:
I feel foolish asking this, but will the hash generated by SHA-1 or other encryption methods ever have the possibility of containing a quote? Or any other characters that may be escaped such as ", ', and \

I am attempting to make a non-MySQL database to hold values such as hashes (and yes, I am aware that it is not the most secure option for holding things such as passwords; this is just a private endevour for fun). I was planning to store the tables and data in JSON files, so that is why I need to know if I will need to escape some characters before storing the data.


texts: Isn't the structure of a potential plaintext of a ciphertext generated by a one-time pad dispositive, cryptanalysis-wise?

texts:
That is, if I generate every possible result, and analyze the structure against, for example, a dictionary, won't that identify which of the solutions in the domain is most likely the correct one?

I realize the numbers involved, but this does ultimately reduce the problem to a hardware one. If this is not true, then I'm not understanding something correctly about one-time pads.

TIA.


texts: Basic attacks on McEliece; finding S and P

texts:
Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is random & non-singular and $P$ is a permutation.

Let's say an attacker Eve has a way to find $G$ from $G'$ but not $S$ or $P$. How would Eve now continue the attack on a encrypted codeword $c = mSGP+e$?

There are ways to find $P$, if you know $SG$: Support splitting algorithm, but I don't see how Eve can continue without $S$.

Clarification / Example / Thoughts from previous answers

One of the problems is, that $P$ changes the code enough already, that it will be hard to decode. This is an example over $\mathbb{F}_2$

$G:=\left( \begin{eqnarray} 1 & 1 & 0 & 0 & 1 \\ 0 & 0  & 1 & 1 & 1 \end{eqnarray} \right)$ generates the code
$\mathcal{C} = \mathbb{F}_2^2G= \left\{ (0,0,0,0,0),(1,1,0,0,1),(0,0,1,1,1),(1,1,1,1,0) \right\}$.
Take the permutation that switches the 2nd and 3rd component
$P = (23)$.

The generator $GP$ now generates the code
$\mathcal{C}P = \left\{ (0,0,0,0,0),(1,0,1,0,1),(0,1,0,1,1),(1,1,1,1,0) \right\}$.

Take a codeword in $\mathcal{C}P$:
$c = (1,0,1,0,1) \in \mathcal{C}P$ and an error vector $e=(1,0,0,0,0)$.

$y=c+e=(0,0,1,0,1)$ has distance 1 to a codeword in $\mathcal{C}P$; so for someone who knows $P$ it could be translated into a codeword in $\mathcal{C}$ and decoded with $G$.

$y$ also has a distance of 1 to a codeword in $\mathcal{C}$, but to the wrong one; so simple decoding does not work.


texts: What are the potential (major) flaws in this security scheme?

texts:
It’s been a few years since I read anything involving crypto. I’ve come across this scheme and I wonder how secure it is:

Alice generates an RSA keypair (we assume Alice is using proper random numbers).
Alice sends the public key as plain text to Bob.
Bob generates a 3DES session key: BA.
Bob sends BA encrypted with Alice’s public key, together with a checksum of BA.
Alice receives and decrypts BA using its private key.
All following sensitive data is encrypted with BA and integrity is checked via the checksum.
When the checksum fails communication is aborted and Alice generates a new keypair.

What are the potential (or very real) problems with this scheme?


texts: How to get the datapacket from wireshark?

texts: I have a pcap of my twitter traffic using wireshark. The cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 method is used for for encryption data.. I have a tweet of 42 characters are traced in the pcap. How can i get the application data packet with the length of my tweet data.


texts: Breaking zero knowledge protocol for graph hamiltonicity

texts:
The FLS zero knowledge protocol for graph hamiltonicity proceeds as follows.

The prover (proving graph hamiltonicity of graph G) picks a random cycle graph C, and sends its commitment to verifier.

Verifier picks a random bit b and sends it to sender.

If b = 0, then prover decommits all the edges of graph, and verifier verifies if its a cycle graph.

If b = 1, then prover computes isomporphism between hamiltonian cycle of G and cycle graph C. It then decommits all the edges in C that are not present in the isomporphism of G.

This protocol is proven to be honest-verifier zero knowledge in many places.
How can a dishonest verifier break ZK property of this scheme? A dishonest verifier can break ZK property only if he can compute bit b depending on commitment(C) and learn some info. But that would violate hiding property of commitment scheme right?


texts: Explanation of part of a visual cryptography algorithm

texts:
I have been working on a project involving visual cryptography and I am stuck with the following problem.

My question is related to this paper, AN IMPROVED VISUAL CRYPTOGRAPHY SCHEME FOR SECRET HIDING, by R.Youmaran, A. Adler, A. Miri.

Can someone explain how one obtains the values for the matrix $O_{11}^{1'}$?  Which can be seen in Figure 1 in the paper linked above.  If possible, a step by step procedure would be appreciated.


texts: Understanding Twist Security with respect to short Weierstrass curves

texts:
I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves.

That section claims that in order to thwart invalid curve attacks an efficient technique is to use a single coordinate ladder to compute the scalar multiplication.
Then the section goes on in describing twists and explicitly refers to Montgomery Curves, particularly when it says "The Montgomery ladder formulas for $By^2=x^3+Ax^2+x$ also compute scalar multiplication for the twisted curve $(B/u)y^2=x^3+Ax^2+x$".

Now, I understand this is a problem because during an ECDH, implemented with a single coordinate ladder on a Montgomery curve, I can provide a public key on the curve's twist and, if the twist's order is "weak", gain information on the other peer's private key.

But, does this apply to short Weierstrass curves ? If so, how ?

It is my understanding that a nontrivial quadratic twists on a Weierstrass curve has the form $y^2=x^3+c^2ax +c^3b$ where $c$ is a non-square in $F_p$. So the twist modifies both $a$ and $b$ parameter of the curves.
For the attack to work I would assume that it is required to have a scalar multiplication ladder that works on both curves (normal and twisted).
Is this assumption correct ?

Does such a ladder exists for short Weierstrass curves ?

As far as I know all $x$-coordinate only ladders for short Weierstrass make use of $a$ and $b$ in the computation, such as the one of Brier and Joye. How could this work on the twist which as different values for $a$ and $b$ ?

I'm asking this question because if such an algorithm doesn't exist, then I don't see how to apply the measure of twist security to short Weierstrass curves such as NIST P-224 and brainpoolP256t1 as djb did on that page.


texts: Is there a preferred way/standard on how to transmit an initialization vector for AES encryption

texts:
Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the file's beginning before the actual encrypted data (or somehting similar).

Is there such a convention?


texts:
Is there a way to prove that two ElGamal ciphertexts encrypt the same message with different public keys without knowing the private keys?

The prover is the producer of both ciphertexts.


texts: Is quantum key distribution safe against MITM attacks too?

texts:
i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html

and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution

they talk about direct fibre optic cable and evesdropping that seems passive.

i want to know whether quantum key distribution provides any security against active attacks too?

i mean, for example isn't it possible that fibre optic cable is cut at some point in its path by an attacker and then he places a repeater there and before repeating the signal he can read the secret information in the channel?


texts: I'm seeing this all over my Katz and Lindell book and I don't see where they introduced it.


texts: CBC Padding Oracle in SSL3. Why only in SSL3 not in TLS1,TLS1.1, etc

texts:
I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1

And found CBC is still used in its ciphersuites. Why is POODLE needs to downgrade to SSL 3? Can't the POODLE attack works by downgrading to TLS 1 or TLS 1.1? Is the CBC implementation in SSL 3 different than that in TLS 1 and TLS 1.1?


texts: How can we say an elliptic curve is secure and can be used for cryptographic applications?


texts: What is the "compression function" in Merkle-Damgård?

texts:
Is the "compression function" in Merkle-Damgård just a collision-resistant, one-way hash function but one that operates only on fixed size inputs?

If so, is MD just a way to extend it to work on arbitrary length strings?


texts: Complete taxonomy of public-key cryptosystem primitives

texts:
This question is similar to “What primitives are needed to generically implement public-key cryptography?”, but with a more applied/contingent focus:

That question asked about what's theoretically required, to which the Accepted answer is “we have no [necessary and sufficient] primitive… for public-key encryption”

(contrasted with symmetric cryptosystems, for which a necessary and sufficient primitive has been identified: a one-way function)

This question asks, not about the identically-correct N&S primitive in the platonic limit, which clearly has not been identified (if a decisive choice even exists), but about what known categories of primitives we have identified so far (that are not widely accepted as being irreconcilably broken)

So: what is the taxonomy of public-key cryptographic schemes?
That is, cryptographic schemes that can do at least one of the following:

Convert an authenticated (but not confidential) communication channel into a confidential one
Examples:

RSA Encryption

Curve25519+EDCH

Leverage an authenticated (but not necessarily confidential) communication channel available at time $t$ to authenticate communications at time $t'$
Examples:

RSA Signatures
Merkle trees

My current understanding is that all primitives that yield these abilities can be grouped together something like this:

Number-theoretic

Based on the difficulty of factoring large numbers

RSA

Based on the difficulty of inverting a group operation

Based on the difficulty of finding the discrete-logarithm

…over elliptic curves:

(Very many)

Pallier

ElGamal

Based on lattices, …

hic sunt dracones

Based on "any" one-way function:

Merkle trees

One-time signatures

Is there any current survey, overview, book, etc. giving such a "taxonomy of public-key cryptosystems" that includes all the systems mentioned above as well as at least one lattice-based system?


texts: How can a digital signature algorithm incorporate a random data if it is to be authenticated on a separate system

texts:
I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others signatures if they chose a different method for coming up with random padding based on the input or a hash of the input?

Is this something that is different between RSASSA-PKCS1-v1_5 and RSASSA-PSS?


texts:
When an SSH session is rekeyed due to either the time limit or data limit for rekeying having passed, does the Diffie-Hellman exchange take place within the encrypted channel provided by the existing session, or does it take place "in the open" the way it does when the client first connects to the SSH server?

Looking at the RFC for SSH and having read the output from ssh with the -vvv option during a rekey, I still can't figure out the answer.

For the sake of this question, I'm mainly thinking about openssh in version above 6, if that matters.


texts: AES-256, CBC, plaintext length is multiple of block size: Does PKCS #7 padding weaken the encryption?

texts:
Of course, padding is superfluous when AES with CBC is used if you know that the plaintext length is a multiple of the block size.
But does the padding precipitate a weakness in the encryption?
Because due to the padding at a block length of 16 bytes, you always have the last block containing just 0x10. So, to my understanding, this is "known-plaintext".
Can this be exploited in real life (today)? Or is this just a theoretical problem (today)?
This answer makes it sound like it's no problem.

If the cipher can't resist a known plaintext attack then the problem
is with the cipher, not the padding.

But is this true for AES-256?


texts: How to Compute C^2 in AES MixColumns Matrix?

texts:
In mix Columns we have:

$$C(x) = \{03\}X^3 + \{01\}X^2 + \{01\}X^1 + \{02\}$$

In Viktor Fischer's Paper on MixColumn and InvMixColumn Resource Sharing, in page 2, Equation 8, it's been said that $C^2(X)$ can be computed as follows:
$$C^2(x) = \{04\}X^2 + \{05\}$$
Can anybody explain why is that?


texts: How do I construct a 256-bit hash function from 128-bit AES?

texts: I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher?


texts: Why are some websites seemingly immune to self-signed certificate MitM attacks?

texts: I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and one as the attacker, running ettercap. One attempt (pretending to be steamcommunity.com) yielded information; the target accepted the attacker's fake CA self-signed certificate presented via the MitM attack. The other attempt (pretending to be facebook.com) didn't even allow me to add an exception for the self-signed certificate on the target machine. So the question is, why did one website allow me to add an exception while the other one didn't?


texts:
I am reading Pragmatic MPC (link) about the BGW protocol.
I also cross-reference here (click on lecture link for slides) *The BGW Construction for the Information Theoretic Setting – Benny Pinkas
I do not understand why the multiplication gate calculation can work.

First, let's say of $N$ parties, party $P_i$ has shares of wires $\alpha$, $\beta$ as $[v_{\alpha}]$, $[v_{\beta}]$. He can multiply them together to get
a point on the polynomial $q(x) = p_{\alpha}(x) p_{\beta}(x)$.
 But everyone's values together could then only be reconstructed with $q(x)$, where $q(x)$ is degree $2t$.

Useful fact: we say there exists $\lambda_i$ for $i =1 $ to $N$ (or can index to $2t+1$, but I didn't know why) such that $q(0) = \sum_{i=1}^N \lambda_i q(i)$ (I guess party $P_i$ has the value $q(i)$ in his possession). The $\lambda_i$ are the "appropriate Lagrange coefficients".

Every party $P_i$ can share their value $q(i)$. They pick $g_i$ such that $g_i(0) = q(i)$. (This polynomial was unnamed in the book, but maybe makes things more explicit). Then $P_i$ shares to all the parties so they have shares $[q(i)]$.

If we then think of what $P_i$ is receiving, he gets shares of $g_j(0)$ for each $j$, for him that means he gets the value $g_j(i)$.

Then, each $P_i$ on inputs $g_j(i)$ uses these points
to create the share for himself
$[q(0)] = \sum_{i=1}^N \lambda_i [q(i)]$. For party $P_i$, this means he can figure out
$q(i) = \sum_{i=1}^n \lambda_i g_j(i)$.

The value $q(i)$ turns out to be their share $[v_{\alpha}v_{\beta}]$.

I understand that these $\lambda_i$ should be the same as the one for the useful fact. Why?
Where did the useful fact come from?
I also took a look at a paper (didn't read through) of A Full Proof of the BGW Protocol for Perfectly-Secure Multiparty Computation
link where they say that the $q(x)$ (they call it $h(x)$) has a "specific structure". What does it mean?


texts: What are the typical instance parameters of non-commutative cryptographic schemes?

texts:
Recently, I grew a tremendous interest for public-key cryptography based on "groupoids", and collaborated with someone on this topic. What I notice afterwards, is that there had been a huge body of work on "non-commutative" cryptography, with a book from 2011 dedicated to that topic titled "Non-commutative Cryptography and Complexity of Group-theoretic Problems" written by A.Myasnikov et al. (published by American Mathematical Society), although I haven't gotten access to its content yet.
Obviously, non-commutative cryptography had not been matured to the stage where they'd get hash-sign-numbered standards like PKCS#1 for RSA, SEC#1 for elliptic-curve, and EESS#1 for NTRU.
What this question asks is, what are the typical parameters proposed for non-commutative cryptographic schemes? What're their typical cryptogram sizes?


texts: Why are the constants so simple in Keccak?


texts: What makes the quadratic residuosity problem hard?

texts:
The quadratic residuosity problem is the problem of determining whether, for given $r$, $m$, $\exists a.a^2\equiv r\mod m$.

This problem's believed to be hard to solve in general (e.g. an efficient general solution to finding $a$ would allow you to factorise semiprimes efficiently). However, there are many special cases where the problem is easy (e.g. when $r$ and $m$ are both odd primes, determining whether or not $a$ exists can be solved in constant time), and I'm interested in avoiding those special cases.

I'm looking at the decision problem version of quadratic residuosity – that is, to determine whether $a$ exists at all (the attacker doesn't need to be able to work out what its value is). What restrictions are needed on $r$ and $m$ in order to prevent any of the known algorithms for solving the problem efficiently for being usable?


texts:
Can I create a secure hash function $h: E(\mathbb{F}_p) \rightarrow \mathbb{Z}_q$ (for some $q$) where $E(\mathbb{F}_p)$ is an elliptic curve on the finite field of $p$ elements?
By secure hash function I mean: one way, strongly collision free.


texts:
When generating a public-private key pair you have the option to secure the keystore with a password.

where is that password stored, is it a hashed version that is stored and if that is so which hashing algorithm is used ?


texts: RSA prove $a^{\varphi(n)/g} \equiv 1 \pmod{n}$

texts:
I should prove that $a^{\varphi(n)/g} \equiv 1 \pmod{n}$, so I thought I would prove it with primitive roots but I got stuck. Here is the assignment:

  Let $p, q$ be primes such that $p \ne q$. Denote $n = pq$, $\varphi(n) = (p − 1)(q − 1)$, and $g = gcd(p − 1, q − 1)$. Prove that

  $$a^{\varphi(n)/g} \equiv 1 \pmod{n} ~ ~ \text{for all} ~ a ~ \text{satisfying} ~ \gcd(a, n) = 1$$

Any help/hint would be great. Thanks.


texts: Now i know that the F function doesn't have to be injective, but is it NEVER injective? or is it possible to have an injective F function?


texts: Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, Micali-Schnorr, and BBB algorithms (see http://cacr.uwaterloo.ca/hac/about/chap5.pdf), but these require one to know both the seed and other parameters used in the construction (e.g., the modulus $n$). I need a construction that only requires the random integer seed as input. I'm aware that I could potentially fix a universal set of public parameters and then just specify the integer seed, but I'd like to avoid that since the parameters would likely need to be refreshed after a certain number of invocations or uses.


texts:
I found the following challenge on a wargames site:

A 16 byte string is randomly generated and hashed with md5 => HashRandom

Next, the following happens in an infinite loop:

user is prompted for a 16 byte input
input is hashed => HashUser
HashUser is compared with HashRandom and the number of matching bits is displayed

The goal is to get at least 100 matching bits.

A couple of observations:

The initial random string is generated using lowercase/uppercase characters, numbers and characters like .,"...
usually, for any user input string like AAAAAAAAAAAAAAAA I get between 50 and 70 matching bits

To get a better understanding on what happens behind the scenes, I did some reading on md5 and Wang's attack ( http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf ) + other papers related to it. Based on that, here are some notes:

My input will look like this (UI - user input - bytes I can control):

m0  - 0xUIUIUIUI
m1  - 0xUIUIUIUI
m2  - 0xUIUIUIUI
m3  - 0xUIUIUIUI
m4  - 0x00000080 - initial padding with 1 + 0's
m5  - 0x00000000
m6  - 0x00000000
m7  - 0x00000000
m8  - 0x00000000
m9  - 0x00000000
m10 - 0x00000000
m11 - 0x00000000
m12 - 0x00000000
m13 - 0x00000000
m14 - 0x00000000
m15 - 0x00000080 - input size - 128 bits - 16 bytes

Wang talks about a differential attack used to generate messages that collide under md5. I read that hoping it would give me some hints, however it can't really be applied for this challenge. The method described uses two 512 bit input blocks per message. It also imposes restrictions on bytes I can't control.
The only breakthrough I had with this is the ability to control the hash function after the first round (however, this is trivial and I don't think it can help me)
Because I can get the matching number of bits for how many strings I want, I can get an idea on how the hash of the random generated string looks like. Since I only need 100 bits, I don't need the hash to mach 100%. Basically, if I can control half of the hash (64 bits), with some luck I can get 36 other random bits to match.
On the fourth round of the md5 algorithm, the 63rd operation (so right before the final value is calculated) involves m2 (which I control):

Q63 = Q62 + Q59 + I (Q62, Q61, Q60) + m2 + 0x2ad7d2bb) <<< 15

Q63 will also have an effect on Q64.

This might allow me to intervene on the last 64 bits of the hash function; however, any change on m2 will impact the way in which Q63 and Q64 are calculated so I'm not sure if this can help.

Any ideas or suggested reading that could point me in the right direction? (GPU + brute force is the last thing on the list - I'm hoping there's another way to do it)


texts: Shannon entropy calculation: is $H(A|R·A) = H(A)$?

texts:
Suppose I generate a random $m×m$ matrix $R$, where each of its elements belongs to $\mathbb Z_n$. I ensure that $R$ is invertible in $\mathbb Z_n^{m×m}$.

Now I take a non-random $m×m$ matrix $A$, where each of its elements belongs to $\mathbb Z_n$ and is not zero. I now multiply them both together to obtain $R·A$ and reduce $R·A$ modulo $n$.

My question is about its Shannon entropy: Is $H(A|R·A) = H(A)\ $?


texts:
What is the chances to forge a signature for the system implementing Rabin signature with total message recovery, if attacker posses the public key and have some message pairs? The last byte of message to be signed is freely changeable.
The attacker doesn't have access to signing oracle.


texts:
Which block (cipher) algorithms are the most popular and most used today?
What parameter values (block length, key length) are now considered standard (safe).


texts: Are all block ciphers FPE (format preserving encryption)?

texts:
A FPE preserves the format. There is a correspondence between the format of the ciphertext and the plaintext.

Given that a message in some binary enconded format can easily be divded in some l blocks of n bits which will be encrypted to l blocks of n bits I would call (some necessary padding issues ignored) pretty much a format preserving encryption).

Is this true? Are block ciphers considered to be FPE?

Or are the ciphers working on blocks which have a disparity of the input->output ratio of either block numbers and block size?


texts: Encrypting data with HMAC-SHA1 challenge response as the key

texts:
I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data.

Generate a non-secret 64 byte random string $M$ (fixed challenge)
Generate a secret 20 byte random string $K$ (HMAC key)
Compute $E = \operatorname{HMAC-SHA1}(K, M)$

$E$ is a 20-byte encryption key that is used to encrypt some data (with some well-known cryptographically secure algorithm). $M$ is kept alongside the data, while $K$ is separated from it and kept secret. Whenever data has to be accessed, $K$ is retrieved and the HMAC computation is repeated to re-generate $E$ and decrypt the data.
Is this algorithm secure, assuming that $E$ and $K$ are kept secret?


texts: Finding scalar that creates a point with zero X-coordinate for popular elliptic curves

texts:
In signature creation in ECDSA we use a nonce, commonly identified as $k$.
To create an ECDSA signature, we need to calculate two integers, commonly identified as $r$ and $s$.
$r$ is simply the X-coordinate of the base point multiplied by $k \bmod n$.
$s$ is the actual signature, so it's $s = k^{-1}\cdot(z+d\cdot r)\text{ mod }n$, where $z$ is the number signed (usually the hash value as a big-endian integer), $d$ is the private key, and $n$ is the order of the base point.
Now, if a curve includes points with X-coordinate equal 0, then there may exist such a scalar that when multiplied by the base point it will result in a point that has such coordinate. That's true for some popular curves like NIST P-256, points

$\small{(0, \texttt{0x66485c780e2f83d72433bd5d84a06bb6541c2af31dae871728bf856a174f93f4})}$ and
$\small{(0, \texttt{0x99b7a386f1d07c29dbcc42a27b5f9449abe3d50de25178e8d7407a95e8b06c0b})}$

lay on the curve, and the curve has cofactor $1$, so we know that there is such $k$ that will generate them.
The ECDSA algorithm does require a retry with a different $k$ if either $r$ or $s$ ends up $0$, but I'd like to test if that code actually works correctly.
My questions:

Do we know of $k$ values for the popular curves (like the NIST P-256) that create points with $x = 0$?
Is there an algorithm to find them?
Same for the $s$ value: do we know of a triplet of $k$ value, message, and the private key that will result in $s = 0$ when using one of the popular curves?
If so, how would I go about finding it?

I did try a brute force approach (keep adding a base point to an accumulator, check fox x becoming zero), but that's too slow even for the likes of secp112r2.


texts: Zero knowledge proof in smart parking managment systems

texts: I read this paper on protecting user privacy in smart parking management system. It talks about using zero knowledge proofs to protect privacy but I am not certain how they do it.  My assumption is that the Verifier has the public key of the User and sends the User challenges that the User needs to complete with its private key. Would be great if someone could clarify this to me.


texts: Which safe elliptic curves allow for the fastest scalar multiplication

texts:
I'm specifically looking for curves that are safe (ideally on this list: https://safecurves.cr.yp.to/) and which allow for the fastest scalar multiplication operations on arbitrary points.

By 'arbitrary', I mean scalar multiplication with points other than the base point, which are only expected to ever be encountered once, and therefore cannot be precomputed in advance for scalar multiplication in order to speed things up.


texts: How do I prove the tracing part in a ring signature model?

texts:
I have a question about the article “efficient and multi-level privacy-preserving communication protocol for VANET” by H. Xiong et al.

I need the ID of malicious vehicle, but I could not prove how I can get its public key from the equation given in the part of OBU fast tracing on page 5.

How do I prove that the equation in section 3.4 is correct?

Page 4:

Page 5:


texts: Assume G(s) is a PRG, is the following also a PRG?

texts:
Let s be a n-length binary word and not_s its negation. Let G be a PRNG with expansion 2n.

Prove that H1(s) = G(not_s) is also a PRG?

Prove that H2(s) = G1(s)||G2(not_s) is also PRG. Given G1, G2 are both PRGs and the || is concatenation

I honestly don't know how to make of this question as I am pretty new. But maybe you can prove it just by saying the existence of a distinguisher D which can predict the output of G(not_s) would imply that you can predict the output of G(s) too by flipping the End_output. This would imply G is no longer a PRG. so... done?
As for the 2nd part to the question – my guess here would be to choose G1 as H1 so we would have 2 normal PRGs as proven in a but the concatenation of the output string would be G2(not_s)||G2(not_s). Then we can say H2 is not a PRG but i don't know how to explain that formally?


texts:
In SIDH both parties agree on the key in following way:

Alice calculates a kernel $R = mPB + nQB$
Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$
She uses $\phi_a$ to start hers random walk and ends up with trio $(E_a, \phi_a(PB),\phi_a(PB))$
Now she sends this trio to Bob (I know, she actually sends 3 points)
Bob does the same, let say his secret isogeny is $\phi_b$. Upon receipt of corresponding trio from Bob $(E_b, \phi_b(PA), \phi_b(QA))$ Alice uses $m, n$ to compute new kernel $R' = m*\phi_b(PA) + n*\phi_b(QA)$ and new isogeny
Then she starts from $E_b$ and does the random walk again ending on $E_{ab}$
Bob proceeds mutatis mutandis and ends up on a probably different curve $E_{ba}$, but surely in same isomorphism class as Alice. Thanks to j-invariant then can agree on a shared secret $j(E_{ab}) == j(E_{ba})$

Now, I've to say point 6. and 7. are a bit black magic to me. I understand that we have this equality here:

$R' =m*\phi_b(PA) + n*\phi_b(QA) = \phi_b(m*PA + n*QA)$

But still, why exactly they will end up in the same isomorphism class? What is a mathematical base, for those two isogenies to converge to the same class. I'm wondering how would a proof look like for this.


texts:
I have a server and a client that need to authenticate to that server.
The idea is that we have user/pass and the authentication generates a token that can later be used.

An important factor here is that I want to reduce the number of network round trips as much as possible.
I came up with the following scheme:

Client generates a single use public key / private key
Client sends the server the following:

user
public key
hash(public key + pass)

The server load the relevant user and computes hash(public key + pass)
It then generates a token that the client will use, and encrypt that token using the public key.
Client decrypt the token using the private key, and can then use it.

The issue of token security is not relevant here. It is expected that most users will use this over HTTPS, but we need to avoid sending the password on the clear for cases where users use HTTP internally inside the organization.

As I figure, we prevent replay attacks using this approach because only the client can decrypt the token.

I'm aware that if an attacker can listen to the network they can just sniff the token on the next request after authentication, but that isn't the concern here.

Are there any holes that I'm missing?


texts: Can a message encrypted with one AES-256-GCM implementation always be decrypted with another?

texts:
I have a cookie being encrypted with AES-256-GCM in Rust using ring. I need to decrypt the cookie in Node.js. I'm using the standard crypto library, but it's just not working.

My understanding is that different implementations of AES-256-GCM algorithm should be compatible as long as they

Use the same key
Use the same ADD, and
Use the same IV/nonce. (Node.js calls it IV, ring calls it nonce.)

Is this correct?

I just want to double-check before spending even more time on this.


texts: Is there a technique to confirm that a given large integer value is a product of two primes?

texts:
Given a list of 2048 bit integer values in which one or few 2048 bit integer values
may be product of two prime numbers and other values may be just 2048 bit odd integers numbers.

My question is -
Is there a way / technique (apart from brute-force) to confirm that a given 2048 bit integer value is product of two prime numbers or not?

Is there any pattern in an integer value which is not product of two prime numbers?


texts: Authenticated encryption with Signatures

texts:
I've given a CPA secure private key encryption scheme (wich gets to a CCA secure scheme or better to an authenticated encryption scheme, when i combine it with a given MAC) and a unforgeable public key signature scheme. I want to combine both to get an authenticated encryption scheme.

My approach was to first sign the message and then encrypt(+MAC) the message with the signature. I think this should work.

But is there any possibility to combine the CPA secure private key encryption scheme with the public key signature scheme and get an authenticated encryption scheme, without using the MAC to ensure authenticity and integrity?

Mac AND Signatures seems like doing the same thing twice since encryption+mac leads to an authenticated encryption scheme. But i have to use Signatures in my scheme.


texts: Is there a standard benchmark data set for "Homomorphic Encryption" implementations?

texts: Both in terms of statistical analysis (mean/variance, histograms, contingency tables, etc) and machine learning data sets. The question has also been asked here.


texts: A simple keyed message authentication code using XOR

texts:
Suppose I have a key that is at least 32 characters in length and provides at least 128-bits of entropy. If I picked from the character set of [a-hjkmnp-z2-9-], then I know that each unambiguous character provides exactly 5 bits of entropy if built from a CSPRNG, such as /dev/urandom. Thus, a 32-character string would meet my requirements by providing 160-bits of entropy. Something like amjgg6d3e9v7makwad2y544qtz-wxu9x. Suppose also I have a 16-character base64 salt. Something like BGTH8iPYi16nJCCh.

Now, suppose I hash the concatenated password and salt with SHA-256(salt||password), giving hex string H1;

3b1a89849599a9a2b8ebfa34fb4f9ef7fc26093980fb49901d6670329fcc8da8

And suppose I hash the message "foo bar baz" with SHA-256 as well, giving hex string H2:

dbd318c1c462aee872f41109a4dfd3048871a03dedd0fe0e757ced57dad6f2d7

My question is this: Aside from the cryptographic strength resting on the entropy of the provided key, and the cryptographic strength of the hashing function, what is cryptographically weak with the MAC construction of H1 XOR H2, which provides the following as a hexadecimal string as a MAC?

e0c9914551fb074aca1feb3d5f904df37457a9046d2bb79e681a9d65451a7f7f


texts:
I usually generate a key pair using OpenSSL or Bouncy Castle.

I'm using curve secp256k1.

The 256bit private keys look fairly random.

Do all values of "private key" have a corresponding public key?

If so, can the public key be found for all arbitrary 256bit values, when treated as if they were private keys?

If not, is there a way to tell whether a 256bit value could be a private key?


texts: Parallelizing MACs by subdividing the message and then aggregating results

texts:
Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC.

Could these be securely parallelized by computing multiple MACs in parallel and then combining the result? This is sort of academic, just curious though.

Let's say you have a message being that you split into four parts such that M==M1|M2|M3|M4. You then compute CMAC on each of these and then a final CMAC on the results.

T=CMAC(CMAC(M1)|CMAC(M2)|CMAC(M3)|CMAC(M4))

The advantage is that this could be implemented in a way that exploits instruction-level parallelism. Instead of splitting the message into four chunks you could implement this by computing four CMACs in parallel with a stride of 4*B where B is the block size of the cipher (e.g. 128-bit for AES). The final CMAC could also be done sort of in parallel with the last block of each component CMAC.

You could also potentially use those crazy 4X parallel AES instructions on CPUs that support AVX-512 to do four CMACs in true parallel.

Obviously, the result would be different from CMAC(M), but would the security be equivalent? This is basically a hash list so I'm thinking yes, but the MAC use case is different from ordinary hash use cases.

Edit: an even bolder thing would be to just compute four CMACs and XOR them, but since XOR is commutative that makes me think it would be vulnerable to chosen-plaintext attacks.

Edit #2: it appears the XOR case may be secure if each MAC is independently keyed, but I'd want to look into it more.

Edit #3: alternatively it seems like CMAC(M1|CMAC(M2)|CMAC(M3)|CMAC(M4)) should be secure if the above is secure. This can be done in parallel by computing CMAC on all four parts (or stripes) of the message and then doing three more blocks of the first CMAC to incorporate the siblings.

Edit #4: thinking about this more, I think the fastest algorithm would be to do N parallel HMACs/CMACs with different keys and then XOR them together. This is secure as long as the MACs are secure. You can't swap anything because the keys are different and so e.g. CMAC[k1](M1) XOR CMAC[k2](M2) != CMAC[k1](M2) XOR CMAC[k2](M1). On an AVX2 enabled machine you could use _mm512_aesenc_epi128 to do four CMACs at once with different keys in true parallel. Even without that instruction level parallelism would kick in if the CPU does it.

So you would have something like (pseudocode, using CMAC-AES with 16-byte blocks):

K1 = KDF(K,1)
K2 = KDF(K,2)
K3 = KDF(K,3)
K4 = KDF(K,4)

while (remaining >= 64) {
  CMAC_BLOCK(K1,input)
  CMAC_BLOCK(K2,input + 16)
  CMAC_BLOCK(K3,input + 32)
  CMAC_BLOCK(K4,input + 48)
  remaining -= 64
  input += 64
}

// ... do final blocks with padding ...

MAC = CMAC_FINAL(K1) XOR CMAC_FINAL(K2) XOR ...

A highly optimized implementation would interpolate the instructions for each AES round to allow ILP to work or use SIMD AES like _mm512_aesenc_epi128 if available.


texts:
I have implemented a ECC key generation scheme successfully. Now I need to find ECC key sizes of each generating key pairs. I assumed that ECC key size is the size of the ECC private Key.

So I would like to to know whether this is correct?


texts: Role of trusted party in the Ideal model in Malicious case

texts:
Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private sets to the server. The server computes the private set intersection and returns it to $B$. $A$ and $B$ are honest but server is malicious. The server learns nothing about the input and output of the computation. Since the server may change the result, $B$ needs to ensure the result is correct. The only thing the server learns is the number of elements in the clients’ set.

What I need to know:  1- In ideal model to simulate a malicious server, do $A$ and $B$ first send their sets to a trusted party (TP) and then TP gives the set size to the simulator? 2- Does the server compute the intersection and return to TP and then TP only checks the correctness of intersection? 3- In general, the responsibilities of each party (e.g. simulator, trusted party) in ideal model are not clear to me.


texts: Why does Ed25519 scalar multiplication allow values larger than the subgroup order?

texts:
The GeScalarMultBase function is documented like so. From the way it is documented we see that it expects a little-endian value and has a precondition that constrains the range it accepts.

// GeScalarMultBase computes h = a*B, where
//   a = a[0]+256*a[1]+...+256^31 a[31]
//   B is the Ed25519 base point (x,4/5) with x positive.
//
// Preconditions:
//   a[31] <= 127
func GeScalarMultBase(h *ExtendedGroupElement, a *[32]byte) {

My understanding of elliptic curves has me thinking that the range of accepted values for scalar point multiplication should be in [0, subgroup_order]. While it could accept larger values since $(n+x)G = xG \pmod n$ it would be wasteful computationally so I'd expect the function to constrain it to the subgroup order or always mod it before using it.

In Ed25519 the order constants are defined like so:

field_order 2**255 - 19
subgroup_order 2**252 + 27742317777372353535851937790883648493

Comparing these to what that method documentation says:

# hex in little-endian
field_order: 0xdefffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7
subgroup_order: 0xde3d5fc5a13621856dc97f2aed9fed4100000000000000000000000000000001
GeScalarMulBase states: a[31] <= 127 (0xf7)
field_order[31]: 0xf7 (127)
subgroup_order[31]: 0x01 (16)

Since we are working in little-endian, byte 31 is the most significant byte and we see from the documentation that the function enforces it is less than 127, which maps to the field order.

This seems to indicate it accepts values in the range of [0, curve_order] instead of my expectation of [0, subgroup_order].

Is my understanding of what's happening accurate? If so, is there a particular reason this allows values larger than the subgroup order?


texts: On keyword for generators of composite moduli

texts:
The link says $n$ has a primitive root if and only if $n$ is of certain form ($n=ap^k$ where $a=1$ or $a=2$ if $p$ is an odd prime or else $a=1$ and $k\leq2$ holds).

In particular $n=pq$ or $n=pqr$ where $p,q,r$ are not all equal primes are disallowed.

Yet in here discrete logarithms modulo such $n=pq$ or $n=pqr$ forms are defined and used (by this I mean there is a $g$ that generates $\phi(n)$ elements and this is used as generator).

Since generator $g$ cannot be primitive root what is the keyword for $g$ for these $n=pq$ or $n=pqr$ forms?

I tried this in mathematica with no use. How to search for these generators in mathematica?


texts: Is MD5 particularly vulnerable when given multiple MD5 hashes using a common, secret suffix?

texts:
Suppose I've got a list of "passwords" that are hashed using the same suffix, so basically what we do is hash = md5_digest(prefix+suffix), with suffix being a constant.

Now, if I know a single prefix and hash pair, I can trivially do a brute-force search for suffix.

But given multiple different known matching pairs of prefix and hash, is there a better than brute-force way of finding the value of suffix? Is there an algorithmic vulnerability of MD5, relying on the internal state that would allow me to do this? Or, alternatively, to construct a fake prefix that would generate a known hash when concatenated with the unknown suffix?

Update: Please don't suggest alternative hashing schemes, as I'm not designing a system or anything, I just want to understand how MD5 works.

Update 2: Okay, I might not have made myself clear enough. I'm not interested in any other "solution" for the simple reason that my problem isn't "how do I secure this system?" but "how does this specific algorithm behave?". Yes, I do know the difference between a hash algorithm and message authentication, yes, I do know HMAC, yes I do know MD5 is broken.


texts: Discrete logarithm with exponentiation oracle

texts:
Suppose $(n, d)$ is an RSA private keypair. We know the public key only (wlog suppose it's $(n, 2^{16}+1)$ and we are given oracle $E$, decryption oracle for $(n, d)$. Is there any efficient algorithm to recover $d$? This is a bit easier than directly attacking for known pair of plaintext and ciphertext, as for any $m$ we can astablish this relation:

$$
E(m) \equiv m^d \pmod n
$$


texts:
Background of the problem: I am undertaking a blockchain course at University and I have taken up a case study for blockchain that relates to logistics. The requirements are simple, yet I am confused with the storage segment of blockchain. Given that we have a table of deliveries to be made, I incorporate certain fields of the table into the blockchain.

Problems Faced:

Would the data (payload of the block) be stored as plaintext?
And how would I verify that the table hasn't been tampered with and it satisfies the blockchain?


texts: Perfect secrecy and known ciphertext length

texts:
From what I understand perfect secrecy means that the probability distribution of the messages are independent of the cipertext, right? How can the one time-pad be perfectly secret when the ciphertext is as long as the message in terms of bits?

Because for a given ciphertext I could for example know that my message is not longer than my ciphertext and therefore I could say that a given message occurs with higher probability?


texts: As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?


texts: Simulation-based proof in the semi-honest model when a party is corrupted

texts:
Full paper

Would you mind telling me based on the attached file, why in case 3(corrupted client B), the authors did not use the real input which is $S_B$ and instead they have generated $S'_B$? In this case, I think the reason why authors have generated $S'_A$ is that party B has no access to $S_A$(belongs to party A), but why did they generate $S'_B$, considering that party B has access to $S_B$(the real input)? So, based on this security proof, the input $S_B$ has no role in the process of the simulation by the simulator!

It would be highly appreciated if you could help me with this.


texts: Costs of operations in elliptic curves explanation

texts:
I'm trying to understand the cost of operation in elliptic curve (only Weierstrass curve for simplicity) from Wikipedia and there seems to be lack of online information/papers regarding this. I understand the concepts of EC, EDSA, point addition, multiplication, inverse and doubling.

My question is: what does the values of the table represent?

Why aren't the units in seconds?

Why does ADD have more operation, I thought they were the "cheapest"?

If someone could provide a sort of overview, it would be much appreciated.


texts: Which public key encryption scheme is re-randomizable? How can I re-randomize an encryption scheme?

texts:
Which public key encryption scheme is re-randomizable?
Is there any library for re-randomizable encryption scheme?
If not, how can I re-randomize a given public key encryption scheme?

I cannot find any papers about re-randomizable encryption.


texts: I am trying to understand AES-GCM and I do not understand what I should transmit to Auth Data during encryption. What kind of data is that?


texts:
Is KDF based on HMAC-SHA-256(Hashed Message Authentication Code, Secure Hash Algorithm) algorithm a suitable option to generate symmetric key from the secret key?

What is the basic funda, behind using KDF after getting the secret key. Can the secret key itself be used as the symmetric key.


texts:
The following is a quote from Wikipedia:

One key insight is that the same encryption key can be used for both, provided that the counter values used in the encryption do not collide with the (pre-)initialization vector used in the authentication.

The entire article can be found at:
     https://en.wikipedia.org/wiki/CCM_mode

I do not understand what it is saying. I am hoping somebody can explain it to me.

Thanks
Bob


texts: Is the software that uses PGP broken, or is it PGP itself?

texts:
PGP is all over the news (even on TV) and there seems to be a lot of confusion about it.

For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take action now which tell readers to deactivate their PGP plugins while raising concerns related to PGP beyond email client software and good, old email itself.

  A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME.

Since I've been asked about the status of PGP several times today, I think a short Q&A related to this makes sense.

Do the new vulnerabilities mean that

there is a problem with PGP itself (as in: we should not use PGP encryption/signing at all), or
do the vulnerabilities "merely" point to a problem with email clients and the way they handle things (as in: PGP is fine outside or your email client)?

Differently stated: I'm asking to clarify if it is still safe to use PGP itself (eg sign/encrypt via commandline and transmit via non-email channels) or if there's a problem with the cryptographic internals of PGP.


texts: If I generate an MD5 hash from 2 pieces of information – i.e. by concatenating two strings – how easy is it to guess what that hash is, assuming an attacker has knowledge of only 1 piece of those info?


texts: The way to break Diffie-Hellman(small nonprime number)

texts:
i am wondering how to break DH（small nonprime number）.
Let's say we don't know:

$a$: Alice's private key

$b$: Bob's private key

And we know:

$N$: nonprime number

$p$,$q$:  $N = p * q$ ($p$ and $q$ are prime number)

$g$: the base

$A$: Alice's public key   A = pow(g, a, N)

$B$: Bob's public key B = pow(g, b, N)

Now we want to calculate
shared_secret = pow(A, b, N) or shared_secret = pow(B, a, N)

If we want to find shared secret, we need to find private key $a$ or $b$ first.
We now have $g^{a} \equiv A \bmod pq$

And then
 ${x_p}$ with $g^{x_p} \equiv A \bmod p$
 ${x_q}$ with $g^{x_q} \equiv A \bmod q$

And then
$x_p \equiv x \bmod p-1$
$x_q \equiv x \bmod q-1$

I know we need to use the Chinese Reminder theorem after that, but i don't know how to start it. Any suggestions?


texts:
It was suggested to choose $k$ large Blum primes
($k > 2$), and compute $m = p_1\cdot p_2\cdots p_k$.

The trusted center (TC), who knows the prime factors of $m$,
computes for each user $U$: $(e_U , d_U )$ and sends it to him. Each user publishes $e_U$ and keeps $d_U$.

The question is whether someone apart from the TC can find the factorization of $m$.

One weakness of the scheme is that if the same message $x$ is transmitted to two different users an eavesdropper can obtain $x$ using Bezout's identity, which is also a weakness of the regular RSA in a shared modulus system.

In a 'two primes RSA' system with shared modulus a user can find $p,q$ with very high probability using his public and private key.

But what can be said with $k$ primes? I don't see how to use a similar approach like I used in the two primes case in order to obtain $(p,q)$, nor do I know how to prove the security of it.


texts:
Since a nonce must be unique and that time only goes forward, is it safe to use the Unix epoch as nonce ?

My use case is be AES w/ GCM which recommends a nonce length of 12B. Current Unix time can be represented using 4B, so that leaves the upper 8B free for future timestamps (plenty of space).

One possible security implication is the forgery of NTP replies, which would cause the client to use a Unix timestamp in the past (i.e. breaks the stream cipher). Secure channels should prevent this from happening, but a bad operator could always force bad NTP replies.


texts: Preventing attack in RSA modified version

texts:
I have the following modified version of RSA apparently proposed by Shamir. To check the original version of RSA check the first scheme in this other question.

  The modified version goes as follows: que take $p$ a prime number of
  $s$ bits and $q$ a random number not necesseraily prime of size $ts$
  where $t \simeq 10$ and take $n = pq$. The public key and the
  encryption function are as in RSA shown in the link.

We can show that the decryption problem is equivalent to find the factor $p$ of $n$. Namely, to show that decrypting would imply finding factor $p$ we do at follows:

Choose a message $p < m < 2p$ and write $m = u + p$ then $m = m^{ed} \, mod \, p = (p+u) \, mod \, p = u$ so that $p = m-u$.

Here we used the fact that decrypting with $m^{ed} \, mod \, p$ is good enough (is injective if we choose $gcd(e,p-1) = 1$.

My question

In the previous the deduction we actually chose a convenient message to show that solving decryption problem implies factoring $n$ but in reality we won't get a chosen message $m$ but  random ones so that even if we know how to decrypt we might not be able to find out $p$. How is this deduction valid then?
The notes I'm following propose a way to thwart this attack.

  One can add some redundancy in the message before encryption, and
  check the redundancy after decryption before disclosing the result.

I don't see very well how this strategy would work. Can you give an example?


texts: Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the abbreviations in "NIST security categories" column mean? Where can I find a formal definition of them?


texts: How much data can I encrypt with RSA before I need to change the key

texts:
How much data can be encrypted with the same RSA key before it has to be changed?

I looking for the total amount of data that can be encrypted for a single key pair, not the maximum length of data per iteration.

As an example, let's take a 2048-bit RSA key with a PKCS#1 "v1.5 padding". We can compute that the the maximum size of data which can be encrypted per iteration is 245 bytes (2048 bits - 88 bits). How many times can I reuse that key assuming that it encrypts 245 bytes each time?

I find a lot of information on this for AES but almost nothing for RSA.


texts: Proving that there is no scheme which would be perfectly CPA-secure

texts:
A private-key encryption scheme Π = (Gen, Enc, Dec) has perfectly indistinguishable encryptions under a chosen-plaintext attack, if for all probabilistic polynomial-time adversaries A it holds that
Pr[PrivK_cpa(n) = 1] = 1/2. I need to show that there is no encryption scheme that can satisfy this definition.

The perfect indistinguishably under a chosen-plaintext attack: Pr[PrivK_cpa = 1] = 1/2

implicates

the perfect indistinguishably in the presence of eavesdropper: Pr[PrivK_eav = 1] = 1/2.

Which, in turn, implicates perfect secrecy: Pr[Enc_K (m) = c] = Pr[Enc_K (m') = c] for all m, m' from M, c from C.

Is my argumentation correct to this point? If so, could you, please, tell how can I now find the contradiction between the scheme being perfectly secret and perfectly indistinguishable under a chosen-plaintext attack? Should I find the contradiction using the definition of the perfect secrecy (above-mentioned) or should I use the fact that |K| should be >= |M|?

I saw this post Is there such a thing as perfect CPA security? with the same question but it does not help as there the fact that Enc is probabilistic rather than deterministic is mostly discussed.


texts: Why can ECDSA public keys be sent over an insecure network, while ECDSA is used to sign ECDH public keys to securely be transported over the network?

texts:
Basically the title says it all. I am trying to develop and understand an ECDH-ECDSA encryption.

My current approach to provide some form of authentication to the ECDH is to use ECDSA to sign the public key of ECDH before sending it over the network, in order to allow the receiver to verify the sender.

However, after reading up on some ECDSA implementations, I am quite confused about the way ECDSA public keys are being handled.

In my implementation, I wanted to hardcode a static key pair into both sides, as I am not planning on making it a high scale public implementation. That way I don't have to expose my keys and fear any man in the middle attacks - given I understood everything correct.

However, most solutions seem to simply send the ECDSA public key over an insecure channel.

But isn't this what ECDSA is trying to prevent? Why is the algorithm doing exactly what it is trying to prevent itself?


texts: What problems might you encounter if you use a block size much greater than AES?

texts: What problems might you encounter if you use a block size much greater than AES (1000 bits, say)?


texts: In RSA encryption, does the value of e need to be random?

texts: I am a novice programmer and am just finishing up an RSA encryption program that I am writing for practice. Currently I have the program generate a relatively small random value for the public key e. When adding the finishing touches, I realized that there was no point for e to be random. Is this thinking correct?


texts:
I am trying to have some MiFare Plus SE cards manufactured but I was told that I need to give instructions on the HMAC encoding method, as shown in the image, which I understand and have done, but also I have to produce a table with the AES-Key Sector Values like the one shown below. I tried to read the MiFare Plus SE documentation/datasheet found on the NXP website but I am unclear of how to go about the encryption as I am new to this and the table that the manufacturer provided me as an example doesn't seem to match the MiFare Plus SE EEPROM organization datasheet.
I realized that if the address has a Key Type A then you multiply the sector by 2 resulting in the key address, and if it has a Key Type B then you multiply the sector by 2 then add 1 to get the key address. But I would like to know if I am supposed to use a different plain text, IV and secret key for each key address - 4000, 4001, etc - to generate the AES hash values in the Volume column? Or do I reuse the same plain text per card, but change the IV and secret key for each address?
Any guidance on this process would be useful. Thank you


texts: Feasibility of finding public key when private key is known

texts:
We all know that in a public key cryptosystem, given a public key it is extremely hard to compute private key from it.

Is it the same case in reverse?

Given a private key, how easy is it to compute public key out of it?

It would be great to have answers with respect to an algorithm like RSA.


texts:
Referring to both

Wikipedia page and
ECDSA-cert paper

I can understand that, given $\mathcal{E} = \mathcal{E}(a,\,b,\,\mathbb{F}_{2^m})$ as our elliptic curve on $\mathbb{F}_{2^m}$ group

$G \in \mathcal{E}$ is a generator of the group, i.e. $\exists n: n\times G = O$
$n$ is the order of point $G$ with respect to the group
choosen randomly $d_A\in[1,n-1]$ as a private key,
$Q_A\triangleq n \times d_A$ is the public one.

Got it, but in the "Key pair validation from Bob" process, I see that $Q_A$  must respect these bounds:

$Q_A \neq O$ (trivial)
$Q_A \in \mathcal{E}$ (trivial)
$Q_A\times n = O$

I can't really understand the last thing. I'm not very acquainted with EC algebra, but comparing $Q_A\times n = O$ with $n\times G = O$ seems the same thing, so I would conclude that $Q_A=G$, which is clearly false.

What am I missing?


texts: Cryptanalysis of MD4 (Wang et al) -- how did the authors come up with the collision differential?

texts:
Edit:
ok, after I re-read the paper a couple of times it is clear that Table 6 is  easily derived from Table 5, which describes the collision differential. So the real question is: how did the authors come up with the collision differential?

Original question:

The paper Cryptanalysis of the Hash Functions
MD4 and RIPEMD describes a set of sufficient conditions for collisions of MD4 (Table 6 in the paper). The authors explain how to verify these conditions, but there is no info about how they got them in the first place. I'm curious, what could be a possible procedure?


texts: Are analog quantum computers a threat to RSA and DLP?

texts:
We already know that D-WAVE's "quantum computers" can't really run the Shor's algorithm, because the way they're built doesn't qualify them as universal quantum computers.

Now researchers actually found out that so-called analog quantum computers can be scaled much better and quicker (for now) than normal, digital ones. (relevant paper)

Now for the important question:
Can analog quantum computers run any (currently known) algorithm, dangerous to modern cryptography?


texts: Boolean XOR function a valid way to verify the integrity of a message

texts: Does the Boolean XOR function represent a valid way to verify the integrity of a message ?


texts: Why pairing based crypto is suitable for some particular cryptographic primitives?

texts: Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for that schemes while other schemes do not feet?


texts: Does AES-ECB with random padding added to each block satisfy IND-CPA?

texts:
I present a modified version of AES-ECB. Suppose I want to encrypt the string hello, world. this is a test. For each block, I use the first eight bytes as my actual message, while the second eight bytes are random. For the last block, I'll pad my first eight bytes deterministically. So my four blocks are (I'll use * to denote random bytes, and $ to denote deterministic padding):

hello, w********
orld. th********
is is a ********
test$$$$********

Then I encrypt each block with AES to obtain my cipher text.

I know that this encryption scheme is still malleable. Is it still distinguishable under chosen plaintext?


texts: Are there any authenticated encryption methods that combine encryption and authentication, rather than useing a separate cipher and MAC?


texts: Understanding how to proof an encryption scheme is perfectly secret

texts:
Consider each of the following encryption schemes and state whether
  the scheme is perfectly secret or not. Justify your answer by giving a
  detailed proof if your answer is Yes, and a counterexample if your
  answer is No.

  Consider an encryption scheme whose plaintext space is
  $\mathcal{M}=\{m\in\{0,1\}^\ell \mathrel{|} \text{the last bit
of $m$ is $0$}\}$ and key generation algorithm chooses a uniform key from
  the key space $\mathcal{K}=\{0,1\}^{\ell-1}$. Suppose $\mathit{Enc}_k(m)=m
\oplus (k\parallel 0)$ and $\mathit{Dec}_k(c)=c\oplus (k\parallel 0)$.

$\newcommand{\given}{\mathrel{|}}$The definition of perfectly secret which states:
An encryption scheme $(\mathit{Gen}, \mathit{Enc}, \mathit{Dec})$ with message space $\mathcal{M}$ is perfectly secret if for every probability distribution over $\mathcal{M}$, every message $m\in \mathcal{M}$, and every ciphertext $c\in \mathcal{C}$ for which $\Pr[C=c]>0$: $$\Pr[M=m\given C=c]=\Pr[M=m].$$

We first compute $\Pr[C=c\given M=m']$ for arbitrary $c\in \mathcal{C}$ and $m'\in \mathcal{M}$.
\begin{equation*}
\begin{aligned}
\Pr[C=c\given M=m'] & =\Pr[\mathit{Enc}_K(m')=c]=\Pr[m' \oplus (K\parallel 0)=c] \\
& =\Pr[(K\parallel 0) = c\oplus m']=2^{1-\ell}\quad (1)
\end{aligned}
\end{equation*}
where the final equality holds because the key $K$ is a uniform $\ell-1$-bit string. Fix any distribution over $\mathcal{M}$. For any $c\in \mathcal{C}$, we have
\begin{equation*}
\begin{aligned}
\Pr[C=c] & = \sum_{m'\in\mathcal{M}} \Pr[C=c\given M=m'] \cdot \Pr[M=m'] \\
& = 2^{1-\ell} \cdot \sum_{m'\in \mathcal{M}} \Pr[M=m']=2^{1-\ell}\cdot 1=2^{1-\ell}\quad (2)
\end{aligned}
\end{equation*}
where the sum is over $m'\in \mathcal{M}$ with $\Pr[M=m']\neq 0$. Bayes' Theorem gives:
\begin{equation*}
\begin{aligned}
\Pr[M=m\given C=c] & = \dfrac{\Pr[C=c\given M=m]\cdot \Pr[M=m]}{\Pr[C=c]} \\
& = \dfrac{2^{1-\ell} \cdot \Pr[M=m]}{2^{1-\ell}} = \Pr[M=m]
\end{aligned}
\end{equation*}
Hence we conclude that this encryption scheme is perfectly secret.

MY QUESTION: I tried to follow the set up for the proof of the One-Time Pad being perfectly secure. However, I don't really understand the logic behind the proof (assuming what I did was correct). Can someone clear up why this technique is correct?


texts: Generating keys with HKDF from Diffie Hellman agreement

texts:
In order to generate multiple session keys from a Diffie Hellman key agreement protocol, I'm trying to use the HKDF to generate this session keys. The HKDF algorithm uses an Extraction-Expand procedure. In the extraction procedure, it takes as an input a salt and a source key (in my case it will be the Diffie Hellman generated key). I know that the salt it is a random non-secret value.

My question is: How do I establish this random salt value between two entities? Can I set this value by applying a hash function to my Diffie Hellman key like Salt = HashFunction(DiffieHellmanKey)?


texts: Is $g(x)$, the first $(n -\log(n))$ bit of $f(x)$, a (strong) one-way function?

texts:
Given a (strong) n-bit-by-n-bit one-way function $f$, is $g(x)$, the first $(n - \log(n))$ bit of $f(x)$, a (strong) one-way function, too?

When reading Prof. Sanjam Garg's Graduate Cryptography lecture notes, I came across this problem. I am trying to construct an adv. cracking $f$ based on an adv. cracking $g$, but unable to bound the ratio of $|\{x|g(x) = v$ and $f(x) = v||u\}|$ to $|\{x|g(x) = v\}|$ for arbitrary eligible $v$ and $u$ from the fact that $f$ is a one-way function.

Is there another way to prove/disprove this statement? Thanks.


texts: Composite vs Prime Order Groups in Attribute Based Encryption

texts: Reading about Accountability in ABE currently and the paper "White-box traceable ciphertext-policy attribute-based encryption supporting flexible attributes" when comparing its system with an existing mentioned the fact that theirs is a prime order group scheme while the other is a composite order group scheme. My question is what significance does this have on the underlying scheme. And are there cases where one is preferred to the other or cases where on is applicable and the other is not.


texts: Generic name for (?hash) functions of form $\{0,1\}^n \rightarrow \{0,1\}^{poly(n)}$

texts:
Consider a function $$f: \{0,1\}^n \rightarrow \{0,1\}^{poly(n)} $$

with the following properties:

hard to invert, i.e. given $f(x)$, hard to find $x$
hard to find a collision, i.e given $f(x)$, hard to find $x'$, such that $f(x') = f(x)$
indistinguishable from a random number i.e given $f(x)$ and $y \stackrel{R}{\leftarrow} \{0,1\}^{|f(x)|}$, hard to distinguish w.p. $>1/2$

So, what is the generic name for this type of functions?

(I could model them as them as ideal hash functions, if i did not have the requirement of $|f(x)| = poly(x)$, but with that requirement, is there a 'expansion function' for hashes? or Does PRGs have pre-image resistant property? or OWFs that satisfy the property of indistinguishability?)


texts: Is it possible to have 11 rounds with an AES of 128 bits?

texts:
I want to attack a hardware AES. It is with a 128bit in its key. However, according to the documentation I have 11 rounds in this AES.

I don't understand why I have 11 rounds? What is the role of the 11th round?
Let's suppose that I want t attack the 10th round, must I compute the 10th ciphertext? (I mean that my 11th subkey is different from the 10th round subkey.)


texts: Found weil pairing. Index Calculus method on the results of weil pairing

texts:
Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31).

So I tried to solve this using MOV attack.

The torsion point for them E[5] is R(-25,30i) where is sqroot -1

Chosen two points (40,54) and (48+55i,28+51i)

So calculated weil pairing e(P,R) which is (46+i56) and e(Q,R) is (42+i19)

Now my problem is how do I try index calculus method on these complex numbers.
Can any body help me to solve this.


texts: Can a attacker compute a hash from another hash of the same plaintext (both using different salt)?

texts:
Imagine two PBKDF2-SHA-512 hashes of the same password are generated. Each has individual salt. If an attacker had one hash and the salt of both hashes, would he be able to compute the missing hash or would he gain a significant advantage guessing it?

My situation:
A user inputs a password that should be used for AES encryption. The password is hashed once to get a AES Key. Then a second hash of the password the user entered is generated with a different salt than the first one and is sent to the server together with the salts of both hashes. Can a attacker who hijacked the server, calculate the hash that is used as AES key?


texts: Public key encryption and message integrity

texts:
Let's say I want to send an encrypted email thus I encrypt it with the receiver's public key, so that the receiver uses its private key to decrypt it.

If someone tampers with the message in between then

what kind of tampering can be performed?
wouldn't the decryption process fail since the message ought to be malformed due to the tampering?

Does asymmetric encryption like RSA ensure message integrity without hashing the message with an HMAC? Or is hashing necessary only when utilizing symmetric encryption?

For example at initiation time of the TLS handshake when the client encrypts with the server's public key the symmetric key that's going to be used for the rest of the transaction, does it also uses hashing?


texts: The usual case to distinguish a pseudorandom function from a random function is to assume that the adversary can choose the plaintext blocks. Is there another case (game) in which the adversary can not choose the plaintext blocks ?


texts: Auxiliary Input and the Soundness of Arguments

texts:
Interactive proof systems are often defined such that the interacting parties have access to some arbitrary auxiliary input, as in e.g. Def 4.2.10 of G where a pair of interactive machines $(P, V)$ are an interactive proof system for some language $L$ when the following two conditions are satisfied
Completeness: for all $x \in L$ there exists a string $y$ such that for every $z \in \{0, 1\}^*$
$$\Pr[\langle P(y), V(z) \rangle(x) = 1] \geq 2/3,$$
Soundness: for every $x \notin L$, every interactive machine $P^*$, and every $y, z \in \{0, 1\}^*$
$$\Pr[\langle P^*(y), V(z)\rangle(x) = 1] \leq 1/3.$$
Here $x$ is shared input and $y$ and $z$ are auxiliary inputs to the prover and verifier respectively. The inclusion of auxiliary input is justified by considering such proof systems as part of larger protocols, where the different interactive machines may have already gleaned some information.
When moving to arguments, where only polynomial time $P^*$ are considered, the requirement to include auxiliary input seems necessary, see e.g. Def 4.8.1 G or work on parallel compositions of interactive argument systems PV07.
My confusion comes from the fact that I can imagine moving to the weaker setting of arguments because I want to base the soundess of the protocol on some explicit problem that is conjectured to be computationally hard, e.g. SIS. However, given that solutions to SIS have polynomial length (in whatever the underlying parameter is), if some SIS solutions are given as the auxiliary input $y$ to $P^*$, then $P^*$ can read them and use them while remaining polynomial time.
It seems therefore that we can always specify a malicious prover $P^*$ that checks whether its auxiliary input includes solutions to the conjectured hard problem. Since the soundness definition is quantified over all $P^*$ and $y$, it seems that this always breaks soundness.
Can an interactive argument system based on a computationally hard problem ever be sound? Is the above an issue at all, or just a flaw in my understanding?
Similarly, I have exactly the same questions about provers and auxiliary input in definitions of arguments of knowledge, e.g. Def 9 Lin03 – can an interactive argument system based on a computationally hard problem ever be an argument of knowledge?


texts: Combining CTR and ECB modes to prevent attacks

texts:
In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR followed an ECB.
Now, while their intent was to use this for disk encryption (where the IV is just the unique (but known) location of a block on disk), this approach came with certain weaknesses due to the attack capabilities of an attacker in disk encryption theory. However, I was wondering if there are significant advantages to this CTR-then-ECB outside of necessarily a disk encryption context -- such as encrypting data in a database, for example.
Specifically, any reuse of (IV/nonce + counter) in CTR (for the same key) can trivially lead to a known-plaintext attack if the attacker knows the plaintext of any other blocks also encrypted with that (IV/nonce + counter). And not only just one (IV/nonce + counter) block, but also any "nearby" blocks belonging to those messages as well (due to counter overlap!).
However, if we encrypt with CTR-then-ECB, then the attacker will only know the plaintext of blocks if they are encrypted with the same IV+counter and also contain the same ciphertext as well. In contrast, an attacker of a CTR-only encryption scheme requires only matching IV + counter (to a known block), and an attacker of an CBC-only encryption scheme requires only matching ciphertexts (to a known block).
But is this a significant advantage, or are the probabilities involved here so minute -- especially if using random IV's -- that CTR-then-ECB fails to provide any real benefit? (for example, with AES)


texts: Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

texts:
I have a following use case:
User has his master public (pk) - private (sk) key pair (Ed25519).
In DB we store a public key.
Is there any derivation mechanism D, where when knowing a derivation parameter x we can use it derive a new private key sk2 = D(sk, x) and public key (knowing only public key in DB): pk2 = Dx(pk, x) such that we can verify signature done by sk2 using pk2 ?
In other words, I would like to have a derivation mechanism I can use on the user side and server side, where server doesn't know private key.
Best if it works with Ed25519 keys.


texts: How many computations does it take to figure out the input if you know the function and you know its output to another known function?

texts:
I have no background in cryptography so excuse me if this question is a little basic or poorly defined. I'm trying to build a circuit using microcontrollers that implements a hash function of some arbitrary number that a user inputs. I want to make it such that the person is able to select from a small list of hash functions the circuit is able to accommodate, for example SHA-2, MD5, etc.

What I'm wondering is how "easy" it would be to figure out what someone's input was if they knew exactly what hash algorithms they used and they knew the outputs, where by "easy" I mean how would the number of computations it would take to figure out the input scale up with the bits of the input? Linearly? Exponentially? Is there some general equation or guideline to figure out the maximum number of computations it would take (based on the number of inputs) that doesn't depend on the hash functions themselves, or would it always? I'm assuming that with infinite computations it would be possible, but correct me if I'm wrong.

For the above question I was assuming that you didn't know the number of bits of the input, but if you DID know the number of bits of the input, would that make computing it any "easier" in the same sense?

And lastly, if you also assumed that you knew that the bits were preceded by leading zeros when the number of bits of the input was smaller than the number of bits that the hash function can accommodate, would this change anything?

Please let me know if there are any details I'm missing and I'll try to reformulate. Thanks!


texts: How can I validate a hashed password if all I have is another hash?

texts:
The Scenario
I have a client-side web application that bounces requests against a server-side API.  For the sake of simplicity, every request must pass a username and password.  This is similar to old school XML-RPC where the username and password are passed as parameters in every request.
However, as this is a REST service, some of the requests (GET and DELETE) don't have message bodies and must pass the username and password as query variables in the URL:
GET http://application.url/endpoint?username=xxxx&password=xxxx

This is, frankly, a bad idea.  Requests are logged on the server, so if I send the password in plaintext, it's now sitting in a log file somewhere on the server.  I don't ever want to be sending the password in plaintext over the wire, so I'm stuck with a dilemma.
Approach 1
The first approach to solving this over-the-wire problem was proposed by a coworker:

Encrypt the password using something like Blowfish and store it in the database.
The client hashes the plaintext password plus some salt using some known scheme (i.e. SHA512).
The client send the hash and salt to the server.
The server decrypts the stored password, hashes it with the provided salt, and compares it to the provided hash.

This is an effective means of sending sensitive data across the wire (if the logs were read, no one would be able to snag the password).  But it breaks another one of my personal security rules - I have access to the user's original password!
If the password is stored in the database using reversible encryption, then it's still vulnerable to attack.  Someone could steal my database and decrypt the password.  To me, this is almost as bad as storing it in plaintext to begin with.
The server should not have access to the plain text password.
Approach 2
This approach was suggested in passing by a fellow developer and, on the surface, seems to solve some of my problems.

Hash the password with some salt and store the hash and salt in the database (no plaintext!).
The client encrypts the password using the server's known public RSA key
The client sends the ciphertext to the server.
The server decrypts the password using its private key and hashes the recovered plaintext with a known salt.
The server compares the computed hash with the hash stored in the database.

Once again, an effective way to prevent sending the plaintext password over the wire.  It has the added benefit of never storing the plaintext on the server as well.
But it still bugs me, because the server can see the plaintext after decryption.  Though I can build the system today to be secure, there's no guarantee another developer won't add logging somewhere in the future and write the plaintext to disk.
I'd be much happier if the server never had access to the plain text password.
End Goal
At the moment, approach #2 is the best solution I've come up with and will probably be what I end up implementing.  But there is an ideal solution out there ... I just don't know how practical (or even possible) it might be:

Hash the password with some salt and store both in the database (no plaintext!).
The client hashes the password on its end with its own salt.
The client sends the hash (and the salt?) to the server.
The server runs some other functionality to see if the two hashes (its and the client's) were generated by the same plaintext - it does not get the plaintext.

I could wire up some kind of challenge/response system (where the client asks for a salt, hashes the password with that salt, sends the response, and the server compares it with what it expected), but I'm trying to keep requests to a minimum.  So you'd only make one call to the server when you make the request rather than one call to authenticate and another to execute.
Is this last scenario even possible?


texts: Why aren't Complex number fields used in cryptography?

texts:
Most of the cryptography is limited to use of real integer fields. Complex numbers are seldom used. Is there any reason for it? Wouldn't complex numbers provide more structure?

If there is already some work on this area, I would be happy to learn about it.


texts: What is 'key agility' in relation to symmetric-key encryption?

texts:
I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't understand more than that.

Can anyone give a good explanation of 'key agility' and some contexts in which it is important?