texts: Use cases and implementations of RSA CRT

texts:
I discovered the chinese remainder theorem (CRT) version of RSA cryptosystem which is used in many crypto libraries (OpenSSL, Java...).

The use of this theorem improves the speed of decryption so, why is it not always applied? What are the disadvantages of this version which would explain that it's not always implemented?


texts: Can modular multiplicative inverse be used to create a secure cipher?

texts:
Let $N$ be a large number; and $(e, d, N)$ be a secret-key; where $e$ is a one-time random factor, and large enough (say the more or less the same number of bits as $N$), where $e < N$ and $e * d \equiv  1\pmod N$

Encryption of a plaintext $m$, where $m < N$, is as follows:

$ c = m * e \bmod N$

Decryption of a ciphertext $c$ is as follows:

$m = c * d \bmod N$

How can we prove, if the above defined cipher is secure (or not) under the following conditions?

Message $m$ is randomly padded to $m_p$ before encrypting, where $m_p < N$, matching the bitlength of $N$
$N$ can be re-used
The secret (and random) factors $(e, d)$ are used only once (once per encryption, session, message etc...)

Note: I'm asking this because, optimizations on this cipher can have a direct use on the protocol defined in the question: Random Masking of Padded RSA Ciphertext through homomorphism

Additional question: Does the choice of $e$ and $N$ affect the security of this cipher?


texts: Cracking an appliance's network protocol

texts:
I'm trying to crack my thermostat's network protocol.
I've captured several rounds of network traffic and here is what I've got to work with.

Communicating via HTTP POST
The POST data is JSON followed by ciphertext.
The JSON contains:

A device unique id: 48 bits
An eiv (initialization vector?): 128 bits

The minimum ciphertext length is 32 bytes.
The ciphertext length is always a multiple of 16 bytes
A shared secret key: 32 bits
It's likely that many of ciphertexts have the same plaintext.
The thermostat has very limited computing resources.

I know that AES CBC would produce cipher text of those lengths.
What other encryption schemes might produce this type of output?

Assuming it's AES is there away to detect what the key size is?
What are the common ways a 32 bit secret is expanded to 128 bits?


texts:
Informally, a "Gap problem" arises when solving the computational (or search) version using an oracle for the decisional version. This definition of Gap Problem was introduced by Okamoto and Pointcheval in this paper, originally related to Diffie-Hellman problems.

For example, the Gap Diffie-Hellman Problem (GDH) is to solve the Computational Diffie-Hellman (CDH) problem with the help of a Decisional Diffie-Hellman (DDH) Oracle (which answers whether a given triple is a Diffie-Hellman triple or not).

In the Learning With Errors (LWE) setting, is there any "gap" problem (or similar) that can be assumed to be hard? That is, which computational problem can be defined that is still hard when using an oracle for the Decision LWE? I know that there are some results (see papers from Regev and @chris-peikert) that prove the equivalence of the decision and search versions of the LWE problems. I guess that this means that a "strict" gap problem cannot be defined, since there is a reduction from the Decision LWE to the Search LWE, but maybe some other variant of LWE or related problem still applies.


texts: Can I pre-define the points in Shamir's Secret Sharing algorithm

texts:
With Shamir's secret sharing is it possible to pre-define the points returned by the algorithm?

For simplicity if I have (k, n) where k=2, and n=4, and I have the points X,Y,Z, and Q. Can I create the coefficients so that X,Y,Z, and Q are the points returned from the algorithm.

If yes will it still be secure (or secure enough)?

Edit:

Change my example to k=2 instead of k=1 to keep the comments from degenerating into a discussion on the merits of only needing a single piece of knowledge to access the secret.


texts:
I have been reading about recommendations on the correct use of crypto as a developer and I read at least two references to the obsolescence (so to say) of ECDSA.

https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded
https://crypto.stackexchange.com/a/58382/63254

Is that it? Is ECDSA really obsolete/deprecated ?


texts: Bandwidth and block size for Paillier cryptosystem

texts:
Can someone clarify what is meant by the terms cryptosystem bandwidth and block size for public key cryptosystems;
The context is the Paillier cryptosystem and its Damgård-Jurik generalisation. My intuition is that they refer to the modulus. Since the modulus is $n^2$ and $n^s$ respectively does it apply that they have more bandwidth/block size than ElGamal which computes $mod \;\; q$;
Is this intuition correct;


texts: Double Encrypting with two different keys

texts:
In terms of security, would it be MORE or LESS secure to take, say, an RC4 output (or Serpent) or other, that is encrypted with one key, and to encrypt that output with AES (using a different key)?

> $Data -> Serpent ->  key: $s_key = HASH_HMAC(sha256, "1st Key" .
> $salt1, "HMAC KEY1") = $S_Output
>
> $S_Output -> Rijndael (AES) -> key: $aes_key = HASH_HMAC(sha256, "2nd
> Key" . $salt1 . $s_key . $salt2, "HMAC KEY2") = $AES_Output

As long as I'm using good hashes as keys, would this be MORE secure than using a single key with AES? Is there a risk of the two ciphers colliding in some fashion? If so, would using a stream cipher instead of another xor-type cipher avoid this?

P.S. THIS IS PSUEDO-CODE -- I will be using truly random salts and keys for my data i.e. mcrypt / openssl

I will be using a software based token system like the RSA SecurID that is on a fingerprint-secured thumbdrive that opens a self-contained browser. Each keyholder has a 512 bit has to open the soft-token automatically. Once the token is posted to the auth site, it gives the pair (two people) 90 min to enter the keys.

Repeat the same thing for user# 2 with the second key.

AND THE REAL KICKER -- aside from the php thumb drive token gen, THIS HAS TO RUN ON PHP, killing the possibility of many other libs that are ideal.

Basically, two biometric token systems + two passphrases within 90 mins decrypts the file. But better to use Serpent + AES, AES + AES, or TWOFISH + AES?


texts:
I am trying to understand RSA digital signature algorithm. I am planning to follow these steps:

Sign algorithm:

Take some message $m$
Create digital signature using my private key $[d,n]$: $s = S_a(m) = m^d \bmod n$
Pass my message and signature $[m,s]$

Verification algorithm:

Accept $[m,s]$
Take public key $[e,n]$
Retrieve message: $m' = P_a(s) = s^e \bmod n$
Check authenticity of signature and message immutability by comparing $m$ and $m'$

But I also want to use hashing. I plan to sign not the message $m$, but its hash: $m_{\rm hashed}$. Sign algorithm will probably be changed to:

Sign algorithm (with hashing):

Take some message $m$
Generate hash of message: $m_{\rm hashed}$
Create digital signature using my private key $[d,n]$: $s = S_a(m_{\rm hashed}) = m_{\rm hashed}^d \bmod n$
Pass my message and signature $[m,s]$

I have question about verification steps. Specifically about checking message authenticity in step 4.

Verification algorithm (with hashing):

Accept $[m,s]$
Take public key $[e,n]$
Retrieve message: $m' = P_a(s) = s^e \bmod n$
Check authenticity of signature and message immutability by comparing $m$ and $m'$ ???

Before using hashing we could check authenticity and immutability by comparing $m$ and $m'$. But in this case after step 3, we will get $m'$ as a hashed version (not as original message). How can we compare $m$ and $m'$ if $m$ is original message and $m'$ is hashed version (taking into account that hashing is irreversible and there is no way to decrypt hash back)?

My question: what is the correct algorithm? How to correctly use RSA for digital signature with hashing?


texts: Can 64-bit “PRINCEcore” practically be brute forced?

texts:
There is a cipher called PRINCE proposed in ASIACRYPT two years ago.

See the paper: “PRINCE – A Low-latency Block Cipher for
Pervasive Computing Applications”

The cipher divides the 128-bit key into 64-bit k0 and k1. If I remove the key whitening at the beginning and end. Then the cipher is stripped down to PRINCEcore which only uses 64-bit k1. Is brute forcing the PRINCEcore practical?

Some clarifications:

I dont worry about side channel attacks or fault attacks.
I have seen several attacks on PRINCE (and also PRINCEcore), but they are not significantly better than brute force.


texts: Did authentication/signature primitives fall under the Wassenaar Arrangement?

texts:
I understand that under the Wassenaar Arrangement, encryption algorithms like AES were considered to be some sort of weapon. The legally allowed effective key sizes in export software were limited to something a resourceful attacker could break, presumably to prevent criminals from hiding their communications from some government.

Did authentication/signature primitives fall under such legal arrangements? I see no harm in allowing a full-strength MAC or asymmetric signature provided the encryption is weak or absent.


texts:
I was just wondering if there is a MAC scheme where the key provided after part of the message has been hashed. I was just looking at TLS 1.3 and a comment of Thomas Pornin where the messages needed to be stored before they were hashed with the session key. But I wonder if it isn't easier to first hash the messages and then provide the key.

Of course the hash algorithm would have to be established, but the ciphersuite is established after the Server Hello message. In that case it could be benificial to something similar to $\operatorname{HMAC}_{K_{mac}}(\operatorname{H}(M_1 | M_2 | M_3))$ (where M is a handshake message), but preferably with a single primitive.

Is there a reason that the key is put in first within HMAC / or SHA-3 / KMAC? Are there reasons that the key cannot be put in last? Or are there schemes that already do this?


texts: Is there a way to use Shamir Secret Sharing with updatable data?

texts:
I want to divide a system that maintains these properties, based on Shamir's Secret Sharing:

A secret key is split up to N pieces, where T of them are enough to reconstruct the key.
The original key is then destroyed and doesn't exist anywhere except the N separate pieces.
The information unlocked by the T signatures is updatable - I want to retain some other information that will allow me to update the secret that is accessible by the secret holders.

The use case is a will that contains secret information. I have N people I trust, and I want any group of T of them to be able to read the secret information (hopefully, only after I'm dead). I want to be able to update this secret information from time to time, without the bother of recreating and redistributing another set of keys.

Is there something that answers these requirements?


texts: Can sending the same plaintext twice, each encrypted with different key and IV, weaken the encryption?

texts:
I'm basing code on: https://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption#Authenticated_Encryption_using_GCM_mode

If I send the same plaintext twice, encrypting each with a different key and IV, am I compromising the strength of the encryption?

(Eve would have access to the two ciphertexts of each message, and would know that they were encryptions of the same plaintext.  Eve would not know the keys or IVs used.)


texts: Why do all hash functions use big-endian data?

texts: I've looked at several hash function specifications, and they all emphasize the need for big-endian byte ordering. Is there a reason for this that has to do with security, or is it simply convention?


texts:
Assume an instantiation of AES-CTR like in the following picture:

Some details on the input-values for keystream generation:

COUNT: a 32-bit value associated with the transmission mode
IV#1: a 5-bit value that can be assumed constant for a specified transmission
IV#2: a 1-bit value indicating the direction of the transmission
incr: a 64-bit value initialized to 0 and then incremented per standard $\bmod 2^{64}$ increment function.
cipher key: refers to ciphering key which is obviously not known

Assume that all those input values are not difficult to identify/guess as they are required to establish correct transmission and synchronization between the two communicating parties (e.g., direction, radio info, etc). We also assume that no pairs of ciphering keys and input values ($COUNT||IV\#1||IV\#2||0^{26}||incr$) are used. Is this a weak AES-CTR implementation, assuming one can obtain pairs of keystreams/input-values?

I guess we can say this implementation is malleable as any AES-CTR without authentication steps. Any other weaknesses?


texts:
When someone claims that the private key corresponding to the public key  has been stolen, and sends to the CA a statement of this fact signed with respect to public key pk.

Why doesn't the CA need to check his identity in this case, and why is there no concern

that the person who has stolen his key can forge signatures with respect to pk?


texts: If one has the last round key in an SP or Feistel network (the 16th round key in DES for example), would that someone be able to decrypt the rest of the encryption?


texts:
(This is probably a basic question, and may be a duplicate; if so, just let me know.)

Suppose there are two clients A and B, and some server C. Suppose B and C establish an HTTPS tunnel, and C sends a response to B. And suppose B records the response, and sends it to A.

Can A verify that the alleged response from C was actually sent by C?

This is essentially equivalent to "Are HTTPS responses non-repudiable?". As far as I am aware, HTTPS only provides a secure channel, but does not provide digitally signed traffic.

Motivation

I'm tentatively planning to create a social network add-on which would allow users to flag other users who have sent them offensive material via private messages. I would hypothetically run a web service which would receive flag requests, and in order to avoid spam flags, I would need some way for the flagger to voluntarily send me a minimum but sufficient amount of information to verify that the private message actually exists.

In this scheme, I am A, the flagger is B, and the social network is C.

Is there any sane way to do this, without compromising the flagger's security?


texts: Proving a commitment hides the value hidden in an encrypted puzzle

texts:
I am making a protocol that has one missing piece.  It involves 2 non-trusted party $A$ and $B$ and a semihonest third party $C$.  This protocol has a contingency step where if $A$ leaves prematurely, $B$ is supposed receive time locked puzzle.  It is important that $B$ cannot get the puzzle early.  The puzzle ensures that after a period of time, $B$ will get a value he is supposed to get, but not immediately.  Neither $A$ nor $B$ want $C$ to be able to learn the value hidden in the puzzle (therefore $C$ can't have the puzzle), and $B$ shouldn't be able to start working on the puzzle until $A$ leaves and $C$ reveals the puzzle.  $A$ also needs to prove to $B$ that the value hidden in the puzzle matches a commitment (preferably Pedersen) at the beginning of the protocol.  Note that once $A$ leaves, $C$ wishes to leave almost immediately (for important structural reasons), so it can't just be an encryption to which $C$ holds the key and $C$ gives it to $B$.

My question is does such a system currently exist?  This system being as follows: $A$ creates a time locked puzzle that cannot be worked on by $B$ until a value is released while still proving that the puzzle hides the same value as a commitment.

I know that such a scheme can be created by going down to the bit-level, but I would strongly prefer a more efficient solution.

I am aiming for a sequential puzzle that takes around 2 hours for a powerful computer to solve, akin to this paper.

TLDR:  Is there a way to encrypt a puzzle such that the puzzle cannot be worked on until it is decrypted while still proving that the solution to the puzzle matches a commitment?


texts: How do I compare three cryptographic schemes with respect to security?

texts:
I am working on a project which compares SEAL, HElib and libScarab in terms of their execution times and security. I have already checked for the execution times. How do I decide which one of them is more secure?

How do I analyse the security provided by these libraries when they are used for certain applications?


texts: Can you explain “k out of n” from the VCS paper by Naor and Shamir

texts:
I am new to visual cryptography. I’ve just read the paper “Visual Cryptography” by Moni Naor and Adi Shamir and I'm stuck on the chapter about the “$k$ out of $n$” construction. I am aware that, on page 8, there is a step-by-step explanation on how to construct it… but I still do not understand how it works.

Specifically:

At function $h$ (number 1) – How does one get that function?
Also, related to the notation $S^b_t$ – can someone explain what that $t$ stands for?

Any help is appreciated, but I guess it would probably be best if someone could give me a somewhat simple example that shows how to construct a “$k$ out of $n$” visual cryptography scheme.


texts: What is the SHA-256 hash if the input is null, i.e. an empty bitstring? (Not the hash of 0 or "0".)


texts: Fast crytographically secure Pseudo-Random number generator in software

texts:
What are the methods for generating pseudo-random numbers in software? I have seen methods where people use SHA implementations from openssl to hash a random message as source of entropy, or using AES or Keccak. But I have done some experiments and found them quite slow. They take around more than 3 clock cycles in an intel 3.3GHz i5 processor to generate a random bit. Whereas pseudo-random generators like ISAAC are blazingly fast compared to other methods. Now my question is

Why don't people use ISAAC for their implementations?
Is ISAAC not secure enough for cryptographic applications?
What are the other methods available for fast pseudo random number generation?

Thank you for your help.


texts:
Key space is the set of all possible keys that can be used to generate a key. We using the number of valid key to describe it.

I've given a hill cipher of block size $k$ over alphabet of size $p$, where $p$ is prime, how many keys there (valid key)?

Since the hill cipher key is a $k$ x $k$ matrix, all the elements getting from size $p$ alphabets, and from my understanding the number of possible keys should be $p^{k^2}$? but the answer is:

$(p^k-p^0)\times(p^k-p^1)\times(p^k-p^2)\times\cdots\times(p^k-p^{k-1})$

I believe it related to a matrix have a inverse or not, but don't know how to determine.

EDIT

By reading from the Key size of hill cipher from Wiki, got to known something, the example there shown the case cannot inverses is the co-factor of $26$, which is $13$ and $2$.the number of invertible for $n$ blocks over $26$ alphabets are:

$26^{n^{1}}(1-1/2)(1-1/2^{2})\cdots(1-1/2^{n})(1-1/13)(1-1/13^{2})\cdots(1-1/13^{n})$

so apply it to here, because $p$ is prime, so only $1$ or $p$ itself can divide $p^{k^2}$

the result should be:

$p^{k^2}(1-p^{-1})(1-p^{-2})\cdots(1-p^{-k})$

but still different from the answer.


texts: How do i generate the shared key from this question?

texts:
Say I have Alice and Bob:

Alice has $XA$, $YA = g^{XA} \bmod P$, $RA$ (random number)

Bob has $XB$, $YB = g^{XB} \bmod P$, $RB$ (random number)

Assume they have exchanged their certificates and they perform the following exchange.

\begin{align}
A\to B&:y_B^{RA}\\
B\to A&:y_A^{RB}
\end{align}

The shared key is  $Z_{AB}=g^{RA+RB}$

I am trying to make sense of how they will be able to come to the shared key.

If I am bob I derive the key by:

$(YB^{RA})^{XB^{-1}} = ({g^{XB}}^{RA})^{XB^{-1}} = g^{RA}$

The I issue I am facing is the ${g^{XB}}^{RA}$ is actually ${g^{XB}}^{RA} \bmod P$ so how do I remove the $XB$ from  $({g^{XB}}^{RA} \bmod P)$ to get $g^{RA}$

EDIT:

To make it more clear using numbers:

Say: $XB =4 ,g=9,P =23,RA=6$

Alice sends bob:
\begin{align}
A\to B:&y_B^{RA}\\
&y_B^{RA} \bmod P = 16^{6} \bmod 23 =12 \\
\end{align}

How would bob extract the $RA$ from 12???

Bob can try:

$(YB)^{RA\cdot XB^{-1}} = (16)^{RA \cdot 1/4} mod 23$

As can be seen above how i extract the value of RA?? in terms of $g^{RA}$ and there has to be only one answer if not how would bob know the which answer alice is using? Does it matter which answer alice is using?


texts: Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt? I've tried digging around on the Internet but haven't found anything conclusive on the topic.


texts: How do I prove that an encryption based on a multiplicative cyclic group is IND-CPA?

texts:
Consider the following encryption and decryption functions where $\mathbb{Z}_{N}^{*}$ is a cyclic multiplicative group, $g$ is a generator for the group and $F$ is a keyed PRF.

$E(m, i, k) = m \times g^{F_k(i)} \bmod N$

$D(c, i, k) = c \times g^{-F_k(i)} \bmod N$

Is the above scheme IND-CPA? How would I prove it?

My first thought is that I need to show that if $g$ is a generator then $m \times g^{F_k(i)} \bmod N$ is a bijection but I am not sure how to come up with a formal proof.


texts:
First if this is the wrong place to post this please forgive me.

I know my passphrase. I don't remember specifically how I entered it. ex. If the phrase is "The house at the end is blue and white. I like it." I would have used the first letters of each word... "thateibawili" My problem is I can't remember if I, in this example, remember If the first "t" and the second "I" is capitalized and if I used the punctuation.

I am not a programmer. Since I know the passphrase is there a program that can run through the variations of it with the possible cap letters and punctuation?

Thanks


texts:
I have a question about decryption.

Let's say I have a bunch of files that are encrypted. Someone gains access to those files, and finds out that he already has one of them, unencrypted.

My question is, can he use that file to make a comparison with the encrypted version of the file to find the key, therefor be able to decrypt all the files?


texts: Universal Computation “measurement” using SNARKs?

texts: If SNARKs are able to prove computations of arbitrary complexity and difficulty were executed correctly, would it be possible to use them to create a Proof of Work consensus system where ANY computation can be the “work”? If you are able to develop a SNARK system that can somehow “measure” how much computational effort went in to any arbitrary computation and thus allow any program or computation to be able to be used towards the same Proof of Work consensus method? This would take the idea of “Proof of Useful Work” to the ultimate end, where one would simply use ones computers to run the same computation one would use them for anyway but have these SNARKs working on all of the computations measuring them and contributing to the consensus method, and reaping miner rewards.


texts:
This question is a bit different from other questions here, but I think it is suitable to correctly understand the terminology of cryptography.

Consider the following two sets of terms:

Encryption scheme, signature scheme
Identification scheme, commitment scheme, secret-sharing scheme

The latter are actually "protocols", while we usually do not consider encryption/signature as (interactive) "protocols". Moreover, the word "scheme" is not usually applied to terms like "hash functions", "pseudo-random generators", "one-way functions", etc.

What does the term "scheme" mean? When is it meaningful to apply this term to a cryptographic construct? How does it relate to "protocols"?


texts:
Suppose we have an almost shared secret. For example if we have a noisy connection to a shared secret source of randomness.
So Alice has $k_1$ and Bob has $k_2$ similar but not necessarily identical to $k_1$. One formalization could be:

$\operatorname{hammingDistance}(k_1,k_2) << \operatorname{length}(k_1)=\operatorname{length(k_2)}$

If the keys are similar in absolute terms we could have Alice send a message with Mac and Bob brute force small variations of his key.

Can we do better? Perhaps ending up with a shorter shared key.
Obviously I would not want to rely on other key exchange or asymmetric primitives.


texts: What is insecure about this simple AES implementation?

texts:
There are plenty of articles all over the Internet talking about how most people are dangerously bad at crypto, and most people new to the field often fall victim to common pitfalls.

I'm new to crypto, but I've spent hours researching this and I cannot for the life of of me seem to come up with something that could be insecure about the following implementation (barring a bug in the operating system, the programming language, etc.)

What's insecure about this?

Use Case: Storing files in a cloud environment and preventing anyone who gets access to those files from viewing them. I do not care about people knowing how many files I have, or what their sizes are, etc. I only want to protect the contents.

Implementation:

For each file, generate a random AES key and IV.
Encrypt the file using AES-CTR, and rename the file to a randomly generated filename.
Store the encrypted files in cloud environment.
Store a plaintext file locally that has an index of filenames, keys, and IVs.

Now, as long as nobody ever gets a copy of my local plaintext file, can I assume that the data stored in the cloud is secure?

Example Code

require 'openssl'

# Do the following for each file...

infile = "...input filename..."
outfile = "~/Dropbox/randomly_generated_name"

cipher = OpenSSL::Cipher::AES.new(128, :CTR)
cipher.encrypt
key = cipher.random_key
iv = cipher.random_iv

input = File.open(infile, 'rb')
output = File.open(outfile, 'wb')

while !input.eof? do
  chunk = input.read(100000)
  encrypted = cipher.update(chunk)
  output.write(encrypted)
end

input.close
output.close

store_locally_only = {
  infile: infile,
  outfile: outfile,
  key: key,
  iv: iv
}

File.open('~/local_only/private.txt', 'a') do |f|
  f.write(store_locally_only.to_json)
end

Now, clearly if my private.txt became compromised, this would give an attacker access to everything that was in my Dropbox.  But, assuming that this file as appropriately kept private, can I assume that the data that is stored in Dropbox is secure?

To be clear, I don't mean this post to be an "audit" of my simple code above. Rather, I am trying to understand something fundamental about crypto here. A lot of people say that it is "dangerously hard" to implement crypto. But this implementation seems so simple, that I am unable to think of what would compromise the data.


texts: Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

texts:
In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that:

The GHASH part of GCM is usually the problematic one when it comes to implementation, not the AES. GHASH is very fast on hardware platforms that have dedicated opcodes (x86 with AES-NI, POWER8...) but these platform also provide an AES hardware implementation that outperforms software-based stream ciphers.

Is this really true? Is GHASH really slower than AES, if the CPU has no special instructions for either?


texts:
As the title says, I have some doubts about the term "cofactor" used to describe elliptic curves.

AFAIK, it's a factor of the curve order, but why is it explicitly specified in some parameter lists then?

How does it apply to the curve point addition / etc. algorithms?


texts: Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

texts: If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature algorithm? Or does it use ECDSA for signature? Or can it use any of them (ECDSA or RSA)?


texts:
I had the following questions -

Concerning generating sequences of bits $\textbf{x} = ( x_{0},x_{1}, ... , x_{n-1})$ where the $x_{i} \in \{0,1\}$  are considered coefficients of a polynomial in $\gamma$ (i.e. a polynomial of form $x_{0} + x_{1}\gamma^{1} + ... + x_{n-a}\gamma^{n-1}$) where $\gamma$ is the root of a polynomial $ \Lambda(\gamma) = c_{0} + c_{1}\gamma + ... + c_{n}\gamma^{n} = 0$, $c_{i} \in \{0,1\}$ (i.e. $\textbf{x}$ is an element in a Galois extension), I understand that all the elements of this extension (i.e all possible n bit binary strings) can be generated through the relation $\textbf{x}_{j} = \gamma \textbf{x}_{j-1} \textbf{mod} \space \Lambda(\gamma)$ for correct choice of $\Lambda(\gamma)$, the "period" of this generator is $2^{n} - 1$ after which the recurrence relation "wraps around" the ring and generates the first element over. This is described on page 11 here. If we consider $k$ bit subsequences of this $n$ bit string, is it possible to derive the period for a such a subsequence?
Is there a reference that concretely describes how to go from a construction above based on arithmetic in the field extension to the familiar Galois LSFR as described here?


texts: How to create a decentralized secret ballot among a small group of people?

texts:
A small (< 100) group wants to implement an election. For that, each participant must vote in one of N candidates. After everyone has voted, they must be able to determine a winner; yet, nobody must be able to determine the vote of someone else. There is no trusted third party. You can assume there is a public list of public keys.

Is there a cryptographically secure way to solve this problem?


texts: Is XORing a SHA256 better than truncating it?

texts:
Let say I want to truncate SHA256 to 128 bits. What would be the best way to minimize a probability of a collision and improve collision resistance?

Taking the last 16 bytes
Taking the first 16 bytes
XORing the first 16 bytes and the last 16 bytes together

And should I assume that the same logic will apply for other hash functions from the SHA-2 set (like SHA516) as well as other hash functions in general, for example, SHA-1 or MD5?


texts: Relationship between AES GCM and AES CTR

texts:
I have read that AES GCM uses AES CTR for encryption and GMAC for authentication.

If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR?

TO put the question another way, can I encrypt using GCM and then decrypt using AES CTR (ignoring authentication) and if so, what's the relationship between the IV that I pass to GCM when encrypting and the IV that I pass to AES CTR when decrypting?


texts:
I have actually been able to carry out a DUKPT data decryption successfully, which was also been confirmed with the BP-Tools - Cryptographic Calculator.

After understanding the differences between the DUKPT PIN and DUKPT DATA from their respective Variant Constant "according to ANSI X9.24, Part 1 document the DUKPT section".

I already changed the index of my keys [Varaint Constant] tallying with the Variant Constant, for the PIN decryption which are 7 and 15 compared to that of the DUKPT DATA which are 5 and 13 which worked successfully.

What i would now want to understand is this, after checking through this git used for the DUKPT data decryption

What am i actually getting wrong in this process, or what am i yet to really understand.

Because, trying out the BP-tools DUKPT data decryption, it is really working out with the git provided above, but still having a slight issue to getting the DUKPT pin work out, while been compared with the BP-Tools Calculator.

The question is: Is there any other thing to take note of, apart from the Variant Constant when doing a DUKPT PIN decryption?


texts:
I am trying to find out the inverse of and SBox, but in vain, I have seen multiple questions over StackExchange, But I cant be able to solve my issue.
As in this question, How are the AES inverse S-Boxes calculated? As in this link I followed all the procedure and I made a 16x16 Matrix of inverse. But When I multiplied two(Multiplication in GF-2^8) corresponding entries against a SBox value to a inverse SBox value. If this is true in that question then my multiplication would be resulted into 1. But it is not resulting into 1.
I used X = 0x52. Sbox Generated with C = 0x63 is given Below

 S box Generated
 Inverse Sbox


texts: Replacing elliptic curve diffie-hellman primitive with elliptic curve cofactor diffie-hellman for specifc curves?

texts: From what I've read about elliptic curve Diffie-hellman with and without cofactor (I am pretty new to the whole thing so I am not able to understand everything) is that when the cofactor of the curve $h$ is $1$, Both should give the same result. So for curves such as secp256r1 (which has $h=1$) both should give the same result. Unfortunately, when I am coding it using some third party libraries for Diffie-Hellman primitive without cofactor, I am not getting the expected result of Diffie Hellman with the cofactor. At this point, I am not sure if I have understood the theory incorrectly or if there's some issue with my code. Could someone verify or refute my understanding?


texts:
Possible Duplicate:
  RSA encryption with private key and decryption with a public key

This wording is creeping everywhere (e.g. there): "I encrypt with the private key" and even sometimes, "I decrypt with the public key." Does it make any sense?


texts: How does Euler's Theorem show that $(m^e)^d ≡ m \bmod n$

texts:
In this thread Henrick Hellström says that when $ed \equiv 1\ (mod\ \phi(n))$ then $(m^e)^d \equiv m\ (mod\ n)$. So I thought this is how Euler's theorem is related to RSA. But at least I thought that due to Euler's theorem the prerequisite for $(m^e)^d \equiv m\ (mod\ n)$ was $ed \equiv 1\ (mod\ \phi(n))$, until I read the comments of the answer and @poncho says that

  Minor nit: it's not true that e,d must meet (satisfy) the equation $ed \equiv 1\ (mod\ \phi(n))$. One counterexample is $n=133, e=5, d=11$. That has $ed \equiv 55\ (mod\ \phi(n)=108)$, however $(m^e)^d \equiv m\ (mod\ n)$ for all m. This is a minor point, however we should avoid telling beginners things which aren't true.

So $ed \equiv 1\ (mod\ \phi(n))$ doesn't need to be true in order for $(m^e)^d \equiv m\ (mod\ n)$ to work. At this point I am really confused about the relation between Euler's theorem and RSA, and why we need $gcd(e,d)=1$.

EDIT: Also this website says that $(m^e)^d \equiv m^{\phi(n)}\ (mod\ n)$. How could this be true? Wouldn't this imply that $ed =\phi(n)$?


texts: Computational binding implies Perfect hiding?

texts:
Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding?

My idea was: Since the scheme is computationally binding, it can be broken by an unbounded adversary, who can produce two openings to the same commitment. But this would make the scheme perfectly hiding, because even an unrestricted attacker cannot distinguish between the two (or more) openings of the same commitment by any means.

Is this correct? If not, are there any schemes that prove otherwise?


texts:
I wonder if someone can help me find the algorithm used to generate validation codes from a serial number.

I already have some working examples of serials->codes pairs:

19003148 -> 523254

19003162 -> 458091

19003064 -> 618138

20000589 -> 138224

I understand that the validation code is somehow calculated directly from S/N digits, but i can't find the equation.

Any help welcome!


texts: Attribute Authentication in Attribute Based Encryption (ABE)

texts:
When a data user requires access it asks the key issuer to generate a key for it using the specified attributes.

How does the key issuer authenticate that the data user actually acquires the attributes it claims to possess?


texts: How to securely share AES key between two remote devices (client and server) through UDP protocol?

texts: I have two separate system (client) and (server). I am having a problem which is to encrypt a message from the client and decrypt at the server. In order to do that, I am required to transmit my key along with the message through UDP packets. However, is there any possible ways to ensure the key is transmitted securely?


texts: Differential privacy noise that scales with $L_p$-sensitivity with $p>2$?

texts:
It is well-known that to make the result of a $\mathbb{R}^d$-valued query $(\varepsilon,\delta)$-differentially private, you can add noise to it. If you add Laplace noise, you need to scale the noise by the $L_1$-sensitivity of the query; if you add Gaussian noise, you need to scale it by the $L_2$-sensitivity instead.
Are there noise functions that scale with, say, $L_3$-sensitivity, or any other $L_p$-sensitivity with $p>2$? If not, how to formalize and prove this impossibility result?


texts: Timing attack on RSA as used by CryptoLocker?

texts:
So far I have researched timing attacks on RSA, We all know the ransomware named CryptoLocker uses RSA 2048 bit encryption. Now, is it possible to break the encryption using a timing attack. I have been gathering information about CryptoLocker, it’s a ransomware which encrypts files in the system with RSA 2048 bit encryption and asks for a ransom to release the private key stored in the server and decrypt the files infected. As it is a 2048 bit encryption it is not possible to break the key, however with a side-channel attack researchers have attacked even 4096 bit RSA encryption. Timing attack is a side channel attack.

So my question is, is it possible to attack the cyber criminal's server by performing a timing attack?


texts:
I am looking for some help regarding something I am trying to do and I think to solution might be in Homomorphic encryption.
Person A and B encrypt the same number(unsinged long) N using AES with different keys.
Person C runs a transformation function TF based on some random secret input S on both cyphertexts. A and B decrypt their own transformed cypher texts and gain the same Nt result.
The idea is that the secret used in the transformation function must not leak information as it might be used hundreds of millions of times (practically in public).
What I am looking for is a simple transformation function on this long/bigint that is deterministic.
Homomorphic encryption, as far I read, could theoretically do this on AES encrypted cyphertexts.
The transformation function doesn't need to be complex as long as it doesn't leak information. Some simple multiplications followed by a mod (could be int256) should do the trick. However, I am not sure if this falls in the partial/somewhat homomorphic encryption category and how I should go about.
I am a developer and not a well-educated mathematician, so ideally I am looking for some code examples on github if it is possible at all. I did find some libs but they mainly seem to focus on either FHE or public key encryption. While I want to use AES/Symmetric and not sure if I even need the 'full' version.
Thnx in advance!


texts:
Alice wants to share a symmetric key with Bob. She encrypts the small (64-bit) secret key $K$ with Bob’s public RSA key $(n,e)$ by padding it with zeroes to 2048 bits (the length of n) and computing
$$C\gets(\text{0..0}\|K)^e\bmod n$$
Thereupon, she sends $C$ to Bob. Discuss either why this key exchange is secure or describe an efficient attack that can recover $K$ with far less than $2^{64}$ operations.


texts: Encryption for continuous, real-time data over an unreliable connection

texts:
I have a continuous stream of real-time data. It must be consumed immediately or discarded, so I'm using UDP for transmission without ACK or retransmission (the connection is unreliable).

The packets I'm sending are of the same length, and one packet is sent per transmission (each next packet invalidates the previous one).

Is it insecure to use AES for encryption, reinitializing the AES context with the same key for each packet?

The AES key is pre-shared over a known wired secure channel.


texts: Guarding against vulnerabilities for a digital signature service (RSA )

texts:
Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload.
What are the possible attacks that I would need to guard against in this context (primarily assuming RSA algorithm but it could also be EC-DSA algorithm)?
With regard to the RSA, to guard against chosen cipher-text attacks as noted here have come-up with the following scheme.

Client calculates SHA-256 hash of payload.
Client sends hash to server for timestamping.
Server receives hash, generates a nonce.
Server concatenates nonce (server-generated-random) and the hash (client-input) and calculates hash on the concatenated string.
Server signs the hash that it calculated and returns the signature and the nonce back to client.

What I'd like to know is -

Is the above a standard approach for this type of usecase?
Is there a better scheme than plain concatenation? I
Guess RSA OAEP / PSS schemes are intended to guard against such attacks for RSA but I am more inclined towards the above since its independent of the algorithm (RSA/DSA). Am I correct in this assumption?


texts: Zero Knowledge Non Interactive Proof with random oracle

texts:
I am trying to write an assay about Non Interactive Zero-Knowledge proofs and would like to take the simple discrete logarithm problem example fallowing the Feige-Fiat-Shamir heuristics.

I understand the interactive steps are:

1. P wants to proof he knows x where y = g^x
2. P picks a random v and computes t = g^v and sends t to V
3. V picks a random c and sends it to P
4. P computes r = v - cx and sends it to V
5. V checks t = g^r * y^c

while the non-interactive steps would be like this:

1. P wants to proof he knows x where y = g^x
2. P picks a random v and computes t = g^v and keeps it as first term of the proof
3. P computes c = H(g,y,t)
4. P computes r = v - cx and keeps it as second term of the proof
5. V checks t = g^r * y^H(g,y,t)

Now I see V doesn't actually get any hint about the value of x P wants to proof he knows whithout revealing.

But the definition for Zero-Knowledge should be a Simulator could compute the whole proof in probabilistic polynomial time.

How can this definition be applied to the non-interactive procedure? How can a simulator repoduce the proof (calculating the correct hashes) if he does not know x, thus he can't compute r which is part of t which in turn is an input of H?

Can anybody link me some simple explanation of this?

EDIT

Going ahead in my research, and fallowing some hint form the useful comments I could produce some further consideration:

Such non-interactive protocol is honest verifier since the verifier doesn't really have any strategy he can fallow but simply checking the provided demonstration holds.
As suggested by @xagawa and this link the simulator has complete freedom on what he can do to "come up" with the couples (t,r) he sees in the proof, so he can just pretend the oracle works according to his needs.

The linked paper states as fallows:

  So, our simulator now works as follows. Recall the statement PK{(α) : A = g
  α}.
  (Remember that here the simulator does not know x such that A = g
  x
  !) Instead, the
  simulator chooses random values c, s ∈ Zq as before and computes T = g
  s/Ac
  . The simulator
  then “sets” H(T) = c.

According to this I figured out a simulator may see the generation of each (t,r) as the invocation of a random oracle H'(t) such that r = H'(t) observing that H'(t) is in fact a random oracle itself on the couples (t,r) since:

Given a starting t, H(g,y,t) generates a truly random c and the output r = v - cx of H'(t) is directly bound to such a truly random value
For a given input t, H(g,y,t) always generates the same output c which in turn produces the same r

This way the concept of simulation reduces to the invocation of a random oracle on a random input t to obtain r.

Does all this make sense? Is it correct or do I miss something crucial?

EDIT 2

@Robert NACIRI comments seem to suggest that in fact the verifier challenges the prover by agreeing on a common random oracle H to use, so than the concept of zero-knowledge in this case may become something like this:

  No matter what random oracle you agree to use, if a simulator can see all your output couples as input and output of another "wrapping" random oracle then the only proof of your knowledge lays in the agreement you had with the verifier to actually use the specific random oracle H and the proof is zero-knowledge.

Does this statement make sense? Please correct me if possible and link any better explanation if you know any.

Thanks again for the useful comments and help.


texts: $m^b = z^b \pmod{n}$ - single solution $m = z$?

texts:
If i have the following equation:

$$m^b = z^b \pmod{n}$$

Where all numbers are taken from the multiplicative group $\mathbb{Z}_n^*$.

Suppose I know the values $z$ and $b$. Can I state that $z = m$, or at least that it is a possible solution?

Is it the only solution?


texts: Chaining signatures of different parties

texts:
My question might be quite beginner, so please pardon my ignorance :)
So, assume there are 10 parties, each with their own keypairs. There is a message $M$ that is passed from one party to the next. Each has to sign the message with their own private key, append the signature, and send it to the next guy.
As you can see, such a system will be quite expensive (for an RSA key with keysize 1024-bits, it'll be 128 characters per signature).
Is there a way to achieve the same goal (sending a message to multiple parties for them to sign it) while keeping the signature size cheap and small?
It'll be great if the answer is not an "all-or-nothing", meaning that if the signing parties were X, Y and Z, the "combined signature" wouldn't just either prove that parties X, Y and Z signed it or that no one signed it.


texts: Why is SHA-3 robust against Length-Extension Attacks?

texts: If a length extension attack can occur because of $H(\text{K}\mathbin\|\text{Message})$, what changed in SHA-3 from SHA-2 that prevents this from occurring?


texts:
The passage said that the computational load to attack DES-X can be reduced to approximately $2^{(56+64)}=2^{120}$ steps,and  the storage of data sets should be $2^{64}$.

But I can't figure why it is time complexity $2^{120}$ and  the (space complexity) of data sets should be $2^{64}$.

Can somebody help?


texts: Real time video stream AES encryption with authentication

texts:
I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, the client can only get the MAC message after the whole video is encrypted and authenticated. After that, the client can verify and play the video. However, if the client wants to play the video immediately (without receiving and decrypting the whole video), how can the client verify the MAC message?

I guess the video stream may be divided into many small slices. The server will encrypt and authenticate those slices one by one. At the receiving side, the client will verify, decrypt and play slice_1, then slice_2 ,then slice_3 and so on.

I am not sure whether my guess is right. Could someone please give me some advice? How does the real video provider's server do this kind of secure video stream transmission? If my guess is right, what is the typical size of video slices, or it is dynamic?


texts: Perfect Secrecy for two distinct messages

texts:
We say that and encryption scheme $\pi$ is perfectly secret for two distinct messages, if for all distributions over $\mathcal{M}\times\mathcal{M}$ ($\mathcal{M}$ is the message space), for all $m_1,m_2\in\mathcal{M}$ such that $ m_1\ne m_2$ and all $c_1,c_2\in\mathcal{C}$ (where $\mathcal{C}$ is the cypher text space) such that $\text{Pr}[C_1=c_1\wedge C_2=c_2]>0$ then $$\text{Pr}[M_1=m_1\wedge M_2=m_2|C_1=c_1\wedge C_2=c_2]=\text{Pr}[M_1=m_1\wedge M_2=m_2]$$

I am trying to come up with an encryption scheme that satisfies this definition. So far this is what I have come up with

Say $\mathcal{M}=\{0,1\}^l, \mathcal{K}=\{(0,1),(1,0),(0,0),(1,1)\}^l, \mathcal{C}=\{0,1\}^l$

$k\leftarrow\text{Gen}(\mathcal{K})$

Now let $m_i$ denote the $i^{th}$ bit of $m$.

Let $c_i$ denote the $i^{th}$ bit of $c$.

And let $k_{il}$ denote the $l$ bit of the $i^{th}$ pair in $k$ and  (l=0 for the first, l=1 for the second)

$\text{Enc}_k(m):$ For all $m_i$ in $m$ (iterating through bits)

if $m_i=0$:
    $ c_i=m_i \oplus k_{i0}$

else: $c_i=m_i \oplus k_{i1}$

Return $c$

$\text{Dec}_k(c)$: For all $c_i$ in $c$ (iterating through the bits of $c$)

if $c_i=1$:
    $m_i=m_i \oplus k_{i0}$

else: $m_i=c_i \oplus k_{i1}$

Return $m$

Does this work? I feel like it should because essentially what we've done is essentially create a key that can perform a one-time pad twice safely


texts: How to use cryptography to assure data integrity?

texts: I only understand assurance of integrity using a hash function. How to use cryptograpy to assure data integrity?


texts: Does complicating a flawed algorithm make it secure?

texts:
It's a basic question I guess, but I don't know the answer and I don't think that anyone asked it.

Suppose I built a system, it relies on MD5 for security, suddenly I read am article on how easy are MD5 to crack nowadays.

Not being able to implement other algorithms, I multiply the MD5 hash by Pi, and some Fibonacci sequence then divide it by 0.5 and multiplied it by a random string that I generated using a secure generator. I obtain a totally different string

Then I use a function from my program to reverse all that I have done and then pass the original MD5 Hash to be decrypted.

The example I gave is simple, you can over complicate it as much as you like. Suppose you're a hacker, not knowing what I did to the MD5 hash, would you be able to crack it?


texts: anything obviously wrong with my custom password hash scheme?

texts:
i sha2-256 hash the password, then i base64 encode the hash (per RFC 2045) , resulting in a 44 bytes string looking like LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ= , then i bcrypt ...crypt() that (using a securely generated salt), and i get something like $2b$10$HyPnAMyB2l1onzLjxEeRHuSioZ/X31I/XP6oHa.SPHA7KxJbR9Jq.

anything obviously wrong/bad with that scheme?

and if you're wondering why i'm doing it like this:
bcrypt crypt() (at least the implementation i'm using) has 2 annoyances, most importantly, it can't handle NULL bytes,
it thinks "\x00foo" is the same as "\x00bar". secondly, it only considers the first 72 bytes of the input password. sha2-256 don't have the NULL issue, nor the length issue, but the resulting hash can contain NULL bytes, and base64 encoded data never contains NULL bytes, and i thought the resulting 44 bytes string would be a great key for bcrypt...?


texts: CSPRNG's (ELI5) What's the purpose of multiple seeds/ regenerating sources of entropy (i.e. /dev/random)?

texts:
Why is there a need to generate more than one high entropy seed? It would seem like if the original source of entropy is high quality, than some 512 bits should be more than enough to seed a CSPRNG which has no strong (or known) weaknesses, and pretty much endlessly generate new random numbers and re-seed itself. The average user needs very few cryptographically strong random numbers over the life time of a computer, almost surely (<106) will be enough for all of said users potential applications.

On the other hand reading about cryptographic RNGs / encryption as some one that deals with them occasionally in code, and knows a bit of math, (but not highly technical literature by any means), one gets a highly disjointed sense of what people consider correct seeding procedure, how often a seed should be re-used, /dev/random vs. /dev/urandom, etcetera.

Would re-seeding to generate some 106 random bytes really be enough to find a weakness in CSPRNG and in such a way as to make the original entropy source weak enough to regenerate it with a human lifetime?

I'm not sure if this is more of a Math Stack Exchange or Stack Overflow question. But I would really like to see some mathematically / logically convincing guidelines. I can reference some specific CSPRNGs (but I'm not sure whether that helps or hurts the discussion).


texts: RSA Key generation Public exponent too big

texts:
I'm currently writing a paper about RSA (a self-chosen subject).
I'm writing about the key-generation in RSA, and I have problem finding the public exponent e.

I have chosen p = 61 and q = 53.

Then I determined my modulus n = p ⋅ q = 3233

and my phi(n) = (p-1)(q-1) = 3120.

What bothers me is that when I try to generate the public exponent e using CrypTool (given the same parameters), it gives me e = 2^16+1 = 65537 BUT I thought e had to be less that phi(n) = (p-1)(q-1) (according to this source).
Why is it OK to break this rule? Or is the CrypTool faulty?


texts:
I'm trying to create a strong key for encrypting some data using AES-256 for fun and practice.  For my own practice, I want to make this as strong as possible, I don't care how long it takes to complete.

I got some advice from 1Password white paper and therefore I want to use 2 secret keys.  The master password and a random generated 32-byte string.  The master password and the secret key will always be kept on the client side and never transferred to the server. Let me know how I can make this stronger.

The steps go like this:

1) Create a 32-byte salt.

2) Create a 32-byte secret key

3) Using PBKDF2-HMAC-SHA512 with 100,000 iterations, create a key using the password and the salt.

4) XOR the key and the secret key to create the key to be used to encrypt using AES-256.

 crypto.randomBytes(32, function(err, salt) {
  crypto.randomBytes(32, function(err, secretKey) {
    crypto.pbkdf2(password, salt, 100000, 32, "sha512", (err, derivedKey) => {
      var a = derivedKey;
      var b = secretKey;

      if (!Buffer.isBuffer(a)) a = new Buffer(a)
      if (!Buffer.isBuffer(b)) b = new Buffer(b)
      var res = []
      if (a.length > b.length) {
        for (var i = 0; i < b.length; i++) {
          res.push(a[i] ^ b[i])
        }
      } else {
      for (var i = 0; i < a.length; i++) {
        res.push(a[i] ^ b[i])
        }
      }

      var aes256Key = new Buffer(res).toString('hex');
    });
  });
});

This is going to be client-side Javascript, run inside a React-Native application.

I just want it to be looked over to make sure I'm using strong methods as well as correct key lengths for AES 256.


texts: I am trying to implement an AES encryption on my messages in my app and I want to have a different keystream for each "message group". Therefore, currently I am holding the keystreams in the database of the message groups. And the messages get decrypted by the app. However, there is one problem. The app is talking to the server via REST, and I need to get the encryption keys in a secure way. I am thinking of another keystream to encrypt the keystreams of message groups but I don't know where to keep it. Should I keep it in the app?


texts: Is the AES encryption scheme CPA secure?

texts: Give a 256 bit key space and 128 message space would AES block cipher as the encryption scheme be CPA secure?


texts: Why does knowing the number of points on a curve help solve ECCDLP?

texts:
Perhaps, this is a really obvious question, but I am still having trouble understanding how this all fits together. Why is knowing the number of points on an Elliptic Curve helpful in cracking it?

Because it can help factor $n$ (as in “mod $n$”) if it's composite? Is it because knowing the order of different points is helpful, and the order divides the number of points total?

Why is so much effort put into finding an efficient way to count points?


texts:
as you can see on image above, in VeraCrypt you can select either

Serpent -> Twofish -> AES

or

AES -> Twofish -> Serpent

what's the point of those permutations? is there any difference if I use

A -> B -> C

or

C -> B -> A

combination of encryption algorithms?


texts:
I am trying to understand the operation of the Dual_EC_DRBG.  I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition that I can grasp.  The definition I found is on page 65 of SP 800-90A. Just to be clear, I'm referring to the $\phi$ found in this diagram.

Can anyone explain what this function does exactly?  Is it a common function in elliptic curves? Something in number theory that's just over my head?  Any help would be much appreciated.


texts: Prevent everyone except customer to read DB data

texts:
We are planning an application that must store sensitive data.
Data is coming from other sources, the application will be a "collector" of third party data.

We need to encrypt database data so no one (also DB admin) can read DB data except the customer.
If data were inserted directly by the customer, we could have encrypted data using a key generated by the customer, but data is coming from other sources, there is a background thread that fills data in the DB, customer can only see and search data.

So the problem is how can we encrypt data without having decryption key (asymmetric encryption?) and giving the customer the ability to read that data?

If using asymmetric encryption, we must give the customer the private key, but doing this the customer will not be able to use our web application from any device, as it would need to install private key on every device used to access the web application (is it correct?)

The schema of the application is this:
1. Background application that writes data to the database, collecting from other sources
2. Web application used by the customer to view and search data in database (no editing)
3. Database with encrypted data that only customer can see


texts:
I was studying the Blind schnorr signatures in this paper (PDF) which says that the signer sends a commitment

$$r=g^{k}\bmod p$$

which the user blinds with 2 random elements $a,b$ to get

$$r'=r\cdot g^{-a}\cdot y^{-b}\bmod p$$

what is the intuition behind this blinding step?

Why can't we use the normal Schnorr signature with Fiat-Shamir heuristic  with the user supplying $e=H(m,r)$ to generate the challenge on his message?


texts:
What's the purpose of key-rotation?

Does it have any effect on the probability of keys being breached in the first place? Does it refer to avoiding access after a breach to all past data, all future data, both or none?


texts:
I have non-negative integers $x,y,z$.  I'm going to give you commitments $C(x),C(y),C(z)$ to them.  Then, I would like to prove in zero knowledge that $xy=z$.  I can choose the commitment scheme to make the zero-knowledge proof easy, if that helps.  What protocol should I use?  Is there a highly efficient protocol for this?

Details: Assume I know that all three of $x,y,z$ fit in $k$-bit integers, i.e., $x,y,z \in [0,2^k-1]$, and $k$ is publicly known.  Given commitments $c_x,c_y,c_z$, I want a zero-knowledge proof of knowledge that I know $k$-bit non-negative integers $x,y,z$ such that $xy=z$ (over the integers) and $c_x,c_y,c_z$ can be opened to $x,y,z$.  It is not sufficient to prove that $xy=z \pmod q$; I want a proof that the equation holds over the integers.  I don't care whether the commitment scheme is information-theoretically hiding or computationally hiding; either is fine.

Preferably, the commitment scheme should also allow me to do range proofs (to prove in zero knowledge that $x,y,z$ are in a particular range).


texts: Properties of a single-message protocol using AES

texts:
The following protocol is used for providing data confidentiality between sender and receiver:

$$ \text{sender} \rightarrow \text{receiver}: E_k(m \mathbin\Vert \mathrm{ID}_s\mathbin\Vert \mathrm{Timestamp}) $$

$E_k$: the encryption function of AES
$k$: a shared secret key
$\mathrm{ID}_s$: the ID of sender
$\mathrm{Timestamp}$: the time
$m$: the message (payload) from the sender

Assume that AES is secure. What are the security services that can be provided by this protocol?

I think we can get the Sender authentication because of the sender ID. But how about the others like data integrity, non-repudiation or data authentication? Can AES and this protocol provide this?


texts: Is forward search attack is the same as dictionary attack?

texts:
Currently, I started to learn about secure passwords in password file. The password file contains the hashed values for passwords. I know that the forward search attack for a password that if an intruder could have an access to password file in a system. Then he/she could hash the most common password and compare them to the ones in the password file looking for matching. While the dictionary attack the intruder compute the hash for the password and looks for them in a dictionary of common passwords.

For me, both of the definitions looks like the same. So is forward search attack is the same as dictionary attack?


texts: I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted Data to search for words on encrypted data. But why they don't use DET encryption for each word and to search for a word just encrypt a word and compare it?


texts: Differential Privacy: is the bound for group privacy tight?

texts:
Suppose mechanism $M$ is $(\epsilon, \delta)$-differentially private. For datasets $x$ and $x''$ that differ by 2 elements, we have
$$
Pr[M(x)=y] \le e^{\epsilon} Pr[M(x')=y] + \delta \le  e^{2\epsilon} Pr[M(x'')=y] + (1+e^\epsilon)\delta
$$
where $x$ and $x'$ are adjacent, $x'$ and $x''$ are adjacent. This bound is the one from group privacy. Is this bound tight? If so, can anyone give me a specific example of the mechanism to illustrate that this bound is tight? I'm thinking of randomized response but seems doesn't achieve the $(2\epsilon, (1+e^\epsilon)\delta))$-indistinguishability for $M(x)$ and $M(x'')$.
Thanks a lot!


texts: How to change the following commitment scheme to Pedersen commitment?

texts:
In my question here Zero knowledge set membership protocol

The suggested solution allows a prover to choose a commitment $C$. Then, A trusted third party ($T$) can validate if $C$ is valid or not. The $C$ is in form of $C = rG + [age]H$. How to make a similar protocol with $C = g^{r}h^{[age]}$ as in Pedersen commitment scheme where $g,h$ are elements in a group $G$ of prime order $q$

Here is the answer form the previous question:
Notation:
$P$ is the prover, $T$ is the trusted party, $V$ is the verifier, $a$ is the information to convince $T$ of $P$'s age, $A \rightarrow B: x$ means that party $A$ send information $x$ to party $B$.

$P$ chooses a random $r$ and calculates the commit $C = rG + [age]H$.
$P$ signs $a$ with $r$ as private key
$P \leftarrow T: C,a, signature_a$
$T$ looks up $P$'s age, calculates $R=C-[age]H$, verifies $signature_a$ against $R$ and sign's $C$ using $T$'s private key.
$T \rightarrow P: signature_c$
$P \rightarrow V: C, signature_c, proof$


texts: Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

texts:
During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice chooses a secret integer $a$ and sends $(A = g^a \mod p)$ to Bob, Bob chooses a secret integer $b$ and sends $(B = g^b \mod p)$ to Alice, etc.

One of the main pitfalls with a Diffie–Hellman public key exchange is, that Eve could try to use $p$ and $g$ for cryptanalysis, potentially learning the DH secret. Eve would have to solve the Diffie–Hellman problem to obtain $g^{ab}$. This makes things hard for Eve, but given enough computing power, it is not impossible.

Now, if Alice and Bob would agree upon $p$ and $g$ in advance (for example, during a face-to-face meeting in a SCIF), they would not have to agree upon $p$ and $g$ in public. As a result, Eve would have no option to learn the values of $p$ or $g$.

Under this condition:

Would it still be possible for Eve to work out the shared secret key that Alice and Bob calculate? After all, Eve would only be able to intercept Alice’s $A$ and Bob’s $B$. Would it be feasible for Eve to learn anything (useful) at all, or would the missing $p$ and $g$ make it impossible for Eve to calculate the secret (even when assuming she had solved the DH problem)?
What would be the impact on security, if Alice and Bob would “reuse” those $p$ and $g$ values for more than a single public key exchange? Would that give Eve any advantage in this scenario?


texts: Security of Randomized Encryption Scheme

texts:
I have the following question which I'm struggling with

  Suppose we are interested in encrypting bit strings. Consider a
  randomized encryption scheme that always produces ciphertexts of the
  same length as the plaintexts.

  Show that this scheme cannot be IND-CPA secure

Intuitively to me this kind of scheme shouldn't even be decryptable if the randomness lies in the mapping between plaintexts and ciphertexts. How can a single plaintext map to multiple ciphertexts (of the same length) without avoiding collisions and whilst also being decryptable? Am I misunderstanding what it means for an encryption scheme to be "randomized"?

I remember seeing a rough solution once which used the idea of mapping plaintexts to sets of ciphertexts but can't see how that would work / solve the problem.


texts: How is the EAX-mode used in EAP-PSK (RFC 4764)?

texts:
According to the specification of RFC 4764, contents in EAP's third message and fourth message are required to be encrypted by AES-128 in EAX mode (also called protected channel).

In RFC 4764, the length of ciphertext is as the same as the length of plaintext. However, the test vectors in The EAX Mode of Operation show that the ciphertext must be longer than the plaintext.

Therefore, what happens in RFC 4764?


texts: What is the extra defense that McEliece 6960119 and 6688128 have that 8192128 does not?

texts:
From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf

The 8192128 parameter set is bigger, but the 6960119 and 6688128 parameter sets include an extra defense explained in the submission. People paranoid enough to imagine 2^306 vs. 2^270 making a difference should also be paranoid enough to imagine this defense making a difference.

I looked in the Classic McEliece round 1, round 2, and round 3 submissions but I was not able to find any defense applying to 6960119 and 6688128 but not 8192128. The only sections which seem kinda relevant to me are 4.3 and 8.3 in the round 3 submission https://classic.mceliece.org/nist/mceliece-20201010.pdf but I am not able to understand their effect (and they do not mention both 6960119 and 6688128).


texts: Choosing an optimal generator for an irreducible polynomial over a binary field?

texts:
I am reading the Certicom tutorial “An Example of an Elliptic Curve Group over F2m ” and I have following questions:

How do they assume that generator $g = (0010)$ is correct for this polynomial?
How can/should one choose an optimal generator from a group of generators for a specific field?


texts: If you iterate a cryptographic permutation long enough will you map the input to itself?

texts: Given a cryptographic permutation $\{0,1\}^n \rightarrow \{0,1\}^n$ does it follow that after some number of iterations you must eventually map the input to itself?


texts: So, what is the best outer layer encryption option?

texts: When using tools like an encrypter that encrypts hard or flash drives, you have to pick an outer layer encoding method. What is the best?


texts: Can you exchange a shared key without any hardness assumptions?

texts:
Imagine that P=NP, and one way functions don't exist. Can two people end up with a random shared key of arbitrary length, if every exchange is public? They have true RNGs, and know who they are talking to (we're not worried about mitm attacks).

There is also someone else sharing the channel, who has one time pads with both of them. The two people want to get their own one time pad, without the third person having it. They can obviously check afterwards if they have the same pad by sending random bits in it to each other.

It seems like there should be some way to have one person send a secure message to the third person (who shares a otp with him), and send that on and back with different layers added on each time, then unlayering afterwards, but I don't see exactly if it can work. A solution should make it that the two sides only end up with the same key if the middle person has no way of getting it.

The motivation for this was that CAs could act as middlemen for secure communication in a post-P=NP world, with every computer shipping with the CAs OTPs.


texts:
I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than e.g. HTTP for transferring large files when the latency/rtt is > 100 ms (e.g. between Europe and the US).

The protocol will be used in a server/client architecture - where a server will send/receive data to/from many clients.

Servers are running .NET - and clients will be written in .NET, Java (Android), and Swift (OS X, iOS).

And - it's now time to make the UDP protocol secure.

Some requirements:

Must be secure and fast :)
Must be supported on .NET, OS X and Java
Must support some kind of SessionID - so that the server can separate different clients from another and use the appropriate key for each client.

Reading this post I agree with the approved answer by Otus:

Don't roll your own protocol, but use (D)TLS.
If you must roll your own protocol, use an authenticated encryption mode.
If you can't, at least use standard encryption and MAC.

Here are my thoughts regarding these 3 alternatives:

DTLS
The reason I am a bit sceptical towards DTLS is that I am unable to find any good/trusted implementations for it in C#. BouncyCastle is a museum of old crypto and bad ports according to  Inferno. Eldos has another implementation, but I am unsure of the quality + it's a bit pricey.

Authenticated Encryption Mode
AES-GCM is a good AEAD candidate, and also fast. Inferno has a .NET implementation and there seems to be good candidates for Java and OS X /iOS we well (OpenSSL). However - I'm a bit sceptical to getting all these libraries to work together correctly - just a gut feeling. SessionID could be included as AdditionalData (AEAD).

Standard Encryption and MAC - here's what I'm currently thinking:

Get TLS1.2 Cert Client retrieves the TLS1.2 certificate of the server through a .NET HTTPS call. The client has also authenticated the server by making this call.
Handshake. Client generates a KEY - and encrypts this with the public key of the server. The client sends a "handshake" UDP package to the server containing:

SessionID - A Guid generated by the client. Used to identify client for all subsequent communication. (I do not wish to use a combination of IP/Port to identify client - due to the parking-lot problem)
A SHA-256 Hash of (1) + (3) + KEY (often referred to as MAC)
The Generated KEY - AES-256 encrypted with the public key of the server.

The server and client now has a shared private KEY that they both use to synchronously encrypt/decrypt messages that they send/receive - very similar to the way SSL/TLS works I guess. (Doing async encryption/decryption with the private/public key of the server will be extremely slow)
Each subsequent UDP package sent by the Server will contain:

SessionID - GUID. Plain text. Server uses this to lookup key on its side.
A SHA-256 Hash of (1) + (3) + KEY. This way - the plaintext SessionID is authenticated.
Payload encrypted with AES-256

The advantages - as I see them - are that I am using standardized (and relatively simple) building blocks that are well-proven and easy to implement/test/debug on all platforms. I also get an authenticated SessionID into the mix.

What are your thoughts? Is 3. a feasible option - or should I abandon this approach?


texts: Diffie-Hellman "handshake" vs RSA "handshake"

texts:
I have a question about exchanging symmetric keys. I have read something about the Diffie-Hellman algorithm, where two parties generate the shared key independently, sharing only some parts of it before generation.

In general, I guess that I get the point of how this works, but wouldn't it be easier if the server requested a public RSA key from the client, encrypts the symmetric key using this public key, and sending it back to the client?

Hope you can help, and thanks in advance.

fre3zr


texts: What is the reasoning behind the PRESENT key schedule?

texts:
It seems there are few books on PRESENT and even fewer that give any reasoning behind the mechanics of the key schedule.

I understand how it works to the extent that I made a simple Excel program of it. I can clearly see all the steps and I assume it works as it matches test vectors.

However, I do not understand why certain bits were XORed rather than others, or why the round counters have to be in order $1-31$. My questions are:

In simple terms, how does the key schedule protect it from key related attacks?
What if (for instance) we changed the step $S[b_{78}b_{77}b_{76}b_{75}]$ to something else, such as $S[b_{74}b_{73}b_{72}b_{71}]$ or anything else. Would that make it weaker? Stronger? No different?
What if the round counters were not in the order $1,2,\ldots,31$? What if the round counters were any order of $1-31$? Again, would this make it weaker, stronger or no different?

Thx.


texts: RSA: How to compute the number of possible plaintexts if $e$ is not coprime to $\varphi(n)$?

texts:
I'm studying for an exam next week, and there are two questions that me and my friend don't understand:

Question 1:
Let $p,q$ be big prime numbers and $n=pq$.
Let $e$ be a number between $1$ and $\varphi(n)$ such that $e\mid(p-1)$, $e\mid(q-1)$.
For a plaintext $M$, the ciphertext is $C=M^e \bmod n$.

How many different $M$s will be ciphered to the same $C$?
Edit: what is the maximum number of messages $M$ that will yield to the same $C$?
Why is the answer $e^2$?

Question 2:
Let $p,q$ be big prime numbers and $n=pq$.
Let $e$ be a number between $1$ and $\varphi(n)$ such that $\gcd(e,p-1)=a > 1$ and $\gcd(e,q-1)=1$.
For a plaintext $M$, the ciphertext is $C=M^e \bmod n$.

How may different $M$s will be ciphered to the same $C$?
Why is the answer $a$?


texts: Extending pseudorandom generator by one bit using exclusive-or of previous bits

texts:
Is it possible to have a pseudorandom generator that extends its output by 1 bit by simply appending the exclusive-or of all the previous bits?

I know the output of a pseudorandom generator is indistinguishable from random, so would the appended bit still retain its pseudorandom property? Or is this not pseudorandom because the last bit is deterministic?


texts:
Scenario:

We have a central server $S$.
We have a number of peripheral servers $P_i$
We have some individuals $U_j$
A given individual may be "known" to one or more peripheral servers. Each peripheral server generates unique IDs for the individuals it knows and stores a map $f_i: U_j \to \textrm{ID}$ and the corresponding inverse $f_i^{-1}$
A peripheral server may share its IDs but may never share the identities of the individuals it knows.
The peripheral servers can communicate securely with $S$.
The peripheral servers regularly transmit to $S$ a map from IDs to some data.

Problem:

$S$ wants to determine whether $P_1$'s ID $a$ corresponds to the same individual $u$ as $P_2$'s ID $b$ without ever knowing the value of $u$. If so, it will merge the data from the different peripheral servers. (Details of the merge method are out of scope). Is this possible?

In essence this is "mental snap", or perhaps zero-knowledge set intersection.

Rejected approach:

The domain of individuals is too small to simply send hashes to $S$ and compare the hashes: this would allow identifying the individuals by brute force.


texts:
I have been trying to find a case where AES-192 is used over AES-128 but AES-256 is not used. There are many questions about AES here (I liked this one AES-128/192/256), but from the actual application side, I was unable to determine any cases where AES-192 was used over AES-128.

AES-192 seems to exist because levels of security were desired, but hardware implementations seem to be AES-128 or AES-256.  I did a literature survey on the IEEE and I couldn't find any applications in the hardware space that used AES-192 instead of AES-256, and I could not find anything in the software space, but I did not dive into specific implementations.

Is there any compelling or logical reason to use AES-192 over AES-128 but not use AES-256?

Maybe you can even point me to an example – meaning: some application or implementation where AES-192 is used over AES-128 instead of AES-256?


texts: Is there any appropriate way to break a specific S-BOX?

texts:
I have just started learning cryptography. And I came across such a question that had troubled me for several days.
The picture contains an LFSR and an S-Box.
The LFSR is 32-bit long and the inside structure of the S-Box is unknown which means the whole system is keyed by the S-Box.
The round function picks four bits and looks them up in the S-Box, feed them back in the next four bits over and shifts circularly by four bits.

Now I put a 32-bit long plaintext into the LFSR and the LFSR starts moving.
After 8 clock ticks, it finishes a full-round encryption. To finish a whole process of encryption, it will go 8 full-round encryptions.
Now I can make an arbitrary number of requests in this system which means that I can put different 32-bit texts into the system and check their results after 8 full-round encryptions (= one whole encryption process).

I have several questions about how to know the exact content inside the S-Box:

I have learned several common attack ways to recover an S-Box like the Differentiable Cryptoanalysis and I am a little bit confused about the choice of different attack approaches. Can such ways apply on such a circumstance?
Does this problem have a special property that allows me to own a special-made way to break the S-Box?


texts:
I have a sequence of integers between 0 to 100. Is there any free software like Sage, where I can test randomness of this sequence? I have Linux machine.

To clarify:

I have huge data set. Actually I have my own generator. I want to test its randomness.


texts: Public Key Encryption scheme with small messages among many parties

texts:
Question
Is it possible to create a public key encryption scheme, with $n$ parties, where a party can send all other parties a bit unique to each party in less than $n$ bits?
Assume we can set up a PKI and there exists some public broadcast channel like a trusted forum or a personal webpage.  All users including adversaries are polynomial bound.
Here's an example (completely made up):
I host a website in which people can register their public keys.  Later on the site gets hacked and t accounts got their password stolen. I post a data-blob on my site and users should be able to use their private key to derive either 1, their account got hacked and they should change their password or 0, they didn't get hacked (but should change their password anyway for security reasons).  At the end no one (but me) should know how many users got hacked or the result of any other person.
In addition my site has over eight million keys registered and I would like to minimize the amount of data sent because I have limited bandwidth.  Naively I would think that I would have to host this > 1 MB file and whenever a person visits give them a copy of the file.  After all the users check it would have used over 8 TB of bandwidth.
Ideas
One idea I had was to use a cryptographic accumulator and to somehow insert users based on their public key and post the result.  Later users could check if they are in the accumulator with their secret key.  If they are in the accumulator then their value is 1, otherwise it is 0.
I was considering users generate (sk, pk) pairs like ($sk$, $sk^r$ mod $p$) where $sk$ is a random prime number less than $p$, $r$ is a random number in integers mod $p$ and $p$ is a large prime number.  Next to generate the accumulator I would take all the $pk$ that I want to send 1 to and multiply them together mod p, lets call this $A$.  Then, after I post it, if a user want to check if they are in it they check if their $sk$ divides $A$, if so their value is a 1 otherwise their value is a 0.
A small optimization is that if I have more 1's than 0's then I could create a 0-accumulator instead which identify the users who have 0's.  The problem with this is that users learn if there are more 1's than 0's.  In my application I don't mind if users learn this information.
To throw some numbers around, if I let $p$ = $2^{64} - 59$ then the accumulator will never grow above 64 bits.  The number of keys is about $4.158 \times 10^{17}$ and the odds of a collision in the 8 million keys would be about $7.695\times 10^{-5}$.  In this case I just need to host the 64 bits for all 8 million users which would only cost 64 MB.
I came up with this idea in a few hours so I doubt it would actually work...


texts: Differential Path Search of a Block Cipher

texts:
Camellia Design and Analysis document refers to a paper:

  [24] M. Matsui, "Differential Path Search of the Block
  Cipher E2," (in Japanese), Technical report of IE-
  ICE, ISEC99-19, pp.57-64, The Institute of Electronics, Information and Communication Engineers, 1999

Does someone know the algorithm presented in the above paper, as I couldn't find the paper. It will be great if someone can link to the paper or the portion containing algorithm contents.


texts: Is it correct to concatenate (pseudo-)random byte values before testing them with the NIST suite or tools like dieharder?

texts:
Let's assume I have thousands of (pseudo-)random 4-byte values. The values are 4 byte random values which a blackbox device gave me. I got these values by requesting them. In between others might have requested them too (I don't know about that). Now I'd like to test them for randomness. There are tools for this like dieharder or the NIST Statistical Test Suite.

Is it valid to just concatenate the thousands of 4-byte values so that I end up with one very long byte (n * 1000 * 4 byte) stream which I then feed into these tools?

Is it correct that it doesn't matter for the tests how long the individual values (4-byte) were before? (Because the test tool wouldn't know that I had 4-byte values in the beginning, once I concatenated them?).

Edit:
The question is meant as a general question. The actual underlying problem is how to examine seed values for randomness, which I obtained via UDS Security Access (see https://en.wikipedia.org/wiki/Unified_Diagnostic_Services#Services $27).


texts: What practical uses can random hash collisions be put to?

texts:
Using magic, I've built a machine that instantly generates hash collisions. To try it out, I set the dial to SHA256 and typed in "e7cf3ef4f17c3999a94f2c6f612e8a888e5b1026878e4e19398b23bd38ec221a".

I hit the button and it showed me a long sequence of bytes starting with "09F7E02F1290BE211DA707A266F153B3...". I hit the button again and it showed me another long sequence of bytes starting with "F326BED0DD25CED6BC1799EAF74E7F8C...".

Every possible hash output has an infinite number of collisions. My machine is just picking one of those collisions at random.

What practical uses could I have for a machine like this? You can't reliably get a collision you want - such as one that starts with a given salt or is structured as a valid Bitcoin package - just one of the many random looking collisions.

Note that attempting to open the machine will cause it to disintegrate, leaving only a golden egg behind.


texts: Is there a multiple asymmetric encryption algorithm, which requires all private keys to reveal the secret?

texts:
I am looking for an asymmetric encryption algorithm, which allows to encrypt a secret with multiple public keys, but to reveal the secret all private keys must be used. You shouldn't be able to tell how many times secret was encrypted from ciphertext length. Ciphertext can be decrypted in reverse sequence as it was encrypted.

RSA would be perfect, but it can only encrypt shorter messages than its key length. And the output is same as key length.


texts: I calculated multiplicative inverses of my polynomial in AES using the EEA. How do I find the multiplicative inverses using Fermat's Little Theorem?

texts: How do we find multiplicative inverses using Fermat's Little Theorem? I have the basic understanding of how we compute inverses of numbers, but can someone help with calculating inverses of polynomials in $$GF(2^8)$$


texts: Is there a way of encryption that allows to check what encrypted values are close to their mean?

texts:
I am looking for a way to allow parties to publicize encrypted values that can only be decrypted by one or a select few other parties, but that allow everyone to check how close they are to the mean of all such publicized values.

This of course would mean that there is some entropy that is lost; the encryption would not be perfect because certain information can be gleaned from the given values.

However, are there schemes in which this is possible? At first I thought it might be possible using Homomorphic Encryption, but as far as I now know, these seems to allow to calculate the mean as encrypted value, but not the process of comparing the other values against it.

Is there a way to do this?


texts: Is it possible to brute force a single smaller variable in $\operatorname{HMAC-SHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$?

texts:
Given $c' = \operatorname{HMACSHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$ and the 32-bit integers $a$, $b$, $c$, and $d$ is it feasible to alter $b$ and produce a valid MAC under the unknown key?

I understand that typically it wouldn't be, but I am mostly wondering if it's possible with 4 small independent inputs being used.

Would it change anything if I could observe many MACs over time with all variables constant except one?


texts:
$N=p·q$ ($p$ and $q$ are prime numbers), $m_1, ..., m_x$ are the messages, $e$ and $d$ are RSA encryption and decryption exponents, respectively.

I am given $e, m_1, m_1^e, m_1^d, ..., m_x, m_x^e, m_x^d$.
Is it possible for me to factor $N$ or derive $d$ from the above knowledge?

My tentative answer is "no" because this problem seems to be similar to the problem mentioned in RSA Without Padding?. Therefore, my problem is also similar to the open problem 1 mentioned in Twenty Years of Attacks on the RSA Cryptosystem.

Therefore, I think it's practically impossible to recover $d$ or factor $N$, but I cannot come up with the solid proof. Can anyone help?


texts: Is this variant of Diffie-Hellman viable and quantum resilient?

texts:
In this paper the author suggests using a variant of Diffie-Hellman which involves floating-point numbers of arbitrary size in the generation of a shared secret.  There are no primes, calculations are performed$\bmod{1}$
In simple terms:

Alice picks $x$ (a decimal number) and $a$ (a random integer). She generates $a'=ax\bmod{1}$ and sends to Bob along with x.
Bob generates $b'=bx\mod{1}$ and sends to Alice.
$a'b \mod{1} \equiv b'a\bmod{1}$, accurate to a certain number of digits depending on the size of $a$ and $b$.

I've checked and remarkably (to me at least) the symmetry works.
In the concluding paragraph, the author suggests that this method is resilient to quantum computers:

Apart from being resilient to quantum computers, the great achievement of the suggested
protocol as opposed to the Diffie–Hellman finite fields methodology is the use of the decimal part of a
transcendental number rather than large finite integers. The use of transcendental numbers does not,
by nature, restrict the number of digits in the calculation as do integers. In the case with finite fields,
the secret numbers are limited by the order of the finite field q. For brute force guessing, one only
has to systematically try all numbers less than q. With the proposed method, there is another bound
indicated by the number of digits in the transmitted numbers $a_
0$ and $b_0$
. However, the cryptanalysis
made possible by Shor’s and Grover’s algorithm does not seem to be a threat to this procedure.

Questions

Is this actually a viable method of key exchange?
Is it really resilient to quantum computers?
Is the $\bmod{1}$ calculation as described a known one-way/symmetrical function, and is it used elsewhere?


texts:
So I recently discovered the --s2k mode in gpg.
Sadly it is not very well-documented. I mean, what is s2k even supposed to mean?

Could someone explain to me the purpose and detailed function of s2k?

Is --s2k-cipher-algo even necessary in a symmetric encryption scenario where you define the cipher separately?
What exactly  does --s2k-count do?
What does the number after --s2k-count do? What does it indicate and why is 65 million the highest number? 65 million of what? What is done so many times?


texts: How to get exact number of slots in HElib? Such as 256, 4096

texts:
In the Homomorphic Encryption Library, HElib (https://github.com/homenc/HElib), we set up a set of parameters before generating the ciphertext.
For example:
m = 20191, p = 47, phi(m) = 19800
  ord(p) = 66
  normBnd = 1.62077
  polyNormBnd = 4.92719
  factors = [61 331]
  generator 2 has order (== Z_m^*) of 60
  generator 985 has order (== Z_m^*) of 5
r = 1
nslots = 300
hwt = 0
ctxtPrimes = [6,7,8,9,10,11,12,13,14]
specialPrimes = [15,16,17,18,19]
number of bits = 778

security level = 77.9265

Finally, we get the ciphertext with 300 slots. But I want to get ciphertext with 256 slots.
When I use the function findM(/*k=*/80, /*nBits=*/500, /*c=*/2, /*p=*/47, /*d=*/1, /*s=*/256, /*chosen_m=*/0, /*verbose=*/true);, cannot get the proper parameter m to generate 256 slots.
So how should I select the parameters to get 80/120-bit security, ciphertext with 256/4096 slots.


texts: Choosing encryption algorithms and encryption protocols in military systems

texts:
Militaries use their own cryptographic algorithms, those of a private third party, or ones that are openly available.

But fear of a backdoor having been planted in publicly-available encryption protocols scares them--even though it is technically possible to analyze cryptographic primitives and establish whether or not they are dorked.

Is there any other advantage in hiding the algorithms and protocols a military uses for its systems?


texts:
I have been able properly set up an EC-elgamal protocol by using algorithms available in an IP that I have developed. Everything works fine, except for the fact that I haven't been able to completely "map" my message on the curve. I have converted a string message into hexadecimal ASCII, and used it as the x coordinate before the $S = M + kY$ (point addition) method, and have temporarily given the $y$ coordinate a value of my own because my FPGA isn't capable of performing square root to find the y value in $y^2 = x^3 + ax + b$. After the entire process, the messages sent and received are the same nevertheless therefore visually, it seems to be working well.

Can anyone tell me if "mapping" my message on the curve the way I did (ascii value for $x$ and a random number for $y$) should be legitimate or not? I am still having a hard time trying to find the purpose of the necessity of $y$ coordinate of the mapped message.


texts: Threshold decryption in multi-key homomorphic encryption

texts:
I have a problem understanding the security of threshold decryption in multi-key homomorphic encryption (MKHE) with so called "noise flooding". In particular I think that it is not secure, so probably I misunderstood something.

MKHE allows multiple clients to encrypt their inputs $x_i$ with their private keys, which is joined into a common ciphertext $C$. An arbitrary function $f$ can then be used on $C$ to produce an encryption $C_f$ of $f(x_1,\ldots, x_k)$. Finally (and most importantly for this question), each client creates a partial decryption of $C_f$, which is joined to obtain $f(x_1,\ldots, x_k)$.

I will explain how this is done in this paper based on BFV FHE scheme (RLWE), since I think it is maybe the most simple. There are other approaches with similar ideas like this first paper, this paper
,...

For simplicity I will consider just a simple operation of addition. Say we have three clients, each encrypting $x_i$ and at the end we want to get $f(x_1,x_2,x_3) = x_1 + x_2 + x_3$. The scheme is based on RLWE problem, so let $R$ be a ring and $D_{\sigma}$ a distribution for which RLWE problem is hard. Let $q$ be the modulus of $R$ and $t$ the modulus of plaintext. Define $\Delta = \lfloor q/t \rceil$.

Setup: Let $a \in R$ be a uniformly random element.

Key-gen: Each client samples a secret and noise $s_i, e_i$ with $D_{\sigma}$ and set $b_i = -as_i + e_i$. Then $(s_i, b_i)$ is his key.

Encrypt: Each client encrypts $x_i$ by sampling $r_i, e_i^1, e_i^2$ with $D_{\sigma}$ setting $(c_i^0, c_i^1) = (b_ir_i + e_i^1 + \Delta x_i, a_ir_i + e_i^2)$

Eval: Ciphertexts $(c_i^0, c_i^1)$ are evaluated into an encryption of $f(x_1,x_2,x_3)$ by defining:
$C_{f} = (c_0, c_1, c_2, c_3)$ where $c_0 = c_1^0 + c_2^0 + c_3^0$, $c_1 = c_1^1$, $c_2 = c_2^1$, $c_3 = c_3^1$.

PartDec: Each client samples so called "smudging noise" $e_i^{sm}$ and sends: $\mu_i = c_i^1s_i + e_i^{sm}$

MergeDec: Everyone can calculate $\mu = c_0 + \mu_1 + \mu_2 + \mu_3$ from which corresponds to $\Delta(x_1 + x_2 + x_3) + \text{noise}$ so the result can be extracted.

QUESTION: The reason for the security of the partial decryption is that the "smudging noise" should hide the secrets. But if I use the partial decryption $\mu_i$ of a client together with his partial ciphertext:
$$c_i^0 + \mu_i = (b_ir_i + e_i^1 + \Delta x_i) + (c_i^1s_i + e_i^{sm}) = ((-as_i + e_i)r_i + e_i^1 + \Delta x_i) + ((a_ir_i + e_i^2)s_i + e_i^{sm}) = e_ir_i + e_i^1 + e_i^2s_i + e_i^{sm} + \Delta x_i$$
But this means that one can get $x_i$ which is not ok. One can hide $x_i$ only if $e_i^{sm}$ would be big enough to hide it. But then also $\mu$ would be flooded with noise. What am I missing?


texts: Why image size is decreasing after steganography although no compression is used?

texts:
I'm working on image steganography with LSB technique, mainly text-into-image steganography. My sample images are in bmp format, and surprisingly all bmp images of the same pixel dimensions have the same size (which probably means that they are in bmp format which isn't using any lossless or lossy compression). However and after embedding the text, the product images all have the same size which is smaller the original! From my understanding of steganography, the product images should have the same size as the original images as no compression is used.
Important note: all the sample images have the same before and after sizes.


texts: Could a 2nd EC private key be derived from a public key?

texts:
I understand that the public key does not expose the private key.  That is not the question.

The question is:  Given a EC public key, can a different, but plausible and functional private key be derived to match the public key?

In other words:

In basic arithmetic, if you know a x b = c, and you know any two variables, then you can calculate the third.  But in ECC, we have a public key q, a well known point G, and a private number d.  The public key is derived from the private key by ECPoint q = CreateBasePointMultiplier().Multiply(parameters.G, d);.  I have to assume Multiply is a special form of multiplication, such that knowing q and G do not result in knowing d.  Maybe it's essentially looping over a finite field many times over, or something like that.  But could a different private key be selected that would result in the same public key?

In other words, specifically, let Alice and Bob both have ECDH keypairs, and exchange public keys.  They each remember the other's public key for later authentication.  When somebody claims to Alice "I am Bob, and here's my public key," then Alice confirms the public key matches what she remembers, and she challenges him, "Ok, prove it. Here is my (Alice) public key.  Use it to derive our shared secret, and HMAC sign the following challenge.  Send me back the result as a challenge response.  If you can do that, you must know your private key corresponding to the exposed public key."  Could Eve capture Bob's public key, then derive some different private key to correspond to it, and then impersonate Bob by saying "I am Bob, and here's my public key."  Even though Eve doesn't have Bob's private key, she's able to produce some other private key that's compatible with Bob's public key?


texts: AES-GCM ciphertext that deciphers under two keys

texts:
How can we exhibit an AES-GCM ciphertext, including IV and 128-bit authentication tag, and distinct keys $K_0$ and $K_1$, so that decryption succeeds for both keys?
What degree of control do we have on the respective plaintexts obtained by such decryption? Can that extend to the point that this nightmare (referring page) of the same encrypted and authenticated ciphertext decrypting to two meaningful but wildly different documents holds (for some standard document/archive format)?
Numerical example (or link to that) welcome!

Update: I'm told this is as described there by Yevgeniy Dodis, Paul Grubbs, Thomas Ristenpart and Joanne Woodage's Fast Message Franking: From Invisible Salamanders to Encryptment, in proceedings of Crypto 2018; but I'd like an independent answer focusing on the how (even if that's not detailed), and leaving out Associated Data if that's not essential.