texts:
I'm currently designing a mobile/desktop application to synchronize some messages or notes. I'm searching for a way to secure it and to avoid letting the server be able to read the messages.

My goal is to have a client which encrypts a message on the client side, sending it to the server which stores it to the database. Then, if another client on the same account is connected, it will receive the encrypted message, decrypt it and store it in its local cache.

I can't just use one of the standard end-to-end encryption methods because I don't want to have a different key each time I use the application. I want to be able to store the messages in the database.

Another constraint is that I don't want the user to manually manage the keys. I just want a password for the account.

So, a solution I have imagined is to use an asymmetric algorithm like RSA and a symmetric one like Blowfish or CAST. I generate an RSA key pair when the user creates an account, encrypt it with CAST and the user's password as the key, and store the result locally on the phone. Then, the messages are encrypted with the public RSA key, sent to server and stored in the database. To be able to decrypt messages on another client (like on a PC, for example), I just send the encrypted key pair from the phone to the server that sent it back to the new client. The new client can now decrypt the RSA key pair with the user password and decrypt messages stored in the database.

Since I'm pretty new to all this stuff, I don't know whether this is a good idea, or whether there is a better way to do it.


texts: For what does "Rcon" stand for in Rijndael/AES?

texts:
How do we expand the abbreviation “Rcon” used in the Rijndael key schedule?

I know what it is, I know how it works; I just do not know for what it is a shortcut for. I mean: if "Sbox" is "Substitution box", then "Rcon" stands for… ?


texts:
Consider a very simple symmetric block encryption algorithm, in which 32-bits blocks of plaintext are encrypted using a 64-bit key.

Encryption is defined as $C = (P\oplus K_L) \boxplus K_R$

where $C$ = ciphertext; $K$ = secret key;

$K_L$ = leftmost 32 bits of K;

$K_R$ = rightmost 32 bits of K;

$\oplus$ = bitwise exclusive or;

$\boxplus$ is addition mod $2^{32}$

Show the decryption equation. That is, show the equation for P as a function of $C$, $K_L$ and $K_R$

below is my attempt, I am kinda lost.


texts: Attacks on elliptic-curve based cryptosystems through solving the Decisional Diffie-Hellman Problem with the Weil Pairing

texts:
Are there any examples of practical attacks on cryptosystems set over elliptic curves which utilize the easiness of DDH for certain choices of curves $E(\textbf{F}_q)$, and as such their lack of semantic security? I'm looking for something along the lines of using the Jacobi symbol to narrow the set of possible plaintexts (and therefore cards) against the SRA algorithm in the original Mental Poker proposal.

For instance, Elliptic Curve ElGamal Encryption doesn't seem to omit one. As the ciphertext is $(rP, M + rQ)$, where $r \in \mathbb{Z}$ is random and private, $M \in E(\textbf{F}_q)$ is the plaintext, and $P, \, Q \in E(\textbf{F}_q)$ are public, even if an attacker who can solve the DDH can distinguish elements of the ciphertext, the randomness of $r$ would seem to prevent them from narrowing the search space.

My inclination is no, since the relevance of semantic security predates the advent of ECC and so such an attack would likely have at least been considered heuristically, but I figured I'd see if anyone was aware of anything.


texts: breaking fully homomorphic encryption schemes

texts:
Fully homomorphic encryption schemes allow one to evaluate any arbitrary computation over encrypted data. Intuitively this seems to be too weak, irrespective of how we achieve this.

An adversary who has access to the cipher text only could do variety of operations. For example, duplicates in the cipher text could be found easily. No separate trapdoors are required apart from Public Key. Variety of further operations could be performed on the given corpus of cipher text, so identifying prefixes, suffixes etc. among the cipher words by simply running their respective circuits.

Also with additional information like if an adversary could guess if the column in the encrypted database is an integer. He can do operations like $<$ or $>$ among the encrypted values to further deduce interesting information.

Is this true with homomorphic schemes ? or am i missing some thing ?


texts:
I can calculate $Q = a\,b\,G$ in several ways:
$Q = a \, (b \, G)$ or $Q = b \, (a \, G)$. These give the same result, as expected.

But if I do $c = (a \, b) \bmod n$ where $a \, b$ is much greater than $n$, then $Q = c \, G$, I get a different point.

Should I have expected this? Or does this difference indicate a problem in my
code?


texts: I'm researching on the SHA-1 algorithm and looking for reasons why it has fallen prey to differential cryptanalysis. I have read the research papers by Merc Stevens and Wang both of which describe how to attack and reduce the complexity of the attack on sha1 but none provide a way to reduce its vulnerability. Please help me out by explaining how to increase the strength of a hash function against differential cryptanalysis.


texts: Encryption(AES) and verification per message

texts:
I want to send/receive messages with A (an peer) using TCP socket.
I want to encrypt messages using AES CBC.
Only I and A know a symmetric key K1 used in AES CBC, and K2 used in HMAC.
The size of each message is small( < 100 bytes).
Low latency is needed.
(verification per message is needed.)

Then, I want to verify if the messages are encrypted by A.

Idea 1:
Calculate HMAC of each message.
example: Messages = M1 HMAC(M1) M2 HMAC(M2) ....
         Send(AES_CBC(Messages))
Receiver decyprt Messages and checks if sent "HMAC(M1)" is the same as HMAC(sent "M1").

Idea 2:
Pad zero bits.
example: Messages = M1 Z1 M2 Z2 ....
         Send(AES_CBC(Messages))
Receiver decrypt Messages and check if Z1 is zero.

My question is "Are Idea 1 and 2 secure as assumed by length of bits?"
(example: I put 8bit HMAC or zeros, then I can't break verification the probability of larger than 1 / 256?)

Sorry for my poor English.
Thank you.


texts: Is SHA-256 a one way permutation when restricting the domain to {0,1}^256?

texts:
Suppose we consider the space of $\lbrace 0,1 \rbrace^{256}$ as the domain and SHA-256 as our hash function.  Does SHA-256 become a one way permutation?

Has anyone tried to prove this? Or can it be shown that SHA-256 has more than one cycle under the given constraints?


texts: Homomorphic encryption and approximated GCD

texts:
I am reading the paper Fully homomorphic encryption over the integers (PDF). The paper reduced the security to the approximated GCD problem. My first question is whether the scheme proposed by the paper is semantically secure?

In the paper, the plaintext set is {0,1} and the scheme is asymmetric. I am now thinking about a symmetric setting in which the plaintext set is integers. For an integer $m_i$, the encryption is $c_i=pq_i+m_i$ and the decryption is $m_i=c_i\mod p$, where $p$ is the key and $q_i$ is some randomly chosen integer. It seems that this scheme is fully homomorphic (if the key is large enough). My question is that whether this scheme is secure at all? If so, what kind of security level I can claim?


texts: how to obtain the plaintext in counter mode using the AES block cipher

texts:
I want to obtain the plaintexts.

Sentence1

9d567b9ae76c8a1c72c9075e28d3537a8325bed6043620216c5d796fa65ef24d46a059
9b0c337e9f32465dae103cdb852cddc2e49ab525e923bf364e5c7602f31ee40805ef36
5340e83ef1ee2220fadb2d58ac6e8cf3d0348c34b7a48887a85d8a864bcd5f4ff5b3dc
0b33ada6b92c069f

Sentence2

8c507dc8ce4fb7556bc1554124c54029c420b8d71c36202177547f6ba00bf34356a00a
d2067c65d026444ee20f2a979930c0d1e488b422ff2ffa3b45427018f35bb34739bb72
4b01f571e0af2538bd9e7f50eb608aa9

They were encrypted with the same nonce and key in the counter mode using the AES block cipher. The plaintexts are English sentences.

I guess the first word is 'the' in sentence2.
When I found the 'Enc' in the sentence2. I thought the first word of sentence2 is 'Encrypted'.

I know that the keystream is combined the nonce and the counter value in the Counter Mode.
But, I don't know what should I do after this.

I can't guess the word anymore. How can I know the nonce and obtain full plaintexts??

Any help will be really helpful to me!! Thank you!


texts: Quantitatively measure the private information revealed by a matrix?

texts:
Suppose I have a private matrix $A$ that I want to conceal. I do the matrix multiplication $A^\prime =AK$ and $A^\prime$ is public.

How can I quantitatively measure "how well" the matrix $A$ is concealed? To be specific, I may select different matrices $K$  and want to analyze the different protection levels provided by multiplying $K$.

I way we can think about is the probability to recover $A$ given $A^\prime$. However, even if $A$ cannot be recovered, some information (such as ratio between the entries) will be leaked. How can I quantify such information?


texts: Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?

texts:
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the prime field. I.e. for a 256-bit prime field (like a secp256r1 curve) the we have 128 bits of security and for a 384-bit prime field the symmetrical equivalent strength is 192 bits.

Why is this the case? As I understand it, an $n$-bit symmetric key has $2^n$ bits of security, and an ECC public key is some point $P$ such that $P=k \cdot G (\text{ mod }p)$ where $k$ is the private key and $p$ is the modulus prime field.

secp256r1 has a 256 bit prime field who's prime is a Mersenne prime. So what's going on? Do we use only half the field or...?


texts: Calculating private keys in the RSA cryptosystem

texts:
The number $43733$ was chosen as base for an implementation of the RSA system.
$M=19985$ is the message, that was encrypted with help of a public key $K=53$.

What is the plaintext text?
What is the private key?

So far, my calculations are:

$n=pq$
$n=101*433$
$\phi(43733) = (101 − 1)*(433 − 1) = 43200$.
The public key is $(n = 43733, e = 53)$.
The private key is $(n = 43733, d = 12343)$.

However, I'm not sure if this is right? Where am I going wrong?


texts: SHA1 no longer considered secure for SSL Certificates -- what about Cipher Suites?

texts:
Many browsers and Internet companies have recently claimed that SSL Certificates with a signature algorithm of SHA1 will imminently no longer be considered secure.  Most notably, Google and Google Chrome.

Yet I've read that since the SSL/TLS negotiation and Cipher Suite don't make use of plain SHA1 (or even MD5), and instead use SHA1 within an HMAC; that using a Cipher Suite with SHA1 is still an acceptable security practice.

Is this the case?

While we're on it, is it also the case of using MD5 in a cipher suite?


texts: RSA: Does it matter if you use e or d to encrypt?

texts:
In RSA: Suppose I have already chosen p,q and constructed phi(n).

Now my question is if it’s important whether I encrypt with e or with d?
I don’t think so, e.g. because when encrypting I take plainoneofthe2numbers = cipher and then decrypting I take ciphertheotherofthe2numbers = plain, which is the same as taking plainoneofthe2numberstheotherofthe2numbers, which is the same as plainoneofthe2numbers * theotherofthe2numbers and since in multiplication both sides can be switched there doesn’t seem to be any possible difference whether e or d was “oneofthe2numbers”.

However our lecturer said that e is to encrypt and d is to encrypt (might have said so for pedagogical reasons), so now I’m unsure.
In addition his slides say that when signing a message the roles are reversed. So that you encrypt/sign with d, but decrypt/verify with e. However if there really is no mathematical difference in their role in the decryption/encryption process this differentiation wouldn’t really be needed. (I realize that when signing “key-knowledge” is reversed, meaning the key to encrypt is secret, and the one used to decrypt is public, but my question only concerns the mathematical aspect.)
Thanks for any answers

EDIT: It has been said now by both commenters that knowing d and n, with the secret key being a small e it would be possible to factor N.
Can somebody explain how? Aside from brute-forcing phi(n) and then going from there?
(Pls note that I never suggested using a small e as the private key, but was just interested in the mentioned hypothetical.)


texts: Is the Salsa20/ChaCha20 keystream generation one-way?

texts: Is it possible to recompute the Salsa20 or ChaCha20 key in a realistic time if the keystream and the nonce are given to an attacker? Or is the keystream generation one-way, like a cryptographic hash function?


texts: What is the current encryption method used on GSM currently?

texts:
I am currently doing a mini project which sniffs GSM packets using gr-gsm and wireshark.

I was wondering if anyone knows what is the name of the current encryption algorithm method used on GSM?


texts: How to make a message into a polynomial? I saw many answers to this question and yes, i know that here are some questions. But i did not get it. I think that i am making some mistakes. I took a word and just convert to binary-and here is my polynomial. I this that it is not correct, i am working with utf-8 (so example with ascii-7 not solution for me). I dont like to use a hybrid crypto ( with for example aes-think that these symmetric crypto are not secure), but i tried it-and i used a 128-bit key for aes and parameter N=503 for NTRU and this is not enough for me. Because i have key ( aes) for example 255 255 255 255 255 255 255 255 255 255 255 255 255 155 155 155 and i need these spaces- i am trying to create app for windows phone  encrypt sms, so it need for correcting decrypt. So i think that i am not right and need your help. Help me understand how to correct in my case make a message into a polynomial and may be give some ideas for encrypting sms.


texts: Pseudorandom number generators based on hard problems in mathematics

texts: I know that Dual_EC_DRBG's security is based on the ellitpic curve discrete logarithm problem, Micali-Schnorr is based on the difficulty of factorization, and MQ_DRBG is based on multivariate cryptography. Are there any others based on known hard problems instead of intricate designs?


texts:
Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as:

$SigGen(s, B)$:

$m = H_{q}(s||B)$, $M = m \times G$
$c = H_{q}(P||M||B)$
$p = m + c \cdot s$
Outputs $\sigma = (M, p)$

$\text{Verify}(P, B, \sigma)$:

$c = H_{q}(P||M||B)$
Check if $ p \times G \stackrel{?}{=} M + c \times P$

What would be the implications of changing $c = H_{q}(P||B)$, removing the dependency on $M$?

The only thing I can see is that there exists one $M^{*}$ such that $\sigma = (M, p) = (M^{*}, p)$ is equally valid. But an acceptable compromise in my point of view, if one actually needs to construct a scheme that maintains a deterministic value for $c$ given $B$.

Are there any other drawbacks?


texts: Why EMI/EMC testing is necessary of Cryptographic Equipment?

texts:
In the Book, "Endpoint Security" Page 265, It includes Electromagnetic Interference / Electromagnetic Compatibility Testing in Heading Level 1.

Why is it necessary for Cryptographic Equipment to have EMI/EMC
Testing?
What equipment is used to carry out such testing?


texts:
I am a maths teacher and I'm trying to understand the  Boneh and Durfee attack on RSA. I am not very familiar with cryptography. I found a dutch scripting about it.

I know that:

$ e*d\equiv1+k*\phi(n)$

$\phi(n)=n+1-(p+q)$

I become the function $f(x,y)=xy-(n+1)x-1$, but next I do not understand why you know that $f(k, p+q)\equiv0\,(mod\,e)?$

Further, they choose modulus $M=e^2$ and choose some polynomials of which we know for sure that $(x,y)=(k,p+q)$ is a root of $f(x,y)\,(mod\,e^2)$.

These polynomials are:

How can I see that $(x,y)=(k,p+q)$ is a root of all of these polynomials?

And then, they go on using a table hat contains the coëfficiënts of the polynomials:

I do not understand the meaning of the columns. For example the columns of $g_{0,1}$.


texts:
I apologize if this is in the wrong section. I am completely new to Cryptography. I was presented with the following problem and I am trying to find something that will explain to me how to proceed.
Demonstrate the Diffie-Hellman key exchange using an elliptic curve y^2 = x^3 + ax + 9 mod p, where p = 223. Use XA = 8, XB = 15. Find a perfect generator point or a generator point with the highest order if a perfect generator cannot be found for the first 30 points. List the values of the order of both the elliptic curve and generator point.


texts: how to prove that given cryptosystem is not IND-CCA secure?

texts:
Let $m$ and $k$ be positive integers ($m$ bit plain text) ; let $Q$ be a family of trapdoor one-way permutations such that $f : \{0,1\}^k \rightarrow \{0,1\}^k$ for all $f$ in $Q$; and let $G : \{0,1\}^k \rightarrow \{0,1\}^m$ be a random oracle. Let $P = \{0,1\}^m$ and $C = \{0,1\}^k \times \{0,1\}^m$, and define

$K = \{(f, f^{(-1)},G) : f$ in $Q\}$

For $K = (f,f^{(-1)},G)$, let $r$ in $\{0,1\}^k$ be chosen randomly, and define

encryption of $x = (y_1,y_2) = (f(r),G(r) \oplus x)$, where $y_1$ in $\{0,1\}^k$, $y_2$ in $\{0,1\}^m$

decryption of $(y_1,y_2) = G(f^{(-1)}(y_1)) \oplus y_2$

The functions $f$ and $G$ are public key; the function $f^{(-1)}$ is the private key


texts: How much can I assume hashes to be different for different contents?

texts:
I know that some hashes, like MD5 or SHA-1, that were previously thought to be safe are now known to be vulnerable to collision attacks. But it is obvious that collisions exist for all hashes, given that the space of possible hashes is smaller than the space of possible contents. For example, if one considers all possible files whose size is smaller or equal to the hash size, there must be some collisions.

However, I wonder if I can be sure that hashes will be different for “small enough” differences in contents. For example, for a given hash, can I assume that:

All contents whose size is = the hash size will have different hashes (so that if $H(m_1) ≠ H(m_2)$ then $H(H(m_1)) ≠ H(H(m_2))$)?
All contents smaller that $m$ bits/bytes will have different hashes?
All contents that differ by less than $m$ bits/bytes will have different hashes?
All contents that differ by less than $m$ consecutive bits/bytes will have different values?
Inserting less that $m$ bits/bytes within a content will change its hash?
Inserting less that $m$ bits/bytes at the end/beginning of a content will change its hash?
Anything else?

If there are such assumptions that are true, do they survive the hash being truncated?

I guess answers to these questions are very dependent with the chosen hash functions. I’m very interested by answers about hashes of the SHA-2 and SHA-3 families, but answers about other hash functions (even MD5 and SHA-1) are welcome as well.


texts: Does the backdoor in Dual_EC_DRBG work like that?

texts:
From what I read, the backdoor in Dual_EC_DRBG operates by using related $P$ and $Q$ points.

Did I understand the idea correctly?

Dual_EC_DRBG works by multiplying the $P$ point with the seed initially, and then using the $x$-coordinate of the previous resulting point (let's call that $S$) instead of the seed (that value is named $s$).

The $x$-coordinate of the current point is then multiplied by the $Q$ point, to act as an one-way function and prevent the ability to produce more bits knowing one output value.

Let's call the resulting point $R$.
Its $x$-coordinate (called $r$) is then truncated and output.

Does the backdoor work the following way?

Assuming
$Q = P \cdot x$ and $R = Q  \cdot s = (P \cdot x) \cdot s$

(and that x is known to the adversary)

it should be possible to calculate
$S = P \cdot s$, which would allow to continue generating bits since the output:

$$S = R \cdot x^{-1} \pmod n)$$

Is that true?


texts: Is a car odometer reading protected by MAC?

texts: I knew the reading on a car odometer can be easily modified with the help of some softwares. But isn't there MAC to protect the reading from being modified?


texts:
I'm trying to work through an encryption assignment and the instructions aren't particularly clear because they don't go hand in hand with the lecture video.

  Using encryption key e = 9 in modulo 23, perform the following
  calculations:

  Take the secret message M = 21, encrypt this message as a number E. Note down the value of E.
  Let d be the decryption key for this encryption system. Compute d. Complete the following sentence: e × d ≡ a(mod b). Note down the value of a, b and d.
  Use the results above (or an alternative approach) to decrypt the secret message M that was encrypted as E = 15. Note down the value of M.

I was sorta able to do the first one but I have my doubts.  So e = 9, p = 23(got this from a classmate) and M = 21.  The encryption algorithm given in the lecture was E ≡ M^e (mod p) and that turned out to be 17.  So the message 21 was encrypted to 17.  I am going off of p = 23 from a classmate but I don't quite get she got that value from.

The 2nd issue that I'm having is E = 15 in #2.  The value is suppose to be 17.

The 3rd issue I'm having is the value of a.  I know the value for e and I can find d by isolating it but I don't know what to make of a.

I'm not asking anyone to do my homework for me.  My problem is that this is super unclear and half-assed.  I was wondering if those well-versed in encryption can break this down for me and highlight my mistakes.


texts: what's the advantages of identity-based systems over certificate-based ones?

texts: Actually, I'm not familiar to how  identity-based and  certificate-based systems work, so ,can anyone give me a detail and comprehensive answer to this question? Moreover, in what environments the  identity-based systems is recommended(or needed) and why?


texts: What are the current limitations (and capabilities) of Functional Encryption used for access control?

texts:
I'm trying to make my way in Functional Encryption used for access control.

I read a lot of papers such as "How to Run Turing Machines on Encrypted Data", "Functional Encryption: New Perspectives and Lower Bounds", or "Attribute-based encryption for circuits" and I ended up with a feeling of uncertainty in my understanding as they are quite hard to digest.
What I'm looking for is an ABE-like scheme where policy may contain both logic and algebraic gates. For example:

"job=doctor" AND "age mod 2 = 0"

this (stupid) policy provides access to the plaintext to doctors whose age is even.

Pushing on the line, a policy could include arbitrary computation such as a signature verification algorithm. From what I read, I feel the only hope of achieving these goals lies in FE. Is there a scheme able to meet these requirements (at least the first policy)? At which cost?

How much of what I wrote is reality, what is achievable and what is fiction?


texts: How effective is Serpent-256 in CTR mode?

texts:
I downloaded a compression program known as PeaZip which offers encryption and 2-way authentication also.

PeaZip has an option to encrypt compressed file with variety of ciphers and one of them is Serpent.

It gives option of:

Serpent 128 CTR OMAC
Serpent 256 CTR OMAC

I want to know how strong any cipher, specifically Serpent, is in CTR mode. Assuming a strong password or truly random key file of appropriate size is used.

I am not aware of how effectively this cipher is handled in PeaZip, but that is a different matter.

Ideally, in which mode Serpent is more effective.

-- Edited --

The details of crypto library which PeaZip uses are here.

Author of this library says about Serpent:

  Serpent (designed by Ross Anderson, Eli Biham, and Lars Knudsen) was one of the AES finalists; it is a 128-bit block cipher with key sizes of 128, 192, or 256 bits. Please note that although my code supports OMAC and EAX, these modes are not tested against public test vectors (the usual C libraries do either not implement Serpent or OMAC/EAX).


texts: Openssl speed vs TLS speed with postquantum KEM

texts:
I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl).
I don't know why, but the KEM algorithms performance in TLS is 10 times slower than using the openssl speed command.
For example, Kyber512 takes more or less 2.20 ms to perform the key generation in TLS with the method OQS_KEM_keypair, while with the command openssl takes more or less 0.14 ms in a Raspberry Pi 3B+.
Can someone explain what's wrong? Does the TLS protocol affect in the postquantum algorithms speed?


texts:
I'm working on a program that uses an ECC keypair in a (password protected) PKCS12 file (.pfx) to encrypt files. I like this method because I think it will be higher security (using ECDH to negotiate the key) and more easy to use (one PIN for all files). How I'm going about this is by using the public and private keys of the same certificate to negotiate a secret using ECDH. A SHA-256 of this secret is used every time to encrypt a random generated key just for that file. The program outputs file.enc, kek.iv, kek.enc, file.iv all in a zip for the encryption portion of the program. file.enc is the ciphertext of the original file, kek.iv is the IV used to encrypt the file-specific key (session key if you will). kek.enc is the ciphertext of the file-specific key that has been encrypted with the shared secret. And by "I'm working on this program", I mean I already wrote the program but it's not working and I'm starting to question the fundamental logic.

My question is, is it even possible to get the same ECDH secret every time between the same public/private key pair so that it can be used to encrypt files? If not, how can I achieve the goal of encrypting files with one keypair?

Btw I'm trying to implement Suite B so I'm using ECC(P-521) keys for ECDH and AES-256/GCM with BouncyCastle


texts: Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?

texts:
I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet.

I'm putting together a small radio protocol where packets can be lost and if an ack isn't received the packet is re-transmitted. In this instance the nonce is reused, but I can't see that an attacker has any more useful information than the initial packet. I would presume that the key is still safe. Is this correct or have I missed something obvious?

EDIT:

It is a custom protocol, based on a resource requirement that prevents going with something like 6LoWPAN.

I was not going to use random nonces, but rather sequential nonces, with the top 32 bits of the 96 bit nonce set to the 32 bit node address that the packet comes from. The problem with this is reliably storing the nonce in flash with limited erase / write cycles. Although I have seen implementations save blocks of nonces, rather than every use.

I can gather entropy from concatenating the lowest bit of multiple reads of the signal strength from the radio, but I would guess that sequential nonces are safer to use, if I can guarantee they are sequential.

I was thinking of using a network registration method where the node, on power up, would have a preshared RX encryption key, but no TX encryption key. The node would ask for network registration where a master node (server) would send a new TX key encrypted and authenticated. If correctly received the new node would use the new TX key and the nonce would start again from 0. This would get around the problem of storing the nonce at the expense of a slight delay in network registration. This network is only designed to be local to a single site, all nodes within reception of each other.


texts: How does converting character set affect hash entropy?

texts:
Does mapping a large character-set hash onto a small character-set hash lower entropy for a fixed size substring?

I'm writing a python app that involves generating passwords for websites. During the application I want to convert hexidecimal hashes to alphanumeric strings, and take the first twenty characters of the output. I want to convert to alphanumeric, because most websites at least support the upper-lower alphanumeric character set.

I surjectively map the larger character set of hexadecimal bytes $\{00...\text{ff}\}$ onto the smaller set of upper and lowercase alphanumerics $\{a...z, A...Z, 0...9\}$.

The mapping is done by recycling the 62 alphanumeric elements cyclically to correspond to each element of the 256 bytes

$$00 \rightarrow a$$
$$01 \rightarrow b$$
$$\vdots$$
$$0e \rightarrow 9$$
$$0f \rightarrow a$$
$$\vdots$$

For example, if the world's most secure password - "password" - is sha512 digested as hexadecimal it is unsurprisingly - $128 \times log_2(16) = 512$ bits.

$$
\text{b109f3bbbc244eb82441917ed06d618}\\
\text{b9008dd09b3befd1b5e07394c706a8b}\\
\text{b980b1d7785e5976ec049b46df5f1326}\\
\text{af5a2ea6d103fd07c95385ffab0cacbc}\\
86\\
$$

Since each pair of hex-digits is mapped onto one alphanumeric digit, I assume the entropy of the resultant alphanumeric string is $64 \times log_2(62) = 382.5459$ bits.

$$\text{1j5bcKq8KdvcwVJpuiJj3efBGh5oYSp}\\\text{9
e1D6GB4YeFiLHtMZCUQxdfhpvjhVmWck}\\$$

The new string has half the length but ~75% of the entropy of the original string, so there is more per-character entropy in the alphanumeric projection,
making

$$\text{1j5bcKq8Kd}$$

a better password than

$$\text{b109f3bbbc}$$

Have I made any invalid assumptions, or done the math incorrectly? Any insights into whether or not this surjective mapping is a good idea would be appreciated.
If any clarification or edits are needed I'd be happy to make them - please leave a comment below.


texts: A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book

texts:
Based on the question proposed on page 27, we propose a modified question as follows:

Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($P_2$ publishes its pub key). Then, $P_1$ will encrypt $x$ using the public key and send it to $P_2$.

Considering this scenario, is it secure in the semi-honest model?


texts: Which public key cryptosystem has the highest security/keysize rate?

texts: I'm working on a 16-bit processor msp430 and I need to know what I need to study when it comes to key size efficiency of a public key cryptosystem.


texts: What do these notations mean in the definition of Perfect Secrecy, if we read those in English?

texts:
If m: message, M: message space, k: key, K: keyspace, c: cipher, C: cipher space and $E_k$: encryption function, such that
$E_k(m) = c,\ m,m^* \in M,\ k\in K,\ c\in C.$

Then, what do the following notations actually mean in plain English?

What does it mean by $C=c$? If it means "If $C$ takes the value of $c$", to my understanding it is meaningless. Why would $C$ take the value of $c$? $c$ is a part of the whole message $C$. The same is true for $M$ and $m$.


texts:
It seems that the nonce of AES-GCM in SSL has 3 parts:

salt, 4 bytes, generated in handshake, not changed in whole session
nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL record
inner_counter, 4 bytes, used in AES-GCM internal

Is it possible to use a more simple method to construct the nonce:

generate a 16-bytes IV in handshake
use this IV as counter for each cipher block in the whole session life, ignore SSL record boundary

then the sender need not carry nonce for each record, saving the bandwidth.

===

I read the RFCs again and found I misunderstood something.

Let me make the question clear.

AES-GCM algorithm: require the nonce is distinct.
AES-GCM specification [RFC 5116]:

It gives an recommended format (not required):

" When there are multiple devices performing encryption using a single
key, those devices must coordinate to ensure that the nonces are
unique.  A simple way to do this is to use a nonce format that
contains a field that is distinct for each one of the devices, as
described in Section 3.2."     [ Fixed + Counter ]

" In some cases, it is desirable to not transmit or store an entire
nonce, but instead to reconstruct that value from contextual
information immediately prior to decryption."
[ Fixed-Common + Fixed-Distinct + Counter ]
It is defined for protocols that uses record. I missed this before:

"Each AEAD algorithm MUST accept any plaintext with a length between
zero and P_MAX octets, inclusive, where the value P_MAX is specific
to that algorithm.  The value of P_MAX MUST be larger than zero, and
SHOULD be at least 65,536 (2^16) octets.  This size is a typical
upper limit for network data packets."

QUESTION: However if we ignore the specification, is it possible to treat the whole SSL session as a stream (ignore the record bondary), and use only one nonce (and use the nonce as counter) ?

AES-GCM in SSL [RFC 5288]: it uses the recommended format.

QUESTION: since it generates master-secret in each SSL session, it would not hanppen that "multiple devices performing encryption using a single key". Why does SSL use the recommended format (the Fixed part)? What's the function of 'salt'?

I know that since specifications of AES-GCM and SSL have been defined, we should just follow it.
I just wonder why it was defined like this.

Besides, maybe we could define an SSL-extension, so that the SSL client and server could use record-seq as nonce_explicit, and do not send it with record.


texts: How to show that a function is not a PRP?

texts:
So I have to answer these questions, but I honestly have no idea what I am doing or where to begin. Can I get some advice on how to tackle these?

Consider a PRP candidate function $f$ on $K = X = \{0, 1\}^n$ which is a permutation on $X$ for every key in $K$, but for all $k, x \in \{0, 1\}^n$, it satisfies $\operatorname{parity}(f_k(x)) = \operatorname{parity}(x)$.

Show that $f$ is not secure as a PRP.
Show that the CBC encryption mode with block cipher $f$ is not indistinguishable.
Show that the CTR encryption mode with block cipher $f$ is not indistinguishable.


texts: Encrypt your ECDSA signature with NTRU to make them quantum secure, does that work?

texts:
I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure.

My question is: if we sign with ECDSA and encrypt the signature NTRU. Does that make the signature safe? Because I can expose both ECDSA and NTRU public keys but if either of them is compromised it shouldn't compromise.

Is this a correct statement or am I missing something?


texts: Why does TLS 1.2 use GCM with additional SHA hash?

texts:
I am studying the cipher suites provided by TLS 1.2 and found an interesting question.

TLS 1.2 adopts GCM for encryption and SHA256 or SHA384 for hash (e.g. TLS_RSA_WITH_AES_128_GCM_SHA256). But, GCM already provides data authenticity (integrity).

So, my question is that why TLS 1.2 includes another hash functions (SHA256 or SHA384) to provide integrity. Why not just use GCM for both encryption and hash, like IPsec?


texts: If $G$ is a PRG, is $F(s)=G(S)||G(\bar{s})$ necessarily a PRG?

texts:
Let $G$ be a pseudorandom generator, and $F(s)=G(s)||G(\bar{s})$ (where $\bar{s}$ denotes the bitwise complement of $s$), is $F$ necessarily a PRG?

My intuition says that it is a PRG, as clearly $G(s)$ and $G(\bar{s})$ are PRGs on their own, and concatenating them shouldn't affect the randomness, but rather it will simply increase the expansion factor (length of output). However, I feel like there exists a counterexample where $G(s)$ and $G(\bar{s})$ are secure on their own but concatenating them will lose some randomness, i.e. make them predictable (because $F(s)$ and $F(\bar{s})$ should look pretty similar). I've thought about some examples where $G(s)=H(s) \oplus H(\bar{s})$, where $H(s)$ is a PRG (and $G(s)$ would also still be a PRG here), but I'm not sure if this leads to $F(s)$ not being a PRG. Any thoughts would be appreciated!


texts: In storing passwords in a database should I use a per-application salt in addition to a per-secret salt?

texts:
Assuming that the salts are sufficiently long (16 random chars) is there any advantage in using a per-application salt in addition to a per-secret salt when storing hashed passwords in a database?

The per-application salt would held in the code.  The per-secret salt would be held in plain text on the same database entry as the hashed password.


texts:
Let CS be a combined scheme of $n$ public key subschemes.
CS is composed of two algorithms Setup and KeyGen, that all the subschemes share, plus all the other algorithms of each subscheme.
Suppose that each one of the subschemes is individually secure in the Random Oracle Model (ROM).
I want to prove that CS is secure, with the following definition: CS is secure if all its subschemes are jointly secure, meaning that each subscheme is secure in the presence of the others.
$Proof$. Suppose an adversary A is able to break the security of subscheme $i \in n$ in the presence of the others.
We can construct an adversary B that simulates subscheme $j \neq i \in n$ by programming random oracles, in a game that is indistinguishable from the real experiment.
B will then use the attack of A to break the standalone security of subscheme $i$, which we assumed to be secure. We prove, by contradiction, that CS is secure.
Does this make sense? If not, how can I prove that CS is secure?


texts: What Chaining Mode to use with RSA? (CNG's BCrypt)

texts:
I'm trying to make my first RSA encryption/decryption using CNG. In 1 part of the example they add pick a chaining mode, I don't know if this is mandatory and when I tried to google about it I found that most of those are not safe. So I would like to know which one is the right one to pick.
(In the future I would like to use it to sign data)

From Cryptography Primitive Property Identifiers, Microsoft's Docs it offers:

CBC
CCM
CFB
ECB
GCM


texts: Non-cryptographic hash function as MAC for stream ciphers

texts:
I understand that for a stream cipher to be useful, there must be a way to verify that the message was not tampered with (bits were flipped by an attacker).

So, instead of using some cryptographic hash function, like SHA-2, with HMAC, what if I used a much simpler (and faster) hash function, like FNV hash algorithm, and encode its output together with the plaintext?

Like, suppose I have a 1000 bytes plaintext message, then I hash it with Fowler–Noll–Vo of 256 bits output, then concatenate them both, having a message+MAC with 1032 bytes.

Then I XOR this 1032 bytes message+MAC with 1032 bytes output of some stream cipher (the ordinary encode operation of most of them, like RC4 or those in eSTREAM portfolio).

What is the problem of this approach?


texts: Is it possible for a cryptographic algorithm to limit the number of times a package/ciphertext can be decrypted?

texts:
I got the idea from Eve Online's BPCs (Blueprint Copy). The in-game explanation is that the license to manufacture a copy of a starship is limited to X times, and afterwards the BPC is automatically corrupted.

I understand that the resulting plaintext can be copied after decryption any number of times, rendering the limit moot, I was just wondering if its possible.


texts: Calculating ECDSA m or k (k or d) when s1 = s2

texts:
I recently began to look into some information about obtaining the private key $k$ when two signatures have been produced using the same $m$ and $k$.
I've been using the well-publicised information about how the Sony PS3 private key was leaked, where:
$$m = \frac{e_1 - e_2}{s_1 - s_2}$$
$$k = \frac{e_1s_2 - e_2s_1}{R(s_1 - s_2)}$$
This has worked well and I've managed to use it to calculate $k$ (private key) in a few situations successfully.
However, I'm confused by what I should do with two different signatures ($e_1 \neq e_2$) with the same $s_1$ and $s_2$, because when I calculate $m$ or $k$ I get:
$$m = \frac{e_1 - e_2}{0}$$
$$k = \frac{e_1s_2 - e_2s_1}{R(0)}$$
Is there a way to calculate $m$ or $k$ in the situation where $s_1 - s_2 = 0$?


texts: SHA-1 – Would using a SHA1 signature be a risk?

texts:
If data (e.g. an e-mail, pdf file, xml content) is hashed using SHA-1 and then signed by a SHA-2 certificate, is this any bigger of a risk than using a SHA-2 hash with a SHA-2 certificate?

I assume in this scenario although the actual file content COULD be collided (as being hashed using SHA-1), in practice the risk is very small since the signature is made by a secure SHA-2 certificate.

In my question “SHA-1 – Why is it hard to find a certificate collision?” I stated colliding a certificate is harder than a PDF file. However, does this hold up for ANY kind of signed file? A certificate is basically a file with a signed hash. So what if I take a signed PDF? Or a signed e-mail? Would it still be hard to attack and why?


texts: How can an all-zero encryption key result in plaintext ?

texts:
In the Krack-attack paper, the section 6.3 says that a vulnerability on Android devices involves installing an all-zero encryption key when the message 3 is re-sent.

In his demonstration, he shows via Wireshark that the credentials of the user were sent in plaintext.

How can any algorithm result in a cipher equal to the plaintext if it's key is all-zero ? Am I missing something ?


texts: Is there any analysis of freebsd's "geli" encrypted geometry provider?

texts: I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli.  Is there some out there, or has it gone unanalyzed since its introduction circa 2005?  Frustratingly, it seems to have sprung into existence fully-formed and without explanation of the choices in e.g., deriving encryption keys from a master key via HMAC or deriving the key to the master key from passphrase and key files.


texts: I see a lot of papers about FPGA implementations. For what kind of "concrete" application should we implement cryptographic algorithms on FPGA ? Which secured application require such a huge data processing performance ?


texts: Is there a field guide to ECC for the IT Security layman?

texts:
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the common ECC stacks.

Question

Namely, I'd like to know when should a non-standard ECC library (or related hardware) should be used versus when a standard ECC library should be used.

Second, I'd also like to know what trade-offs were considered in the common implementations such as DHE in MSFT or Java versus what's implemented in other software

What I think I understand so far:

There are several mathematic properties that can be used in encryption
Many protocols have been created on those properties to facilitate key exchange.  The common standards are broken into the following categories

NIST - Only
The NIST / SECG overlap
SECG - Only
ECC Brainpool

Real world implementation of the above properties and standards are dictated by:

Patent concerns on the math and the key exchange (Certicom)
Security through obscurity (some haven't been released, and some "compatible" derivatives have been created)
Government approval (why did the government approve it? Backdoors, patents, the country that 'invented' it?)

What I haven't been able to figure out is:

Are some implementations faster, more secure, or more suited for (or against) hardware optimizations?
Are some standards preferred simply because a vendor (or government) paid for their patent fees and will not be legislated?

For a given implementation above, is there any risk of (or benefit depending on whose side you're on) of patented techniques like:

implementation of curves over binary fields using normal bases;
point compression;
acceleration of Koblitz curves using the Frobenius endomorphism;
various optimization tricks on dedicated hardware architectures (FPGA, GPU, ASIC).


texts: Most frequently used digital signature schemes in the recent years

texts:
I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today.

I'm only really interested in what is employed recently (ie. last couple years), as opposite to what was adopted say ten years ago, and especially what's employed in systems in which the bandwidth is limited, hence the signature length needs to be short.

If you could include the figures and link the relevant sources, that would be excellent.

note: I know that last change to DSA happened in 2000, and up to 2004 it was still in use.
Is it still in use in 2012?


texts: How are new coins minted in Proof of Stake systems

texts:
I've been trying to understand Proof Of Stake cryptocurrency systems, but I don't see how new coins are made using the Proof Of Stake system.
My current understanding of Proof Of Stake

People put up a certain amount of cryptocurrency they already hold for a chance to be the entity that creates the next block.  This is the Stake.

Whoever is chosen to write the next block verifies the transactions and as a reward gets to keep all the transaction fees.  If you're not chosen, you get your Stake back.

The Stake of the new block writer is held in escrow (i.e. not allowed to be spent) until several new blocks are added.

If they are found to be cheating they loose their Stake.

I don't see where new coins are being added.  It seems like the coin supply is set and it just moves around as people pay transaction fees.
In Bitcoin, and other Proof Of Work systems, I would buy a computer and become a miner.  I'd keep solving hash problems until I mined a coin, then I could spend the coin.  I do not need to have Bitcoin to mine it.  With Proof of Stake it appears I have to have currency to get more - it's a chicken and egg problem.
In a Proof Of Stake system, how do I go from 0 coins to 1 coin?  For example, I invent a Proof Of Stake cryptocurrency.  How do people besides me get coins to spend?


texts: How to account for moore's law in estimating time-to-crack?

texts:
It seems to be common practice (at least in some communities) to tack on the phrase "with current computing power" when estimating the absurdly long time it would take to, for example, brute-force an ECDSA private key or find an SHA256 collision, but am I wrong in thinking that these calculations should account for the ever-increasing power of the "average" computer?

In short, when making an educated guess of time-to-crack via brute force, is there a some kind of easy "fudge factor" to include that accounts for likely technological improvements a la Moore's Law (et al)?


texts:
How can I judge the level of security with the following algorithm:

I create a 64 byte hash using SHA512 via some input. I use this hash to iterate over the plaintext, byte by byte, and similarly iterate over the hash byte by byte XORing each byte of the plaintext with a respective byte from the hash like this (in C#):

for (int i = 0; i < data.Length; i++)
{
  if (j == key.Length) j = 0;
  data[i] = (byte)(data[i] ^ key[j++]);

}

where key is a byte array containing the hash. Issues of how the code acquires the key aside, is this secure? (Apologies if I am not framing this with the proper terminology). I am not using a salt. The input which is used to create the hash can be of any length (up to being reasonable; i.e., not a huge block of text).


texts: How much computing resource is required to brute-force RSA?

texts:
It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for around 40 years—possibly longer.

It's fair to assume that, during those 40 years, certain three-letter organisations have employed their vast resources toward "breaking" RSA.  One brute-force approach may have been to enumerate every possible key-pair such that, upon encountering a message known to be  encrypted with a particular public-key, they need merely lookup the associated private-key in order to decrypt that message.  Signatures could be forged similarly.

How reasonable is this hypothesis?  How much computing resource would have been required over those 40 years to enumerate every possible {1024,2048,4096}-bit key-pair?  I think it best to avoid discussion and leave the question of whether the spooks could have harnessed such resource as an exercise to the reader.


texts: Short Weierstrass equation is non-singular for not 2 or 3 characteristic

texts:
Consider a field $K$ of characteristic $p \neq 2,3$. Consider a curve $E$ over $K$ defined by the equation $y^2 = x^3 + ax + b$.

How can I show that:

  $E$ is not an elliptic curve (it is not singular) $\iff$
  $4a^3 + 27b^2 = 0$


texts: Can someone clarify two things about the HKDF by Krawczyk?

texts:
I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been published as RFC 5869.

I got two questions about the short informations. It is said that:

  Research results obtained in recent years point out to the advantages of building KDF functions based on HMAC rather than on plain hash functions as traditional schemes do.

What are the advantages? What is exactly meant by that?

  In particular, these results show that an HMAC-based KDF can be founded on weaker assumptions on the underlying hash function
  …
  Based on such results we propose HKDF, a fully-specified HMAC-based KDF, that can serve multiple applications under a wide variety of requirements and under relaxed assumptions on the hash functions.

What assumptions are exactly meant?

It would be very nice if someone can give me some short explanations or some thoughts.


texts: How effective is quantum computing against elliptic curve cryptography?

texts:
I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following.

  in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due to concerns about quantum computing attacks on ECC. Elliptic-Curve Cryptography

My question is, how vulnerable is ECC to quantum computing?


texts: Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?


texts: How can I encrypt more than 64 bit with the Data Encryption Standard?

texts:
The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key.

If my data is more than 64 bits, (suppose 66 or 67 bits), will it take remaining bits as 0s (zeros)?

How would it encrypt?


texts: Is it secure to use hexadecimal data for IV instead of raw binary?

texts:
Is it safe and secure to use a function like bin2hex (which converts binary data to hexadecimal) on the binary output of functions like openssl_random_pseudo_bytes and mcrypt_create_iv?

Meaning: can I use the hexadecimal output instead of the raw binary data, or is there some kind of security risk involved when doing so?


texts: Significance of parameter q in NTRU lattice attack

texts:
In NTRU (N,p,q,d), N is usually chosen to be prime and q be a power of 2. Why is it that if I increase the parameter q, the probability of finding a key or spurious key that can decrypt the message is much higher?
For example, N=127, q=256 will give me an unsuccessful lattice attack but N=127, q=2^16 will give me a successful lattice attack


texts: What's the difference between H(m) $\oplus$ H(key) and H(m || key) in MAC construction?

texts:
We all know that HMAC has the form of $H(ikey || H(okey || M))$. I'm wondering what if we replace the H(okey || M) into H(okey) $\oplus$ H(M)? In other words, is $$H\Big( ikey \mathbin\| \big( H(okey) \oplus H(M)\big)\Big)$$ also as secure as HMAC? How does this transformation will affect the security of MAC?
I have learned about Bellare's original proof of NMAC and HMAC.


texts: Why when I perform RSA 5 times do I get my original input back out?

texts:
If I perform RSA on my input 5 times, I get the original input back out.
Why is it that often, iterating RSA encryption just a few times cycles yields back the original value, when the public modulus N is small?


texts: What's the difference between a hash chain, transaction chain and a blockchain?

texts: Can anyone explain to me what the difference is between a hash chain, transaction chain and a blockchain?


texts: Verifying Diffie–Hellman parameters someone else generated

texts:
I am auditing some software that includes compiled in Diffie–Hellman parameters (2048 bits).

I can't be sure who generated the DH parameters or how they were generated.

Question:

Can DH parameters be weak if they were generated improperly or
made intentionally weak?
Is it possible to test DH parameters, that I did not generate, to see if
they are 'good'?

I realize this might be better discussed in security SE, however, I wanted to get a more abstract opinion about the cryptography in crypto SE, and depending on the answer here, I will raise a more specific question about the software in question, and what to do about it, on security SE.

UPDATE 2015-Oct-28:
Since I asked this question, the https://weakdh.org analysis was published and the upstream provider ( https://www.stunnel.org ) is changing how they manage the DH parameters. The compiled-in DH parameters may be re-generated during build or software packaging and new DH parameters are generated every 24 hours.


texts: How to prove that a hash or an encrypted message was obtained from a plaintext that has a certain pattern?

texts:
I have the following idea of implementing a lottery game:

we have all the numbers from 1 to 40
we generate a permutation of those numbers which will be the lottery solution
participants need to guess that permutation to win the pot.

The implementation will be in a smart contract.

The game will have a timer, let's say a couple of minutes. If the pot is not won during that timespan, that game ends, to prevent brute-force attacks; afterwards, we can reload the game with a new permutation, but this is not relevant at the moment.

Now, my question is the following: how can we make sure that a valid permutation was generated at the beginning of the game? Any participant should be able to verify that a lucky permutation exists. I was thinking of storing the permutation as a hash and then compare the participant's hash with our hash, but it does not assure that we didn't hash garbage. Furthermore, besides hashing, my ideas point to some public key cryptography algorithms, but I can't figure out how to demonstrate that the encrypted message was obtained from a plaintext that has a certain pattern.

Therefore, I ask you, my fellow crypto-enthusiasts, is there any secure possibility to achieve this?

Thanks in advance.


texts: How to hide multiple types of information in the same file?

texts:
I have a vague memory of watching a video of a guy "unraveling the secret story / lore" from the game Doki Doki Literature Club.
And I remember that he took a file, converted it to .txt and had certain information, converted the same file to .jpg and had other totally different information. Information that can only be seen if you convert the file to .txt and other information that can only be seen if you convert the file to .jpg.
How do I hide different messages in the same file that can only be deciphered by converting it to other file extensions?
If that is not possible then it must be something that my brain messed up in my memories, but I am pretty sure it was like that.
And I don’t have any more details, so I can’t research it properly. This would open up new possibilities for more immersive mystery or horror games.
By the way, I know the basics of steganography but I have never seen anything like it, hiding multiple types of information in the same file.


texts: How to test an encryption against different attacks

texts:
For the last while I have been reading up on cryptography and the different kinds of methods for encryption (public key, blocks, etc) and the attacks against them. This got me wondering how to implement or calculate how well an attack would work against a encryption of my own creation.

What are the kinds of attack channels that most encryption have to protect against and how do they do it? I've read into some such as timing and information leakage, but is there a complete list out there somewhere along with information depicting on how to test a cipher against these attacks?

How are attack vectors described once one is found? I saw that some older encryption schemes depict how secure they are based on their key length (such as RSA and the private/public key bitness), and others on how many rounds minimum before a cipher is not secure (like for AES). What do these values, specifically the rounds for block ciphers like AES, mean?

Basically if I create a block cipher, what kinds of attacks should/can I test, and how would I test these attacks, against my cipher?

Thanks.

P.S: If people could comment free encryption related books on this subject of testing of attack vectors I would appreciate it.


texts: RSA private / public key, two valid private keys?

texts:
This might be really stupid but... if
P = 11 and q = 13
N = 143 and r = 120
Say we choose e = 7 where gcd(r, e) = 1 and e < r.
And therefore our public key is (7, 143)
can there be multiple valid private keys? In that...
Where: e*d mod r = 1
d could be 103 or 223, since 103 * 7 = 721 and 223 * 7 = 1561.
They both feel like valid numbers to me...
Does this mean that if I lock the message with e and N.
They can be unlocked with both possible Ds?


texts: What is the post-quantum cryptography alternative to Diffie-Hellman?

texts:
Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption algorithms and public-key signature algorithms - but there are dozens of other constructs like hashes, block ciphers, etc. - but with a quick peek, I didn't find any key agreement algorithms.

Most of todays interactive communication is focused on key agreement via Diffie-Hellman and authentication on top of that - the goal is to set up a "secure channel". Some schemes use signatures for non-repudiable authentication, but many use Diffie-Hellman for repudiable authentication. There are many protocols for key agreement, with varying security properties, that mostly just use Diffie-Hellman in complex ways and depend on the DDH or CDH assumptions on security. As an example of the protocols I mean, I present YAK and J-PAKE.

Now, my question is, what is the post-quantum cryptography answer to establishing a secure channel? Or, specifically - anonymous key agreement, authenticated key agreement and password-authenticated key agreement?

All of the different post-quantum cryptography systems seem to have some big drawback - large signatures, large public keys, large processing requirements etc. - so I am wondering which would offer the best tradeoff for key agreement?

In general, it would seem that any public key encryption algorithm could be used pretty easily for key agreement - but are there any concrete proposals on cryptographic protocols doing key agreement for some post-quantum cryptography algorithm? What properties do these provide, such as PFS, UKS, KCI, deniability, etc? Simply encrypting a random key to the recipients public key does not achieve forward secrecy, unless the recipient public key is ephemeral (random generated each time). If it is ephemeral, the question becomes how to tie some authentication in to the ephemeral key agreement, for which there's no obvious best method but a number of tradeoffs.

I understand that post-quantum cryptography isn't ready yet for general use - and the primitives are not secure enough or standardized enough to use these kinds of protocols in the real world yet - but it feels like there should be more preliminary work done on this problem as well. If you disagree, please let me know that, too!


texts: Why should one model an entropy source in order to build a TRNG?

texts:
Some  assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement.  So a few related questions arise:-

What is a "model"? For example, are we talking a simple histogram of the raw output distribution, or something like $ \sigma^2_{quantum} = \frac{\gamma}{\gamma + 1} \langle V(t)^2 \rangle $ thus $ \sim H_{Shannon}  $ in laser phase interference?
More generally, do they mean   a posteriori (empirical summary statistics, probability density function, $V_{RMS}$ , $\delta^2_{signal}$)  , or a priori (predictive) modelling like the $ V \sim -C_1(1 - e^{-\frac{t - t_a}{C_2}})  $ capacitive charge curve that governs the shape of Zener diode breakdown and the earlier laser equation? The major difference being that an empirical/a posteriori model is agnostic to any physics. Yet underlying physical processes are often mentioned.
Is there any original theoretical work justifying this modelling requirement? I'm asking about any works underpinning or justifying what one might read in a NIST/BSI AIS document.
What to do if the empirically measured entropy rate does not agree with a priori (predictive) modelling? Say a very significant error. A measured noise signal can easily increase 100% between two generic component types from different manufacturers (eg. BZX85C24 Zener diode).

Update:

There is now a hot network question - Is a model fitted to data or is data fitted to a model?
 Currently answers are leaning towards the empirical data taking priority over the theory. So you'd start with the oscilloscope and work upstream to the physicsing[sic]. As a philosophical empiricist, this seems more intuitive to me but there does seem to be a portion of members here that give precedence to   math over  measurement. It's a Plato v Aristotle question and I'm trying to be  open minded on this one.


texts: Generate one-time-pad with pre-shared key and public randomness

texts:
I know very little about cryptography, so I apologize if the question does not make sense.

Let's say we design a function $F(P, X) \rightarrow K$ that takes in a pre-shared private key $P$ and a publicly available source of randomness (say a server that generates true random numbers) $X$. The output $K$ of this function is a new key that we use as a one-time-pad to encrypt and decrypt a message.

The sender pre-share the key $P$, the function $F$ and the source of randomness to the receiver before their communication. For every new message $M$, the sender collects the random information $X$, generates a one-time-pad $K$ using the function $F$ and encrypts the message with $K$. The receiver generates the same $K$ and decrypts the message.

My questions are

This scheme is not information theoretic secure, right? because AFAIK, the one-time-pad cannot be reused in any way, but in this case, we are reusing $P$ for every message, which can be considered as part of the one-time-pad $K$
Is this scheme viable? Is it more secure than simply encrypting/decrypting with the pre-shared key $P$?


texts: How can you extract individual characters of an encrypted string such as a password?

texts:
Many banks and other systems have some sort of a  "select the Nth, Nth, and Nth characters of your password" system.

I don't believe they are going to be storing in plain text, nor would it make much sense to hash and salt each character of the password. Someone I asked mentioned they believe there are algorithms that can check or manipulate parts of encrypted data.

Do these algorithms exist and how do they work?


texts: How Should Form Input be Encrypted for sending to a Server?

texts:
I apologise if this question is a duplicate.  I couldn't find any similar questions.
I am writing a web app that consists of a series of drop-down style question menus.  These generate more drop-downs as questions are answered.
I want to use the end user's answers to the presented questions to generate a JSON file (or similar) and have the client send this back to my server.
I was planning on using a standard SSL certificate to do this.  However it has occurred to me that given the data has an underlying structure this might make it susceptible to brute force attacks.
IE a user registers an account on my server.  Tries the options and encrypts them with my public key.  As the data will be identical to the data generated by any other user that selects the same options they would then be able to determine the input data fairly easily because they would just compare their own transmitted cipher-texts with the cipher-text my other users were sending.
The data is anonymous but would be of an extremely sensitive nature if it could be traced as belonging to a specific individual.  (The software is for helping semi-legal advisers interview their clients).
This can't be a new problem.  So is there a standard accepted way to solve this issue?


texts: How does RSA encrypt a message? Are the message packets chained together?

texts:
This question is quite related to this one, but I am looking for more details.

I am writing a very basic implementation to demonstrate how RSA works. My current implementation generates key pairs using 64-bit integers.

I am looking for the proper method to encrypt a string. I guess the bytes are packed together (32-bits) (smaller than the modulus value), then each packet is encrypted.

I would like to know if each packet is encrypted independently or if they are chained together.


texts: Is there a message size limit with elliptic-curve-based public-key encryption?

texts:
There's a lot of discussion and answers regarding RSA's limits when it comes to the size of the plaintext, but I couldn't find anything similar when talking about ECC.

Is there a limit? If so, why and what is it?


texts: Can I securely refill a one time pad over the same connection?

texts:
If you have a channel where you are communicating using a one time key, is it possible to receive additional key over that same connection without compromising security?

Naively sending it through the same encrypted channel would of course consume the pad at the same rate that you refill it, but maybe there's a more clever way?

Presumably brute forcing would yield the dictionary both when run against encrypted data and against the pad used to encypt future messages, since both look like (or are) random data.


texts:
If $f(x)=x_0x_1\oplus x_1x_2\oplus\cdots\oplus x_{n-2}x_{n-1}\oplus x_{n-1}x_n\oplus L(x)$ is a balanced boolean function (which is a boolean function whose output yields as many 0s as 1s over its input). Determine if $f(x)\oplus x_0\oplus x_n$ is balanced.    Notice that $L(x)=k_0x_0\oplus k_1x_1\oplus k_2x_2+\cdots\oplus k_nx_n$, where $  k_i \in \{0,1\}$.

Newly to this field. Any hints would be helpful.


texts: Partial collisions of hashes, why is this important?

texts:
There's a lot of work finding "partial collisions" in hashes, and "Parallel Collision Search with Cryptanalytic Applications" seems to be the go-to paper for this work.  I'm trying to understand why finding partial collisions, particularly by brute force, is such a topic of interest. As an example, let's say we have a 256-bit hash, and the last 4 bytes are the same for two message.

Is the interest in this work just because it's a useful segue to understand how to make collision?  Is there a condition where one would truncate a longer hash that would cause a partial collision to be a problem?


texts: Difference between $F_2^n$ and $\Bbb F_2^n$ for a field

texts:
I am confused between the notation $F_2^n$ and $\Bbb F_2^n$ for a field in regards to codes.

I thought that $F_2^n$ and $\Bbb F_2^n$ were both fields composed by codes of length n and entries in mod 2, but I now know that this cannot be true.
What is the difference between them?

For example, if code C is consists of all the codewords in $F_n^2$ that have even weight, to show that C is a linear code, do I use the fact that it is a subspace of $F_2^n$ or $\Bbb F_2^n$?

Thank you!


texts: In Microsoft Password Monitor implementation using HME how do they perform ComputeMatch Function?

texts:
https://www.microsoft.com/en-us/research/blog/password-monitor-safeguarding-passwords-in-microsoft-edge/
In this they mention

The server then evaluates a matching function on the encrypted credential, obtaining a result (True or False) encrypted under the same client key. The matching function operation looks like this: computeMatch(Enc(k), D).

How exactly do they perform it? As far as I can understand client data would be encrypted by their own private key and database will be encrypted using server's private key. So since keys mismatch they wouldn't be able to perform HME computations right? What am I missing here?


texts:
byte *key;
String skey = "abcde"

If I convert skey to bytes and uses it to encrypt AES 128 bit, 192, and 256 bits. How AES would work with small key sizes or large key sizes? Is it key expansion or key round that would make it work or it would break? What actually happens behind?


texts: Is there a partially homomorphic cryptosystem without an inverse (addition without subtraction, multiplication without division)?

texts:
I am learning about partially homomorphic cryptography, and was interested to see if there was a system such that one operation was homomorphic, but its inverse was not.

For example, if I have two messages $m_1$ and $m_2$, with an ecryption scheme $e(x)$, is there a cryptosystem such that we can compute $e(m_1 + m_2)$, but it would be infeasible to compute $e(m_1 - m_2)$? Or a cryptosystem that can compute $e(m_1 m_2)$ but not $e(m_1 m_2^{-1})$?

I looked into homomorphic addition systems such as Pallier, which is feasible to compute the additive inverse. I also looked into homomorphic multiplication systems such as RSA and El Gamal, but it seems like its possible to compute the multiplicative inverse as well. Is it always the case that if one operation is homomorphic, its inverse is also homomorphic?


texts:
It is hard to get Least Significant Bit for Discrete Logarithm systems with composite moduli. However this is because of the hardness of the factoring problem.

Is it hard to get Least Significant Bit for Elliptic Curve Discrete Logarithms?
For which cases is it hard to get Least Significant Bit for Discrete Logarithms?


texts: Choosing the parameters $n$ and $q$ in RLWE cryptography

texts:
The usual RLWE cryptographic constructions that I have read uses the parameters $n$ to be a power of two and $q$ a prime such that $q\equiv 1 \mod (2n)$. Do I understand it correctly that the reason we choose $q$ to be that way is that the polynomial $X^n+1$ will split into linear factors which allows a CRT representation for the elements in $R_q=\mathbb{Z}_q[X]/(X^n+1)$?
On the other hand, I saw a paper of Lyubashevksy about Efficient Zero-Knowledge Proofs based on RLWE and they choose $q$ to be a prime such that $q\equiv 3\mod 8$ hence $X^n+1$ only factors into two irreducible factors. My question is, with $q\equiv 3\mod 8$, do we still have a CRT representation on $R_q$?
In general, how do we choose $q$ and $n$ for constructing RLWE cryptographic protocol for it to be secure and efficient enough to implement?
Thanks!


texts: Finding the private key for this signature scheme

texts:
Assume the signature scheme where $x$ is the private key and the public key $y = g^x \pmod{p}$. The signature works as:

Choose $h \in \{0, \dots, p-2 \}$ s.t.: $\mathcal{H}(m) + x + h \equiv 0 \pmod{p-1}$, $\mathcal{H}(m)$ collision-resistant hash function.

The signature is the triple $(m, (x+h) \pmod{p-1},g^h \pmod{p}) = (m,a,b)$

Verification checks if:
\begin{align}
yb &\equiv g^a \pmod{p} \tag{1} \\
g^{\mathcal{H}(m)}yb &\equiv 1 \pmod{p} \tag{2}
\end{align}

The objective is to achieve and forge signatures for arbitrary messages of our choice.


texts:
I collect entropy from the following sources:

system_entropy = System provided crypto entropy stream (CryptGenRandom on Windows)
user_entropy = User-provided entropy - in a form of a byte stream of serialized random mouse movements, key strokes etc (this is manually entered by the user, similar to how TrueCrypt collects entropy)

To generate a key from these sources, is the following construct appropriate?

my_random_key = HKDF(salt, system_entropy || user_entropy)

Where HKDF is a RFC 5869 construct (both extract and expand steps, but since I don't use "info", just extract is sufficient also) based on HMAC-SHA256.

To my understanding, it should be perfectly fine to just append the user entropy to the system entropy, even under the assumption that the user entropy can be entirely controlled by an adversary, right? Because in that case, the adversary will just destroy the "user_entropy" contribution to the security of the key, but assuming the "system_entropy" is sufficient, then it's ok? In a sense, I assume the "system_entropy" to be already secure, but I want to provide "user_entropy" for additional hardening. So I just want to throw as much random junk at the HKDF as possible.


texts: Why are there only positive value points on an elliptic curve?

texts:
I read about elliptic curve cryptography $E$ over $Z_p$ where $p$ is prime number and $G$ is a base point on the curve. I noticed the points resulting from multiplication e.g. $2G$,$3G$,.....,$(N-1)G$ are always be positive numbers for $x , y$ and don't contain any negative values.

Whats the reason for these results not containing any negative values?


texts: What is the difference between information-theoretic and perfect types of security?

texts:
I'm having a hard time pinning down an exact definition of the difference between  information-theoretic and perfect types of security.  A rigorous definition seems elusive...

A. Wikipedia puts the difference down to the perfect type being a (poorly) defined special case of the information-theoretic type. "...a cryptosystem to leak some information" - yet I thought that these two particular security definitions only applied to breaking the encryption, rather than peripheral things like leaking the time the message was sent,
 it's length, etc.

B. An e-voting manufacturer uses entropy to quantify the difference as:-

$H(K | C) = H(K)$ – Perfect secrecy
$H(K | C) < H(K)$ – Information-theoretic security

Yet #2 can be rewritten as $H(K | C) = H(K) - \delta$, and that leads to #2 equalling #1 if $\delta \to 0$.

C. And finally a link from What's the difference between perfect security and unconditional security? is suggesting that "perfect security is the same as information-theoretic security".


texts: How inefficient are current Indistinguishability Obfuscation (IO) candidates?

texts:
Since last year, IO finally seems to be within our reach. Several papers (https://eprint.iacr.org/2020/1003, https://eprint.iacr.org/2020/1024 and https://eprint.iacr.org/2020/1042) proved the existence of IO based on almost-standard assumptions.
Also, we have some heuristically secure (or rather "we don't really know how to break them"-secure) IO candidates https://eprint.iacr.org/2018/756 and https://eprint.iacr.org/2020/889.
Now I'm wondering, how "bad" (in terms of efficiency) would it be, if we actually wanted to use one of them? Let's say we want to obfuscate some Boolean circuit $C$ of size $n$, what's the magnitude of $|iO(C)|$ in Landau notation (if we take $n$ to be the security parameter)? Or are there even concrete estimates on how big the blowup of the obfuscated circuit would be if we want, e.g., 128 bit security?


texts: Problem with calculating the correct value for $(p-1)*(q-1)$?

texts:
I came to a problem when calculating some values for RSA encryption task.

So the data I have is this:

$e*d=81$

$C=5$

Now I have to calculate the original message($m$) and I have an issue because I can see what the solution for $m$ should be, but I get a different answer.

So far, I was able to figure out that $e=27$ and $d=3$.

Now I should calculate $m=(p-1)*(q-1)$ with the equation: $e*d \bmod m = 1$.

But the solution I have from this example says that $m=40 \rightarrow 4*10$ which gives us $p=5$ and $q=11$.

Now my question is why is $40$ correct and not $m=20 \rightarrow 2*10 \rightarrow p=3$ and $q=11$, which is what I got?


texts: Is it generally okay to substitute “like for like”?

texts:
Is it generally okay to substitute “like for like” in cryptographic protocols?

For example, many lattice protocols use SHAKE and SHA3 for various purposes.  However, both of those are relatively slow in software.

If I substitute Blake2X and Blake2b for these respectively, will the resulting (incompatible) protocol still be secure?  Similarly, if a protocol calls for an AEAD, and specifies AES-GCM, can I substitute ChaCha20-Poly1305 instead and still get a secure protocol?


texts: Practical brute-force attack on 128 bit encryption

texts:
In brute-force attack calculations cryptographers say we should assume an attacker will find the key after $2^{(n/2)}$ tries. If n=128, then n/2=64. We know that this is practical (A 64 bit key is already found via brute-force by distributed.net). Then why 128 bit encryption is considered practically secure at present?

BTW, is birthday attack somehow relevant here? I think it is believed that 128 bit hashes are really not secure enough because of the birthday attack. So isn't that fact extendable to encryption too?


texts: How much entropy do I need to add to passwords if they are NOT used in conjunction with logins

texts:
I'm building a system to authenticate users to a website via a single use login token. This token can either be included in links OR typed in directly by the user as a code. Because of that second requirement I'm interested in the token being as short as possible in order to improve user experience.

There are plenty of guidelines regarding "regular" password strength, i.e. for a password to be used in conjunction with a login handle (email, username...). But in my case I believe the entropy needs to be higher since an attacker would essentially be targeting all users in the system at once when doing a brute force attack: if they guess any of the currently valid tokens they'll get into that random user's account.

So the solution needs to take into account how many valid tokens exist in the system.

So, if I can have up to $v$ valid tokens at any point in time in the system, how much more entropy do my tokens need to have? Do I just need to add $log_2(v)$ bits of entropy or is there something else to take into account? How can we prove that?

PS: I'm focusing here on the additional entropy required compared to "regular" password systems as a way to focus the discussion, as there are various measures that can be put in place to reduce required entropy (rate limiting, token expiration policies etc.) that could be applied, but this is not my question :)


texts: Distributed key generation + signature scheme?

texts:
I'm looking for a special signature scheme that has the following features:

There is a group. The group consists of $n$ key centers and 1 user.
All group members have their own private keys, and public keys that satisfies feature 3.
If the user signs (or, private key operation) a message using his private key, then the $n$ key centers (or specific $t < n$) can find out what the public key that used to sign the message is (or, who is the user).

Is there any scheme appropriate for these features? Or a scheme which is similar?

I looked at lots of signature schemes such as group/threshold/ring..., but I cannot find a suitable one.


texts: Trying to implement the algorithm in Wikipedia regarding key exchange

texts:
I am trying to understand the reconciliation technique mentioned in Wikipedia page for Ring-LWE key exchange.
Basically, if we intentionally choose x, y (or the coefficients of calculated shared key of Alice and Bob)
to be different in terms of range or one in range (-floor(q/4), round(q/4)) and another not in that range, then w should be 1 for at least one of them.
Then that party sends w which would be 1 to the other part and then we do the reconciliation technique of $Mod_2$:

$Mod_{2}(v,w)={(}v+w.{\frac {q-1}{2}}{ )}{\text{ mod }}q{\text{ mod 2}}$

Which essentially would do the following (and the bits are supposed to match):

k1 = ((x + (q-1) / 2) % q) % 2
k2 = ((y + (q-1) / 2) % q) % 2

So what I have done (in SageMath) is that I randomly choose 2 values one in the range and one not in that range and then followed the reconciliation
and it does not workout, half of the time bits don't match. Obviously, I am not understanding something here. Any help would be appreciated.

What I assume is that the difference between x and y in a real world implementation should be small (errors are supposed to be small) and that is why reconciliation does not work

arr = {
        "correct" : 0,
        "incorrect" : 0
        }

q = 40961

for i in range(0, 10000):
    x = ZZ.random_element(-floor(q/4), round(q/4))
    y = ZZ.random_element(round(q/4) + 1, q)

    if x not in range(-floor(q/4), round(q/4)) or y in range(-floor(q/4), round(q/4)):
        print "critical error! (range does not match)"

    k1 = ((x + (q-1) / 2) % q) % 2
    k2 = ((y + (q-1) / 2) % q) % 2

    if k1 != k2:
        # print "error!"
        # print k1
        # print k2

        arr["correct"] = arr["correct"] + 1
    else:
        arr["incorrect"] = arr["incorrect"] + 1

print arr

output >> {'incorrect': 4980, 'correct': 5020}


texts:
A simple symmetric encryption algorithm can be written as follows:

Input message M and 64 bit key $K$
Divide M into 64 bit size blocks $B_1...B_n$
Get first block $B_1$ and perform bit-wise $\oplus$ with K
to produce encrypted block $E_1$
Repeat
 Get next block $B_i$ and perform bit-wise $\oplus$  with
 $E_{i-1}$ to produce encrypted block $E_i$
Until End of message

Q) What is the weakness in the above Algorithm if $K = B_1$(first 64 bits in message)

This may seem like an assignment question because it is. I think I know what is happening here. From the algorithm,

$E_1= Key \oplus B_1$ and $E_i=E_{i-1} \oplus B_i$ for all $i>1$

If encrypted text is known, it is possible to get plaintext using $B_i =  E_{i-1}  \oplus E_i$. With the help of this formula, we can derive the entire plain text without having any knowledge of the key.

The algorithm is weak even if $K \neq B_1$ because even then we are able to get the plaintext from ciphertext without any knowledge of the key. However, can we use the fact that Key is equal B1 in this scenario and get any meaningful outcome?

I know that if $K = B_1$, $E_1$ will become 0, then $E_2=B_2$. I am stuck here. So can I draw any other conclusion from it?or is my approach completely wrong?


texts: Which encryption algorithm is used for password protecting a file

texts:
I am using a library to password protect my files into a zip file. The implementation has been taken from this piece of code.
I want to understand which algorithm(if any) has been used here to password protect the files.
The code is minimal and easily readable.
Any leads on this would be helpful.


texts: Length of a Challenge in Challenge and Response Protocol

texts:
Lets consider a challenge and response protocol with the following setup.
Two entities $A$ and $B$. $A$ is generating the challenge and $B$ is generating the response using a digital signature scheme. Lets suppose, that $A$ already has the certificate of $B$. So the procedure is as follows:

$B$ wants to access some service, that $A$ provides.
$A$ would like to know whether $B$ is authorized. Therefore, $A$ generates a challenge ch and sends it over to $B$.
$B$ is generating a response, by signing the ch with its private key and sending the signature over to $A$.
$A$ verifies the received response using the public key inside the available certificate.

This is just a common challenge and response procedure.
Question: How long shall the challenge be? If the challenge is to small, it repeats in a short amount of time. Are there any common methods that are "good-practice" in order to determine a suitable length?
Does this have anything to do with the security level of 128-bit that shall be satisfied in any case?


texts:
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:

SHA-256d(x) = SHA-256(SHA-256(x))

Apparently, the motivation for this construction is to avoid length extension attacks.

Incidentally, SHA-256d is the hash function forming the core of Bitcoin.

According to the comment on the answer linked above, "some minor weaknesses" are known in SHA-256d. What are they?


texts: How can I instantiate a generalized hash function?

texts:
I've come across a bunch of "strange" hash function notations, such as the following ones and now I don't know how to choose / instantiate them.

Can you please explain me what this notation means and how I can actually instantiate such a hash function?

The notation in question:
$$H_1:\mathcal M \rightarrow \mathbb F_p$$
$$H_2:\mathcal M \rightarrow \mathbb Z_n^*$$
$$H_3:\mathcal M \rightarrow \{0,1\}^l$$
$$H_4:\mathcal M_1\times ...\times \mathcal M_k\rightarrow \mathcal S$$

where $\mathcal M\in\{\mathbb F_p,\mathbb Z_n^*,\{0,1\}^*,\mathbb G,...\}$ where $\mathbb G$ is a generic (but there instantiated) group and $\mathcal S\in\{\mathbb F_p,\mathbb Z_n^*,\{0,1\}^l\}$


texts: Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?

texts:
Let's assume we have a message $M$ and it's signature $S$ and that $|$ is
the concatenation operator.

Should we encrypt $S|M$ or $M|S$?

Does it even matter?


texts: Question about the proof of the change of base formula for the discrete logarithm

texts:
I was looking at the proof of a change of base formula for the discrete logarithm in this paper (page 6, 4th bullet indent).
In the intruduction, the paper states:
Let $F_q$ be a finite field of order $q$, where $q=p^n$ ($p$ prime), and let $F_q^* = F_q -\{0\}$. Given $g$, a primitive element of $F_q$, and an arbitrary $y\in F_q^*$, the discrete logarithm of $y$ base $g$ is defined as
$$ \log_g y = x \iff g^x=y \text{ in } F_q \text{ and } 0\leq x\leq q-2.$$
And then the author of the paper proves the change of base formula for the discrete logarithm:
Suppose $\Gamma$ is another primitive element of $F_q$ and we know $\log_g \Gamma = \gamma$.
$\Gamma$ and $g$ both primitive $\implies \gcd(\gamma , q-1)=1$
$\implies \exists \overline\gamma$ such that $\gamma \overline\gamma \equiv 1 \pmod{q-1} \implies g=\Gamma ^{\overline\gamma}$ in $F_q$.
Therefore $\log_g y = x \iff y = g^x = \Gamma ^{\overline\gamma x}$ in $F_q \iff \log_\Gamma y \equiv \overline\gamma x \pmod{q-1}$.
Multiplying the last congruence by $\gamma$ gives $\log_g y \equiv \log_g \Gamma \cdot \log_\Gamma y \pmod{q-1}$.
My question is, why does the following holds (from the beginning of the proof):
$$ g \text{ and } \Gamma  \text{ both primitive element of } F_q \text{ and } \log_g \Gamma =\gamma \implies \gcd(\gamma , q-1)=1  $$


texts: Can substrings of a long string be efficiently authenticated?

texts:
Suppose one has a (strong) shared secret key and wishes to authenticate a very long string in a way that will allow the verifier to verify  small substrings without reading much of the stored data and without much storage overhead.

The trivial way to do this is to have a nonce, divide the string into chunks, MAC each chunk along with its position and the nonce, and then MAC the string length along with a special indicator.

Is there any better way to do that?


texts: How is text converted to a number for RSA?

texts: According to http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Key_generation the key length is the number of bits in n. So how can a message of many megabytes (millions of bits) be modded by a 1024 bit n? I never hear of a block mode for RSA, for instance.


texts:
According to Wikipedia, if Alice wants to sign some message, she computes $s = k^{-1} (z + r d_A)$ then sends $(r, s)$ to Bob.

I don't understand why they use this particular formula $s = k^{-1} (z + r d_A)$ for signing the message ? Why don't they just take $s = r d_A + z$ (i.e. $k = 1$) or $s = d_A + z$ or some other form ?


texts: What are "unspecified" differentials in a differential characteristic?

texts:
I've been studying many papers on differential cryptanalysis and I see that in the published differential characteristics, such as in the appendices of [1], [2] and [3], some differences are left "unspecified" (usually denoted by ** or -).
Why are these differences left unspecified? Since the differentials pass through an S-box, shouldn't their probability be counted? Additionally, how to determine which differentials can be left unspecified and which cannot? Specifically, I'm asking in the context of boomerang attacks
For a more concrete example, section 3.2 from this paper [1] lists a toy example of computing the probability of a differential characteristic for SKINNY:

Example 1. Figure 3 shows a toy example of boomerang characteristic
with two differential characteristics on 3 rounds of SKINNY-64(the upper
characteristic is above the lower characteristic). We suppose that we
are not adding differences in the key (SK model), so we omit the key
from the figure as it will not modify the differences. Lime (for the
upper characteristic) and pink (for the lower characteristic) colored
cells are non zero differences,and grey cells are unspecified
differences. All the differences are given in hexadecimal. We denote
the input and output differences by ∆ex=
[0,d,d,0,0,0,0,0,0,5,0,0,0,0,0,0] and ∇ex=
[0,0,2,0,0,2,0,0,0,0,0,0,0,0,0,0] respectively.

In R1 of the upper characteristic, the cell in position 1 (starting from top left, from left to right) with value "2" passes through the SB layer to the "unspecified" gray cell, thus its probability is not counted. It's not clear to me why these cells in particular do not have their probabilities counted in the total prob. of the distinguisher, and why some cells are seemingly more important than others.


texts: Is encrypting a public key with a symmetric key safe?

texts:
Assume the sender wants to share their ephemeral/long-term public key with intended receiver only and both share symmetric key.

Is it secure to encrypt the (full/partial) public key (of RSA, ECC) with the shared symmetric key?

Is there any chance of finding symmetric key from encrypted public key?

If not why?


texts: Simulation-based proofs and universal composability proofs

texts:
I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says

  The stand-alone simulation-based definitions give you security under sequential  composition, and universal composability and its variants give you security under concurrent composition

What does this mean, exactly?

Moreover, how does a UC proof work? Is the following correct:

A UC proof works if you show that the environment can not tell if it is interacting with the real adversary and the real protocol, or the simulator/ideal adversary and ideal functionality.
To this end, for the proof one must define, for each real adversary, a simulator.

My (other) question is, how do we define this simulator? In proofs, I only ever see the simulator being defined by how it behaves when it receives a message from the ideal functionality and how it behaves when it receives a message from the adversary? But why is it never described by how it behaves when it receives a message from the environment?  The environment wants a two-way interaction with the real adversary/simulator right? So do we have to define the simulator so it knows how to respond and interact with the environment?

Also, I would be most grateful if you should show me example proofs in the UC framework. The shorter/easier the better, just so I can get my head around it. I would absolutely love a paper like Shoup's tutorial on game hopping proofs.

Many thanks!


texts: Is there a number of tries after which Hashcash is guaranted to be solved?

texts:
Hashcash is a proof-of-work system in which the Sender needs to find $Y$ such as the first (let's say 20) bits of $H(X+Y)$ are zeros where $H$ is a one-way hash function, $X$ is a fixed value and $+$ means concatenation.

The Sender starts with an initial random number $Y$. It then computes the hash of $X+Y$. If the first 20 bits of the hash are zeros, then $Y$ is an acceptable number. If not, then the sender increments the random number and tries again. Since about $1$ in $2^{20}$ headers will have $20$ zeros as the beginning of the hash, the sender will on average have to try $2^{20}$ random numbers to find a valid number.

My question is: The average number of tries is $2^{20}$ but is there a number of tries after which Hashcash is guaranted to be solved?


texts: Question on using endomorphism on secp256k1 and negative results

texts:
I have read section 3.5 (algorithm 3.7) in "Guide to Elliptic Curve Cryptography", and have been trying to implement endomorphism on secpt256k1 to speed up calculating $kP$ by changing it into 2 point multiplication operations over half-size bit widths of k with a final point add. I tried to implement this in Python first to make sure I had the equations correct.

I can follow algorithm 3.7 to calculate $k_1$ and $k_2$, but for some values of k input I will get a negative $k_2$.

Does this mean when I evaluate $kP = k_1P + k_2φ(P)$, where
 $φ(P) : (x, y) →(βx, y)$ , I have to either convert $k_2$ to positive by doing $k_2' = n - k_2$ where $n$ is the curve order (this would not make sense as now $k_2$ would be the same bit size of $k$), or do I calculate $k_2φ(P)$ and then find the inverse of this point (just negate the Y coordinate) before adding it to $k_1P$?

This is my code I wrote (I am also not sure if all these operations should be mod n or not).

I do a final check to see if the values match what they should in the textbook ($k = k_1 +k_2λ$ mod n).

But I also have the problem of regardless of $k_2$ being negative (and so I would do the final inversion), the result I calculate from $kP$ does not match the result when I don't use endomorphism (I am using the double-add algorithm for the two point multiplications, not point or NAF, if this makes a difference). I was wondering if anyone knows why?

def decompose_mult(k):
        curve_n = 115792089237316195423570985008687907852837564279074904382605163141518161494337
        lam = 37718080363155996902926221483475020450927657555482586988616620542887997980018
        beta = 55594575648329892869085402983802832744385952214688224221778511981742606582254
        a1 = 64502973549206556628585045361533709077
        a2 = 367917413016453100223835821029139468248
        b2 = 64502973549206556628585045361533709077
        b1_neg = 303414439467246543595250775667605759171

        c1 = (b2*k) // curve_n
        c2 = (b1_neg*k) // curve_n

        c1_a1 = (c1*a1) % curve_n
        c2_a2 = (c2*a2) % curve_n

        c1_b1 = (c1*b1_neg) % curve_n
        c2_b2 = (c2*b2) % curve_n

        k1 = (k - (c1_a1) - (c2_a2))
        k2 = c1_b1 - c2_b2

        print ("k1 ", k1, " bits ", k1.bit_length())
        print ("k2 ", k2, " bits ", k2.bit_length())

        k_test = (k1 + k2*lam) % curve_n
        if (k_test == k):
                print("Values matched")
        else:
                print("Values MISMATCHED")
                print ("k_test ", k_test)
                print ("k ", k)
```