texts: OAEP security with variable length hash function

texts:
I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable length hash functions (specifically SHAKE256) are used for the $G$ and $H$ random oracles.

I already found a paper showing that OAEP was functional as an all-or-nothing-transform, but I'd like to use SHAKE256 as a hash function because it allows for arbitrary-length messages.

My current implementation is here. I pad the message to a minimum of 32 bytes, and then then my $k0$ length, or the length of the additional information added, is another 32 bytes.

I'm wondering if this use of SHAKE256 is theoretically secure, or if there is a problem with using a variable output hash function with OAEP. I'm not concerned with side channel attacks, this is a purely educational implementation.


texts: Is batching possible for a LWE based crypto-system like we do for a RLWE based one?


texts: Can SHA 256 be modified to make it vulnerable to length extension attack both by appending text to the front and adding text to the end?


texts:
Is there anyway to detect that a cipher is encrypted with ROT13 Or Base64 without decrypting it using the algorithm and check that the result means (works)?
I mean does an algorithm exists that test the cipher and tell YES it is ROT13/Base64 (or NO it isn't)?

Thanks


texts: How to design a deliberately weak PRNG for experimentation?

texts:
I'm looking for a PRNG that is deliberately weak, that is, follows a set of rules stochasticly.

For example:
Encounters a set of bits that is a multiple of X, starts exhibiting bias, or starts to oscillate somewhat. etc...

The weaknesses need to both be simple and complex, the experiment would consist of trying to identify those weaknesses to attain some probability P of predicting future output information using various machine learning methods.


texts:
I hope this question is not too obvious, but I came across this paper about PRF, and at some point it writes:

"Let $\mathcal{F}:=\{F_s\}_{s∈S}$ be a family of keyed functions, where each function $F_s$ maps ${\{0, 1\}}^{\ell_1}$ to ${\{0, 1\}}^{\ell_2}$."

What is this meaning of keyed function? What is $S$ in this example?

Thank you!


texts: Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

texts:
I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms approved for FIPS are the most standard ones: RSA, AES, SHA-*, etc.

Is there a similar standard (or an extension to FIPS 140-2) that enables the use of (say) Lifted ElGamal or Paillier? If not, how could one evaluate commercial solutions that support said algorithms?


texts: Scrypt's maximum strength to increase entropy of lame passwords

texts:
The developers claim that a 6 letter long password hashed with 3.8 second's of scrypt would cost $900 to brute-force.

If we use more cycles, how quickly will the brute force cost increase?
What are the minimum system requirements to compute such a huge KDF on a desktop or mobile?
Is there any formula to estimate its entropy based on CPU cycle time?
Does Scrypt survive from Grover's algorithm?

Please consider that bad passwords can be very long.


texts: How to find modulus from a RSA public key?

texts:
I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A typical public key is expressed in base64, and is of the following type:

 -----BEGIN PUBLIC KEY-----

 MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0
 FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/
 3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB

-----END PUBLIC KEY-----

Now from the above key, it is not clear which part is the modulus and which is the exponent. How can I extract the two?


texts:
I'm working on a cryptosystem which uses IDEA.  The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad passwords.  Of course, that opens it up to the obvious attack of brute forcing CRC32 over potential passwords until the right one is found.  Which is what I'm trying to do.

Questions:

Is the best way to do this simply to do an exhaustive search of the password space? It would seem to me that since CRC32(x) is related to x in manifest ways (eg XOR is preserved), it might be possible to do a construction where we actively direct the search in the right direction.  I don't know enough about CRC32, but it would seem to me something like this is possible.

Of course, it's not enough to find a string with the same CRC32.  It has to be the real password used, otherwise the IDEA decrypt will be gibberish.  So this might throw some water on this method.  But, regardless, I'd like to know more about it.  What do you say?
Failing that, I'll need fast code to brute force the CRC32B.  What is the fastest code? My plan is to brute force candidates via CRC32, then try to decrypt via IDEA and measure the entropy to filter out all of the false positives (1 in 4 billion) that will still match CRC.


texts: What is the adversary advantage for soundness of a sigma protocol?

texts: Does a sigma protocol have an adversary advantage of zero for soundness? Or is this affected by the probability distribution of the indistinguishability of the simulator? Will in that case using the Fiat-Shamir heuristic affect the adversary advantage?


texts: Can you use a dynamic key and data size for KMAC?

texts:
I've asked before if some kind of canonical encoding should be used on the input parameters of SHA-3 before it could be used as replacement for HMAC.
However, if I read the current NIST specifications in NIST SP 800-185 correctly, there is no Keypack function defined. The Keypack function prefixed a key size to the key so that the key and message data are kept separate. Currently the key just seems to be zero-padded up to the next block boundary using the function bytepad(encode_string(K), 168) for KMAC128 and bytepad(encode_string(K), 136) for KMAC256.
Does that mean that there is no canonical encoding for key and data? Is it safe to use a dynamically sized key and data within KMAC so that bytepad(encode_string(K), 136) || X != bytepad(encode_string(K'), 136) || X' for K != K?


texts: Is Type I lattice trapdoor hard to find even given oracle access to compute inverse of trapdoor function?

texts:
Consider the Type I lattice trapdoor in [GPV08]: https://eprint.iacr.org/2007/432.pdf

Suppose a PPT adversary is given the LWE trapdoor function in the picture:

$g_{A^\top} (s,e) = A^\top s + e = b (\text{mod } q)$

Let T be a type 1 trapdoor for A.

Now a PPT adversary is given an oracle that does the following:
On input b', the oracle answers with a pair of (s',e') that satisfy $A^\top s' + e' = b' (\text{mod } q)$.

Can a PPT adversary find a trapdoor T by querying this oracle for polynomially many times?

Picture is from lecture notes: https://fangsong.info/teaching/s16_uw_pqc/qic891_pqc_lec3.pdf


texts: How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?

texts:
I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here.

I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd first Enc_k1(m) = c, MAC_k2(m) = t, and then send c||t over to Bob. So far, I understand that this scheme provides no integrity on the cipher-text itself, since the tag only verifies the original message and nothing else.

However, I am also presented with that Enc_k1 is CCA secure.

And then I was told that the Enc-and-MAC scheme is NOT CCA secure.

How can this be? If the encryption itself is CCA secure, the only way the scheme is not CCA secure is if and only if the MAC is not CCA insecure, but I have no idea if that even makes sense.

If it is possible, how can an attacker provide a possible CCA attack?


texts: I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of $n$ make RSA less secure? If so, why? If not, then why isn't $n=p^2q$ standard since it allows operations on a bigger $\mathbb{Z}_n$? Btw, I'm talking about textbook RSA here.


texts: Error during transmission with one plaintext block (Cipher block operation)

texts:
I was given a graph like this, and the problem was stated as: if something happens to P2 then only P2 would not be retrieved on the decryption side, and all other P's can be retrieved normally. I do not understand how so? If something happens to P2 then its encrypted XOR will be wrong, then leads to a wrong C2. Also, P2 will get XOR with the encrypted P3 to create C3, won't that be wrong too, and the same with all other blocks?

Note: P is plaintext, C is ciphertext, D is decryption, and E is encryption.


texts: Why is a number of shares that is greater than a threshold required to construct secret?

texts:
In this][1] paper of Asmuth–Bloom threshold SSS, the algorithm is as follows:
Shares Distribution
To distribute n shares of a secret $K$ among the set of participants
$P = \{ p_i : 1 ≤ i ≤ n\}$, the dealer D does the following:

A set of integers $\{ p, m_1 < m_2 < · · · < m_n \}$, where $0 ≤ K < p$, is chosen subject to the following conditions:

$\gcd(m_i , m_j)=1$ where for $i\neq j$
$\gcd(p , m_i)=1$ ,for all $i$,
$\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$

Let $M =\prod \limits_{i=1}^{t}m_i$. The dealer computes $$y = K+ap,$$
where a is a positive integer generated randomly subject to the condition that $0 ≤ y < M$

The share of the $i^{th}$ participant,$1 ≤ i ≤ n$, is $$y_i = y~ mod ~m_i$$

Secret  Construction
Assume $C$ is a coalition of $t$ participants to construct the secret.
Let $M_C =\prod \limits_{i=1}^{C}m_i$

Given the system $$y \equiv y_ i \mod m_ i $$  for $i ∈ C$, solve y in $GF(M_C  )$ uniquely using the CRT.

Compute the secret as
$$K = y \mod p$$

According to the CRT, y can be determined uniquely in $GF(M_ C)$ . Since $y < M ≤ M_C$ , the solution is also unique in $GF(M)$.
In the [this] [2] original paper the author given to  recover $K$ , it clearly suffices to find y. If $y_{1},y_{2}.......y_{t}$ are known, then by the Chinese remainder theorem modulo $M_C =\prod \limits_{i=1}^{C}m_i$ .
As  $M ≤ M_C$ this uniquely determines $y$ and thus $K$ . On the other
hand, if   only $t-1$ shares were known, essentially no information about  the secret can be recovered

How to prove formally that the number of participants lesser than threshold number $t$ cannot get secret?
[2]:https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=1056651
[1]: http://pdfs.semanticscholar.org/440d/fa8ab99301d4ea3a8b19c0748575915aef15.pdf


texts: How to efficiently generate a random safe prime of given length?

texts:
A prime $p$ is said to be safe prime if $(p-1)/2$ is also a prime. How to efficiently generate a safe prime? I have written the following code in sagemath which generates a random safe prime of 1536 bits. This code took 426 seconds to generate a safe prime. That's very inefficient. Is there a faster way to efficiently generate a safe prime?

while True:
    p = random_prime(2^1536-1, false, 2^(1535))
    if ZZ((p-1)/2).is_prime():
        return p


texts: Is this simple memory-hard function good?

texts:
I'm trying to come up with a simple memory-hard function for a proof-of-work system to protect against spam. Is the one below secure?

For a message M, append a random number R. Repeat until you find R1, R2 such that sha256(M++R1) and sha256(M++R2) share at least d binary digits. R1, R2 is the proof of work, which is sent along with the message. Replace sha256 with any cryptographic hash function you'd like.

I'm assuming this function is memory-hard since you'd want to store all R and their corresponding hash to increase the likelyhood of a match. If you don't store them all, you decrease the probability of a match, which saves memory, but requires more cpu time on average. Also, only storing a part of a hash, like the first half of each hash, should save memory but decrease the probability of a match by orders of magnitude.

Is there an obvious flaw in this algorithm? Is this a known algorithm? Is there a standard algorithm that is roughly as simple to implement?


texts: Implementation of differential cryptanalysis

texts:
This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay.
I am working with the book "The Block Cipher Companion" on the topic differential cryptanalysis currently. I want to implement the proceed, but it seems that there are some problems over here. May be someone had already seen my question here:  Differential cryptanalysis in "The Block Cipher Companion"
I got an working implementation for the CipherFour from the book, which can successful attack all rounds of the CipherFour. But it seems that I can not reach the statistic values from the book in Fig. 6.10.
To figure out some possible problems with my implementation I implemented a easier variant of CipherFour the CipherThree from the book. The Cipher is in the following picture:

I implemented the differential cryptanalysis but it seems that it works a lot more bad than in CipherFour. For that purpose I uploaded my code for that cipher to GitHub, because someone asked on cipherFour implementation. I hope we can solve the problem here in CipherThree, the code is nearly similar. Some comments to my code:
I am starting to search for a differential in method GenerateConfiguraiton. After successful search I generate a list of 16 input pairs satisfying the input differential from the path. Then I do not apply the filter (to reduce possible problems). Then I try go get the key with encrypting the input pairs, decrypt with the guessed key (there are only 16) and then build the difference. But it seems that it works very very bad... May be someone can give me some hint or figure out some problem?
My Code is here: https://github.com/dercdev/TBC_CipherThree


texts: Proper formatting of symmetric algorithm secret key

texts:
Given this description from RFC 4880 sec 5.1:

  The value "m" in the above formulas is derived from the session key as
  follows. First, the session key is prefixed with a one-octet algorithm
  identifier that specifies the symmetric encryption algorithm used to
  encrypt the following Symmetrically Encrypted Data Packet. Then a
  two-octet checksum is appended, which is equal to the sum of the
  preceding session key octets, not including the algorithm identifier,
  modulo 65536. This value is then encoded as described in PKCS#1 block
  encoding EME-PKCS1-v1_5 in Section 7.2.1 of [RFC3447] to form the "m"
  value used in the formulas above. See Section 13.1 of this
  document for notes on OpenPGP’s use of PKCS#1.

and this guess at what the pronoun this in the passage means, what is the proper way to format m? The description seems somewhat vague at where everything goes.

13.1.1.  EME-PKCS1-v1_5-ENCODE

   Input:

   k  = the length in octets of the key modulus

   M  = message to be encoded, an octet string of length mLen, where
        mLen <= k - 11

   Output:

   EM = encoded message, an octet string of length k

   Error:   "message too long"

     1. Length checking: If mLen > k - 11, output "message too long" and
        stop.

     2. Generate an octet string PS of length k - mLen - 3 consisting of
        pseudo-randomly generated nonzero octets.  The length of PS will
        be at least eight octets.

     3. Concatenate PS, the message M, and other padding to form an
        encoded message EM of length k octets as

        EM = 0x00 || 0x02 || PS || 0x00 || M.

     4. Output EM.

Given this data:

ElGamal modulus p has 512 bits -> 64 octets
Symmetric key algorithm = AES128 = 0x07
secret key = 0x0123456789abcdef0123456789abcdef
checksum = 2 * (0x01 + 0x23 + 0x45 + 0x67 + 0x89 + 0xab + 0xcd + 0xef) = 0x780

At first, i thought it was: "0002" + random_non_zero_data + "00070123456789abcdef0123456789abcdef0780", but when i try to decrypt the data using a real PGP program, it says the key checksum failed.

Then, I get contradictory data from PGPdump: m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02, so i tried "070780" + "0002" + random_non_zero_data + "0123456789abcdef0123456789abcdef", but that didnt work either ("exception decrypting secret key").

What is the correct m i should be getting?


texts: Can you break a Vigenere cipher with key length of 2 and message/cipher text length of 4?

texts:
I am currently working on a problem where an attacker knows that a user's password is either "pqrs" or "jmlo" and also knows that the encryption scheme is using the Vigenere cipher with a key length of 2 (Obviously, the attacker also knows the ciphertext). I must either describe how to find out with 100% certainty that the password is either pqrs or jmlo, or describe why this cannot be broken.
After working through it, I cannot see how this would be broken. The plaintext is only 4 characters, so statistical analysis and Kasiskis method of searching for bigrams/trigrams wont work either. Is there anything you can do to crack this encryption scheme?


texts: Can one-way permutations be constructed from one-way functions?

texts:
We can construct various symmetric key primitives like PRGs, PRFs, SPRPs etc., assuming the existence of either one-way permutations or one-way functions with the former assumption allowing simpler constructions.

However, what is the relationship between one-way permutations and one-way functions? Clearly, the existence of one-way permutations implies the existence of one-way functions. Is the converse true? If it isn't then assuming one-way permutations is strictly stronger than assuming one-way functions.


texts: Is streaming API to ChaCha20-Poly1305 possible or recommended against?

texts:
None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the pseudocode from the section 2.8 of "ChaCha20 and Poly1305 for IETF Protocols", which requires the plaintext message to be fully loaded into memory. I would prefer to avoid that in case the input becomes very large (but still finite and with a known size). (I know I could split the message up, but I want to avoid that, too)

I'm starting to wonder if it's at all possible to provide a streaming API to that scheme? If not, why?


texts: Do all stream ciphers (and AES-128-CTR in particular) produce equal output size as the input size?

texts:
I'm particulary interested on knowing if the output of the AES-128-CTR ciphertext is always going to have the same size as the input plaintext, or it could be padded somehow. It seems so from my tests using openssl.

My input (plaintext) is a bytestream (not a bitstream). Is there any difference bytestream / bitstream regarding output ciphertext size?

Does this output size == input size applies to all stream ciphers?


texts: Self signed certificate for mobile app and backend from same company

texts:
My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company.

In such a situation, can the backend use a self signed certificate (instead of getting a certificate from CA) and pin this self-signed certificate on mobile app to make it more secure.

Please let me know if this strategy makes sense (or we still have to get SSL cert from a CA)


texts: Can I open a file in plaintext (already decrypt) but the cipher doesn't change?

texts: I want to create an app that encrypts a file and saves it to the Dropbox. Thus, I open and edit this file, I want the file is already decrypted, but the encrypted file that stored in Dropbox still in cipher text. Whenever I update/edit this file, encrypted file that stored in Dropbox also update. Is this possible?


texts:
Suppose $y=f(x)$ and $z=g(y)$ such that $y\in L_x[a,b]$ and $z\in L_y[c,d]$, where $L$ is the usual sub-exponential asymptotic notation
$$L_x[a,b] = \exp\left((b+o(1))(\log x)^a(\log\log x)^{1-a}\right)$$.
Can $z$ be written as $L_x[a',b']$ for some $a',b'$? I think the answer is yes, based on the following (using the $o(1)$ to hide a lot of terms):
$$\begin{align}
\log z = & (d+o(1))(\log y)^c(\log\log y)^{1-c}\\
= & (d+o(1))\left((b+o(1))(\log x)^a(\log\log x)^{1-a}\right)^c(\log\log y)^{1-c}\\
= & (b^cd+o(1))(\log x)^{ac}(\log\log x)^{c-ac}(\log\log y)^{1-c}\\
= &  (b^cd+o(1))(\log x)^{ac}(\log\log x)^{c-ac}\left(\log(b+o(1)) + a\log\log x + (1-a)(\log\log\log x)^{1-a}\right)^{1-c}\\
= &  (b^cd+o(1))(\log x)^{ac}(\log\log x)^{c-ac}(\log\log x)^{1-c}\left(a+o(1)\right)^{1-c}\\
= & (a^{1-c}b^cd+o(1))(\log x)^{ac}(\log\log x)^{1-ac}\\
= & \log L_x[ac, a^{1-c}b^cd]
\end{align}$$
This confuses me because for $a,c<1$, then $ac<a$. But that would imply that $L_x[ac,a^{a-c}b^cd] = o(L_x[a,b])$, which implies $z=o(y)$, but that does not make sense if $z$ grows subexponentially with $y$.
Have I made some mistake in my derivation? Is the composition of $L[\cdot, \cdot]$ well-known?


texts:
I'm new to RSA and instead of using RSA to encrypt a symmetric encryption key to encrypt data with (although it might help to understand) I would like to use an integer ring with RSA.

My question is what are the minimum/maximum values of $P$ before being turned into $E$ cannot be recovered, and how can I encrypt with a ring, i.e $1 \leq P \leq 26$ and $1 \leq E \leq 26$


texts: Why is padding used for RSA encryption given that it is not a block cipher?

texts:
In AES we use some padded bytes at end of message to fit 128/256
byte blocks.  But as RSA is not a block cipher why is padding used?
Can the message size be any byte length (is the encrypting agent
free to choose) or must it be a certain byte length to use RSA
encryption?


texts: What use cases would benefit from a faster RNG?

texts:
The paper “Explicit Two-Source Extractors and Resilient Functions” (PDF) by Eshan Chattopadhyay and David Zuckerman is described by some as being a technological leap in RNG – opposed to slow and incremental benefits over time.

What benefits would a faster RNG have for cryptography in general? Does this make some formerly implausible scenarios possible?


texts: Can a proof be constructed to show there is no distinguisher?

texts:
Let's assume a simple algorithm like the Skein hash function.

Is it possible, given the algorithm, to construct a proof that it does not have a particular distinguisher, something like:

$P(xyz)$ is the probability that $xyz$ is truly random over some alphabet,

Given $\vert y \vert = l$, for some fixed length l, $z = f(x)$ (i.e., $z$ is dependent on $x$).

Not in general, of course, but for a particular such distinguisher.


texts: Best differential characteristic for this PRF

texts:
Consider the following construction of a PRF $F: \{0,1\}^{128} \times \{0,1\}^{64} \to \{0,1\}^{64}$ on 64-bit messages and 128-bit keys.  Define $f:\{0,1\}^3 \to \{0,1\}$ by

$$f(c,x,y) = \begin{cases} \neg(x \land y) &\text{if $c=0$}\\
\neg(x \lor y) &\text{if $c=1$.} \end{cases}$$

Define an (unkeyed) round function $R_i: \{0,1\}^{1024} \to \{0,1\}^{768}$ by

$R_i(S[0..1023])$:
For $j := 0,1,2,\dots,767$, do:
   $S'[j] := f(c_{i,j},S[r_{i,j}],S[r'_{i,j}])$
Return $S'[0..767]$.

Here the $c_{i,j},r_{i,j},r'_{i,j}$ are design-time constants chosen randomly at design time, from $c_{i,j} \in \{0,1\}$, $r_{i,j} \in \{0,1,\dots,1023\}$, $r'_{i,j} \in \{256,257,\dots,1023\}$.  These design-time constants are public and known to everyone.

Finally, define the PRF by:

$F(K,M)$:
$S_0 := K||M||M||K||M||M||K||M||M||K||M||M$.
For $i := 0,1,2,\dots,47$, do:
  $S_{i+1} := K||M||M||R_i(S_i)$.
Return $S_{48}[256,257,\dots,319]$.

My question: What is the probability of the highest-probability differential characteristic in this PRF?  Of course the answer will depend on the random choice of the design-time constants, but I'm looking for a typical answer or "average-case" answer.  I am excluding related-key attacks, so I care about

$$\Pr[\Delta M \to \Delta Y] = \Pr_{K,M}[F_K(M) \oplus F_K(M \oplus \Delta M) = \Delta Y].$$

Is there a clean way to analyze this?

(Bonus question: are there any simple ways to decrease this probability significantly, without increasing the circuit depth of this construction?)


texts:
To authenticate a message $m = m_1 \,\|\, \dots \,\|\,m_n$ the tag $t := F_k(r) \oplus F_k(m_1) \oplus \dotsb \oplus F_k(m_n)$ is used, where r is uniform random number $(0,1)^n$ and $m=(0,1)^n$. Even though the random number is prepended to the sequence there is still a chance of reordering the message blocks which makes it insecure.

I am confused whether the blocks changed by an attacker make it insecure or not?


texts: Whether there is a public key encryption system based on elliptic curve with the property of multiplication and addition homomorphism。

texts: I want to implement it on the intelligent contract and then do the development，because use paillier i cant genereate 1024bits key,so i try to find if there is exit a public key encryption system based on elliptic curve with the property of multiplication and addition homomorphism。


texts: Is a composition of computational hardness problems still hard?

texts:
It is well known that both $g^x$ and $x^2$ are computational hardness problems in certain rings. But I wonder if the composition of them is still hard?
Namely, given $(g, g^x, x^2)$ in a ring $Z_n$ where $n$ is a composite number of secret factorization, is it hard to get $x$?


texts: Why aren't there function based discrete log problems?

texts:
If discrete logarithm is based on the fact that finding $x$ for $a^x$ is difficult, wouldn't it be difficult to find $n$ such that if $f(x_1) = x_2$ then $f(x_2) = x_3 ... = x_n$ if $x$ is a generator with the equation for a group $N$?

I'm just confused as to why there seem to be only two discrete logarithm problems, EC scalar multiplication and exponentiation.


texts: algorithmic scheme to compare these two number encrypted using paillier cryptosystem

texts:
I have been going through https://eprint.iacr.org/2006/287.pdf (Conjunctive, Subset, and Range Queries on Encrypted Data by Dan boneh)

I am trying to implement the paillier system to create a secure tunnel for gps related data on cloud.

There is a simple implementation of the system in python @https://github.com/mikeivanov/paillier

I am currently stuck at understanding how to code a comparision scheme for any two encrypted values


texts: K-dimensional equidistribution - how big are periods of PCG?

texts:
I'm trying to figure out what is period of PCG generator XSL-RR-RR:
https://www.pcg-random.org
https://en.wikipedia.org/wiki/Permuted_congruential_generator
If we use just random multiplier and increment in LCG in that PCG. M. O'Neill wrote:
"For the PCG family, arbitrary k-dimensional equidistribution (and the huge periods it implies) requires PCG's extended generation scheme."
It looks like their generators has big periods, XSL-RR-RR too. But I can't find accurate information about that. She proved somehow that they are k-dimensional equidistributed. But what is k exactly, what periods it implies and could it be the same with every parameter of LCG in XSL-RR-RR? She tested some specific multiplier and increments so maybe other ones have worse parameters and periods?
I don't understand exactly why she use just some specific miltipliers (two ones if I understand it well) and increments in XSL-RR-RR. What will happen if we will use other, random ones?


texts: How to convert a Diffie–Hellman key exchange number to work with different encryption algorithms

texts: I just read about Diffie–Hellman key exchange and was wondering how the value created from that can be used for any encryption method.  Here is a link of where I read it from.


texts: How do I calculate the correlation immunity of the standard AES Sbox. All material ive read gives out calculation of correlation immunity of boolean functions with single bit outputs. How can it be translated to the 8bit AES Sbox.


texts:
Q: Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version?

I am searching for an algorithm where you can see what happens if you try to transfer it into a blinded or EC version.

There are some algorithms, which have two versions e.g. DSA and ECDSA but is there a single one which has three versions or even all four?


texts: Is possible that find numbers where the product of 3 numbers is congruent modulo to 1?

texts:
It is possible that find the $a, b, c$ randomly in here?
$$
abc \equiv 1{\pmod {\varphi (N)}}
$$
Instead of
$$
de \equiv 1{\pmod {\varphi (N)}}
$$
in the RSA Algorithm.


texts: How do signatures or MACs achieve authenticity, integrity or non-repudiation？

texts:
Actually, I want to know whether there are explicit and formal definitions of the properties which are authenticity, integrity or non-repudiation.
It seems that the signatures and MACs can achieve the authenticity, integrity, non-repudiation and unforgeability. However, there is only an unforgeable experiment when we consider the security of signatures or MACs.
Q1: What about other three types of security experiments? Are there the formal definitions of the security experiments of the other three properties?
Q2: What are the relations among these four properties? (Anyway, how to prove the relation formally, if there are not a formal definitions?)
If the unforgeability implies the others which means that unforgeability is the strongest notion among these four properties, then I think I can regard this conclusion as the answer of Q1. If any pair of these four properties are separated, there must exist a scheme which only achieves any part of these four properties. (I know that a scheme which cannot achieve all these four properties is not secure. I just want to consider the existence of them in order to know the relation among these four properties.)


texts: How to change the master password in a password manager

texts:
For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf

Since I don't exactly have to take the class for the credit and strictly follow the instructions, I've gone ahead and changed some things (like I added a MySQL DB for the backend). What I'm wondering is this: how do you handle someone changing the master password? I have a master password that is used just like the syllabus says, but what if I want to flesh it out more, and have an option to change your master password (seems like something a password manager should have!). How do I implement this? The straightforward way is to simply decrypt everything then re encrypt everything with the new master password. I was just wondering if there's something that's not so inelegant that I'm missing.


texts:
What is the difference between an encryption protocol and an encryption standard?

Am I missing something here? Or are they in fact two different concepts altogether?


texts:
I understand that if a block cipher has $k$-bit keys and $n$-bit input/output blocks, then if $k>n$, we can expect one message-ciphertext pair to narrow us down (I think?) to $2^{k-n}$ possible keys, right? But doesn't DES/AES have a similar system as a block cipher with keys bigger than the blocks. So surely finding one message-ciphertext pair doesn't narrow down the key search so much!?

As you can see, I'm quite confused and so any help would be appreciated!


texts: Are there special techniques to factor numbers of this form?

texts: Suppose $N=p^2rq$ where $p,r,q$ are primes and $r,q$ have equal bits with roughly $(\frac14-\epsilon)\log_2N$ bits while $p$ has roughly $(\frac14+\epsilon)\log_2N$ bits is there a special technique to factor this form of integers?


texts:
I've been thinking about PICNIC, the tier 2 NIST post-quantum signature scheme. Leaving aside the innovative multi-party computation zero-knowledge proof structure, the private key is an $n$-bit key for an $n$-bit block cipher and the public key is a single matched plain and cipher pair corresponding to the key. There's no a priori reason why another key could not produce the same pair, merely that it has probability $2^{-n}$. In the case of PICNIC, recovery of a non-causal key is sufficient to produce forgeries under the signature scheme.
We should expect Poisson($1-2^{-n}$) non-causal keys which most of the time means at least two keys to hunt for. The median exhaust time for one key is $2^n/2$, but for one of two keys it is $2^n/\sqrt 2$. Does this count as a legitimate attack given that some of the security requirements for NIST levels are relative to the exhaust cost of AES?
To be clear, I don't think that this is a serious security deficiency. The effect is easy to mitigate by increasing the block size by 1 (there's even some mitigation keeping the key size fixed and only increasing the block size).


texts: Cryptanalysis of Linear Feedback Shift Registers

texts: It is well known that simple m-sequence linear feedback shift registers have a linear algebraic structure and therefore the generator seed can easily be deduced using the Berlekamp-Massey algorithm. Are there any other algorithms that can that can be used to "break" LFSR's and if so how does the algebra of said algorithm(s) compare to the Berlekamp-Massey algebra?


texts: Am I understanding AES GCM implementation correctly?

texts:
I am implementing an AES cipher in GCM mode in c# and have a few questions. My code is based on the code found [here] for reference. I'll copy in the relevant portions.

I am having difficulty understand the "additional authenticated data" (AAD) of the GCM implementation. (a) What does the AAD consist of? (b) where should the AAD be stored? (c) Is it detrimental to the operation of the cipher if I leave the AAD blank?
 // Authenticated data becomes part of the authentication tag that is generated during
 // encryption, however it is not part of the ciphertext.  That is, when decrypting the
 // ciphertext the authenticated data will not be produced.  However, if the
 // authenticated data does not match at encryption and decryption time, the
 // authentication tag will not validate.
 aes.AuthenticatedData = Encoding.UTF8.GetBytes("Additional authenticated data");

I also do not understand how I am supposed to utilize the "tag" property. (a) Do I need to store the tag once it is created? (b) is the data authentication portion of GCM automatically implemented?
 tag = encryptor.GetTag();

I'm not certain how to retrieve the IV (nonce) from the encrypted data. The code I am referencing simply makes this call:
 aes.IV = GetNonce();

(a) Is this implicitly removing the first 12 bytes from the encrypted data?
If someone is actually able to answer these questions I'd be completely surprised, but it's worth a shot. Thanks


texts: Memory hardness of key derivation function through XOR-ring multiple matrix values

texts:
For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function achieved by a more intense shuffling of the matrix.

If I were to create a matrix with N elements with pseudorandom values:

for i=1 to N
    matrix[i] = HASH (some input)

and then hash over all elements of the matrix:

for i=0 to N
    result = HMAC (SHA512, result XOR matrix[i], matrix[N-i])

It was pointed out to me here that this was not especially memory-hard, since an attacker can trade twice the computation for half the memory use. This is done by only storing the second half of M. Then for the first N/2 iterations of the loop, one only calculates the i'th element from the i-1'th, then recalculate the first half of M instead and continue as earlier.

Greater memory-hardness would therefore seem to be achievable through a more intensive XOR-ring of matrix values in the second loop.

One could e.g. generate a matrix of a size N * x, which is then hashed N times, but each hash made up of XOR-ring multiple different matrix values. The example below (PHP code) shows it for x=4 (^ is the PHP XOR operator):

for i=1 to N*4
    matrix[i] = HASH (some input)

for i=1 to N
    result = HMAC (SHA512, result +
            (matrix[$i] ^ matrix[(N*2-$i)] ^ matrix[N*2+i] ^ matrix[N*4-i]),
            (matrix[N-i)] ^ matrix[N+i)] ^ matrix[N*3-i] ^ matrix[N*3+i)]))

For 8 rounds, a matrix size 8*4 = 32 would be created, and then hashed with XOR combinations in the loop shown. The output below shows, which matrix index values (the i in matrix[i]) would be combined in each HMAC round:

Computing 1 ^ 15 ^ 17 ^ 31 AND 7 ^ 9 ^ 23 ^ 25
Computing 2 ^ 14 ^ 18 ^ 30 AND 6 ^ 10 ^ 22 ^ 26
Computing 3 ^ 13 ^ 19 ^ 29 AND 5 ^ 11 ^ 21 ^ 27
Computing 4 ^ 12 ^ 20 ^ 28 AND 4 ^ 12 ^ 20 ^ 28
Computing 5 ^ 11 ^ 21 ^ 27 AND 3 ^ 13 ^ 19 ^ 29
Computing 6 ^ 10 ^ 22 ^ 26 AND 2 ^ 14 ^ 18 ^ 30
Computing 7 ^ 9 ^ 23 ^ 25 AND 1 ^ 15 ^ 17 ^ 31
Computing 8 ^ 8 ^ 24 ^ 24 AND 0 ^ 16 ^ 16 ^ 32

One concern there is the question of whether that many XOR operations would create a lot of collisions and thus compromise security, even though each result is HMAC hashed. The lines "computing 4/8" show same matrix values being XOR-ed, although one could remove these lines (only two in total) from the second loop or alternate the respective values. It would be interesting to get people's comments on that, with the reasons behind it.


texts: Seeking special-use fingerprinting/hashing algorithm

texts:
For a project I wonder if there exists some kind of fixed-size checksumming/fingerprinting function in which based on this fingerprint given data block 1, it is easy to generate more data blocks that share the same fingerprint/hash key.

Therefore this is unlike an MD5 sum. (In that I don't know how to easily go back from MD5 sum → new matching file.)

Basically, I am looking to generate the set of data blocks that hash to the same fingerprint of data block 1. Data blocks 2, 3, 4 etc... may be the same size or even smaller than 1 – ideally the less information entropy the better – but the series must be deterministic and finite, and computationally easy to find.

Comment#1 helps me tighten some properties.
In particular, considering the mapping

hash[key][index] -> datablock

Given a 32-byte key for instance, index should be consecutive integers like you would expect in arrays, and a fixed index should map to a fixed datablock (for that key).  Within that set of datablocks, each datablock should calculate to the same hash key, but when enumerated should maintain their relative index position (eg. datablockYYY should always and only be found at 15 index positions higher than datablockBBB).

The tricky part might be that the index range of hashes should not have to be so vast as to need as many bits of entropy as the data blocks themselves generally, but substantially less: limited to a 31bit unsigned integer for simpler testing, let's say.  In fact, when I come to calculating the key1 given my starting datablock1, I hope to find a datablockN whose index in the hash is not too far from datablock1's index.  The data blocks need not all be the same size, nor all possible blocks of a certain size be mappable by a particular key (pigeonhole principle in reverse). An onto function? Not sure about the terminology.

Hoping that a much reduced problem using familiar things will help shed some light, though there are significant differences here.


texts:
I'm going through the below snippet of code which does multiplication of point over the curve Curve25519:

bits256 curve25519(bits256 mysecret,bits256 basepoint)
{

    bits320 bp,x,z;
    mysecret.bytes[0] &= 0xf8,
    mysecret.bytes[31] &= 0x7f,
    mysecret.bytes[31] |= 0x40;
    bp = fexpand(basepoint);
    cmult(&x,&z,mysecret,bp);
    return(fcontract(fmul(x,crecip(z))));
}

Here I didn't understand why the few bits are set and few bits are cleared in the mysecret.
Can't I perform multiplication of any point over the curve?
Is there any restriction on it?

Is curve multiplication is commutative over curve25519?

Can you help me understand multiplication of points when using Curve25519?


texts: ECCS: Elliptic Curve Cryptography Cramer Shoup

texts:
Introduction

I know how to do Cramer-Shoup with cyclic groups. But how do I do it in elliptic curve cryptography (ECC)?

Cramer-Shoup with cyclic groups

Following was taken from Wikipedia: https://en.wikipedia.org/wiki/Cramer%E2%80%93Shoup_cryptosystem

Key Generation

Alice generates an efficient description of a cyclic group $G$ of order $q$ with two distinct, random generators $g_1, g_2$.
Alice chooses five random values $({x}_{1}, {x}_{2}, {y}_{1}, {y}_{2}, z)$ from $\{0, \ldots, q-1\}$.
Alice computes $c = {g}_{1}^{x_1} g_{2}^{x_2}, d = {g}_{1}^{y_1} g_{2}^{y_2}, h = {g}_{1}^{z}$.
Alice publishes $(c, d, h)$, along with the description of $G, q, g_1, g_2$, as her public key.  Alice retains $(x_1, x_2, y_1, y_2, z)$ as her secret key. The group can be shared between users of the system.

Encryption

To encrypt a message $m$ to Alice under her public key $(G,q,g_1,g_2,c,d,h)$,

Bob converts $m$ into an element of $G$.
Bob chooses a random $k$ from $\{0, \ldots, q-1\}$, then calculates:

$u_1 = {g}_{1}^{k}, u_2 = {g}_{2}^{k}$
$e = h^k m$
$\alpha = H(u_1, u_2, e)$, where ''H''() is a universal one-way hash function (or a collision-resistant cryptographic hash function, which is a stronger requirement).
$v = c^k d^{k\alpha}$

Bob sends the ciphertext $(u_1, u_2, e, v)$ to Alice.

Decryption

To decrypt a ciphertext $(u_1, u_2, e, v)$ with Alice's secret key $(x_1, x_2, y_1, y_2, z)$,

Alice computes $\alpha = H(u_1, u_2, e) \,$ and verifies that ${u}_{1}^{x_1} u_{2}^{x_2} ({u}_{1}^{y_1} u_{2}^{y_2})^{\alpha} = v \,$.  If this test fails, further decryption is aborted and the output is rejected.
Otherwise, Alice computes the plaintext as $m = e / ({u}_{1}^{z}) \,$.

The decryption stage correctly decrypts any properly-formed ciphertext, since

$ {u}_{1}^{z} = {g}_{1}^{k z} = h^k \,$, and $m = e / h^k. \,$

If the space of possible messages is larger than the size of $G$, then Cramer–Shoup may be used in a hybrid cryptosystem to improve efficiency on long messages.

Questions

How to convert Cramer-Shoup into ECC?
How do I prove the security of ECC Cramer-Shoup?

Literature

Cramer, Ronald, and Victor Shoup (1998). “A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack.” Advances in Cryptology—CRYPTO'98, Lecture Notes in Computer Science, vol. 1462, ed. Hugo Krawczyk. Springer-Verlag, Berlin, 13–25.

Crosspost: https://math.stackexchange.com/questions/3643951/elliptic-curve-public-key-encryption-schemes-cramer-shoup


texts: Is there a function similar to a hash function, but it's reversible?

texts: I am currently making a Python game where the user's high score gets encrypted and stored in a log (a text file). The reason for this encryption is because I don't want the user to be able to enter something (say, 1000000) into the text file. Is there a function that, given a string, will generate a string that looks random to the user (but it's not), and unlike a hash function, can be reversible? Does anyone know how to make one of these in Python? Thanks!


texts:
Cipher modes typically assume data is streamed or read from a reliable channel with guaranteed ordering. However, many communication transports, such as UDP, are not reliable and don't guarantee order of delivery.

I can imagine that there are are some cipher modes which are packet-oriented and can deal with unreliable, unordered datagrams. Is any specific packet cipher mode to be prefered for use with – for example – UDP? And if, what would be the advantages or disadvantages of its alternatives?


texts: During electronic voting, how does one hide the choice from Voting device?

texts:
Assume the following: I want to cast a vote during an election through an electronic voting system. For our system we make the assumption that the device one uses to cast the vote is potentially compromised and will tell a third party how one votes.

Now we allow any out of band preparations before the election beginns. What methods are there to prevent the device from knowing how the voter chose?
One i know of is proposed in the paper "Scratch, click & vote: E2E voting over the internet"

Summary of papers method: To take part in the election the voter gets a coding card and a ballot from two separate authorities. The coding card can be used to determine which fields on the ballot correspond to which candidate. The device the voter uses to vote can only obtain the ballot. as a result the device can not obtain the voters choice as long as none of the authorities collude with the device.

My question is: Are there other Methods to hide the vote from the voting device?


texts: RSA: Detecting period of unconcealed messages

texts:
Referencing:
Project Euler Problem 182 Clarification

I'm trying to determine the (minimum) period for a given value of $(p, q)$.

For a simple case where $p=19,q=23$ the period of repeating order is 132 (which I assume is from 2x2x3x11, the prime factors of 18 and 22).
It's trivial to explore the number-space of 132 to see where $\gcd(e,\phi)=1$ and $\gcd(e,p-1)=2$ and $\gcd(e,q-1)=2$. Same goes for when $p=1009$ and $q=3643$ and I calculate the period to be 152964.

But what about for larger values for $p$ and $q$, like $p=232919$, $q=233117$?

Given that $\phi = 54296912488$, and the prime factors of $p-1$ are 2, 7, 127, 131 and the prime factors of $q-1$ are 2, 13, 4483 then I calculate the period is 27148456244 (is there any possibility of reducing this number-space?)
Is there any other order/period that can be used to my advantage in order to drastically reduce the number of gcd calcs that I have to perform?


texts: What does it mean for a number to be “in the order of” a prime number?

texts:
In some papers I'm looking at there is some language that says things like "Choose a random number in the order of prime q" and I see some syntax that it is referring to that looks s = Zq (where q is a subscript). What does it mean for a number to be "in the order of" some prime?

For context, the paper I am reading is The Twin Diffie-Hellman Problem and Applications.

Here is a link to the paper: https://eprint.iacr.org/2008/067.pdf


texts: AES 256 Encryption - Is it really easy to decrypt if you have the key?

texts:
So this might sound like a crazy question but bear with me for a minute. I can't find any info on the internet and so am here, although this might have been a good place to start.

I've recently developed an encryption engine using the .net's AES managed classes. I use a 256 bit key generated by the Rfc2898DeriveBytes function. The key is generated from a pass phrase that is at least 40 characters long. The IV is also generated from this pass phrase. The encryption class uses a CypherMode of CBC and a padding mode of PKCS7. There is a static salt that is 8 bytes long.

The key is stored in a separate database to the data and is itself encrypted using a certificate based on the database master key.

So, my question is: is it really easy to decrypt the data if the attacker has the key? I'm not talking about the Chinese government (or even GHCQ given recent headlines), I'm talking about an attacker who steals both databases.

What would be the steps they have to follow and/or how can I stop them on their path? The reason I ask this is that I want to know how feasible it is. Is it something that can be done in minutes or does it fall into the bracket of being infeasible? Do they have to calculate all of the parameters used when encrypting?


texts:
Lets say we use RSA as the signature method.

Alice wants to send a message to Bob and uses RSA signing. For that she signs her message with her private key. But everybody could now have access to her message if one just decrypts the signature with Alice's public key.

What is the point of digital signatures if confidentiality is violated?


texts: A substitution based on a matrix vector product

texts:
I choose at random an invertible square matrix A of size 128 in GF(2). I want to use this matrix as a substitution box. Is this a non linear transformation ?

I've seen that substitution boxes are the non linear parts of a block cipher algorithm, but the product between A and x is linear ? Not ? There is something that I don't understand.

Thank you.


texts: What is the conventional way to encrypt double/float data accurately?

texts:
Basically, i want to encrypt standard ecg data with resolution of 11 bit mostly come from MIT-BIH Arrhythmia Database. The sample point values i saw are decimal like .
Suppose that i just want to do simple xor encryption with a set of random generated integer number. How do i accomplish xor of double/float with these integer number?

I already tried by converting the sample point and the random number into 64 bit binary according to ieee754 standard, but there will be a case of the resulting xor values will be NaN (too big or too smal values with all 1 in exponent part) hence i cant get the float value or plot the encrypted data(because NaN is not a value) to visualize the signal before and after encryption.
I also already thought of converting the double/float into integers first by multiplying it by 10^N and floor it down but i dont know what is the appropriate N for all ecg data cases because i might have data loss for some sample point cases such as 0.0009823 with N=100 will become 0. I had hunch that to determine the appropriate N depends on the resolution of the ecg data but after reading some related literature i still dont found the answer.

So what i would like to know is what is the best approaches?and what is the most conventional way of encrypting double/float value of ecg data like that?


texts:
I've been reading Introduction to Modern Cryptography by Katz and Lindell as an introduction to cryptography. The book seems to use the term 'simulator' when it talks about a game like, for instance, how it defines CPA-security as an interaction between an algorithm and a simulator.

Having looked at some crypto papers, it seems like these definitions are actually called 'game-based security definitions'. If this is the case, then what exactly is meant by a simulation-based security definition?


texts:
Unlike the TPM 1.2 module, the TPM 2.0 specification allows the platform user to create own EK (Endorsement Key) using EPS (Endorsement Primary Seed) and EKTemplate and obtain a certificate signed by the Privacy CA corresponding to the public key.

According to TPM 2.0 specification

the manufacturer can install the already generated certificate for the common template provided by the specification.
the manufacturer must have already generated certificates for all templates with zero unique field.

My questions (can't find answers in specification);

According to which protocol can a TPM administrator obtain certificates for an EK public key that is generated not by a standard template, but by a template that contains a random set of bytes in a unique field (also EKNonce)?
Does the manufacturer keep secret EPS? And if not, then he will understand that the key EK generated with this template (the trust to the platform administrator)?


texts: Is verification of ring signature always linear in the amount of members?

texts:
To me it seems that maybe we can prove that verification of a ring signature  must be linear in the number of members, since we need to make sure each members component is correct and the ring is formed correctly.

Is there any proof of this statement, or a refutation?


texts:
I am currently learning about Certificates in Public Key Infrastructure.

  Cross-Certification exists as an alternative because the concept of a single monolithic CA certifying every possible user in the world is quite unlikely.
  Cross Certification are issued by CA's to create Non hierarchical trust path.

It works on the concept that every root CA has cross certified each other. But how is that even possible?

It is stated that almost every country has it's own root CA (in an abstract way). And there exists a lot of countries in the world, then how can all of them cross certify each other?

For Example, the concept of Cross Certification is explained by showing how the root CA of England cross certifies the root CA of Africa. And then Alice living in England can verify the chain of trust of a Bob living in Africa. Stating, that Technically this would mean that Alice's root CA has obtained a certificate or itself from Bob's root CA and vice versa.

This method seems feasible when the number of CA's are limited (like CA of England and japan). But how could this scale up to a large number of CA's(CA of every country)?


texts: Is there a way to encrypt an integer within an arbitrary range?

texts:
I need an algorithm that can take an integer, an arbitrary range, a key of 16/24/32 bytes, and an initialization vector of 16 bytes(ideally), and return an integer in the same range.
My latest attempt at this repeatedly encrypts an integer with AES_OFB until it is in the requested range. I'm using a stream cipher so that the ciphertext can be truncated without ruining the whole thing. The issue is that the decryption process sometimes halts too early.
Pseudocode:

data = 0x7234
range = 0x1000 to 0xa000 inclusive
data = aes_ofb_encrypt(data) // keystream "0x8d7c", data == 0xff48
0xff48 is not in the range, try again
data = aes_ofb_encrypt(data) // keystream "0xe5b7", data == 0x1aff
0x1aff is in the range
return data // 0x1aff

decrypting:
data = 0x1aff
range = 0x1000 to 0xa000 inclusive
data = aes_ofb_decrypt(data) // keystream "0x8d7c", data = 0x9783
0x9783 is in the range // halting too early!!
return 0x9783 // this isn't the right value!

Is there a better way to encrypt integers of an arbitrary range? Ideally I want it to be as strong as the AES algorithm. This example is obviously vulnerable to a brute force attack, but for cases where the integers are of or exceed 128 bits of length, I want the strength of the AES algorithm. Is this possible?


texts: Differences between Extractors and Privacy Amplification for Quantum Random Generators

texts: We know that for the last step of QRNG: we need to separate quantum and classical noises from each other so we use extractors, after extractor we need privacy amplification step. At this point: if extractor is a strong extractor we can use it as a privacy amplification too. However I could not understand differences between extractor and privacy amplification. If I use the strong extractor for the second time, will I be able to complete my privacy amplification step? What will change in privacy amplification? If what happens, privacy amplification will be completed? Thanks


texts: $\ell_2$-norm vs canonical embedding norm on ring-lwe

texts:
Ring-LWE based encryption (I pick up homomorphic encryption here) requires canonical embedding norm rather than $\ell_2$ norm to quantify the polynomial  size (e.g. noise).

Why is this better than $\ell_2$ norm?

Isn't $\ell_2$ norm always be correct?

Canonical embedding is just a embedding which maps a ring element to a complex element by evaluating the original polynomial by complex $n$-th roots of unities, where $n$ is the degree of base polynomial.
Canonical embedding norm is taking a maximum of the complex numbers (Since we evaluate a polynomial by $n$-distinct complex root of unities, we have $n$-dimensional vector, i.e. point-value representation of the original polynomial).


texts: Decrypting the same message with the same IV using aes-256-cbc

texts:
Is it safe to use the same IV when decrypting the exact same encrypted message. From my understanding, there is a security flaw when using the same IV for numerous different messages, as attackers can deduce patterns.
Also is aes-256-cbc the correct encryption method and mode for this scenario. If not, which ones are better?


texts:
What are the valid key types which can get signed (or generated and signed) by a CA to constitute an SSL certificate?
For the keys used in TLS, the key types I have seen are RSA and EC. Anything else?
For non-TLS use cases, are there any other key types that could be used? DH sounds like an option, but I don't think I have ever came across a certificate built upon DH public key.


texts: How exactly works the quantum communication done by China?

texts:
This video and this article announced that spacial quantum communication were finally done using satellites.

As a recap, when two particles are entangled, if a measurement is done to one of them, the appositive value results in the other particle. Nevertheless, traditionally is believed no practical communication is possible to do using this approach because the data is random.

The video says that the way the dealt with the problem is that some information is send trough the quantum channel but extra information is sent also using conventional information which is complemented with the quantum information to get the complete message.

How exactly it works?
What the extra information sent in conventional channel is about?
Is this extra information smaller than the original message?
If not smaller what's the point of using the quantum channel and not just sending all the message in the conventional channel?

Finally they say that it offers unhackeable security. Is that statement valid in any way?


texts: Is it possible to affect the output of HMAC w/ SHA-512 by providing it with a custom message?

texts:
Consider an HMAC algorithm that uses SHA-512 with an unknown private key. Is it possible to affect its output, either partially or totally, by providing it with carefully crafted messages?

For the purposes of this question, consider that the application "updates" its state using our hand-crafted message plus a string that changes on each request which is also known to us. Additionally, consider that we are able to ask the service to sign for us an arbitrary number of messages.


texts: What is the quantum-resistant signature scheme with the smallest signature + pubkey?

texts:
After playing cat and mouse with an number of quantum-resistant signature schemes and coming up with nothing with small enough signatures, I'm turning to Crypto.SE. I need a quantum-resistant signature scheme with the smallest $signature || publickey$ that you can find. Private key size shouldn't really matter, can't I just use a CSRNG to generate a private key from a smaller seed?

Implementations are appreciated but not totally necessary. I'm hoping to get under 1000 bytes at least. Verification time is allowed to be in milliseconds, seconds sounds a bit exessive. Signing time could be up to 10 seconds, it's not the biggest issue. Also, it's fine if it's a one-time signature.

Some interesting reading:

https://en.wikipedia.org/wiki/Lamport_signature
https://gist.github.com/karlgluck/8412807/
http://tuprints.ulb.tu-darmstadt.de/1319/2/dissertation.dahmen.pdf


texts: How to contruct a pseudorandom with a specific property

texts:
How to construct a pseudorandom function $PRF$ with the following property:

Probability that $PRF(k_1,i)=PRF(k_2,i)$ is negligible, for all keys $k_1,k_2$ such that $k_1\neq k_2$

Does the PRF with the above property have to be Pseudorandom function tribe ensembles mentioned here or it can be any PRF with sufficiently large output range.


texts:
"Sir Michael Atiyah claims to have demonstrated a simple solution to the Riemann hypothesis".

If solved, what results we will have in Cryptography?


texts: Diffie-Hellman over several non-secured HTTP requests - will it work?

texts:
This problem is about setting up cryptographic keys on an IoT device. I don't want my devices to be set up with any cryptographic keys pre-baked, but actual communication have to be based on TLS. Now I need a way to inject an SSL certificate and its corresponding private key from the device the user is using. Can this be done by using several HTTP requests to perform a Diffie-Hellman key exchange?

The protocol:

The user presses a button on the device, key setup and the unencryted HTTP channel allowed.
Client to Server: GET /setup/dh.wib.
Server to Client: DH initial parameters, and a new random session cookie.
Client to Server: POST /setup/dh.wib with client's computed DH intermediates and session cookie.
Server to Client: Server's computed DH intermediates.

Up to this point, a cryptographic key that is suitable for AES encryption should be established. Then:

Client to Server: POST /setup/auth.wib with the the device's serial number (as printed on the back of the device) encrypted using the established key, a SHA512-HMAC of the serial number using the key in plain, and the session cookie.
Server to Client: HTTP status code 204 if serial number matched with the record stored inside the device, otherwise HTTP status code 401 and the session cookie removed and invalidated.
Client to Server: POST /setup/key.wib with the generated certificate, and its corresponding key bundled encrypted using the established key, a SHA512-HMAC of the aforementioned bundle using the key in plain and the valid, authenticated session cookie.
Server to Client: If the certificate and key pair worked then HTTP 204, otherwise HTTP 400. Session cookie is invalidated no matter what here. Key setup and unencrypted HTTP access disabled here.


texts: Why is a non-existence proof for ECC discrete log extremely unlikely?

texts:
The question is somehow academic, but hopefully not esoteric:

From https://www.certicom.com/pdfs/cert_ecc_challenge.pdf

  Whether or not there exists a subexponential-time algorithm for the
  ECDLP is an important unsettled question, and one of great relevance
  to the security of ECC. It is extremely unlikely that anyone will ever
  be able to prove that no subexponential-time algorithm exists for the
  ECDLP. (Analogously, it is extremely unlikely that anyone will ever be
  able to prove that no polynomial-time(efficient) algorithm exists for
  the integer factorization and discrete logarithm problems.)

If somebody indeed should find a proof for non existence of a subexponential algorithm one day, can be anything say about how "complex" such proof must necessarily be? Can we exclude, that a proof is very simple and just nobody discovered it until now? On what facts is the statement above based?

On the other hand, can something be said about how likely it is to find a proper algorithm? Could such be very simple and it was just not discovered yet? Or is there something in math that excludes such simple algorithm by putting together the things we already know?


texts: EC Schnorr signature: multiple standard?

texts:
I'm working on some EC-Schnorr signature code.
Reading various papers on that, it seems EC-Schnorr is not standardized as
well as ECDSA.

For example, I found two main differences in two main actors specs (also found other minor variants in other papers);

according to BSI Schnorr signature is computed as:

$k$ a random
$Q$ = $kG$,
$r = Q_x$
$h = H(M \mathbin\Vert Q_x)$
$s = k − h \times d \mod n$
Output $(h, s)$

and according to libsecp256k1:

$k$ a random
$Q = kG$,
$r = Q_x$
$h = H(r \mathbin\Vert m)    = H(Q_x \mathbin\Vert M)$
$s = k - h \times d \mod n$
Output $(r, s)$.

Difference are located in:

step 3 : order of data to hash
step 5 : value to return

Of course, signature verification algorithm differ a bit according to that.

So, I wonder:

if there is specification more standard than another?
in case of several standards how to choose one?
what about interoperability?
what about security (for eg: $H(Q_x \mathbin\Vert M)$ is better than $H(M \mathbin\Vert Q_x)$ in my opinion)?


texts: Can the discret log problem be solved when the modulus is a hard to factor composite number, i.e. when modulus $n=p*q$, where $p$ and $q$ are two large prime numbers?


texts: secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

texts: For a given private key $d$, random $k$ and message hash $h$ is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same signature using $\text{secp256k1}$ curve?


texts: Would finding a Merkle-Damgård preimage that doesn't change the initial state allow an attacker to prepend it to any hashed message?

texts:
Suppose, a message M was found so that MD5(M) = S, where S is the initial state of the MD5 function (0x01234567, ...).

Given a hash MD5(m), would this allow computing MD5(M∥m∥padding), where padding is an empty block to get the length right?


texts: Is there a cryptographic solution for this “dating protocol”?

texts:
The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following dating protocol (due to Bert den Boer):

  Alice and Bob wish to determine
  whether they both want to go on a date; but they want to avoid the embarrassing
  situation in which one of them does not want to go on a date, but knows that the
  other would have liked to do so. Essentially they need a two-player veto protocol:
  they want to compute whether at least one has vetoed the date, without revealing
  any further information.

Q: Bennett’s solution uses playing cards. Does this problem admits cryptographic solution?

Of course it can be reduced to Yao's Millionaires' Problem. But probably this problem has a simpler solution.


texts: How to communicate authentication tag for GCM?

texts: I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?


texts: Is there a standard prefix random padding scheme?

texts:
Is there a standardized padding scheme which is prefix instead of postfix
and that uses random bytes except for the first byte which would be the
length of the padding?


texts: Can sleeper agents in a public network find each other and avoid infiltration?

texts:
Suppose a bunch of software entities are participating in a wide-area broadcast network (the network carries a lot of traffic, and the software entities also participate in those conversations, so their transmissions are likely to be seen by friend and foe alike).  How can they find each other efficiently and establish communications, without being infiltrated by enemy agents who (we will assume) can capture and inspect any particular entity?
For example, one entity could find another candidate entity by noticing a particular type of message error or checksum, and could send a decoy message that would contain a similar type of error.  But an enemy agent could do the same thing, or an enemy monitor could watch for entities engaging in this protocol.
What are the search keywords for learning about protocols that are useful in this area?
Edit to add:
My specific use case is within the BitTorrent network / ecosystem.  The main function of BT is to distribute data files among interested participants.  The data files are identified by a 160-byte hash (the infohash).  An auxiliary network, the Distribute Hash Table (DHT), helps clients find a node that is distributing the data file having a particular infohash.
DHT nodes are identified by a random 160-byte number, and their basic operation is to ask other nodes if they know a BT node that is distributing a particular infohash.  DHT nodes self-organize by their ID numbers, and searching is done by matching the hash from MSB to LSB.
If a DHT node is asked to find infohash abcdefghijklmnopqrs, then it will ask nodes it has already encountered, whose ID numbers start with abcd....  (The longer the matching prefix, the more likely that node will know the answer we're looking for.)  If those nodes don't know, they recursively ask the nodes they know about with longer matching prefixes.  Eventually, a node knows the exact answer, or does not know any other node closer to the exact answer, and that node's address is returned to the original querier.
So DHT nodes are continually asking each other where to find 160-bit hashes of one thing or another.
I would like my DHT nodes to be able to recognize each other by asking for particularly-formatted infohashes.  For example, infohashes where every prime bit is 0.  (I understand that some ordinary inquries may match this pattern as well, but that's OK -- one of my nodes might respond, but the ordinary querier wouldn't proceed with the protocol so my node will know that it's not one of my special nodes.)
The problem is, an adversary can reverse-engineer my code and determine what my special infohashes are, and can implement a node that pretends to be one of my special nodes, but which does not play nice -- it might feed me bogus data, instead of the data my nodes are actually trying to collect.
So, I would like to devise a way that my nodes can identify each other, and can detect and exclude nodes that pretend to be "on my team," but are in fact enemy nodes.  Obviously, I could hard-code the IP addresses of my nodes (or something similar), but I would like to be able to start an arbitrary number of nodes running at arbitrary places around the Internet, and have them find each other and start cooperating.


texts:
In many examples of attacks on public key cryptography, examples of the form $a ^ x = b$ are used, but I can not understand the correlation between this and the multiplication of the generator point of the elliptic curve $Q = xP$.

I have already read a lot, but still I can not understand this. In the case $a ^ x = b$, this is one number, and for an elliptic curve it is a point with coordinates $(x, y)$. Please explain the difference simply, as you would to a child.


texts: Is there a signature scheme for the Cramer-Shoup cryptosystem?

texts:
I have a project that I have to use cryptosystem and signature scheme for it.

I've read about Cramer-Shoup cryptosystem and I want to use it since it is more secure the ElGamal cryptosystem, but, I need a signature scheme based on it which I did not find.  Is there such a signature scheme?

If it does not exist I thought of two solutions:

I can use DSA for it but since there is one generator $g$ in DSA and two generators $g_1$,$g_2$ in Cramer-Shoup cryptosystem. So I think I may not be able to use it.
I can generate a separate DH key and use it as a signature public key for the user. Then I could use this key for DSA. But I am not sure if this is considered secure.

Are these options valid?


texts: When generating and exchanging keys, what is the purpose of performing key evolution after public key exchange + authenticated encryption?


texts:
In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. Gimli permutation in Sponge mode of capacity of at least 128-bit).

Also, $2^{-64}$ seems to be small enough a probability, that it's not uncommon that some protocols happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is: How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory).


texts:
The paper "High-speed high-security signatures" by Bernstein et al. introduces the Edwards curve Ed25519.

Concerning the base point $B$, it says that

$B$ is the unique point $(x, 4/5)\in E$ for which $x$ is positive, and
$B$ corresponds to the basepoint used on the birationally equivalent curve Curve25519.

The actual coordinates of $B$ are:
[15112221349535400772501151409588531511454012693041857206046113283949847762202, 46316835694926478169428394003475163141307993866256225615783033603165251855960]

I'm not sure I fully understand the choice of this point:

I can't really see that $B$ is unique and that '$x$ is positive'. (What does positive mean here?)
Does this point have any special security properties that other points do not have, or is it just a 'rigid' choice to convince us that no backdoor was built-in?

If you know anything about this point, please tell me! Many thanks!


texts: privacy enhancing techniques on image data

texts:
To give some context:

I am looking for a suite of techniques and tools that can theoretically enable me to conduct analysis such as classification on image datasets in a manner in which a naive observer cannot derive "much" information from an image e.g. if the image is of a person/object then the naive observer cannot tell who/what is in the image.

Naively adding noise doesn't seem to protect the content of an image, since a human observer can easily see past the noise.

I'm not aware that a machine learning task can be performed on encrypted images effectively and on naive inspection it shouldn't be possible while still maintaining cryptographic properties.

Is there any work out there on such techniques that maintain privacy of an image while still allowing it to be used for analysis?

Is what I'm after a fool's errand?


texts: Authenticating without sending password to the server, and store data encrypted with password derived key on server

texts:
I am trying to think of a scheme that would allow a user to authenticate to a server, whithout sending the password to the server, and to also derive a symetric key on the client (that also never gets sent to the server), the sym key would be used to encrypt and decrypt data on the client,that gets saved encrypted on the server.

The question is: how robust is the following scheme ?

The client is implemented in javascript, runs in a browser that is assumed to produce good random seed data, and the connection is through TLS.

authenticate without sending the password to the server
derive a symetric key from the password, that never gets sent to the server
store data on the server encrypted with

On the client:

symKey = scrypt(password, salt)
authKey = scrypt(symKey, salt)

On the server:

// when the account is created, the server hashes authKey
// again, and saves it with its salt

authHash = scrypt(authKey, salt2)

database.save([userId, authHash, salt2])

the user then encrypts data using symKey, that gets saved on the database:

userRowInDatabase[id, authHash, salt2, dataEncryptedWith(symKey)]

hasing would be done with Scrypt
Symetric encryption would be done with TweetNACL Secretbox (Based on XSalsa20 stream cipher and Poly1305 one-time authenticator)


texts: Is there something like a secure hashmap?

texts:
TL;DR: Is there such a thing as a hashmap whose contents cannot be read unless you have the right encryption key, and where each encryption key only works for a specific key value pair?

More context:

Say you're building an offline first web application and want to save the client from having to do a bunch of round trips to the server to ask for data. Within such constraints you may decide to, say, provide a whole dump of the database when the client first loads the site, and then the client can query its own copy of the database without needing to talk to the server.

You wouldn't want sensitive data to be part of the database dump, so you're not going to include user emails and passwords in the dump. But here you run into a problem: part of the website relies on user data (perhaps a user wants to view another user's profile) and would then need to query the server.

Given that we want to avoid any additional requests from the client to the server beyond the initial request for the db dump, how could this be achieved? Let's assume you wouldn't include emails and passwords in the dump, but user data that is publicly available, such as user handles and full names.

In such a case, you could simply include user handles and full names in the db dump in plain text. But you don't want to do that because it would give away all users' names at once, as well as metadata such as how many users your site has, etc. If a user reads some other user's handle and name by browsing your site, that's one thing - but if he can read all users at once, that's a problem.

So I'm wondering if part of the dump that contains user data could be made of a sort of "secure hashmap". What I mean is that its contents are not readable unless you have the right key; and even then only those contents that correspond to the key can be read.

If there isn't, I would imagine its implementation to go something like the following:

It works like a regular hashmap, with the exception that all its keys are hashed, and its values are encrypted. That way, even though the consumer could iterate over all keys and values, he wouldn't be able to do anything with them. When a piece of privileged information that acts as a key into the hashmap is made available to the consumer - say, a user handle - the lookup mechanism could first hash the user handle, use the result as a key to the hashmap, and then the user handle would allow him to decrypt the corresponding value (e.g. the full name corresponding to that user handle). The producer creates the hashmap by hashing its keys and encrypting its values by partly using their keys.

So in short, if the producer has a hashmap that contains:

"foo" => "bar"

He then turns it into

"1234" => "6%!*3"

where "1234" is the result of hashing "foo", and "6%!*3" is the encryption of "bar" using "foo" as encryption key (or something along those lines, I'm afraid I don't know much about encryption - what I mean is that it should be possible to use the string "foo" to decrypt "6%!*3").

Am I trying to reinvent the wheel here? If not, is the implementation I'm proposing secure?

Edit: I just realized that doing it the way I proposed above would still divulge the number of entries in the hashmap. Ideally, that could be avoided, too.


texts: In AES is 0x11b is the specified field generator?

texts: As I know all arithmetic operations in AES are done over $GF(2^8)$ so I want to know which field generator AES uses? is it 0x11B? and choosing another field generator would it give a different results?


texts:
I need to decrypt a huge file that I own previously encoded by myself with a RSA public key (it's possible for this step using a symmetric algorithm key). Problem is that I can't load it in my disposable memory for specific embedded architecture reasons.

I need to decrypt it with the private key associated to the identity of that architecture (or the shared symmetric case if there were the algorithm chosen). I want to know if its possible to decrypt the file loading it in memory by parts and decrypting each of them, without losing security against brute force attacks. As far as I know, in a typical RSA encoding process first you transform the whole char string that is the file into a number, to be encrypted, so my assumption is that is not possible in a typical RSA encoding-decoding process. However, as I have the file I can encrypt it line by line or char by char, instead of encoding the whole, to decrypt it later again slice by slice. I'm assuming that a line or a char after encryption would have the same length in bytes, which may be a wrong assumption.

EDIT:
Let's complicate things a little bit more: After decrypting through RSA or symmetric key, I'll have to encrypt again the slices of my huge file, this time with a RSA public key. So, first: Encrypting huge file on a custom basis to make it decryptable part by part; second: take each part and encrypt it with RSA.

Is this a feasible solution? Am I losing efficiency and would be more exposed to brute force attacks?

EDIT2:
Keysizes would be the typical for opensource implementations: a minimum of 256bits. I've to investigate the hybrid encryption, can't tell yet. When I say a line I mean chunks of data of, let's say, 50-60 chars. I pretend to encrypt-decrypt a binary file, so char length doesn't matter (consider them 1 bytes ASCII if it helps)


texts: If we don't trust current PQ algorithms enough to use them on their own why should we trust them for a hybrid?

texts: The second question my students have asked me about PQ/Classical Hybrids is about why we think they are good for protecting information with a long security lifetime.  If we don't trust current PQ schemes enough today to use them to protect information on their own, why should we have any confidence that they would be sufficient to protect information after quantum computers have been realized?  When that happens whatever PQ scheme we used in a hybrid will be the only thing left protecting the information since the classical portion of the hybrid will have been broken.  In the long run using a hybrid scheme to protect long lived information today is equivalent to using only a post quantum algorithm in the future when quantum computers are here.  What is the rationale for choosing some PQ algorithm today and believing it will protect data in the future?


texts: Is this man in middle atack possible in quantum cryptography?

texts:
Lets consider there is channel between Alice and Bob, sequered with quantum cryptography.
To put it simple, Alice is left, Bob  is right  and the quantum states are 'up'  ~ U and 'down'  ~ D.
Alice and Bob generates pair of bounded particles ,always one u one d but you dont know wtigth one flyes left or right , what fly always in both direction. Also they can capture particles. If captured, a particle is destroyed.

Alice captures the particle what flyes left and sends free what flyes to the right, Bob does the mirrored. If anyone captures the particle, he would know that other particle of the pair is.

Lets consider the MiM attacker Eve, what can do like Alice and Bob do.

Eve captures the next particle send by Alice, let it be U. So she knows, that the particle what Alice captured locally was D. But the particle U is destroyed, Bob will know that way, that there is something wrong with the channel.

Important : Eve then generates own particles, while capturing the left one.
If the captured is D, Eve knows that the pair is U and it might be send further to Bob. In the model that there are only 2 states, the probability of producing the right pair is 50% , therefore Eve in average need to be capable to generate and send particles twice faster that Alice and Bob do, that generally fair possible practicly.

Alice can not distinguish between cases whether a sent particle was captured by Bob or Eve, neither Bob can distinguish,  because the quantum features of particles match.

Later Eve can, as usually in MiM take over a channel and start to send false data to them.

Is there something wrong it this szenario or generaly quantum cryptography is a big talk about nothing?


texts: Effective key length of Two-Key Triple-DES

texts:
What's the effective key length of Two-Key Triple-DES, for some (possibly several) reasonably well-defined and sensible definitions of effective key length, say assuming attack using ample chosen plaintext?

A sensible definition of effective key length (in bits) of a block cipher under some attack assumptions could be: one plus the base-2 logarithm of the number of evaluations of the cipher (for arbitrary key and plaintext) that could have been made for a cost equivalent to the expected cost of recovering the key using the best known attack applicable to said assumptions.

By this definition, for any secure block cipher, effective key length is at most about the number of key bits that can influence the output. Proof sketch: consider brute force key search, and that a block cipher having a cost of evaluation not much larger than a comparison would be insecure.

Two-Key Triple-DES (also known as TDEA Keying option 2) is a 64-bit block cipher with a 16-octet key, of which 112 bits can influence the output, defined by
$$\operatorname{3DES}(K_1\|K_2,P)=\operatorname{DES}(K_1,\operatorname{DES}^{-1}(K_2,\operatorname{DES}(K_1,P)))$$
where $K_1$ and $K_2$ are 8-octet keys, of which 56 bits can influence the output.

NIST has stated that with $2^{40}$ plaintext/ciphertext pairs, the security is at least 80 bits, but gives no upper bound beyond the obvious 112 bits, which is quite a wide margin.

The effective key length of 3DES assuming two or three chosen plaintexts (per the definition proposed) is no more than about 109.5 bits (see proof below); that obviously can only be lower with more (chosen) plaintext/ciphertext pairs.

One of the best known attack is: Paul C. van Oorschot and Michael J. Wiener: A Known-Plaintext Attack on Two-Key Triple Encryption (in proceedings of Eurocrypt 1990); but it is not easily translated into effective key length, at least for the definition that I propose, for the cost is dominated by memory accesses.

The 109.5 bits upper bound stated is 112, minus $\log_2(3)\approx 1.58$ because the core attack loop only performs a DES thus is about 3 times less costly than a 3DES, minus 1 thanks to the the complementation property, plus a little something for the two comparisons in the core loop.

More in details: 3DES inherit from DES the complementation property:
$$\forall K, \forall P, \operatorname{3DES}(\overline K,\overline P)=\overline{\operatorname{3DES}(K,P)}$$
and that allows a brute force search with maximum cost quite close to $2^{111}$ DES encryptions, that is $\approx2^{111}/3$ 3DES encryptions (and expected cost half that), with two or three chosen plaintexts:

obtain, for some $P$, the ciphertexts $\operatorname{3DES}(K,P)\to C$ and $\operatorname{3DES}(K,\overline P)\to C'$
for each of $2^{55}$ value of $K_1$ with high bit zero

compute $\operatorname{DES}(K_1,P)\to A$, $\operatorname{DES}^{-1}(K_1,C)\to B$, $\operatorname{DES}^{-1}(K_1,\overline{C'})\to B'$
for each of $2^{56}$ value of $K_2$

compute $\operatorname{DES}^{-1}(K_2,A)\to X$; this step dominates the cost
if $X=B$ (implying $\operatorname{3DES}(K_1\|K_2,P)=C$)

if $\operatorname{3DES}(K_1\|K_2,\overline P)=C'$, output $K_1\|K_2$

if $X=B'$ (implying $\operatorname{3DES}(\overline{K_1\|K_2},\overline P)=C'$)

if $\operatorname{3DES}(\overline{K_1\|K_2},P)=C$, output $\overline{K_1\|K_2}$

This is guaranteed to output the right $K$, and (heuristically) will seldom output others for random choice of $K$; and then another plaintext/ciphertext pair allows to rule out a false positive with overwhelming odds. The cost is dominated by $2^{111}$ DES at step (1); $2^{112}$ relatively cheap comparisons at steps (2) and (3), with very occasional false positives costing an expected $3\cdot 2^{48}$ evaluations of DES for their resolution; and the $3\cdot 2^{55}$ DES for computation of $A$, $B$, $B'$.

This attack is impractical: the total effort devoted to bitcoin mining (which is comparable in nature) as of February 2016 would have explored much less than one millionth of the search space for a single attacked key.


texts:
Assume that $\Pi$ is a secure PKE scheme (or other appropriate encryption schemes) with 1-bit message space. And it can be applied bit-by-bit to construct a many-bit encryption scheme $\Pi'$.

Actually, let $\Pi = (\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ with $\mathcal{M} = \{\, 0,1 \,\}$. And we define $\Pi' = (\mathrm{Gen}', \mathrm{Enc}', \mathrm{Dec}')$ with $\mathcal{M}' = \{\, 0,1 \,\}^{*}$ or $\mathcal{M}' = \{\, 0,1 \,\}^{\mathrm{poly}(\lambda)}$ such that
$$\mathrm{Gen}' = \mathrm{Gen}$$
and for every $m = m[0] \Vert m[1] \Vert \cdots \Vert m[n] \in \{\, 0,1 \,\}^{n} \subseteq \mathcal{M}'$,
$$\mathrm{Enc}'_{pk}(m) = (\mathrm{Enc}_{pk}(m[0]), \mathrm{Enc}_{pk}(m[1]), \ldots, \mathrm{Enc}_{pk}(m[n]))$$
for every $\mathrm{\mathbf{c}} = (c_{0}, c_{1}, \ldots, c_{n}) \in \mathcal{C}^{n} \subseteq \mathcal{C}'$,
$$\mathrm{Dec}'_{sk}(\mathrm{\mathbf{c}}) = \mathrm{Dec}_{sk}(c_{0}) \Vert \mathrm{Dec}_{sk}(c_{1}) \Vert \cdots \Vert \mathrm{Dec}_{sk}(c_{n})$$

Can we regard these two schemes as a same scheme in some sense? In other words, is $\Pi'$ as "good" as $\Pi$ in some sense? I want a comprehensive assessment.

As for the security, I know some conclusions.

$\Pi$ is IND-CPA (IND-CCA1) secure iff $\Pi'$ is IND-CPA (IND-CCA1) secure. Although $\Pi'$ is not IND-CCA2 security.
We can construct an IND-CCA2 PKE scheme by using $\Pi$ if $\Pi$ is IND-CCA2. (Bit encryption is complete).

As for the effectiveness, it seems that $\Pi'$ is always inefficient.

Is that all the motivation to construct a new PKE scheme with large message space? (Even the messages have different algebraic structures.)


texts:
Can the channel keys that are derived from an AKE (authenticated key exchange) protocol be used in a secure channel that wants to have perfect forward secrecy?

If the goal of AKE is to establish channel keys and provide authentication of the entities at the same time, then this implies that the long term key used for authentication is contributing to the shared channel key.

But if we want PFS, then the long term key should not be contributing to the channel key.

Meaning that if we want PFS you can not rely on AKE, but you should use a key establishment protocol that does not provide authentication and just authenticate the transcript afterwards.

So my question is: if we say that we use AKE to create our channel keys, does that mean that by definition of AKE we can no longer claim PFS of our secure channel?


texts: Assume $G$ is a PRG. Proof that $G'$ is PRG?

texts:
Let $G: \{0,1\}^s \rightarrow \{0,1\}^n$ be a pseudorandom generator (PRG). Are the following PRGs?

  $G'(x) = G(x)_{0,\ldots,n-2}$ ($G'(x)$ drops the last bit of $G(x)$)
  $G'(x) = G(x) \oplus 1^n$ ($\oplus$ is XOR)

Apparently, 1. is PRG because existence of a distinguisher for $G'$ implies existence of a distinguisher for $G$. However, if expansion factor of $G$ is $n = \ell(s)=s+1 > s$, then expansion factor of $G'$ is $\ell'(s) = \ell(s)-1=s$, so $\ell'(s) > s$ is not true, so $G'$ can't possibly be a PRG in this case, because it deosn't satisfy the expansion property. If I'm wrong, then why?

I'm not sure about 2., but I think it is a PRG, but I don't know how to prove it. Sketch of my proof: assume $G'$ isn't a PRG, then there exists an efficient distinguisher $D$ so that

$$|P_{r \leftarrow\{0,1\}^n}[D(r)=1]-P_{x \leftarrow\{0,1\}^s}[D(G'(x))=1]| > \text{negl}(n)$$

Then

$$|P_{r \leftarrow\{0,1\}^n}[D(r)=1]-P_{x \leftarrow\{0,1\}^s}[D(G(x) \oplus 1^n)=1]| > \text{negl}(n)$$

Now, I want to have that $P_{x \leftarrow\{0,1\}^s}[D(G(x) \oplus 1^n)=1] = P_{x \leftarrow\{0,1\}^s}[D(G(x))=1]$, so the proof is complete, but I don't know how to prove that equation. Intuitevely, $G(x) \oplus 1^n$ just flips all bits of $G(x)$, so if $G(x)$ appears random for $D$, then $G(x) \oplus 1^n$ should appear random too. Is there a formal (and preferably simple) way to show this?


texts: Where does one store 3rd-party Public Keys

texts:
So, I've just started looking at the subject of Cryptography and am working through Stephen Haunt's Practical Cryptography course on PluralSight but have a question that doesn't appear to be covered.

In the course, the Window's Key Container is used for encrypting and decrypting a message.

Now if I'm sending messages to myself, that's fine, but generally, if I talk to myself, the voices and I don't bother encrypting our messages.

If I'm sending messages to someone else then I need to encrypt the message using their Public Key, yes? So, assuming that they have sent it to me, where do I store it? Can I put it in a key store? Do I store it as a String of some kind? and if I do, am I supposed to keep it in a DB? The file system?

I've looked on here for answers to this question, but maybe it is so trivial that no one has thought to write down the answer for those of us who are hard of Thinking.


texts: What's the meaning of this code that is based on bilinear pairing and elliptic curve logarithm problem?

texts:
Select two generators P, Q ∈ G1 of order q,
for i ← 1, l do
Select a random number k(i) ∈ Z∗q
Set the secret key K1(i) = k(i)Q ∈ G1
Set the corresponding public key K2(i) = 1/(k(i)P) ∈ G1
end for
Select an initial secret key Kg ∈ G2

This algorithm is based on bilinear pairing where G1 x G1--> G2 and elliptic curve discrete logarithm where Q=lP but I didn't understand how to code this in python is there a predefined library that I should install of I have to code it and is it normal to select two generators and not just one? also the technique of generating the public and private keys are different to what I read in the theorem of EC and Bilinear pairing. Can anyone help me understand this please ?


texts: HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC

texts:
I'm looking at three options for shared-secret message authentication codes:

HMAC-SHA-256(secret, payload)
SHA-512/256(secret+payload)
SHA-512(secret+payload) truncated to 256 bits

Option 1 is the most standard choice.  I'm considering option 2 because it is faster on 64-bit CPUs.  I'm considering option 3 because SHA-512 is more widely available in programming language libraries than SHA-512/256.

Are options 2 and 3 appropriate for MACs?  Are there any security-related reasons to pick one over the other?

Clarification: I realize that a good HMAC-SHA-256 implementation is not significantly slower than SHA-256.  I'm considering options 2 and 3 because SHA-512 is faster than SHA-256 on 64-bit machines (link).

Background: Some cryptographic hash functions (like SHA-256 and SHA-512) are "length-extendable".  This is not necessarily a problem because correct uses of a hash function should not be affected by that property.  But you can't use such a hash function directly as a MAC because, in that use case, the signature and input both come from an untrusted source (length extension attack).

SHA-512/256 is a hash function based on SHA-512 that is not length-extendable.  (It's similar to running SHA-512 and only using the first 256 bits of output, which is also not length-extendable.)  My question was whether these two hash functions could be directly used as MACs.


texts: How to choose the linear approximations to build a path through a SPN in Linear cryptanalysis?

texts:
so I am reading up on Linear Cryptanalysis using Heys' Tutorial. I understood how to get "good" linear approximations of the S-boxes though I cannot seem to find a reasonable approach to combining them together. In the paper on page 12 the approximations used seem to be specifically hand-picked to work for the particular P-boxes. Anyway they pretty much appear out of nowhere and I am not sure how one would approach finding them in the first place.
This seems to be a optimization problem but I am having trouble formulating it. Please enlighten me, maybe I am on the wrong track somewhere.


texts:
In 2016, security innovation released the NTRU challenge.
I understand that NTRU is now patent free and it seems like most of the documents related to the NTRU challenge on security innovation's website are now not available. Is there an archive where I can access these documents? and is the NTRU challenge still ongoing? Is the largest parameter broken still N=173?


texts:
This is a very basic question about hashing: When a client connects to a SSL/TLS encrypted server it hashes the certificate, right?

So, an attacker could steal the public certificate in the transfer and tell the victim that he is the server. Wouldn’t that be possible because the hash would be the same? (I know that this is impossible, but I don´t know why.)


texts: Differences between Single photon QKD system (BB84) and EPR photon-pair QKD system (BBM92) for quantum public key distribution?

texts: What are some differences between Single photon QKD system (BB84) and EPR photon-pair QKD system (BBM92) for quantum public key distribution?


texts: Understanding the definition of polynomially CPA (IND-CPA) security

texts:
I just started on encryption schemes and have some trouble in understanding the following definition of IND-CPA security:

$E$ is polynomially CPA (IND-CPA) secure, if for all adversaries $A$ and all polynomials $p$, we have: $Adv_a <= \frac{1}{p(\lambda)}$ for sufficiently large $\lambda$, i.e.: For all $A$ and all $p$, there exists an $N_p>0$ such that $Adv_a \leq \frac{1}{p(\lambda)}$ for all $\lambda > N_p$.

As far as I understand, in a simple IND-CPA game, an oracle sends a ciphertext to an adversary that is the encryption of one of two possible messages chosen by the adversary. An adversary now needs reply with what the actual message is.

What I don't understand is how I should interprate the polynomials $p$ and parameters $\lambda$. What do they consist of?


texts: How does the security parameter within a digital locker help prove that it unlocked correctly?

texts:
I refer to Canetti et all, "Reusable Fuzzy Extractors for Low-Entropy Distributions", available here.

Paraphrasing the relevant part from §3:-

  The locking algorithm $lock(key,val)$ outputs the pair $nonce,H(nonce,key) \oplus (val||0^s)$, where H is a cryptographic hash function, nonce is a nonce, ||denotes concatenation, and s is a security parameter.

s creates a certainty of $1−2^{−s}$ that the unlocking was successful.  Surely there must be some  relationship omitted from the paper between s, |(nonce,key)| and  |val| for the XOR operation to be useful.  It has the smell of HMAC about it.

How can what appears to be padding with s zeros help prove that the locker was correctly opened? Is it some strange mathematical way to simply guarantee the bit length of (nonce + key)?

Note.  My confusion is increased by the fact that the nonce output from the lock function does not seem to be an input for the unlock function.


texts:
I am having a hard time understanding and applying the formulas that are used to identify a function is negligible or not?

One text defines it as; a function $f$ from the natural numbers to the non-negative real numbers is negligible if for every positive polynomial $p$ there is an $N$ such that for all integers $n > N$ it holds that $f(n) < 1/p(n)$.
Another textbook defines it as; a function $f$ is negligible if, for every polynomial $p$, we have $\lim_{\lambda \rightarrow \infty} p(\lambda)f(\lambda)=0$

Example: $1/2^{\lambda/2}$ would this be considered as negligible function?