texts: Explain the 'Breaking 104 bit WEP in less than 60 seconds' paper

texts:
Could you explain the 'Breaking 104 bit WEP in less than 60 seconds' paper, without skipping too much technical details.

Could you an answer questions, like: how is '1.24/256' a significant difference compared to '1/256'? And how this seemingly small difference could lead a '104-bit WEP key' to a reduced required computational effort that is approximately 2^20 RC4 key setups.

'The algorithm is based on the following ideas. Andreas Klein, a German researcher, showed that there is a correlation in RC4 between Keybytes 1 to i-1, the keystream and the keybyte i. If the keybytes 1 to i-1 and the keystream are known, it is possible to guess the next unknown keybyte with a probability of about 1.36/256 which is a little bit higher than 1/256. We were able to show that it is also possible to guess the sum of keybytes i to i+k with a probability of more thatn 1.24/256.'


texts:
Suppose that there are Alice with attributes $A$ and $C$ and Bob with  attributes $B$ and $D$. I have a ciphertext with this policy: $A\ \operatorname{AND}\ B$.

Why don't users collude ? If Alice sends the attribute $A$ to Bob, he could regenerate private key and decrypt the document. Why is this not possible ? I don't understand this concept (I'm reading Security intuition in Ciphertext-Policy Attribute-Based Encryption).


texts: How to multiply two Public Keys in Elliptic Curve in Go

texts:
I am working on a messaging client similar to Signal. I am  stuck on
implementing Tripartite Diffie-Hellman handshake in which three DH exchanges are combined to authenticate both parties and produce a session.
Alice starts with identity key $g^A$ and ephemeral key $g^a$ (her secrets are $A$ and $a$). Similarly Bob has identity key $g^B$ and ephemeral key $g^b$ (his secrets are $B$ and $b$). Alice send Bob $g^A$ and $g^a$ and he sends back $g^B$  and $g^b$. Their initial shared secret is:

Now my question is to how to implement $g^{a*B}$ which are both public keys?
Also the code to calculate DH share for private with public key is working which is as follow:

Thanks.


texts: In $\mathbb Z/p\mathbb Z$, is $(a+b\cdot r)$ a random value for fixed $a,b$ and random $r$?

texts:
Let $p$ be a prime number.
Consider two fixed values $a,b\in\mathbb Z/p\mathbb Z$, where $b\neq0$, and a uniformly random value $r\leftarrow \mathbb Z/p\mathbb Z$.

Is $v=a+b\cdot r$ a uniformly random value in $\mathbb Z/p\mathbb Z$?


texts: Secret sharing over reals - constructing a (k,n) threshold scheme

texts:
After following a discussion that Shamir's Secret Sharing scheme cannot be used to share a real number as secret, I came across the paper "Secret Sharing Over Infinite Domains" - B. Chor and E. Kushilevitz
The above paper describes a method for sharing a real number as a secret, I quote from Section 4 (note: this paper may be accessed freely)

  We first introduce a (k,k) secret-sharing scheme which distributes a
  secret a taken from the interval [0,1). We use the Lebesgue
  measure on [0,1)   Choose independently, with a uniform distribution,
  k-1 real numbers, {$s_1$,.., $s_{k-1}$} in the interval [0,1).   2)
  Choose $s_k$ $\in$ [0,1) which satisfies $s_1$ +...+ $s_{k-1}$
  +$s_{k}$ = a (mod 1).   The proof that this is indeed a secret-sharing scheme is similar to the proof of its analogue in the finite case.
  For introducing a (k ,n) secret-sharing scheme for every k $\leq$ n,
  we observe that the same technique described in [BL] works here as
  well.

I can see how this (k,k) threshold scheme works. However, I am having some issues with the (k,n) threshold scheme - I've tried to look at Generalized Secret Sharing and Monotone Functions which is referred to above as BL (note - this paper can also be accessed freely.) I don't see how this paper helps me construct a (k,n) threshold scheme.
Any help would be appreciated!


texts: Why the need to hash before signing small data?

texts:
I’ve got two questions:

I’m doing the following:

Data :  uuid + int + nonce
Signature:  ECDSA(sha256(Data) )

To verify the signature:

decrypt(Signature) == sha256(data)

So if the data, hash function, and public key are known, why is there a need to hash?
If the same Data with a different nonce is sent over and over, can someone figure out my private key?


texts: Is the "New Hope" Lattice Key Exchange vulnerable to a lattice analog of the Bernstein BADA55 Attack?

texts:
In the paper, "Post Quantum Key Exhange - A New Hope," the authors present a lattice-based key exchange based on the work of Chris Peikert.  In this "New Hope" key exchange the authors try to gain security by having the basepoint for the key exchange (a polynomial with coefficients in a finite field) randomly generated by the key exchange initiator for every key exchange.

My question is whether this basepoint generation scheme is vulnerable to a lattice analog of Bernstein's attack on the NIST elliptic curves in his paper, "How to Manipulate Standards:  A White Paper for a Black Hat."  In that paper a single party is allowed to randomly generate a sensitive cryptographic parameter that was to be used by others.


texts: Why FHE takes modulo space $\Bbb Z_p$ as $[−p/2,p/2)$ rather than $[0,p)$?

texts:
Why doesn't FHE scheme see a modulus space $\Bbb Z_p$ as $[0,p)$ ?
Instead, it consider $\Bbb Z_p$ as $\left[-\frac{p}{2},\frac{p}{2}\right)$.

What's the concrete reason?
What happens if I use $[0,p)$?


texts: Need help understanding SPAKE2 setup values

texts:
I am trying to write a simulation of the SPAKE2 protocol in python (just so I can get a better understanding of the protocol altogether). I am reading through the ietf draft here: Datatracker.

There's a lot about cryptography I do not understand though and I am having trouble figuring out how to generate some of the values mentioned in the setup. Here is the excerpt I am talking about:

  Let G be a group in which the computational Diffie-Hellman (CDH)
  problem is hard. Suppose G has order p*h where p is a large prime; h
  will be called the cofactor. Let I be the unit element in G, e.g., the
  point at infinity if G is an elliptic curve group. We denote the
  operations in the group additively. We assume there is a
  representation of elements of G as byte strings: common choices would
  be SEC1 compressed [SEC1] for elliptic curve groups or big endian
  integers of a fixed (pergroup) length for prime field DH. We fix two
  elements M and N in the prime-order subgroup of G as defined in the
  table in this document for common groups, as well as a generator P of
  the (large) prime-order subgroup of G. P is specified in the document
  defining the group, and so we do not repeat it here.

More specifically, I don't know how to generate G, p, h, M, N, or P and I don't have the mathematical understanding to know exactly what those values are supposed to be. I would really appreciate any help or guidance.


texts: Does the One-Time Hash-based Signature Scheme render Ring Signatures useless?

texts:
On the Bitcoin community, to maintain privacy, they recommend using one-time spend addresses. CryptoNote, Monero et al. prefer Ring Signatures to maintain that privacy. There are some issues regarding double-spends in the Ring Signatures realm, so Linkable Ring Signatures + One-Time Key Images are used to avoid that. Both one-time spend addresses and CryptoNote's Ring Signatures approaches will be vulnerable to Quantum Computers in a near future, 'cause they rely on either Elliptic Curves or RSA, tho.

My point is, due the one-time nature of Hash-based Digital Signatures, we should use Merkle Trees to maintain an identity (although signing other public keys embedded in the message also works). But it's optional on that Signature Algorithm. Ring Signatures are used to maintain privacy for Signatures schemes which aren't One-Time, right? If so, are One-Time Signatures more "powerful" than other types of signature schemes?

Despite that question which I asking, One-Time Signatures are unsafe in the case of Network Splits / Hard-Forks. They freeze forever your funds on the other chain. This is a reason which I see Merkle Trees of Public Keys as needed, in the case of forks they're very helpful.

I'm writing a simple but not yet validated One-Time Hash-based Signatures library here (https://github.com/marcoonroad/hieroglyphs) - disclaimer: I'm not an information security and cryptography expert, but I try to do my best. I wonder if I need to implement the Ring Signatures algorithm to hide / protect identities, mostly due the possibility to navigate the chain/history of signatures in a network and track/guess identities by grouping discovered related public keys.

As a side note, there other approaches outside the Digital Signatures realm to implement Blockchains and sort of that. The Elixxir team (who David Chaum is a member and CEO) seems to plan to use Commitment Schemes instead of Digital Signatures, it's really interesting how hashes could be used for almost anything.

Thanks in advance!


texts: What is the purpose of adding secondary error to calculated key in BCNS and NewHope protocols

texts:
The answer to this question might be trivial or very short, but I would like to ask it anyway. In both BCNS and NewHope Ring-LWE key-exchange protocol one party adds a secondary error to their calculated key. What is the reason? Is it just to increase entropy? Or is there another a reason behind it?

BCNS protocol (page 8): notice that $e''$

NewHope protocol (page 5): notice $e''$


texts: Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?

texts:
From wikipedia, the DDH assumption says，given a cyclic group $G$ of order $q$ with generator $g$, $(g^a, g^b, g^{ab})$ looks like $(g^a, g^b, g^c)$ where $a,b,c$ are randomly and independently chosen from $\mathbb{Z}_q$.

Then what I wonder is, whether $(a,(g^a)^b )$ looks like $(a, g^c)$, where $a,b,c$ are randomly and independently chosen from $\mathbb{Z}_q$? Further, in which kind of group does this `assumption' hold?


texts: How to get a random point of a specific EC group with cofactor Not-Equal 1?

texts: We got a EC group generated with point G, and the cofactor of E(G) is with the similar size of the Order. Now we need a random point of E(G) and not revealing the "logarithm" of the random point, so we don't want to use base point multplication method. The curve equation solved method seems hard to get a valid point of E(G). How can we get such a random point?


texts: Formula for the number of expected collisions

texts:
Say we have a hash function that produces $n$ bit outputs. From the birthday problem that after around $\sqrt{2^n}$ different inputs to the has function, we can expect a collision.

Say instead that we have $m$ outputs. How many collisions can we expect in those $m$ outputs?

If there are $k$ inputs that all have the same output, we say there are $\binom{k}{2}$ collisions.


texts: Is there any way to parallelize AES running in CBC mode? (The plan is to parallelize it using OpenMP)


texts: Key lengths of asymmetric encryption: ElGamal and ECC

texts:
Recently I have been researching asymmetric encryption algorithms for a class, I cannot find any information anywhere on the key lengths used in any of the algorithms I'm looking into (ElGamal & Elliptic Curve Cryptography).

Is there a range of valid key sizes?


texts: RSA cipher: ambiguous or break by eth root?

texts:
Confused about RSA message cipher: $c = m^e (mod\ n)$

So if $m^e$ can be greater than n, then you can get duplicate ciphers for the same message.   Most postings I've read say that $m^e$ must always be smaller than n to counteract.

But if $m^e$ is smaller than n, then $c = m^e$ and can just be decrypted by $\sqrt[e]{c}$.  Most postings I've read said that $m^e$ should be greater than n to counteract.

So it seems like there are only 2, differently broken, options.  How is this reconciled in practice?
(My assumption is that "padding" reconciles this, but I'm not sure how.)


texts: I need help determining the best encryption options based on System.Security.Cryptography in .NET

texts:
I asked a question here, and received a great summary but was redirected here. Covering the answers of the post, it was noted and suggested that:

Use of plain (CBC) mode. They suggested to use GCM but in my solution I need to avoid adding an additional library. Here are my options: https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.ciphermode?view=netframework-4.7.2 (for AES essentially CBC, CTR and ECB)  Which one would be better to use? Is this too broad to ask? What are the benefits to each? If it was credit card data for example, which is more suitable?
Use of Use of PBKDF2 is outdated, and it was suggested to use Argon, but here is what I'm using. Not sure of what to replace this with within the constraints of .NET out of the box: https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rfc2898derivebytes?view=netframework-4.7.2

So taking a credit card for example, please help me answer these without introducing another library (i.e. BouncyCastle) or if it's absolutely necessary to include another library, please state why .Net's default cryptography is not suitable.


texts:
I am struck with the following problem:

Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus $n_B$ and $n_C$ respectively with $n_B$ = $n_C$ But different public encryption exponents: $e_B \neq e_C$. Suppose $\gcd(e_B, e_C)=1$, and that Alice sends the same secret message to Bob and Chris.
Show how Eve can decipher the message.


texts: Is a single md5 hash a good way to generate an AES key?

texts:
This site says how to encrypt data using a password in go using AES-GCM.
It says the following:

When encrypting and decrypting data, it is important that you are using a 32 character, or 32 byte key. Being realistic, you’re probably going to want to use a passphrase and that passphrase will never be 32 characters in length.
To get around this, you can actually hash your passphrase using a hashing algorithm that produces 32 byte hashes. I found a list of hashing algorithms on Wikipedia that provide output lengths. We’re going to be using a simple MD5 hash. It is insecure, but it doesn’t really matter since we won’t be storing the output.

Is this true?
So fine, I don't mind using something a bit more secure than MD5, it's easy to replace MD5 with SHA-2.
But another thing hit me:

Why is something like bcypt/scrypt not required?
Is AES slow enough to prevent a brute-force attack?


texts: Using master password to encrypt and decrypt user credentials

texts:
I need a way to store third party credentials, and I want to avoid storing passwords in plain text. I can't use a hash because I will need to be able to get the raw password to log in to the third party service.

My idea is to use a master password that I enter on the startup of the service that will be used as a key to encrypt and decrypt the users third party information. The only flaw that I see with this method is that I (or anyone who can somehow get the master password) will have access to user data for the third party service.

Alternatively, the user can enter their third party login credentials when accessing my service, and my service can access the third party site. However, the service is supposed to run 24/7 and this method would require them to reenter their login credentials every 8 hours rather than only once.

Are there any significant flaws with either of these methods, or is there any better approach to solve the problem?


texts:
Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer.

However, SSH is different: it has its own cryptography layer.

Why does SSH have a non-TLS cryptography layer? Are there any benefits for SSH to have its own cryptography layer?

About the only difference between SSH and other protocols is that SSH frequently sends messages having just one keystroke. Is the SSH cryptography layer more optimal in the case of extremely short messages?

Related although not the same: How does TLS differ from SSH from a strictly cryptographic perspective?

I think the certificate verification mechanism of SSH (automatically learning) could be supported with TLS. You just wouldn't have a root CA; you would accept each certificate separately and remember the acceptance.


texts:
I am making an embedded system for a project that uses AES.

As I cannot accommodate key generation (hardware constraints) I am using a static key. I can use another small algorithm to create dynamism and then pass it to the static AES.

I'm concerned about using a static key, is it safe?


texts: Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

texts:
While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" protocol section on page 24, the author says "Very importantly, the protocols should separate the functions of DH exponentials and freshness nonces into different elements".
I have a few questions based on this:

Why can the DH exponentials NOT be used for freshness during key exchange protocols?
Based on my reading on NIST SP800-56A, this protocol is similar to C(2e, 2s) scheme with a bilateral key confirmation. In the NIST schemes, however, while producing the MAC tags for key confirmation, it appears that the ephemeral public key is used for freshness. Why is it okay here but not in the SIGMA protocol?

If I'm conflating the two protocols, I'd like to understand the differences in SIGMA vs the NIST scheme that allows the ephemeral public key to be used for freshness in one case but not the other.


texts:
Please consider the following scenario:
The user A and B use their keys, K1 and K2 respectively. Each client have a vector of elements. Each client separately permutes his vector using his key and outsources it to the untrusted server. This permutation prevents the server from learning the correct index of each element in this vector.

Now the clinet A and B wants to add exactly two values at the same index (i.e. the index in their original vector before permutation). Trivially, if they share a key, permute their vector using this key and then send each vector to the server, they can achieve what they want. However, they have used different keys to permute their vector, but want to do the same computation as before. Ideally they can interacts (after outsourcing the vectors) and exchange some information. Then the vector(s) at the server can be re-permuted similar to the situation the same key used for both.

Thus I am wondering such re-permutation exists, please. No matter if one client learns the key of the other, but the server should learn as little information as possible.

Regards


texts: How to let CA signed x509 key work in OpenPGP mailing system?

texts:
So let's say we have a OpenPGP mailing system which all mails are signed and encrypted with OpenPGP keys. And now you bought a CA signed x509 certificate and you want to imement into the mailing system. What should you do is the best?

First option is stripping out the public/private key pair as both system uses RSA. But will this method also take away the fact that the key is certified by a CA? Like I mean how is the x509 system verify the key is certified? Do they confirm the public key with CA (which won't matter)? Or does they also rely on data includes in x509 certificate (which will matter as converting those into asc file might lose them).

Another way is to sign your OpenPGP public key with your x509 private key and send it with the mail. But is this method working as I thought? Supposing the receiver do have the system to verify the public key signed by x509 certificate. Also is there software(s) that can make it an automatic workflow like showing messages "the mail is signed with the public key attached", "the public key is signed by certificate signed by XXX" when the mail is opened.


texts: Algorithm to find primes $q$ and $p$ with $q\, |\, p - 1$?

texts: I understand that if $p$ is prime then $p-1$ must be composite (at least divisible by $2$ as it is even). But how does an algorithm find a prime $q$ such that $q \cdot r = p - 1$. I thought prime factorisation is such a hard problem?


texts:
In Bogdanov's and others, PRESENT: An Ultra-Lightweight Block Cipher, they mention that the S-box in PRESENT fulfill four primary conditions. They denote the Fourier coefficient as $$S_b^W (a) = \sum_{x\in \mathbb{F}_2^4} (-1) ^{\langle b, S(x)\rangle+\langle a,x \rangle}.$$

I am trying to understand what conditions (3) and (4) are trying to say. They are:

(3) For all non-zero $a\in \mathbb{F}_2^4$ and all non-zero $b\in \mathbb{F}_2^4$ it holds that $|S_b^W|\leq 8$.

(4) For all $a \in \mathbb{F}_2^4$ and all non-zero $b \in \mathbb{F}_2^4$ such that $wt(a) = wt(b) = 1$ it holds that $S_b^W (a) = \pm 4$

How does one raise a power to Bogdanov's notation (or compute such sum)?


texts:
I have done a google search for "multi-party key agreement", and there doesn't seem to be anything more recent than about 2005.

Are there any practical multi-party key agreement protocols known?

To be more precise, I want a protocol which:

Allows multiple individuals to agree a single shared secret
An adversary cannot tell what the shared secret is by listening to the communications.
It should be authenticated so an active adversary cannot persuade a participant to communicate with a secret the adversary knows.

Note: I am aware of Multi-party Key Exchange protocol from lattice but a) that doesn't have any answers; b) I am not only interested in lattice cryptography (in fact, I would prefer something based on ECC or factoring).

Edit: Background
I want a system for encrypting a conference call.  If each caller sends their audio to every other participant with separately agreed keys, then the total amount of work required is $O(n^2)$ (and the work done by each participant is $O(n)$).  If everyone agrees a single shared secret, then we might be able to reduce the amount of work required.


texts: How much bigger does a precomputed lookup table get when salt is added?

texts:
I am trying to wrap my head around the benefits of salt in cryptography.

http://en.wikipedia.org/wiki/Salt_(cryptography)

I understand that adding salt makes it harder to precompute a table. But exactly how much harder do things get with salt?

It seems to me, like when you add salt, the number of entries in your precomputed table would = number of common passwords to precompute x number of entries in the password table (ie number of different possibile salts).

So if you have a list of 100 common passwords, then without salt, you would have 100 hashed passwords. But if you have 10 users on a system, with 10 different salts, then you would now have 1000 different combinations to check.

So as the numbers of users or the size of common password list increases, the precomputed table gets so big that you can't pre-compute it easily (if at all)

Am I getting this? Do I have it right?

NoteCross posted on cs theory https://cstheory.stackexchange.com/questions/11118/how-much-bigger-does-a-precomputed-lookup-table-get-when-salt-is-added#comment30381_11118 CS Theory Users suggested I post here too


texts:
I am trying to understand how RSA public key cryptography works. I have the following questions:

Are any attacks / compromises possible if a server sends its public key $(n,e)$ in the clear to a client?
Suppose a server is using the same public key $(n,e)$ for all the clients in a LAN. Does this pose a threat?


texts:
I would like to better understand the operation of the LED algorithm, especially the process of substitution and permutation of the blocks and especially the use of the keys in each round.

The keys in each round are expansions of a single key or keys are different?

Already consulted sources:

https://www.cryptolux.org/index.php/Lightweight_Block_Ciphers#Zorro

https://eprint.iacr.org/2012/600.pdf

But could not find if each round are expansions or are different keys.


texts: Is there only one formula for the statistical difference between a pair of distribution ensembles?

texts:
Statistical closeness implies computational indistinguishability was recently posed.  It revolves around a numeric value $\Delta(n)$ of the statistical difference between a pair of distribution ensembles, as:-

$$ \Delta(n) = 1/2 \sum_{\alpha}|\mathbb{P}[X_n = \alpha] - \mathbb{P}[Y_n = \alpha]| $$

But statistical distances can also be measured via other techniques such as Pearson's chi-squared test, Kolmogorov-Smirnov & Anderson–Darling tests and Kullback–Leibler. There are many other exotic tests as well.  My four examples are non parametric tests too that produce a numeric test statistic. And they are also used in many aspects of cryptography.

Is the $\Delta(n)$ formula specific to cryptography, and if so, why?


texts: Is it OK to use a data-encryption key for key wrapping, too?

texts:
Our industry (area of cheap networked devices) has a standard that defines the usage of keys for both authentication and encryption using EAX mode of AES. This standard does not define key management, and someone wants to change this key material in devices using the RFC 3394 key wrap algorithm. For that they want to use these very same encryption/authentication keys as key-wrapping keys to receive new keys (no separate/master key-wrap-key).

I assume it is a bad idea, but I could not find a clear prohibition for this, and here is the best I could find on this site. Can anyone help with a better reference/book? Or is that safe after all?


texts:
I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what does it mean by "hash context"? Secondly, which "data" is it referring to? Is that paragraph still talking about what to do if the hash is too small?

  Simple S2K

  This directly hashes the string to produce the key data.  See below
  for how this hashing is done.

   Octet 0:        0x00
   Octet 1:        hash algorithm

  Simple S2K hashes the passphrase to produce the session key.  The
  manner in which this is done depends on the size of the session key
  (which will depend on the cipher used) and the size of the hash
  algorithm's output.

  If the hash size is greater than the session key    size, the
  high-order (leftmost) octets of the hash are used as the    key.

  If the hash size is less than the key size, multiple instances of
  the    hash context are created -- enough to produce the required key
  data.    These instances are preloaded with 0, 1, 2, ... octets of
  zeros (that    is to say, the first instance has no preloading, the
  second gets    preloaded with 1 octet of zero, the third is preloaded
  with two    octets of zeros, and so forth).

  As the data is hashed, it is given independently to each hash
  context.  Since the contexts have been initialized differently, they
  will each produce different hash output.  Once the passphrase is
  hashed, the output data from the multiple hashes is concatenated,
  first hash leftmost, to produce the key data, with any excess octets
  on the right discarded.


texts: How were one-time pads and keys historically generated?

texts:
In the 20th century, it was common for various intelligence agencies and military organizations to use ciphering machines and one-time pads.

However, no source I've seen ever mentions the process of generating the keys and printouts for such use.

Were there special machines for printing / punching them onto a card?
Where did the entropy they used come from?
Were there any significant breaches due to the bad randomness of the keys used?


texts:
I'm a noob with very fragmental knowledge of basic crypto. So please excuse me if this question is really stupid.

If I understand everything correctly, there are two basic schemes for ciphers: a stream cipher, where every byte is encrypted by itself, and a block cipher, where some fixed length block of bytes is encrypted.

In a stream cipher encrypted bytes are in the same order as message bytes; in a block cipher bytes are mixed inside of a block but order of blocks stays the same.

So my question is: are there any kind of "superblock" ciphers where order of blocks in the ciphertext is different from plaintext? Does it even make sense to do this? Or there is no point because block ciphers are already secure enough?

Obviously such a 'superblock' cipher will not be suitable for any kind of streaming applicatons but may be for something like disk encryption?


texts: How trivial is it to derive a private key from two public keys?

texts:
It turns out that what I was attempting to do was create a form of ECDSA threshold signature protocol by just giving away multiple public keys and then having the two parties solve for the private.

Original Question

I am currently working on building an application and I have a question about the triviality of deriving private keys from multiple public keys. I have read many places that it is possible to derive multiple public keys from a single private key but that publicly revealing more than one will jeopardize the private keys security. If I want to produce two public keys from a single private key (ECDSA) and derive the private key later using only the public keys, how much does knowing the two public keys help. Will two public keys easily yield a single private key? Will introducing more than two public keys reduce the amount of computation that it takes to derive a private key if it is computational difficult?


texts: How does a key actually work in symmetric ciphers

texts:
My sky-high level understanding of modern cryptography is as follows: There is an algorithm and a key. The key or key pair is a randomly generated number (I think). The algorithm describes transformations to be applied to the plain text in order to encrypt it. The key is a specific piece of information that is needed by the algorithm to complete this process of encrypting the plain text. What I do not understand is how, precisely, do the algorithm and key interrelate. One can look at a schematic for, i.e. Serpent and see lots of arrows, boxes, feedback loops and so on. To an interested lay person such as myself, I cannot see:

What the key does to that set of processes or even where it fits in
How it is employed such that it's uniqueness effectively 'locks' the ciphertext.

I apologize for the preposterously rudimentary nature of this question. I do appreciate this board is populated by those with a sophisticated understanding of this subject. However, this has been bugging me for ages and here is an obvious place to ask.

Finally, I understand there isn't a single response to this inquiry given there are different types of keys used for different purposes. In the interest of addressing this, please assume I am referring to the encryption of plain text using a symmetric key algorithm that was fit-for-purpose in 2001 or later.


texts: Non interactive threshold signature without bilinear pairing (is it possible)?

texts:
All threshold signature schemes that I have seen need bilinear pairings to avoid parameter exchange between parties. These are normally commitment schemes for a certain secret.

I believe a 2-round non-interactive scheme is possible, without using bilinear pairings, but I'm not entirely sure if it is secure.

Setup

Assume a set of parties with a pair of private/public keys $s_{i} \times G \mapsto P_{i}$, and a Shamir's secret shares $y_{i}$ of $y$ in a $(t,n)$-threshold where $t+1$ are required to recover the secret.

Assume there is a client interested in the signature result and that it can participate in the signature protocol. It can also try to break the protocol to get useful information (such as trying to get $y$), but gains nothing in receiving an invalid signature.

The Lagrange interpolation is defined as $\mathcal{L}^{i}$ such that $\mathcal{L}^{i} y_{i} \mapsto y$ and $\mathcal{L}^{i} y_{i} \times G \mapsto Y$. Also, $y \times G \mapsto Y$. I know this is already possible from this thread.

ThrGenSig(B) $\mapsto$ (c, p)

Produces a Schnorr signature for the $B$ data block from a 2-round multiparty computation.

Round 1) The client sends $B$ to more than $t+1$ parties. Each party computes an hash value $H(s_{i}||B) \mapsto m_{i}$ and replies with $m_{i} \times G \mapsto M_{i}$.

Round 2) The client selects the first $t+1$ to reply and computes $\mathcal{L}^{i} M_{i} \mapsto M$. The tuple $(B, M)$ is sent to the selected parties. Each party derives $m_{i}$ again and $c = H(Y||M||B)$, equal to all parties. Each party replies with $(m_{i} - c \cdot y_{i}) = p_{i}$. The signature result is computed in the client from $\mathcal{L}^{i} p_{i} \mapsto p$, and $c$ is already known.

VerSig(B, c, p) $\mapsto$ {0,1}

Verification is done as any Schnorr signature.

$p \times G + c \times Y = M$
Is c = H(Y||M||B)

Correctness:
Note that, since the same $t+1$ parties are used to produce $M$ and $p$, the Lagrange interpolation works. The degree of the polynomial for $m_{i}$ is the same as for $y_{i}$, and we can sum shares of the same degree due to the homomorphic properties. The scheme only needs $t+1$ active parties during the 2-rounds.

Rushing adversary: A commitment scheme is not needed between parties since there is no interactivity. The client and a colluding party may try to perform $M_{0}^{'} + \sum_{i=1}^{t} M_{i} = M^{'}$ forcing the result where $m^{'} \times G \mapsto M^{'}$ is known. However, since $m_{0}^{'}$ cannot be known due to DLP, the party cannot participate to produce a valid signature for $M^{'}$. $m_{i}$ values are not exposed in any other way.

Distinct $m$ values: $m$ and $m_{i}$ values are the same for the same parties and $B$. No problem here. Even $t$ colluding parties cannot force the same $m$ for a different $B$. The $m_{i}$ share of the honest party will force a distinct $m$ with high probability. The adversary can try via the rushing adversary for a known $M$ via $M_{0} + \sum_{i=1}^{t} M_{i}^{'} = M$, but needs to derive a $m^{'} \times G \mapsto \sum_{i=1}^{t} M_{i}^{'}$ for the colluding parties. $m^{'}$ cannot be derived due to DLP.

Did I miss something. Is this safe?


texts: Is it possible to construct an encryption scheme for which breaking is NP complete but there nearly always exists an efficient breaking algorithm

texts:
The question stems from the fact that foundations of crypto states:
suppose breaking an encryption scheme is NP-complete, then P != NP implies that this encryption is hard to break in the worst case, but does not rule out the possibility that it can be broken almost always.
How can this be true, if the encryption is NP-complete breaking should take super-polynomial time no?


texts: How to store encrypted solutions of a find location game?

texts:
I'm coding a bot on Telegram to sustain a quiz game.
A group of people (authors) can upload photos of streets or particular landscapes that they have found on internet, without any description, and have autonomously work out the exact location they were taken.
So along with one photo the author has to enter the cordinates with a tolerance.
The bot stores this info and anyone (other authors included) can try to solve that photo.
Haversine formula is used to calculate distance between an attempt and the solution. A distance less than the tolerance yields a correct answer.

Anybody but me can access the .txt file with all the solutions. Of course I'll be honest, but how can I ultimately prevent myself from look into this file and use the solutions?

Hash encryption won't work because, obviously, answers are not expected to match the stored coordinates. Any pair of coordinates close enough has to be accepted.


texts:
I want to check duplicates of secret information which is also already encrypted in our database(using ECC algorithm, one of the std curves). plaintexts can be phone numbers, zip codes, etc. Since it's not possible to query encrypted information without doing a full table scan or building on index on long ciphertext, I am thinking of doing something like hmac(key, plaintext). However, since this is susceptible to a rainbow table attack, I am considering if it's better to perform hmac(salt || key, plaintext).

Ofcourse, since this is for "duplicate" checking, I cannot randomly generate a salt, since each secret has to hash into the same hash value. So the idea is to generate, say, 128 salts(that I can rotate regularly) and pick salt using salt = saltlist[crc32(plaintext) % 128], this gives some rainbow table protection + the ability to find duplicates, which still allowing every key and salt to be rotated. Since we have a finite set of salts, we can store it securely in a key store.

Questions:

hmac(salt || key, plaintext) or hmac(key, salt || plaintext)?
Does having 128 salts(or any constant value) even provide any additional protection. (if the number of values goes into millions)?
Does it even make sense to have an extra secret key, or just hmac(oneof128salts, plaintext) provide the same amount of protection?

I am not sure if this is over-engineered?


texts: How does OAEP improve the security of RSA?

texts:
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.

Does everybody (so also an adversary) know these functions?

If YES: How does it help the security, if he just can decode the padding and read the message?
If NO: What knowledge is needed for these functions? Are keys or something priorly exchanged? Are they related to the receivers private key?


texts:
(Disclaimer: I'm an experienced server-side Java programmer, but with little crypto experience.)

Objective:

I've got a login server which, given a login+password pair, should issue a unique auth token. Using the same login+password pair multiple times should issue new unique tokens, all of them should be valid at the same time. A token is a ciphertext that only the login server should be able to create. Everyone else should only be able to extract the payload from it.

Possible solution:

First, I thought I should just use RSA to encrypt the payload with the private key. Other parties would just use the public key to decrypt it. But I read somewhere that RSA cipher doesn't provide integrity and authenticity so I figured I need to add an RSA signature, so it'd look like:

RSAcipher-with-private-key(payload-length + payload + RSAsignature(payload))

Then I discovered that the plaintext cannot be larger than the key size and thus I need a symmetric cipher, so I went researching on AES and stumbled upon GCM. As I understand, GCM solves the A. and I. problems, so I wouldn't need the signature anymore, and came up with that:

RSAcipher-with-private-key(AESkey + GCMiv) + AES-GCM-cipher(payload)

So the other parties would extract the AESkey and GCMiv using the public key, and then use that to decipher the AEScipher block.

I'm using BouncyCastle java library, since some people say AES/GCM in Java 1.8 is broken.

Will that work, is that secure, am I trying to invent a wheel here? If that's the case, what out of the box solution I could use?


texts:
To introduce the notation for the question, consider a one-time signature algorithm:

There are a private signing key $sk$ and a corresponding public key $pk$, generated by $Gen(seed)$.
To sign a message, use $sig = Sign(sk, m)$, and verify the signature by $Ver(pk, m, sig)$.

The one-time signature works as usual, with one limitation: if more than one message is signed with the same $sk$, there is no assurance that an attacker cannot forge a signature of another message without knowing $sk$.
There is much work to expand this “one-timeness” to “many-timeness”, where “many” still stays limited.
I wonder, why one cannot use a plain one-time signature mechanism to sign an unlimited sequence of messages $m_1, m_2, ...$, as follows.

Assume I have $sk_1$ and the verifier has $pk_1$.
To sign $m_1$,

Generate $(sk_2, pk_2) = Gen(seed_2)$,
Calculate $h_1 = hash(m_1, pk_2)$, $sig_1=Sig(sk_1, h_1)$.
Send to the receiver $m_1$, $pk_2$ and $sig_1$.

The receiver uses $Ver(pk_1, hash(m_1, pk_2), sig_1)$ to verify both the message and the authenticity of the next signature verification key.
The new key can be used to sign the next message and so on. This method can be used, for example, to sign software updates, where the "messages" come in a natural sequence.


texts: Is there any special parameters for using SHA-1 for generating pseudo-random numbers? What are the differences between SHA-1 as a PRNG and original SHA-1?


texts: Using a hash function as a random number generator

texts: Using MD5 or SHA1 for instance, and applying integers (as seed so to speak) to the hash function, in sequence, and only keeping, say, the first 64 bits of the resulting hash, do we always have a probability close to $1/{2^{64}}$ to have $$\text{hash}_{64}(n) = \text{hash}_{64}(n+1)$$ for every $n\in\big[1,2^{64}]$?


texts: How to generate a good symmetric secret key

texts:
I would like to generate a good secret key, that later will be used to encrypt data symmetrically.
I am not sure how to generate a good secret key.

I use Linux, I am not sure which sources of enthropy there are.
The idea now is the following:
I can access current timestamp and seed with it PRNG to get some pseudo random value R.
Feed this R into some KDF, for example HKDF and use the result as a symmetric key.
Are there are some loopholes in such scheme?


texts: How might one create a system of election by lot (sortition) that is both secure and verifiable?

texts:
I've been puzzling recently over sortition, a democratic method of selection for public office which I find very fascinating. Basically, instead of choosing candidates like Hillary Clinton or Donald Trump through voting, under sortition citizens would be randomly selected to fill public offices (in which, under many models, they would then be FORCED to serve for some period of time). There are of course many nuances, but that is the general gist. It would be rather like jury duty in the modern United States.

One particular problem for which I haven't been able to find a fully-formed solution online is ensuring that the random selection is actually random (so that it statistically represents the full population, one of the goals of sortition when a large-enough body is selected, rather than representing special interests or folks who paid off the people in charge).

Let me be clear: I am not a cryptology expert by any means. Indeed, I am only in high school and have never taken a proper computer science course.

Nevertheless, I was wondering if anyone here had any ideas (phrased at a fairly elementary level) for how fraud in the random selection could be prevented. (EDIT: While, as pointed out in the comments below, you could just have blind-folded people pull the names out of a hat, that might not be enough to keep citizen confidence high given the high-stakes and temptation for bribery and other such shenanigans.)

I've been wondering if maybe there could be a connection to RSA public-key encryption, cryptographic hash functions or other one-way functions, Bitcoin, etc (all those are subjects I know at least a bit about). I'm thinking there'd need to be a way for everybody to verify that the sortition wasn't rigged in any way (perhaps through some sort of blockchain?). But the method of choosing (let's say it's a function of some sort) couldn't be too simple because it would probably also need to be difficult for anyone to predict in advance what input would map to a given output, right? (If a selected individual for a public office was an output but people could predict which inputs would lead to that individual getting selected, then the choice of inputs into the function might get rigged by special interests, right?)

And, also, if you're utilizing a fully determinate mathematical function that would be, of course, not truly random (although maybe that's okay - political pollsters don't do truly random sampling either in that sense, but no one really seems to mind). So there's that issue too -- what do we do when we say we want "random sampling" but also want to be able to verify that the sample wasn't tampered with? (I have heard of the topic of pseudo-random functions - is that related to this perhaps?) Perhaps randomness can be approximated well enough by introducing real-world data observations that are somewhat unpredictable?

Sorry for the length and it could be that these are fairly elementary questions (or maybe they are in fact very hard questions, I have no idea). I sincerely thank anyone who responds with any thoughts they may have on any aspects of this question.

One last thing: If there is a potential solution to this question that involves basic prime number/modulus RSA stuff, that would be really awesome -- since that's one of the few crytology concepts I actually sort of know. :) I don't really care at this point if potential solutions would actually work out in the super-complicated real world. I'm more concerned with finding something that's superficially plausible given the very elementary knowledge of cryptology I currently possess (e.g., basic RSA). Once I get more advanced I could then come back and refine everything.


texts: Shamir's Secret Sharing - Impersonating the Dealer

texts:
I understand that Shamir's Secret sharing has nothing to do with the methods that are used to share and later recover a key.

That means then, the secret is only as secure as the methods used in sharing the key, because I can try to impersonate the dealer.

If the dealer shares their private key in some fashion, but later loses the private key, the dealer needs to contact enough shareholders (k out of N) to reconstruct the key.

If I assume this is done in a naive fashion, e.g. a web request, then anybody can do that.

If we secure the way is done, let's say with a password, then the key is only as secure as the password.

If the list of shareholders is secret, then the it's only as secure as the list of shareholders (where and how it is stored).

If we secure the communications with a private/public key method, then the dealer needs to have a second private key that they can use when they've lost the first one, and the key is only as secure as the second private key. The dealer is trying to secure the first private key by sharing... but then gets a second private key they need to secure. That doesn't make sense.

Is there a way to solve this problem? Or - this is my conclusion - is it that secret sharing is simply not suitable for keeping a key secure?


texts:
Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties.

Now I want all the parties to commit to their value of the secret shares

In essence, suppose every party $P_i$ has a share $Y_i$.
Every party should commit their value = $Com(Y_i)$

My problem is that I want to ensure that party $P_i$ doesn't commit to an incorrect value

$Com(Y'_i)$ s.t $Y'_i \not= Y_i$

before moving to the next stage in the protocol. I also do not want to reconstruct the output value until a later stage in the protocol.

Is there any efficient way in which you can perform such a commitment while ensuring that every party commits to the right value?


texts: SHA-1: number of possible inputs, number of possible outputs, how many inputs have the same output,

texts:
From Wikipedia I read SHA-1 function produces an output of 160 bits and expects a max message size of $2^{64}-1$ bits. Is that right?

If I order all possible inputs I would produce $\approx 2^{2^{64}}$ different bit array inputs, right?

Not sure at this point if message 0 is different from message 00.

Can we say that SHA-1 receives a bit array of maximum $2^{64}-1$ elements as input?
If the bit array has less than $2^{64}-1$ elements it is like receiving 0's for the rest (or maybe start receiving 0's until...)?

I'm not good at big numbers... Maybe the difference is small. If 0 bit array is different than 00 bit array maybe still the number of possible inputs is $\approx 2^{2^{64}}$.

Then $2^{160}$ is $\approx 2^{2^8}$.

So there are $2^{2^{64}}$ possible inputs for $2^{2^{8}}$ possible outputs. It means that there are $\approx \frac{2^{2^{64}}}{2^{2^8}}$ inputs for each output. But $\frac{2^{2^{64}}}{2^{2^8}}$ is $\approx 2^{2^{64}}$.

If $2^{2^{64}}$ is the whole universe it looks like almost the whole universe is inside each bucket (hash output).

Does it mean that if I take randomly two different inputs of the set of
$2^{2^{64}}$ elements the probability that they belong to the same bucket is very high?


texts: Set/change password functionality on password: should I apply bcrypt server- or client-side?

texts:
I am writing a webpage on which a user can set (when registering) and change his/her password. This page is only served over HTTPS. When the user is altering his/her password, he/she is already authenticated with his/her current password.

I am planning to use bcrypt to encrypt and salt the password. Should this be done client-side (browser) or at the server? In case of client-side, I could verify on the server that bcrypt was applied with at least X (for example, 12) iterations.


texts: Proof ownership of private key for blinded public key

texts:
so i want to prove to a server that i have the private key to  a public key for which i want to retrieve the server's signature. But the server is not allowed to learn either public nor private key.

In more detail:
In my setup a client has both public key pk and private key sk. For some authentication we need the server's signature over pk. The protocol is as follows:

The client creates a  blinded message by blinding pk.
It then sends this message to the server.
The server signs the message and sends it back.
The client can unblind the message and derive the signature for pk.

To mitigate one specific kind of impersonation attack it is important, that the client can only retrieve the signature for a  public key for which it also has the secret key.

We first thought that the server could send a challenge, the clients signs and blinds it and the server uses the blinded public key it received earlier to verify the challenge.
But this does not work because blinding requires padding and hashing.

Does anyone has an approach they can point me to?


texts: How does Dissent protect against Sybil Attacks?

texts:
Dissent claims to be able to be resistant to Sybil attacks.

  Dissent seeks to offer accountable anonymity, giving users strong guarantees of anonymity while also protecting online groups or forums from anonymous abuse such as spam, Sybil attacks, and sockpuppetry. Unlike other systems, Dissent can guarantee that each user of an online forum gets exactly one bandwidth share, one vote, or one pseudonym, which other users can block in the event of misbehavior.

However, I went through 3 of their presentations and the only 'accountable' anonymity it promises is to successfully blame a bad actor in a dining cryptography network (DC-Net). There was no mention of how to prevent multiple identities from the same user. I could imaging anyone could connect to the Dissent network through TOR and disguise their multiple identities, merely acting as different people and following the rules.


texts: Create a time capsule using a Word processor

texts: I was wondering if there's any option to create sort of a time capsule in a Word document, i.e. not encrypted by password rather than a date. Let's say I send the document today but the receiving side can open the document only the next month on a specific date.


texts: Calculate entropy of key derived from PBKF2 function

texts: I am using PBKF2 to derive a encryption key from a password. suppose entropy of my password is y and my PBKF2 function has x number of iterations. So how to calculate the entropy of finale key derived from the PBKF2 function.


texts: Does passphrase length impact read-write speed?

texts:
I'm using Diskcryptor to encrypt a 2TB external USB HD and the process is taking over 2 days. I chose a 100-character strong encryption key passphrase (because, why not?) and am now wondering if the length of the key passphrase has any impact on how long it takes to encrypt the drive. I'm also wondering if the length of the key passphrase will have an impact on how long it takes to write and read files from the encrypted drive. If I had chosen a 25-character key passphrase would this process be faster? Would reading and writing from the drive be faster?

Update: It has been explained to be below that what I was calling the encryption key is in fact the passphrase.


texts:
On the section 4.2, page 10, of the paper Order-Preserving Symmetric Encryption, the authors define two subroutines: the first one is called $HGD$ and the second one is $GetCoins$.

I have doubts about both, but I am mainly interested on the first.

It is said that

  The first, denoted $HGD$, takes inputs $D$, $R$, and $y \in R$ to return $x \in D$ such that for each $x^∗ \in D$ we have $x = x^*$ with probability $P_{HGD}(x−d; |R|, |D|, y−r)$ over the coins of $HGD$, where $d = min(D)−1$ and $r = min(R)−1$.

So, my questions are the following:

1 - What does "over the coins of $HGD$" mean?

2 - Since $D$ is a set, it does not have repeated elements, so, the probability of $x$ being equal to $x^*$ is $\frac{1}{|D|}$, isn't it? Well, I don't understand how can I fix a element $x$ in $D$ such that the probability of any other element being equal to $x$ follows a hyper-geometric...

Any help will be appreciated.


texts: Isogeny-based AKE: what is the difference between Gal 1 and FTTY 1?

texts:
What is the difference between
(a) the AKE scheme proposed by Galbraith (based on TS2 protocol) in https://eprint.iacr.org/2018/266.pdf (page 9-10);   and
(b) the AKE scheme proposed by Fujioka et al. (they call it SIDH UM protocol) in https://eprint.iacr.org/2018/730.pdf (page 13-14)?


texts: Rounding function used in Saber Key Exchange

texts:
In Saber: Module-LWR based key exchange, the authors use a rounding function called $\textit{bits}$, defined (in page 3) as follows:
$bits(x, i, j)$, with $j \leq i$, gives $j$ consecutive bits of a positive integer $x$ ending at the $i$-th index (assuming the least significant bit in the $0$-th index), producing an integer in $\mathbb{Z}_{2^{j}}$.
How does this rounding function actually work? How does it relate to the rounding function typically used in Learning with Rounding, $\left\lfloor x \right\rceil_p = \left\lfloor \frac{p}{q}\cdot x\right\rceil\bmod p$?


texts: Protocol for proof of knowledge of $l$-th root

texts:
Assume we have Group G in which the adaptive root assumption holds.
This assumption states that if we choose an element $w$ and after that, if we receive a prime value $l$ it is hard to find the $u$ such that: $u^l = w$

Now suppose I want to prove that I know a $l\text{-}th$ root of an element $w$ without revealing it. (I don't want to reveal $u$). Is there any protocol for this?


texts: SHA-1 requires utf-8 and reordering of bytes

texts:
Today I implemented SHA-1 in JavaScript. While doing so I stumbled upon two requirements which are not mentioned in the RFC-3174.

Text is supposed to be utf-8 encoded / one character should be 8 bit long. This makes sense, since the same text should always return the same hash, but I couldn't find anything about it in the RFC. Is there any place where this is documented?
For some reason the bytes for each 32-bit word need to be reversed so the first byte comes last. e.g if we have chunk of 32-bit (reading from left to right).

00110101 00110011 01100110 00001111

the bytes should be arranged like this, before processing them:

00001111 01100110 00110011 00110101

I also couldn't find anything about this in the RFC. Where was this defined and is there a reason why this needs to be done?


texts: Proving a function is or is not a pseudorandom function F_k(x) = F_k(x)||0

texts:
I have 4 functions to analyze. I need to determine if they are or are not pseudorandom and give a proof/counterexample. I'm having trouble just determining if they are - let alone proving or giving counterexamples. For reference, I'm using Katz and Lindell:
(a) $F^1_k(x) = F_k(x) \mathbin\| 0$
I think this is pseudorandom, proving by reduction:
Suppose $F^1$ is not pseudorandom. Then there exists a distinguisher $D'$ s.t. $\forall \mathit{negl}(n)$, $$\bigl|P(D'^{F^1_k(\cdot)}(1^n) = 1) - P(D'^{f(\cdot)}(1^n) = 1)\bigr| > \mathit{negl}(n).$$
We can then use $D'$ to build a new distinguisher that attacks $F$.
Consider discriminator $D$. $D$ gives the oracle input $S$ and the oracle returns output from $F_k$ or random output. $D$ adds a 0 to the end of this output and then asks $D'$ to determine if it is random or from $F'$. If $D'$ says random, $D$ says random. If $D'$ says not random, $D$ says not random. Thus:
\begin{align*}
  P(D^{F_k(\cdot)}(1^n) = 1) &= P(D'^{F^1_k(\cdot)}(1^n) = 1), \\
  P(D^{f(\cdot)}(1^n) = 1) &= P(D'^{f(\cdot)}(1^n) = 1). \tag{$*$}
\end{align*}
So:
\begin{multline*}
  \bigl|P(D^{F_k(\cdot)}(1^n) = 1)-P(D^{f(\cdot)}(1^n) = 1)\bigr| \\
    = \bigl|P(D'^{F^1_k( \cdot)}(1^n) = 1) - P(D'^{f(\cdot )}(1^n) = 1)\bigr|
    > \mathit{negl}(n).
\end{multline*}
Which contradicts that $F_k$ is a pseudorandom function.
On the other hand, clearly, output from $F^1$ always ends in 0, so the discriminator could use this fact to gain an advantage. If the output from the oracle ends in 0 he would guess that the oracle was actually $F^1$, if not he guesses that it is random. He would therefore have a non-negligible chance of getting this correct.
So, my question: is it pseudorandom or not, and where is the error in my thinking in either case?


texts: Confusion and Diffusion in the AES functions

texts:
I am pondering, how each of the four functions that a full AES round does consist of (Add Round Key, Substitute Bytes, Shift Rows and Mix Columns) add to the confusion and diffusion of the full AES.

My understanding would be

Add Round Key: Confusion
Substitute Bytes: Confusion
Shift Rows: Diffusion
Mix Columns: Confusion and Diffusion

Is my understanding correct? There are actually two parts, where I am quite unsure:

Can confusion be introduced without a secret (subBytes)?
Can confusion be introduced from the state alone (Mix Columns)?

I am aware of that and that answer, but they don't go all the way.


texts: How bad is it to use the identity function as hash for ECDSA?

texts:
I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really bad idea. And I also know that there's a trivial attack if two messages have the same prefix as the "hash" gets truncated to the first q bits (q being bitlength of the order of the curve).

However I wanted to know: What are the "worst" possible attack(s) against this signature scheme?

The worst attack is hereby defined to be the attack that needs the least known or chosen signatures while being executable in reasonable amount of time.


texts: How to use cryptography to protect video from forgery?

texts:
As Deepfake and other technologies make video anti-counterfeiting very difficult, I want to design a scheme based on cryptography to verify that a video is actually captured by the camera. At the same time, I hope this video supports truncation. For example, I have a video that takes one hour long, and if I intercept one minute without any other changes, then the video for this one minute is true.
A simple method is to use digital signature. The video stream or video frame captured by the camera is signed with private key, so that other people can verify it. However, in my application scenario, I hope anyone can capture a segment of the video and prove that the captured video is actually recorded rather than forged. It seems that the digital signature method is not suitable for this scene, because only when the video is complete, we can prove its integrity.
Message authentication codes (MAC) can also prove authenticity, but this requires the distribution of a secret.
Do you know any cryptographic primitives or schemes that can be used in this scenario?


texts: On the fly key generation for cloud storage objects

texts:
Cryptographic key management involves storing and managing encryption decryption keys , certificates , signatures etc .

If the requirement is just to store and manage object specific keys ( say amazon's s3 store objects ) do we really require a key management solution like the one from porticor or an appliance ?
Instead can't we generate object specific keys "on the fly" using  HKDF using a master key and object id as inputs, so that we dont have overhead of storing and managing keys each time ?


texts: In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I dont see how this is possible, since this implies that we know the ring in which we work, i.e. we know the polynomial $F$ chosen in the KeyGen() algorithm. But this is not public information. Am I getting this the wrong way ?


texts: Example of a cut-and-paste attack on CBC

texts: I am reading the cryptography book by Stamp and there is a cut-and-paste attack on $ECB$ and this is easy to follow because $ECB$ is relatively simple, the problem is that I would like to see an example of this in $CBC$ mode. Is there an easy example to show this?


texts: In a shamir secret sharing scheme, why can't the secret be a middle coefficient and only the first or the last?

texts:
In the shamir secret sharing scheme, the Secret s is set as the constant in the equation

$ y_p = s+ \sum_{i=0}^{i = t-1} a_i * x_p^i$

s can only be the constant term or the last coefficient or the secret may be leaked. This is also per question below:

Coefficients in Shamir's Secret Sharing Scheme

How can I show this rigorously in a mathematical way? In the provided answer only an example is given.

Updated:

The mathematical way I currently have to show this is for the case of a (t,n) system where t = 3, sharing between two people, and y defined as

$y_1 = a_0 + s*x_1 + a_1*x_1^2$ mod P

$y_2 = a_0 + s*x_2 + a_1*x_2^2$ mod P

Then by rearranging (or by taking inverse of matrix) we have

$s = (y_2 - y_1)(x_2 - x_1) ^{-1} - a_1(x_2+x_1)$ mod P

and we get the case where S is revealed when $(x_2+x_1)$ mod P = 0.

How would we show using similar (or different) argument for t>=3, t-1 shares, that we will not have similar cases when s is the constant or the very last coefficient?


texts: Can Litecoin & Bitcoin have overlapping Transaction Ids (txid)

texts:
Im currently coding my own transaction lookup page for cryptos. Since Litecoin and Bitcoin are so similar to their txid. I wanted to ask if its actually possible that these 2 currencies have overlapping txid's. I know that Bitcoin uses sha256 & Litecoin uses scrypt.
Let me know, im really interested.


texts: Why is ethereum not using threshold signatures like dfinity for randomness? What's the drawback?

texts:
So Ethereum goes for RANDAO. The disadvantage with RANDAO is that the last validator in the commit-reveal scheme is able to hold his contributed value back and thereby influence the random outcome. Ethereum is trying to overcome this by using verifiable delay functions.

Why all that hassle?
Why not just go for threshold signatures like Dfinity?
What's the drawback?

Some link to a statement from Vitalik Buterin on this would be highly appreciated. Otherwise, if you can explain it it's also fine.


texts: Why was there a need to create CP-ABE when KP-ABE already exist?

texts: This is more of a good to know question, but looking online and in this forum I couldn't find an answer to this question. Was there some major reason why CP-ABE was created when KP-ABE already exist? I am new to this field so I apologise before hand if I offend anyone with this question.


texts: Is there a cryptographic hash function that can be performed with pencil and paper?

texts:
Imagine I'm signing up for the 99th new web site this month.
I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into some algorithm (perhaps a HMAC?),
and type the resulting hash into the "password" field of the registration form.

Later, I'm at the library and I want to log in to that one particular site,
but I don't have my phone and the computers at the library are locked down so I can't install any new software,
so I want to reconstruct that password "by hand".

Is it reasonable to use Kerckhoffs's principle and assume that everyone knows exactly which hash algorithm I'm using, and assume every knows I use exactly the exactly the same hash algorithm and exactly the same secure key for web site all 99 web sites that I've signed up for this month?
It would be nice if somehow, even if the sysadmins for websites 1 through 98 all conspire together and share with each other the "password" I gave each one (and they know the algorithm I'm using), the hash is secure enough that finding the password for website 99 is harder than brute-forcing a random 8-character password.
It would be nice if somehow, even if all 99 sysadmins conspired together and shared the "password" I gave each one, the hash is secure enough the recovering my secret key is harder than brute-forcing a random 16-character password.
The amount of secret information I have to write down and put on a card in my wallet and keep secret should be shorter than simply making up a fresh new random 10 character password for each of 100 websites and adding the domain name and the new password to the card. (Perhaps 256 bits of information is reasonable? Perhaps encoded into 80 decimal digits or 55 lowercase letters or 20 Diceware words?).
I'm in a relatively private cubicle at the library -- I can write stuff on my pad of sticky notes, manipulate my deck of cards, perhaps do some calculations on a 5-function calculator, look up a passage from my copy of "The Good Soldier Schweik", that everyone knows I always carry with me, etc. But not run a computer program. (Let's assume I eat any sticky notes that might leak secret information). This should make it easier than " Are there cryptographic hash functions that can be computed using only paper and pen without leaking any information about the plaintext? " because I can write down secret information.

Is there any pencil-and-paper algorithm that meets these criteria?


texts: Compute statistical distance between two distributions over tuples

texts:
Let $X$ denote one distribution. Let $f,g, \text{ and } h$ denote three functions. If we have the results: $g(X)$ is within a negligible statistical distance of $h(X)$. Is it possible to prove

$$(f(X),g(X)) \text{ is within negligible statistical distance of } (f(X),h(X))$$

I was struggling with this problem for a long time.
Any hints are welcomed.


texts: Using hash of plaintext as nonce in NaCl secretbox- bad idea?

texts: I need a nonce to encrypt my stuff using NaCl secretbox. I will be transmitting the nonce along with the ciphertext, which I have been told is OK to do. It occurs to me that one could simply use the hash of the plaintext as the nonce instead, since it will not collide and is easily accessible (I need to generate it anyway for something else). Somehow this strikes me as a possibly risky idea. Is this a bad thing to do?


texts: If the first key-bit is flipped, which DES s-boxes are affected?

texts: Instead of the input bit being flipped... if the 1st bit of the key is being flipped, which s-boxes are affected during encryption/decryption of DES?


texts: Usage of parameter "b" of an elliptic curve over GF(p)

texts:
I'm not fit with elliptic curves from a mathematicians point of view, so I hope, that this beginners-question is not too silly:

I use a library which permits certain operations on elliptic curves over $GF(p)$. I recogniced, that all elementary operations (point doubling - $2P$, adding - $P_1+P_2$ , exponentiation with a scalar number - $kP$  are not using the parameter $"b"$ of the underlying equation

$y^2=x^3+ax+b$

Only the check, whether a given Point is on the curve needs this parameter. This is understandable for me, because both sides of the equation above must be compared.

But why do the mentioned elementary operations NOT need b at all.

During writing this, I found from a white paper, that the mapping

$(x_1,y_1), (x_2, y_2) \rightarrow (x_3, y_3)$

indeed doesn't include $b$.

Is this just a mathematical coincidence or is there some deeper reason for this?

EDIT:

My personal explanation is, that, taken for granted that a given point (x,y) is part of a certain curve $(A, a, b, p)$, $b$ can (of course) be calculated from the defining equation and the knowledge of x,y,a, so additional specification of b would be redundant. Is this right? Then it would answer my question, and it was "silly" ;-)

Thanks

.


texts: Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

texts:
As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But "Strongly Secure One Round Authenticated Key Exchange Protocol with Perfect Forward Security" (Hai Huang) claims that the AKE it proposed can achieve perfect
forward security against active adversary in one round.

Is that correct?  Why?


texts: Beavers Triple Vs BGW Multiplication on MPC

texts:
Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries where protocols of the likes of SPDZ, VIFF and Oralndi prefer the use of the well known Beaver's multiplication triple.

My question is the following:

Given that I could use for instance VSS to provide security against active adversaries in the case of Shamir for instance, why is Beavers triple the preferred method. Is it because the randomized factors $(a,b,c)$ can be computed before hand (offline) and hence I would have a faster multiplication protocol given that stuff like PRSS is available under this security model?


texts: What is the maximum message size when using ECDSA (specifically secp256k1?

texts: I'm guessing that the message must conform to 256 bits but I was not able to find documentation of any message length limits.


texts:
Every time when I read a paper that has digital signature, when it comes to prove the security of a digital signature scheme, many chances that the author will use the forking lemma.

The forking lemma says as follows:

  Let $\mathcal A$ be a probabilistic polynomial time turing machine, given only the public data as input. If $\mathcal A$ can find, with non-negligible probability, a valid signature $(m,\sigma_1,h,\sigma_2)$, then with non-negligible probability, a replay of this machine, with the same random tape and a different oracle, outputs two signatures $(m, \sigma_1,h,\sigma_2)$ and $(m, \sigma_1,h',\sigma_2')$ such that $h$ is not equal to $h'$.

This wording comes from David Pointcheval and Jacques Stern's paper on "Security Proofs for Signature Schemes".
They also give a proof to this lemma, but it's very difficult for me to read.

In order to understand what I'm saying, you can see an example of that on this paper "A Secure and Efficient Authenticated Diffie–Hellman Protocol" from page 8-9. It's a security proof about FXCR. You can download it from http://eprint.iacr.org/2009/408.pdf.

The forking lemma really puzzled me for a long time; who can give a simple way to understand it?


texts: Why are there so many versions of the TEA block cipher?

texts: Why are there so many types of TEA, for example TEA, XTEA, and XXTEA? What are the differences?


texts: Size of Parameters in Polynomial Key-Splitting Algorithm

texts:
I've seen the elegant way of splitting a key among different people so that only a certain number need to be present to re-compute the key, yet nobody has enough information to re-compute the key on their own. For example, if I want to split $K$ between 4 people, such that any 3 can re-compute the key, I first form a polynomial $y(x)=ax^2+bx+K$.
Then I compute and distribute 4 pairs of the form $(x_i, f(x_i))$, one to each of the people.

It seems like $a, b, x$ should certainly be chosen with a cryptographically secure RNG, but is there any advice on how big they should be? Should they be as big as $K$? Big enough so that the term is about the same size as $K$ (which would make $a\approx K/x_i^2$, where $\approx$ means of the same order of magnitude)? As big as I can make them to the point that time to re-compute the key becomes an issue?


texts: Signature operations may leak the private key; signature verification should be safe?

texts:
What does this warning mean:

  Signature operations may leak the private key. Signature verification should be safe.

A haskell cryto library displays the quoted warning above (see Crypto.PubKey.ECC.ECDSA) but I don't really grasp why they are producing that warning.

Can you please explain what this means (from a cryptographical point of view)?


texts:
I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. But is this really feasible when we are talking about encrypting files?

Lets say we got a program that reads and writes encrypted files with AES CTR mode. If we have a word document it will be written to many times, and therefore change alot without the key and counter changing for specific blocks.

Now how feasible is it really for an attacker to actually find these previous versions on a given harddisk? Should this constellation not be reasonable secure against anyone except maybe the NSA?


texts: How to apply Pollard's Rho Method on elliptic curves to solve discrete logarithm problem in finite field?

texts:
I have ElGamal signature scheme implemented in finite field $\mathbb{F}_p$. The thing is that I need to apply Pollard's Rho Method on elliptic curve $E(\mathbb{F}_p)$ to this scheme, solve discrete logarithm problem and find private key $x$. In ElGamal scheme I have $a^x\equiv b\ (mod\  p)$ where $a,\ b\in \mathbb{F}_p$ and in Pollard's Rho Method I have $Q=dP$ where $P,Q\in E(\mathbb{F}_p)$.
So how can I get $P,\ Q$ from $a,\ b$ and, after I get $d$, how can I get $x$ from it?
Is it even possible or am I totally wrong?


texts: SVP=SIVP in ring lattice (ideal lattice)

texts: SVP (shortest vector problem) is equivalent to  SIVP (shortest independent vectors problem) in ring lattice (ideal lattice). How to prove this? Could someone explain it to me?  Thanks!


texts:
Salsa by Daniel J. Bernstein was meant to run with 20 rounds.
As i can configure the rounds in Bouncycastle with Salsa20Engine, do i have better security by increasing the rounds to 1000? The Performance is negligible.


texts: Stream cipher and block cipher usage in network data encryption

texts:
Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption.
In L3 ad L4 security protocols (IPSec and SSL) block ciphers are preferred (AES-CBC).

Why are stream ciphers considered to be better than block ciphers in low layer encryption and block ciphers considered to be better for higher-level encryption?
What makes voice data (which is application layer data) suitable for stream cipher? Isn't it easier to divide the voice stream into blocks and encrypt it with block cipher?


texts:
I have read up on rainbow tables and think I understand the idea behind them. However, I find that it would be better for me to actually attempt to implement a (very basic) rainbow table generator in order to get a proper feel to using rainbow tables.

However, I face the problem of there not being descriptions on how to actually generate one. More specifically, I have found no descriptions on what reduction functions to use. Nor have I found out how many hashes a chain contains. Everything I have found has all been "hash then reduce" or "use OphCrack/RainbowCrack".

Is there information that takes me through the actual steps to generate chains and search through them? I want to learn how to make the tables, not how to use other peoples' programs.

Please do not link me to these websites:

http://kestas.kuliukas.com/RainbowTables/
http://project-rainbowcrack.com/tutorial.htm
http://www.ethicalhacker.net/content/view/94/24/
http://www.thetazzone.com/tutorial-rainbow-tables/
http://en.wikipedia.org/wiki/Rainbow_table


texts:
-- Hopefully this question fits here --
Time and time again, there is always one person who asked about creating their own encryption standard/cipher, and we all agree to stop them early on because we all agree that it is very unwise to do so (such as preventing unknown or invisible weakness in their standard, etc.).
My curious question is: What about programming your own library of, let's say AES cipher, in your language of choice? It's not creating new cipher (still strictly adheres to AES cipher/algorithm), but just writing that algo in programming language of your choice (maybe do AES cipher again in C/C++ so we can use a new feature(s) built into new gen CPU and make it faster -> JUST EXAMPLE) or someone built a new programming language that has no AES library yet (and you want to contribute one). Is it still wise to do so?


texts: How to determine the order of an elliptic curve group from its parameters?

texts:
Let $\quad E:\; y^2 = x^3 + ax + b \quad$ be an elliptic curve defined over a finite field $\mathbb F_q$ where $q = p^n$, $a,b \in \mathbb F_q$ and $p \neq 2, 3$. By Hasse's theorem we know that the order of $E(\mathbb F_q)$ is in the range $[q+1-2\sqrt{q}, q+1+2\sqrt{q}]$.

Is it possible to determine the order of $E(\mathbb F_q)$ given $a, b, q$ without enumerating the points?


texts:
I have been wracking my brain trying to develop a functioning implementation of SRP-6a in Python to use with a 3rd-party API that claims to use SRP-6a with $N=$ 2048-bit prime and generator of $2$.  Unfortunately it has proven quite difficult to find two implementations that "match" to themselves.

For example, Stanford’s “SRP Protocol Design” page indicates that $K=H(S)$ (and I'm assuming that $H$ is SHA1 even though some implementations are using SHA256), but RFC2945 (original RFC for SRP) indicates $K$ is an Interleave-SHA1.  So which is it?

Second, the proof that the user generates ($M$) is stated, "one possible way" is $M=H(H(N) \oplus H(g), H(I), s, A, B, K)$ whereas some implementations have $M=H(A,B,S)$?
Which is it?

Finally, if I look at the original RFC2945 I see pretty much what is written in SRP Protocol Design, with the exception that $k=H(N,g)$ in 6a and for example in the design URL $B=(kv + g^b) % N$ (I guess, its never clear where to apply modulo $N$ if its just left out and written as "All arithmetic is done modulo N) where as in RFC2945 B is simply $(v+g^b) % N$.

Finally, are there test vectors other than $N$=1024-bit, $g=2$ , I can recreate the vector that exists even though nothing every shows the expected calculation for $K$ or $M$.

Apologies for first post to this site as sounding needy, but I've been trying to wrap my mind around this and work with a blackbox application that I simply fail the proof every time even after checking and doublechecking my code. :-(


texts:
In the secure Two-party computation problem with parties $P1$ and $P2$, let us assume the following construction:

$P1$ knows input $a$ and does the following: $a = a1 \oplus a2$ and keeps with itself $a1$ while giving $a2$ to $P2$.

Similarly, $P2$ knows input $b$ and does the following: $b = b1 \oplus b2$ and keeps with itself $b2$ while giving $b1$ to $P1$

So finally, $P1$ knows $a$, $a1$ and $b1$ while $P2$ knows $b$, $a2$ and $b2$.

To compute $o = a \oplus b$, $P1$ computes $o1 = a1 \oplus b1$ while $P2$ computes $o2 = a2 \oplus b2$. We know that $o = o1 \oplus o2$.

My question is where is the operation $o1 \oplus o2$ performed?
If it is on $P1$ (say), then $P1$ would know $o1$, $o2$ and $a2$ (because $P1$ knows $a$ and $a1$, he can recompute $a2$ as $a2 = a \oplus a1$) and we get $b2 = o2 \oplus a2$. Now since $P1$ knows $b1$ and $b2$, he knows $b$, which shouldn't happen.

What is the major flaw in my understanding of the problem here?


texts: Are two keys derived from the same password vulnerable to a related key attack?

texts:
Background

I am currently writing a password manager application. As usual, the passwords are put in a file encrypted using a user-entered password. I'm using the NaCl library but actually it's not really important.

Here is what I do to encrypt the file content with a user-entered password P:

First I generate a random salt S of 32 bytes (256 bits) and store it at the start of the encrypted file.
Second I derive a secret encryption key K from the password P and salt S using Argon2i.
I then compute a hash H of the file content using SHA-512.
Then I encrypt and authenticate the hash H with the XSalsa20 and Poly1305 primitive of the NaCl library (crypto_secretbox functions) using key K and nonce 0 and I store the encrypted and authenticated hash in the encrypted file after the salt.
Finally, I split the file content into blocks of 1024 bytes, except for the last block which may be less than 1024 bytes. The blocks are encrypted/authenticated and stored in the encrypted file in order, one by one, using the XSalsa20 and Poly1305 primitive. The first block is encrypted with key K and nonce 1, second block with nonce 2, third block with nonce 3, etc...

The file content length is not hidden since the last block is not padded to 1024 bytes but I don't believe it's a problem for a file holding logins and passwords.

Each time a file is encrypted or re-encrypted, for instance after having been modified, a new salt S is generated to prevent the same key K from being used twice.

To decrypt the file, the plaintext salt is used to derive the key again from the password entered by the user, then the hash H and file content are decrypted and authenticated and a hash of the decrypted file content is computed and checked to see if it match the initial hash H.

The reason I'm computing a hash H and encrypting and authenticating it is to prevent the individual encrypted blocks of the file from being added, removed or swapped. If an attacker try to do this, the hash H will not match at decryption. I'm also using block size of 1024 bytes because the NaCl website warns that primitives are only tested with message lengths up to 4096 bytes (https://nacl.cr.yp.to/valid.html). 1024 is completely arbitrary, I could have chosen 2048, 3159 or 4096 but I thought "Better take some margin" and I feel power of 2 are neater.

Question

It's obvious that in a given file, a combination of K and a given nonce is never used twice, since the nonce is incremented each time the key K is used. The same key K is also never used twice since it depends on the salt which is random and changed each time and is therefore never the same. So unless I'm overlooking something, it seems to me that my scheme is not vulnerable to a reused key attack.

However, the NaCl website also warns that "NaCl does not make any promises regarding the resistance of crypto_stream to related-key attacks". Since crypto_stream is XSalsa20, I believe this warning also applies to XSalsa20 + Poly1305. It makes me fear that two secret keys K1 and K2 derived from the same password P using Argon2i and two different salts S1 and S2 are somewhat related, since they come from the same password.

On the other hand, I'm thinking that even if a mathematical relation exists between K1 and K2 it's not a simple direct one. Otherwise we could compute, say Argon2i(P, S1) from Argon2i(P, S2) and that would mean that Argon2 was flawed since the salt would be ineffective.

Does two keys K1 and K2 derived from the same password P but from two different salts using Argon2i are vulnerable to a related key attack ? By the way, do you see any other flaws in my file encryption scheme? My main goal is confidentiality but it's a plus if my application can detect files which were tampered with, that is authenticity.


texts: How to prove if a Hash Function is collision resistant

texts:
Say we have the following Hash Function, H(x) = 4x mod N where N is a number generated by multiplying two prime numbers and x={0,1,2,3,...,N-1}. So lets assume that N=15 where 15 is made from 3 and 5

How would we prove whether it is collision resistant or not? I tried manually doing it like below:

x=0; 4(0) mod 15 = 0
x=1; 4(1) mod 15 = 4
x=2; 4(2) mod 15 = 8
x=3; 4(3) mod 15 = 12
x=4; 4(4) mod 15 = 1
x=5; 4(5) mod 15 = 5
x=6; 4(6) mod 15 = 9
x=7; 4(7) mod 15 = 13
x=8; 4(8) mod 15 = 2
x=9; 4(9) mod 15 = 6
x=10; 4(10) mod 15 = 10
x=11; 4(11) mod 15 = 14
x=12; 4(12) mod 15 = 3
x=13; 4(13) mod 15 = 7
x=14; 4(14) mod 15 = 11

As you can see in the example, there are no collisions but how do you prove it Mathematically without providing numbers?


texts: Does Signal Application use Eliptic Curve cryptography for encryption as well?

texts:
I am studying how Signal application works and as I was reading the documentation on how is applied the XEdDSA and VXEdDSA Signature Schemes.

But I kept wondering: if Signal uses elliptic curve for signing a message (as far as I understood), then how does it apply cryptography for encrypting the actual voice and instant messages. Does it use an eliptic curve cryptography scheme with a different key besides the other one?


texts: Number of keys for a monoalphabetic cipher

texts:
My teacher stated that…

  The number of possible keys (E) in a monoalphabetic cipher is $26$!

My thinking:

  Every letter in the alphabet can be $25$ different letters hence it the  number of possible keys should be $26^{25}$.

What is wrong with my way of thinking, and how did she come to a conclusion of “$26!$”?


texts: Privately Sum Values without Dealers, MPC

texts:
Suppose $n$ actors each hold a plaintext $p_i$. We wish to find $\sum p_i$, without leaking any information about individual $p_i$. Any actor (or any link in the network) could be controlled by an active adversary. The calculations should finish in seconds or minutes for $n = 20$.

The usual approach to this problem is use homomorphic encryption, but homomorphic encryption requires keys to be distributed among the actors. The two approaches to key generation that I found in the literature aren't useful here: there is no trusted party to act as a dealer, and secure multiparty computation is too slow.

Here's the best I can do using my own imagination. I'm curious if there's something in the literature I missed, or if somebody else's imagination is more fertile.

Choose $m > \sum p_i$
Each actor chooses a random $r_i < m$
The actors seed their random number generators using a hard-coded value, and all compute the same random ordering of the actors.
Actor $i$ receives some $e_i$ from the previous actor, and sends $e_{i+1} = p_i + r_i + e_i \mod m \;\;$ to the next actor. $\;\; e_0 = 0 \qquad e_n = \sum p_i + \sum r_i \mod m$
All the actors compute the same, new random ordering of the actors.
Actor $i$ receives some $d_i$ from the previous actor, and sends $\;\;d_{i+1} = d_i - r_i \mod m \;\;$ to the next actor. $\;\; d_0 = e_n \qquad e_n = \sum p_i$.

This is quite fast, requiring $2*n$ network transmissions and negligible computation. The security is good but not ideal. Most seriously, someone eavesdropping on your network connection can learn your $p_i$. Also, if your neighbors in the encryption and decryption processes share data, they can determine your $p_i$. If the adversary controls an actor with probability $p$, your data is leaked with probability $p^4$. An algorithm "better" than this one would maintain the secrecy of an individual $p_i$ even if the network is controlled by the adversary.


texts:
I have two ciphertexts, I suppose that its RC4 with reused key. I have XORed both ciphertexts and obtained message containing combined cleartexts.

I suppose that the underlaying messages are written in some structured format, but unfortuanatelly I do not know anything about frequencies (I might guess that there will be eg plenty of { }, if its json).

Most sources that I have read state that the separation is simple, but do not discuss the method to separate the texts. My idea was to use backtracking algorithm and try to construct both messages, so their sum (xor) matches the known combined text.

Is this the correct solution to this issue, or is there some smarter way?


texts:
Ciphertext:1rUHjDnJs09VNvxLiWZzL7PXeKUHvxFVG5GT59WdS6nvOZ1UypVbKlQTcl4orHFShQMBCFGH8+4+SlFDDv4+dUIcmd3zyaBnsXKCb9lMuGmMJkslgPFvgPKNWGsSVu4BhI6/42dGG3q0Lca465xeDaEKTj3Yan/59/+D5Sd6Cha3qwEWoITbR8zFgFNcOVLR
Key:3917249
I was given this as a scenario for as an assignment, I've tried everything in the book to the best of my knowledge to decipher this ciphertext using e.g. online cipher detector tools, hash identifier and, frequency analyser, still couldn't decipher it. It's supposed to contain some sort of link to a target machine. But in order to obtain that link, the ciphertext must first be deciphered.
Here are my findings: the ciphertext is base64 encoded, Key length is 7 bytes, the ciphertext contains 192 characters.
My Question Now Is What Do I Need To Do / What Have I Missed?


texts:
We have cryptography based on hard problems from number theory, like DDH.

When we speak about symmetric cryptography with AES, a mode of encryption (CBC, ...), what is the type of problem ? What is the term used ?


texts: Generating random vector for Full Homomorphic Cryptography

texts:
The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector mod 2 has an absolute value less than some amount (but greater than zero).

http://windowsontheory.org/2012/05/02/building-the-swiss-army-knife/

Is there any way to generate such a vector other than brute force?  Seems like it could take a long time for a large vector.


texts: Determine whether nonlinear boolean function is balanced or not

texts:
Is there any way to check that a nonlinear boolean function is balanced or not?

I can't think any other way except to check all input variables.


texts: What are recommended, general strategies to start block-cipher design and/or analysis?

texts:
I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers.

Now, the ressources on the "black art" of design and analysis of these ciphers are sparse; especially for the entry level. Available information like the Schneier guide seems to be somewhat outdated (due to its age).

What's the general consensus of the “best” (read: recommended) strategy to start designing and/or analyzing modern cryptographical block ciphers?

Nota bene: Think of this as a general, wiki-alike question – for learning purposes only. (Besides that, this Q&A would represent a place we can point people to when alike algorithm design questions arise.)


texts: What is the value of the fpad used in the NMAC?

texts:
NMAC uses an fpad value that is appended to the output of the Cascade function in the penultimate step of the algorithm (as depicted here, p.63) before it is sent to the last step of the NMAC algorithm to produce final tag.

I found that opad and ipad values used in HMAC are one-block constants (0x5c5c5c…5c5c and 0x363636…3636 respectively). I could not find the same for the NMAC's fpad.

What is the value of the fpad? Is it fixed and well-defined? Is it expected to be defined by the standard/cryptosystem that may decide to employ NMAC?


texts:
I need to create a commitment to a value X such that I can provide either proof that the commitment is to X or proof that the commitment is not to some other given value Y != X.

If I use a simple hash with a blinding factor

C = H(BF | X)

I can provide proof by revealing BF,X and "negative proof" that X!=Y by revealing BF, but this would defeat the purpose of the blinding factor, making X guessable as it has a small domain.

Is there some other way to create such commitment?


texts: Is RSA vulnerable to possible PRNG + Miller Rabin test weaknesses?

texts:
Factoring a 2048 bit number is a difficult topic with a well known complexity.

But it seems that p, q, the prime numbers used in RSA (order of magnitude: 10^308) are generated thanks to the probabilistic primality Miller Rabin test. Indeed even a table of primes between 10^307 and  10^308 would be out of reach.

Is RSA vulnerable to the potential specific arithmetic properties (if any) of the primes generated during the pseudo random number generator + Miller Rabin process?


texts: Why does CBC decryption with a wrong IV still give readable results?

texts:
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.

My encryption was correct.  I was generating a random IV block and writing it to the file (without encrypting the IV).  Then I was encrypting the plaintext and writing it.

The decryption was wrong though... instead of reading the first block from the file an using it as an IV, it was just using a random IV and decrypting everything.  The first block came out gibberish but the 2nd (and subsequent) ones were decrypted properly!  Why would this be?

And even weirder... when I tried to fix it by encrypting the IV in the encryption code (instead of writing the IV unchanged) the decryption result was the same!  (gibberish then correctly decrypted blocks).

Although I eventually fixed my code, how do these results make sense?


texts: Multiplication/Division in Galois Field (2^8)

texts:
I'm attempting to implement multiplication and division in $GF(2^8)$ using log and exponential tables. I'm using the exponent of 3 as my generator, using instructions from here.

However I'm having trouble getting the expected answer for some of these trivial multiplications.

For $2 · 4$ this works:

$$ \begin{align*}
 \log_3(2) &= 25 \\
 \log_3(4) &= 50 \\
    25 + 50 &= 75 \\
 \exp_3(75) &= 8 \Rightarrow \text{ expected answer}
\end{align*}$$

However for $7 · 11$ this breaks down:

$$\begin{align*}
    \log_3(7) &= 198 \\
    \log_3(11) &= 104 \\
    198 + 104 &= 302. \\
\text{Mod it by 255, gives us 47.}\\
    \exp_3(47) &= 49
\end{align*}$$
instead of the expected 77.

From what I understand, we use modulus 255 because the 3 generator 'wraps around' on the 255th power (so the pattern repeats after that) thus we only need 0~254. Even if I'm wrong in this, $302 \bmod 256$ still doesn't give us $70$, where $\exp_3(70) = 77$ (the expected answer)

My observation for both multiplication and division is that it works fine until the result of addition/subtraction goes out of range of 0~255.


texts: How can I prove I'm the recipient of an encrypted message without revealing my identity and the message?

texts:
Alice wants to leave a message for Bob. So she encrypt a signed message with Bob's public key.

Then leaves it at a dead drop service.

Then later Bob arrives and checks the messages and attempts to trial decrypt all of them to see if there are any addressed to him.

When Bob finds Alice's message, he manages to decrypt and read it.

However in order to avoid the vandalization of the dead drop, he can only remove the message from the dead drop if he can prove he is indeed the recipient.

Is there a way to do that without revealing the message and his identity?


texts: Formal proof that the following definitions of perfect secrecy are equivalent

texts:
I've seen the following two definitions of perfect secrecy for an encryption scheme (Gen, Enc, Dec).

Pr[M = m | C = c] = Pr[M = m] for all c, m, M and C

Intuitively, this means that if the adversary trying to guess the plaintext, gets no information from the ciphertext.

Pr[k <- Gen | Enc k m1 = c] = Pr[k <- Gen | Enc k m2 = c] for all k, m1, m2, c

Informally, this means that any key k encodes both m1 and m2 to c with equal probability.
Can someone formally show me how these two definitions are in fact, equivalent?


texts: I've been delving into cryptography for fun and trying to implement a visualization for AES using image encryption. So far, represented each pixel's RGB values as hexadecimal numbers, then split it into an array of 16 character strings. I know that AES is a block cipher, so I have to split them into 16 character strings, but how am I supposed to handle when the string becomes less than 16 characters? I've heard that I should just pad it and add more characters to fit it into 16 characters, but I'm not sure if that's correct, since the padded characters won't be represented in the final image, and be able to be decrypted.


texts: How to calculate the time it'll take to crack RSA or DH?

texts: Sometimes the easiest way to describe security of a type of cryptography is to say that "the time it takes to solve for an x-bit key would be y years". How would one go about doing such a calculation for RSA, DH, and ElGamal. In other words, given x, how to solve for y?


texts: Algorithm to rotate values in a predefined manner

texts:
I will start with an example. Some beacon like estimote Beacons use something called secure ID. The ID transmitted by the beacon change every 10 minutes autonomously without contacting the server. When the new ID are sent to the server, this one can identify the beacon generating the ID.

This is exactly what I want to do. I have a raspberry pi acting like a beacon and transmitting an ID. I want to share the original ID and maybe a key with the server. Then using this key, I want to crypt or change the original ID value every few minutes and I want the server to be able to identify the original ID.

Is there any function that allow that ? I have almost no knowledge about cryptography, is there any good book/article that can help me understand what I should do ?


texts: Secret modular exponentiation with chosen modulus

texts:
Let $e$ be a secret value and $n$ a public 2048-bit RSA modulus.
Consider the RSA encryption under the key $(e, n)$ with unknown $e$.

The goal is to decrypt a given ciphertext $c=m^e \pmod{n}$ to recover $m$.

The adversary is assumed to have oracle access to:

the encryption function $x\mapsto x^e\pmod{n}$ for chosen $x$.
the function $x\mapsto x^e\pmod{n'}$ for chosen $x$ and $n'$.

Is it possible to recover the following values

$m$ ?
$e$ ?
$d = e^{-1}\pmod{\varphi(n)}$ ?