texts: RSA vs. Super Computer vs. Quantum Computer

texts:
I know that RSA is known to be secure in the current landscape of computing, and I know that RSA is known to be broken in the world of quantum computing and cryptography.

I have two questions, can someone tell me why super computer's with this magnitude of processing power are unable to break RSA:

Six Clicks: The six fastest computers in the world

Please be specific with maths and all.

Additionally, can someone explain why RSA is broken by quantum computers mathematically and how lattice cryptography is resistant to them?


texts: Allow message inspection by proxy without ability to modify it

texts:
My client creates a private/public key pair and sends it securely to a server (the "public" key is not really public, only the server is supposed to know it). The server then sends messages to the client, encrypted using the public key.

Now a customer wants to add a proxy that inspects these messages. Obviously the proxy cannot inspect the encrypted message, only the client. Can anyone think of a way to allow the proxy to verify that the encrypted message is what it is supposed to be, without being able to replace it with it's own encrypted message? We assume that traffic from server to proxy is secure (both are on the same machine).

(We are willing to modify what the server sends out. I am writing the client, and there's no way I'll hand the private key to anyone, and the server devs are very unwilling to pass the public key to anyone. Otherwise they could pass the public key and the plaintext message to the proxy and let it create the encrypted message itself).


texts:
I'm reading a proof of the proposition of CollisionResistant Hashing Towards Making UOWHFs Practical

  Suppose there exists a compression function $F: \Sigma^k\times\Sigma^{c+m'} \rightarrow \Sigma^c$ with $m'>k$ such that $F$ is $(t',\epsilon')$-resistant to target collisions. Then there exists a compression function $H$ such that $H$ is $(t,\epsilon)$-resistant to target collisions for $t=t'- \Theta (k+m') $ and $\epsilon' = \epsilon + 2^{-k+1}$

To show that, the author constructs the following hash function:
$$H(K,x||y||z) = H_K(x||y||z)=
\begin{cases}
  F_K(x||y||z)||K & \text{if }y\neq K
\\1^c||1^k & \text{if }y = K
\end{cases}$$

Here is the proof:

My questions:

I don't understand why a $CF'$ run in time $t+O(k+c+m)$ I know why he add $t$ but I don't undertand Why $O(k+c+m)$?
Why a $ProbSuccess(CF',F)\geq 1-2^{-k+1}$? I understand that means $2^{-k}$ but I don't Why $2^{-k}*2$


texts: Is Checksum to file back decoding possible?

texts: So, I was having this weird thought. If the checksums(MD5 or SHA...) are unique to any file and are modified if any part of the file is edited, why cant the checksums be decoded back to get the original file? That is if I want to send a large(say 700MB) video, instead I could send just the hash and the file be decoded locally in my friend's computer. I know the thought is stupid, but is it possible by any chance? Or am I missing some thing here? And forgive me if I'm wrong, I ain't a professional.


texts: Is this good way of Elliptical curve point mapping

texts:
Mapping a bit string $L$ to elliptical curve point in say prime field $\mathbb Z_p$. A simple way would be to use an integer mapping function that maps $L$ to a number $\{1, q\}$ where $q$ is the order of the group and then return $q[B]$, where $B$ is a base point. But it would be unacceptable for the purpose I want.
Here is my design for some mental poker or any card game "https://crypto.stackexchange.com/questions/87159/a-card-game-for-mental-poker-or-any-other-card-game"
as it should not allow anyone to compute the discrete logarithm of one point base on another point in the group. So we use a function which maps $L$ to a number $\{1,p\}$ call it $x$ and a bit $b$. If any point $P = (x,y)$ exists on the curve, return $[h]P'^*$ where $h$ is the cofactor of the curve and $P' = (x,y)$ if $b=0$ $(x,-y)$ otherwise $(x,y)$. Otherwise set $L = H_{0,..|L|}(L)$ and repeat the process in a loop until you can find a point. It should be secure (Infeasible to calculate the Elliptical curve discrete logarithm of one point over another as long as the curve is good enough) right?


texts: Security properties of ElGamal encryption variants

texts:
I'll use Taher ElGamal's A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms (July 1985 in IEEE Transactions on Information Theory, formerly in proceedings of Crypto 1984) as the reference scheme.

Public parameters are a large prime $p$ with $p-1$ having at least one large prime factor, and a generator $\alpha$.
Long-term (public, private) key pair for receiver Bob is $(y_B,x_B)$ with random secret $x_B$ and $y_B=\alpha^{x_B}\bmod p$.
Message $m$ is in $[0,p)$. Sender draws random $k$, computes $K={y_B}^k\bmod p$, $c_1=\alpha^k\bmod p$, $c_2=Km\bmod p$. The ciphertext is $(c_1,c_2)$.
Receiver Bob accepts ciphertext $(c_1,c_2)$ in $[0,p)^2$, computes $K={c_1}^{x_B}\bmod p$, and $m=K^{-1}c_2\bmod p$.

As is, the scheme is not IND-CPA secure. For a start, $m=0\iff c_2=0$, which is easily fixed by using $\Bbb Z_p^*$ as the message space; assume that.

Another issue breaking IND-CPA is that the Legendre symbol $\displaystyle\biggl(\frac m p\biggr)$ can be found from $(p,\alpha,y_B,c_1,c_2)$, leaking one bit of information about $m$.

What has been devised to fix that, and how are the modified encryption schemes named? What security property and argument do we have for these?

I'm in particular interested by variants where

$m$ is restricted to $\displaystyle\biggl(\frac m p\biggr)=+1$ by altering some bits of $m$ by trial and error.
some field of $m$ is randomized (e.g. highest-order bit set to 0, next high-order $b$ bits per-encryption randomness, where $b$ is a security parameter).
$m$ is a bitstring shorter than $p$ by $b$ bits; $K$ is truncated to $\tilde K$ of that size, keeping low-order bits; and $c_2=m\oplus\tilde K$ for encryption, $m=c_2\oplus\tilde K$ for decryption.
as 3 above with $\tilde K$ further split into $K_i\mathbin\| K_e$, $K_i$ used as key for a Carter-Wegman hash preventing decryption of falsified ciphertexts, and $K_e$ the key for XOR-encryption of a message $m$ restricted to the corresponding size.


texts: Decrypt web https-transmitted file manually

texts:
When the communication between server and client starts -after a request, the computers agree on an encryption protocol to protect the data, the TLS handshake. The data may not be encrypted on the server, but it should be before sending using the server's private key.
If protocols involves asymmetric encryption (and exchange of public key) files (or the HTTP-body) are encrypted, the browser needs the locally generated private key to decrypt it.
This may be more complicated and I'm open to corrections. But just by checking many of the x509 certificates (by clicking on firefox lock symbol) it seems many certificates involve asymmetric cryptography (maybe this is used to exchange the symmetric keys, and next move on to use symmetric encryption).
Assuming all this:
Is it possible to get decrypt the data sent by the server using our private key and the information on the certificate (by clicking on the lock at the URL bar) to decrypt the file via command line using openssl?
(I am not sure where the private key that I use locally to decrypt the file is stored by mozilla firefox.)
I know it should be possible to get the encrypted packets on wireshark, but am not sure about the particular details to decrypt.


texts: Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?


texts: Relationship among secrecy-constant, key space and message space

texts:
Here scheme $\Pi$ is $\epsilon $ -
perfectly secret.
Given that encryption scheme $\Pi$ =  $(\mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec})$ over $(\mathcal K,\mathcal M,\mathcal C)$ is called $\epsilon $ -
perfectly secret if for any distribution over $\mathcal M$, any $m \in  M $ and any $ c \in C$,
$|Pr[M=m|C=c] - Pr[M=m]|<\epsilon$
then how to prove that ,
$|\mathcal K|\geq (1 - \epsilon)|\mathcal M|$
I am not getting idea how to proceed as here $\epsilon$ can be anything i.e non-negligible or negligible both.


texts: How to prove two ECDSA public keys on two different curves are generated from the same private key

texts:
I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the private key itself?

For example, I have a private key (which is a large random 256-bit number) and I generate one public key on the secp256r1 curve and another public key on the secp256k1 curve, how do I provide the two keys to a third party and prove to them that these two public keys are generated from the same private key? Is there some kind of zero-knowledge proof or some algorithm that can accomplish that? Thanks.


texts: Logical OR operation in a homomorphic additive cryptosystem

texts:
Suppose we have a cryptosystem homomorphic for addition (say Paillier's). Is there a way to perform a logical OR operation between two binary values (with a binary result).

We can, of course, obtain the encoded result of addition between two values (by multiplying the encoded values):

$Enc(x + y) = Enc(x) \cdot Enc(y)$

and that gives us something close to a logical OR, except if both $x$ and $y$ have value $1$, in which case the result will be $2$, when it should be $1$.

Therefore another way to solve the problem might be to figure a homomorphic function: $F: \{1, 2\} \rightarrow 1; 0 \rightarrow 0$.

Does such a function exist?

Conversely, is there any way to prove that a true logical OR operation would break some fundamental properties/limitations of (non-full) homomorphic cryptosystems (and that I am wasting my time looking for one)?


texts: How to decrypt safeNet wrapped exported keys?


texts: How to make Fernet encryption produce the same ciphertext for the same data

texts:
I am using a cryptography library for Python and it provides Fernet Module.

Now I have a plaintext to encrypt. It produces a ciphertext. Then I try to encrypt the same plaintext with the same key but the ciphertexts are different.

I need the ciphertext to be the same every time.
Do you know any way around this? Or maybe a different encryption technique?
Thanks in advance


texts: Where does the range of possible values in Bleichenbacher's attack against PKCS #1 come from?

texts:
In Bleichenbacher's paper on his attack against PKCS #1, we find:

If the oracle says that $c'$ is PKCS conforming, then the attacker
knows that the  first two bytes of $ms$ are $\mathtt{00}$ and $\mathtt{02}$. For
convenience, let $$B = 2^{8(k−2)}.$$
Recall that $k$ is the length of $n$ in bytes. Hence, that $ms$ is
PKCS conforming implies that
$$2B \ \leq\  ms \bmod n \ <\ 3B$$

I know that if $c'$ is PKCS conforming, that means that $2 \times 16^{k-2} \leq c' < 3 \times 16^{k-2}$ (because the two most significant bytes of $c'$ are $\mathtt{00}$ and $\mathtt{02}$). I clearly understand why the size of the range from above is $2^{8(k−2)}$, but I don't see where the lower bound come from. Can someone please explain?


texts: Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

texts:
A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden subgroup problem.

However, in 2008, new parameters were proposed after the old ones were found to be vulnerable.

So my question – as someone who hasn't much knowledge on this particular cryptosystem – is: Why isn't it in greater usage?

It would seem that if the promise of quantum computing is fulfilled, we may soon have need for cryptosystems not vulnerable to it. So, is the requirement for a large matrix (and therefore a large key) the only barrier, or are there other concerns/potential weaknesses? Or is there a better candidate for a post-quantum public key system?


texts:
Let's say I want a way of generating a deterministic public ID for a specific symmetric cryptographic key (AES, for example). Would it be secure to use SHA-3 (or SHAKE) to hash the key, and then distribute the hash as the public ID for the secret key?

Is there an advantage or disadvantage to using a larger or shorter hash length relative to the key length? For example, if the key is 256 bits (32 bytes), using a 256 vs 512 bit SHA3 hash?


texts:
Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell, BLS-Signature is the VRF output and the verification first checks the signature is valid, and then compute the hash over it to provide the VRF output. (Or similarly, one can provide H(BLS-Signature) as the VRF output and BLS-Signature as the VRF proof.)

Is this scheme a VRF ? Given a collision resistant hash function of course.
How would one would go about proving it ?


texts: Does this pairing-based signature scheme work?

texts:
Suppose $g$ is a pairing-friendly elliptic curve with subgroup generators $G_1$ and $G_2$. Suppose also that $M$ is the message I want to sign.

Setup

Compute $A = a \cdot G_1$ and $P = p \cdot G_2$, where $a$ and $p$ are some secret values.
The public key is then defined as a tuple $(A, P)$.

Signature

Hash message $M$ to a number using a hash function: $m=Hash(M)$.
Compute  $C = \frac{p}{a \cdot m} \cdot G_2$.
The signature is then defined as $C$.

Verification

Compute $m = Hash(M)$.
Verify that $e(A, C)^m = e(G_1, P)$.

Are there any holes in this scheme?


texts: Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

texts:
Is it possible to deterministically generate public/private RSA key pairs from passphrases?

Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a source of random data) be sufficient and strong?

Extra credit:

Is it possible to generate a key pair from one public and one private passphrase, such that the public key can be generated from only the public passphrasse?  (The private key can use both.)

(I'm trying to deal with the difficulties in using RSA keys as pasted/exchanged things.)


texts: Order of subgroups formed by Elliptic Curves with a Cofactor

texts:
In this question:

Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?

The answer indicates that the order of all points on the curve over the finite field 2^255 - 19 is 8 times the size of the subgroup formed by G.

i.e. the subgroup size is
1=2^252+27742317777372353535851937790883648493 whereas the number of points in the curve itself is 8(1).

The answer then states: "This means that there are a few remaining points that have small order."

However, as stated in the answer the few remaining points are in fact 8 times the number of points in the cyclic subgroup G.

So how can one conclude that the remaining points form small order groups?

Isn't there scope for a group within the set of remaining points to be bigger than 1?

How do we know the other points not inside 1, form a variety of small order groups?


texts: Which cipher to use with openssl for shortest output?

texts:
I'd like to encrypt my 12-24 words seed for my bitcoin wallet with openssl command line tool to be able to have it with me on paper without the risk that somebody could use it

Which cipher should I use for the shortest output in base64? The seed consists of just a-z characters and is case insensitive

Main requirements are short length and decodable on any computer with openssl installed - nothing exotic


texts: Missing Final Step in Montgomery Reduction

texts:
I'm following well with using the shifting method to try out the Montgomery reduction (1st round).
However, the computed result is actually equal to:
$$XYR^{-1} \bmod N$$
while the final goal is to obtain the result of
$$XY \bmod N$$
In order to get the final answer, I need to implement an extra step which is
$$(XYR^{-1})(R \bmod N) \bmod N$$
However, What if the product of $(XYR^{-1})(R \bmod N)$ giving me the large integer number?
In this case, how should leverage the same shifting method Montgomery reduction engine until I can obtain the final $Z = XY \bmod N$?
If I repeat the same Montgomery Reduction 2nd round using the product of $(XYR^{-1})(R \bmod N)$, I will just get back the same answer as $(XYR^{-1})$.
May I know what are the missing steps above?


texts: Attack on stream cipher that XOR's the output of two LFSRs

texts:
There are two LFSRs of different lengths: LFSR-17 and LFSR-25. LFSR-17 Initially contains a two byte seed, with a 1 injected into the fourth bit, for a total of 17 bits. LFSR-25 operates in the same way.

Of the 40-bit key, 2 bytes is seeded into the first LFSR and 3 bytes into the other. If the outputs of each LFSR were simply XORd to produce the keystream, how could we launch a known plaintext to retrieve the key?


texts:
Consider a (hypothetical) PRNG where the state update function is onto, but it is easy to find the set of preimages (so not one-way).  That is, if an attacker is given the internal state of the system, say state $s_n, s_{n+1}, ..., s_{n+m}$, the "true" previous state $s_{n-1}$ obtained by the user could be any one of multiple states in an infinite set $S$.  So the attacker knows $s_{n-1} \in S$, but assume $|S|$ is large or infinite, so the attacker must guess the "true" $s_{n-1}$ state.  Does such a PRNG exist?  And, would one be able to call such a PRNG "backtracking resistant"?

Something I am unsure of is whether such a PRNG would by default be cryptographically secure: because the state update function is onto, the "true" previous state could have been, with equal probability, any one of the states in $S$, so the previous state would almost be trivially unpredictable, implying such a PRNG would be cryptographically secure.  Where does my logic go wrong here?


texts: ECIES is must with Symmetric?(ECIES-AES or ECIES-TDES)

texts:
I can't understand the ECIES algorithm.

I saw two different ECIES algorithms:

Using only Public key

Key generation:

$A_{pri} : n_A$
$A_{pub} : n_A G$

$B_{pri} : n_B$
$B_{pub} : n_B G$

Encryption:

Select a random $k$.

A -> B to Cipher C : $\{kG, \text{message} + k B_{pub}\}$

Decryption

$\text{message} + k B_{pub} - n_B kG = message + k n_B G - n_B k G = \text{message}$
Using Symmetric key(AES)

what is real?


texts: Designing a hash function from first principles rather than depending on heuristics

texts:
Is there a general method to design a cryptographic hash function (with desired properties) from first principles? That is, is there a general process for constructing such functions? I get the impression that Merkle–Damgård construction simplifies the process by allowing collision-resistant compression functions to be used, but are there any general ways of finding "good" compression functions other than by using trial-and-error?
In the entries to the most recent NIST challenge, it seemed to me as if the teams were using very different approaches based on different heuristics, and then essentially testing their functions against many inputs, tweaking parameters, and after that iterating until all evidence pointed to their functions as being secure.

To what extent is this an accurate summary of their approaches? I would really appreciate a reference to a thesis or other publication on this subject.


texts: is it possible to generate IV for a given block with AES GCM

texts:
So, I have a java CipherInputStream encrypted using AES/GCM/NoPadding (Bouncy Castle). I can decrypt the stream just fine with the IV (12 bytes) and the AES key.

Is there any way I can decrypt the stream if I start reading it from some random byte?

Can I generate a correct new IV knowing the original one, byte im starting to read from and total stream length?


texts: What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

texts:
This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of protocols concerned by the attack(s), beyond:

  Some of the ECDLP security requirements for the twist are overkill for DH on the original curve: DH does not actually reveal nQ to Eve, so there is no obvious way for Eve to apply (e.g.) an additive transfer. There are, however, other ECC protocols that make full use of both the original curve and its twist, and twist security is important for these protocols.  See, e.g., 1986 Kaliski, 1988 Kaliski, and 2001 Boyd–Montague–Nguyen.

What are theses attacks (in the simplest meaningful terms possible please, including some introduction to the twist)? To what class of protocols (perhaps: signature, key establishment..) and operational setup (number/nature of queries to signer/server..) do they apply?

Note: the present question is closely related to (and inspired by) this more technical one.


texts: Calculating Maximum Index of Coincidence

texts:
I'm trying to understand how the maximum Index of Coincidence (IC) is found. This is the only description I have for it:

"For a given period $P$ you can divide a cipher into $P$ groups, calculate the IC for each group, then take the average of these $P$ values. Doing this for all periods from 1 to 15 and selecting the maximum of these 15 values gives a MIC statistic"

Just to make sure I understand it correctly if I have a text with a length of 100 characters I should calculate the IC for:
... 100 characters
... two sets of 50 characters
... three sets of 33 characters (or 34?)
... four sets of 25 characters

and so on until I have my 15 groups of $P$

Then I take the maximum IC from each of the groups of $P$ and

sum = sum + count * (count - 1);

Then

sum / totcount * totcount - 1

Sorry if I don't understand I'm new to cryptoanalysis


texts: How does hashing twice protect against birthday attacks?

texts:
The bitcoin wiki says:

  Bitcoin is using two hash iterations (denoted SHA256^2 ie "SHA256 function squared") and the reason for this relates to a partial attack on the smaller but related SHA1 hash. SHA1's resistance to birthday attacks has been partially broken as of 2005 in O(2^64) vs the design O(2^80). While hashcash relies on pre-image resistance and so is not vulnerable to birthday attacks, a generic method of hardening SHA1 against the birthday collision attack is to iterate it twice. A comparable attack on SHA256 does not exist so far, however as the design of SHA256 is similar to SHA1 it is probably defensive for applications to use double SHA256. And this is what bitcoin does, it is not necessary given hashcash reliance on preimage security, but it is a defensive step against future cryptanalytic developments. The attack on SHA1 and in principle other hashes of similar design like SHA256, was also the motivation for the NIST SHA3 design competition which is still ongoing.

I don't understand how hashing twice would prevent a birthday attack considering that finding a collision after the first hash would trivially entail a collision after the second hash.

Is it because you have to compute the hash twice thus slowing the process down or is there a more significant reason?


texts: Endless PRNG from PRNG with specific stretch?

texts:
Every definition of pseudorandom generator that I've seen says it takes n-bit strings and gives poly(n)-bit strings.

Is there a proof that if there is such a pseudorandom generator then there is a pseudorandom generator that takes n-bit seeds and repeatedly outputs bits on request?

Things I would be curious about that are not essential to the answer:

Could it be made random access? (ie, one can efficiently find what its m-th output will be)
Could it be made so that a state compromise would not give useful information about earlier outputs?


texts: Probability of false positive key matching two plaintext/ciphertext pairs

texts:
Given a keyspace of $ 2^{80} $ and plaintext space of $2^{64}$. And two plaintext and ciphertext pairs $(x_1, y_1)$ , $(x_2, y_2)$. Now we have $2^{80}/2^{64} = 2^{16}$ keys that encrypt $x_1$ to $y_1$ and another $2^{16}$ keys that encrypt $x_2$ to $y_2$, with only one key that is supposed to be the target key (correct key).
What is the probability that once brute-force identifies a first key ($k_1$) this same key happen by mistake to also encrypt $x_2$ to $y_2$, that is this this key happen to be a False-positive (that is, this key will likely not encrypt $x_3$ correctly). What is the equation used and how is it derived?


texts: RSA: How to get ciphertext in decimal from an encrypted base64?

texts:
I was given the ciphertext as base64 just like that:

ADknbLUTEh1NBT80tH57H7B44DZOWao67c8I8+AQwuSwnUUxiJUidAedSaOGceVjC4tVF3sfnj0b
1akQiMMXO7YPj+0MFFN09WqE0Jz36ZtY695Esp3DoErjnK8=

How can I convert it to decimal?


texts: What's the purpose of the smoothing parameter in lattice-based cryptography?

texts: I see nearly all the lattice-based crypto papers talk about the smoothing parameter $\eta$. And I believe even some parameters are chosen with respect to that. However, I do not quite understand what's the purpose of it. What's its relation to lattices? Why is it useful and important for cryptography?


texts: Is direct RSA encryption of AES keys secure?

texts:
I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process?

This is the scheme:

Bob has an RSA key with modulo $N$ with a size that is considered safe, 2048 and a public power of $e=3$ (should assure efficient encryption).

Alice wants to send Bob a big file, and chooses symmetric encryption: She uses a random $k$ for AES and sends it encrypted using RSA using $C=k^e \bmod N$, and then sends the file encrypted by AES using key $k$.

To decrypt the file, Bob recovers $k$ using $k=C^d \bmod N$ and then decrypts the encrypted file using AES with $k$ is the key.

Is this procedure really secure?

On the paper, it uses secure parameters and seems secure, but I am not sure because $k$ is used too much here. Is there some hidden vulnerability I am missing here?

EDIT: what i am asking is in regards to attacking it, so could you please put an emphasize on attacking it rather than suggesting an alternative? i don't fully understand it, i understand that because of AES, $k^3$ cannot be more than 768 bits, so it does not pass the modulo (that is 2048). but i don't understand the technical details very well and would appreciate if you could elaborate on it instead of on possible mitigations.

thank you very much


texts: Do deterministic secret sharing schemes exist?

texts:
Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations.

If there aren't, is such an algorithm an impossibility? If there are, what are some examples?

I ask because I've come up with a secret sharing scheme (which is probably littered with flaws ;-)), and I'd like try and prove certain properties about it. If deterministic secret sharing schemes are a no-go, I'd very much appreciate a heads up.

I'm not entirely certain this question is well defined. If it is not, I would greatly appreciate any information on why it is ill defined and how to make it more rigorous if possible.


texts: Why is this not a viable key exchange algorithm?

texts:
I was just wondering why this kind of algorithm can't be used instead of, say, Diffie-Hellman to exchange keys:

Alice decides on a key she wishes to share with Bob.
Alice generates a stream of bytes with the same length as the key (securely, say, with a CSPRNG).
Alice sends to Bob:
C1 = (key ^ alice_random_bytes)

Bob generates a stream of random bytes in a manner similar to Alice.
Bob returns to Alice:
C2 = (C1 ^ bob_random_bytes)

Alice XORs C2 with her random byte sequence again, leaving only key ^ bob_random_bytes like so and sends it to Bob:
C3 = (C2 ^ alice_random_bytes)
   = (C1 ^ bob_random_bytes ^ alice_random_bytes)
   = (key ^ alice_random_bytes ^ bob_random_bytes ^ alice_random_bytes)
   = (key ^ bob_random_bytes)

Bob XORs C3 with his random bytes and obtains the key:
K = (C3 ^ bob_random_bytes)
  = (key ^ bob_random_bytes ^ bob_random_bytes)
  = key

This seems a lot simpler than Diffie Hellman, so I was wondering: what is the issue with such an algorithm?


texts: Why do you need padding block at the end of Merkle damgard if the input is multiple of block length?

texts:
Why do you need padding block at the end of Merkle Damgard if the input is multiple of block length? I learned that it was not collision resistant if a dummy block is not added to the end but I want to understand why this is the case.

Let's say MD outputs Zb instead of H(Zb||L). What is the reasoning for why this particular construction isn't collision resistant?


texts:
I was wondering if the following hash function

f(x) := md5(x) & md5('abc'&x)

(with & as concatenation operator) is secure.

This schema can be even extended like this:

g(x) := md5(x) & md5('abc'&x) & md5('def'&x)

To find a collission in f(x), following requirements would be met:

f(x)=f(x'), x!=x' <==> md5(x)=md5(x') ^ md5('abc'&x)=md5('abc'&x')

or

g(x)=g(x'), x!=x' <==> md5(x)=md5(x') ^ md5('abc'&x)=md5('abc'&x') ^ md5('def'&x)=md5('def'&x')

Is this realistic that such a condition can be found? I can't imagine that.

[I would be happy to learn more about the math behind it]


texts:
Given binary shares $[a_{l-1}]_p,...,[a_0]_p, [b_{l-1}]_p,...,[b_0]_p$ such that $a = \sum_{i=0}^{l-1} a_i2^i,b = \sum_{i=0}^{l-1} b_i2^i $
for $a,b \in Z_p$, how to compute $a \overset{?}{\lt} b$ in MPC (the result is not closed)?


texts: Can we estimate the amount of entropy required to generate an RSA key?

texts:
Of say 4096 bits as is a default GPG master key.

I can manage the first one or so almost immediately on Ubuntu.  It then  runs out of entropy when generating several more RSA keys, and I'm   forced by GPG into mouse wiggling and keyboard smashing.  More entropy is clearly required in those cases than available from /dev/random.

Is there some measure of the total amount of entropy bits needed to make a single 4096 bit RSA key?

Close but not quite is Detecting the amount of entropy used for random number generation. Nor How to generate 1024-bit RSA key as that only calculates the bits in the final key pair. Some sort of combination is probably required to take into account primacy testing.


texts: How to determine the multiplicative inverse modulo 64 (or other power of two)?

texts:
I am trying to determine the multiplicative inverse of $47$ modulo $64$. So I have looked for an algorithm or scheme in order to perform this.

I found this wiki explaining how to find a multiplicative inverse. I tried to perform all the calculations, but the result was incorrect. I got $5$ as a multiplicative inverse, but this cannot be true: $47\times5\not\equiv1\pmod{64}$. Who can help me?


texts: How do malware rely safely on ECDH algorithm to maintain secrecy of keys?

texts:
In traditional malware (especially ransomware) using RSA approach, the public key may be hard-coded in the malware binary and is used to encrypt a symmetric key generated on the system. The symmetric key itself is used to encrypt user files.

Some new variants of malware are using ECDH instead of RSA. How is ECDH used in this context securely when malware analysts can reverse engineer the malware binary to find the curve and the parameters?

I have done the following research on this issue:

Read Wikipedia entry on ECDH
Watched a video in an attempt to comprehend it

So I understand the general concept of the logarithm problem where it is infeasible (computationally intensive) to find factors on the curve. But what I do not understand is this: if the curve and the pre-agreed parameters on the curve are hard-coded in the malware, can't malware analysts reverse engineer the malware binary to find the agreed upon curve and the parameters? Can this be then used to find the keys and beat the malware? If not, what is the "secret" that both malware developer and malware binary have access to (the two parties) but not the malware analyst who can reverse engineer the binary? For example, in the case of RSA, this secret is the private key which never leaves the attacker.


texts:
As we know, AES-256 is a block cipher with 256-bit key and 128-bit block size.

The CMAC message authentication code outputs tag length equal to block cipher block size - thus 128 bits with AES. And this provides an assurence that only 1 in 2^128 attempts in forgery may possibly succeed.

So is there any point using a 256-bit key as may be the case with AES-256?


texts: Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?

texts:
I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash block long (i.e., 512 bits), and nopad means that padding is disabled.
This seems to me to be equivalent in security to truncate8(SHA256(IV=standard, secret||message)), except that it is about twice as fast. This makes me suspicious that it might not be as secure, hence this question.
Is there a real reason to use HMAC in my use case where the message is always one hash block long?


texts: Why should symmetric block cyphers be efficient?

texts:
If I remember well, AES (then named Rijndael) won the competition because it was slightly faster to implement as one of its competitors, Serpent, which erred on the side of caution, using 32 rounds as where most probably, 16 rounds would have been sufficient.  In a way, the competition was rewarding "highest security per clock cycle" (way of speaking).  That was almost 2 decades ago, when computers were still much slower than today, so clock cycles were still expensive, and too heavy cryptographic burdens might make it hard to use on home computers.
However, today the problems of encryption are rather the large amounts of brute force that one can apply.  This is why one uses "inefficient" key derivation functions, to slow down brute force.

My question is: why doesn't this apply to block cyphers ?  Wouldn't it be a good idea to have "inefficient" and slow block cyphers ?  Wouldn't something like Serpent, but even with say, 4096 rounds, be preferable over an efficient algorithm like AES, so that it takes much more time to use in a brute force attack ?


texts: Using same keypair for Diffie-Hellman and signing

texts:
Are there any security risks using a single key-pair for both key-exchange and signing?

I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, such as EC-DH and EC-Schnorr or even EC-DSA with the same key pair would be interesting too.

Curve25519 hashes the output of an x-coordinate only Diffie-Hellman key exchange
Ed25519 is a slight variant of EC-Schnorr signatures.

I saw some recommendations to avoid using a single key for multiple purposes, but I couldn't find anything concrete.


texts: Can zk-snark proof generation be parallelised across multiple parties in a trustless manner

texts:
Can multiple parties using the same snark protocol, the same verification strings, inputs etc, generate separate proofs and then combine the proof strings somehow to get a proof of the desired strength?

I am interested in whether this is possible in theory, and also in practice using libsnark.


texts: example of increasing size weakening security?

texts:
I'm seeking an example of a cipher construction with two variants differing by key/block/state size yet sharing most of the internal structure. Where the larger varient is easier to break than the smaller version.
Should be clearly related to a well known cipher so that claiming strength of smaller varient will have merit. Bonus points for increasing also key size not just block/state.
I'm aware of how this could happen, just looking for an example where it does.


texts: McEliece parameter tuple (n, k, t) through BouncyCastles (m, t, poly)

texts:
I am using BouncyCastles Java API and want to use McEliece encryption. After browsing through various paper for finding good parameters (e.g. How to choose McEliece's parameters?) I am now having the problem, that I do not see a possibility to set these parameters with the BouncyCastle API.

In all papers, the parameter set is a 3-tuple: (n, k, t). But with BouncyCastle, I can only specify the 3-tuple (m, t, poly) for keypair generation.

How do they correspond to the (n, k, t) parameter set?


texts: Collisions in the cyclotomic knapsack function

texts:
I've been working my way through the paper “Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices” by Peikert and Rosen, and I've come across something that doesn't seem to make sense to me.  (Apologies if the level of detail in the following is inconsistent, I'm somewhat less than familiar with the context.)

Here's my problem.

What I'm understanding is a simple linear algebra thing: Take a subspace of $\mathbb R^n$, then reduce a vector in that subspace modulo a lattice, but there's not enough of restriction on the structure of the subspace and lattice that that should stay in the subspace.

In particular

$\mathbb Z[\alpha]/(\alpha^n-1)$ is identified with $\mathbb Z^n$ by considering the representative with degree less than $n$, and taking $b_0+b_1\alpha+\cdots+b_{n-1}\alpha^{n-1}\mapsto(b_0,b_1,\cdots,b_{n-1})$.

We are looking at a restricted collection of lattices $\mathcal{L}(B)\cap H_\Phi$ where $\mathcal L(B)$ is a cyclic lattice (that is, one that is an ideal in $Z[\alpha]/(\alpha^n-1)$, or equivalently that is closed under ${\rm rot}:(c_1,c_2,\cdots,c_n)\mapsto(c_n,c_1,\cdots,c_{n-1})$), and we define the subspace $H_\Phi$ of $\mathbb{R}^n$ to be $\mathbb{R}[\alpha]\Phi(\alpha)/(\alpha^n-1)$ the multiples of some $\Phi(\alpha)=(\alpha^n-1)/(\Phi_k(\alpha))$ where $\Phi_k(\alpha)$ is a cyclotomic polynomial.

Then, we take $y\in\mathcal L(B)\cap H$, and let $y'=y \mod B$, the vector in $B[0,1)^n$ with $y-y'\in\mathcal L(B)$, and it is claimed that $y'\in H_\Phi$.  As I understand things, however, this isn't true; take, for example, the following (general) counterexample:

Let $k=n$ for prime $n$.  Then we have $\Phi(\alpha)=\alpha-1$, and
\begin{align*}
  H_\Phi
    &=\left\{(b_0+\cdots+b_{n-1}\alpha^{n-1})(\alpha-1)\right\}\\
    &=\left\{(b_{n-1}-b_0)+(b_0-b_1)\alpha+\cdots+(b_{n-1}-b_n)\alpha^{n-1}\right\}\\
    &=\left\{(c_0,\cdots,c_{n-2},-(c_0+\cdots+c_{n-2}))\right\}.
\end{align*}
Then let $B$ be the standard basis for $\mathbb Z^n$, and take $y=(1/(n-1),\cdots,1/(n-1),-1)$, so that $y'=(0,\cdots,0,-1)$.  But clearly $y$ is in $H_\Phi$, but $y'$ is not.

I'm not really sure what's going on here, because it is claimed that $y'\in H$ more or less by construction, making me think I'm confused somewhere along the way with the notation, but I can't seem to find it.

I'm fairly certain that what I have written above is correct, as well as that that it is claimed in the paper I linked above (in the proof of claim 5.3) that $y'\in H_\Phi$. Can someone point me to where I'm going wrong?


texts: online Vickrey auction using remote coin flip

texts:
Is there any published work on implementing a online auction, which uses "remote coin flip" to prevent auctioneer cheating when choosing winner and bid value?
Is there any possible way to use remote coin flip for a such scenario?

Note: in a Vickrey auction, bidders submit written bids without knowing the bid of the other people in the auction; the highest bidder wins but the price paid is the second-highest bid.


texts: Are there any applications of Lie algebras or Lie groups in cryptography?

texts:
I am interested in the applications of algebra in general to cryptography. In particular, I am wondering if there are applications of Lie algebras and Lie groups to cryptography.

Are Lie algebras or groups used in cryptography?
How could Lie algebras or groups be used in a cryptographic algorithm?
Are there any, for example, cryptographic algorithms which use Lie algebras?


texts:
I've come to use AES/SIC for my purpose as I want to write an encrypted file and read it back with the possibility to seek (I only need to read parts of it and don't want to decrypt the whole file just to read a single part of it).

SIC (using Bouncy Castle) looked promising. I've implemented a stream which is seekable but ended up with a weird issue. I wrote a few values and suddenly at a specific point data become a mess. I investigated into BC and how SIC was implemented. My conclusion: Each time I call Write on the stream, the block number is used and transformed as nonce and internally the counter is increased. In my case I wrote Major and Minor of my version number in single calls, but read it in one go. The one part was okay, the other was a random number.

I now struggle with this, because I need to write the file differently than I would read it. Like writing in intermediate streams to create header files with relative positions in order to seek to the right position later. But since I am writing the header part and the whole body in one go, but read them sequentially field by field, it would not work.

My idea was to introduce a method, which calculates the counter by the current block number. Thus I could write multiple times with the same outcome until the block size has exceeded.

TL;DR: I'm no expert on cryptography, so here's what I want to know: Is it safe to calculate the counter based on the block number in the stream rather than increasing it every write? After all it's more predictable.

Alternatively what would be a good way to go? Is there any encryption algorithm / cipher mode which allows me to write and read in unequal amounts and is still seekable?


texts: questions about modular reduction algorithm over $F_{2^m}$

texts:
So I'm trying to understand algorithm 2.40 (arbitrary reduction polynomials) from the Guide to Elliptic Curve Cryptography and have some questions.

The very first sentence of this section says this:

  Recall that $f(z) = z^m +r(z)$, where $r(z)$ is a binary polynomial of degree at most $m − 1$

So let's take sect113r1. $f(x)$ is $x^{113}+x^9+1$. It seems like $z^m$ would be $x^{113}$ and $r(z)$ would be $x^9+1$. Is that a correct assumption?
The algorithm uses $c$ and $C$ and I'm wondering if they're the same thing. Like it says this:

  INPUT: A binary polynomial $c(z)$ of degree at most $2m −2$.

...and it also says this:

  Add $u_k(z)$ to $C\{j\}$.

$C\{j\}$ is defined thusly:

  The following notation is used: if $C = (C[n], . . .,C[2],C[1],C[0])$ is an array, then $C\{j\}$ denotes the truncated array $(C[n], . . .,C[ j +1],C[ j ])$.

The thing is... $C$ is not defined prior to the "Add" line. So it seems to me that either $C$ and $c$ are supposed to be the same thing or $C$ is supposed to be pre-initialized to all 0's?
So for the "Add $u_k(z)$ to $C\{j\}$" step...  I assume that means to add by doing XOR? What if $u_k(z)$ and $C\{j\}$ are of different sizes? Do we pad both of them with 0's on the right or left side?
So let's say $W$ equals 8. That means that the largest value of $u_k(z)$ is going to be $z^7r(z)$, which, assuming my understanding in #1 was correct, would mean that, for sect113r1, that it'd be $x^{16}+x^7$. So we add that (perhaps simply by doing XOR, per question #3) to $C\{j\}$ (which I asked about in question #2). The concern I have is...  let's say $C\{j\}$ is 0. At that point the result would be $x^{16}+x^7$, which is bigger than $W$ and I'd kinda expect it to less than $W$. Otherwise it's not really clear to me what that algorithm is supposed to be returning. Like maybe each element could be a digit in a bigint with a limb size equal to $W$?
In the last step it says "Return$(C[t−1], . . .,C[1],C[0])$". What is $t$ supposed to be? It's not defined or referenced anywhere else. Maybe it's supposed to be the length of C?


texts: How do I convert an ed25519 scalar into x25519 for encryption?

texts:
In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random.
My goal is to use the crypto_box_easy / crypto_box_open_easy routines where Alice and Bob each have their own Scalars / Points already previously generated with crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp, respectively.
I did not want to use crypto_box_keypair because I want to re-use the existing keys which Alice and Bob already have.
I've tried to use the crypto_sign_ed25519_sk_to_curve25519 / crypto_sign_ed25519_pk_to_curve25519 routines to convert the Ed25519 scalar/points to x25519. However decryption fails, so this does not seem to be the correct approach.
This routine only seems to work when the keypairs were generated with crypto_sign_ed25519_keypair, and not crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp.
So the question is, what is the right way to derive a key-pair for encryption if I only have a key-pair for signing which was generated with crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp?


texts:
I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message.

Given that an attacker then knows the values of $m$, $c$, $e$ and $n$ in the following equation, is there any extensions which allows them to recover $d$?

$c = m^e \mod n$


texts: How can I generate key scheduling for AES 256 bit key

texts:
I want to implement AES algorithm,instead of 128 bit key encryption I wanted to do it for 256.But I’m stuck at point creating scheduling for 256 key generation.
Can anyone help in this.


texts: Question on Simplest Oblivious Transfer Protocol

texts:
In the paper The Simplest Protocol for Oblivious Transfer, in the scenario where the receiver chooses $c=1$, then $B$ is calculated as $Ag^b$.

Then $k_1$ is calculated as $H( (B/A)^a)$.

That means that the receiver can calculate the same encryption key, and decrypt message $M_1$ (because it's encrypted with $k_1$.

Does this imply that $H( (B/A)^a ) = H( Ag^b)$ ?

I don't understand how it works in this scenario (receiver choosing $c=1$)


texts: What constructions for data authentication are subject to the birthday paradox?

texts: $H(m\mathbin\Vert k)$ as an authentication algorithm, where $H: \{0, 1\}^* \rightarrow \{0, 1\}^{n}$, has at most a strength equivalent to $\frac{n}{2}$ bits. $H((k^\prime \oplus \mathrm{opad})\mathbin\Vert H((k^\prime \oplus \mathrm{ipad})\mathbin\Vert m))$, the definition of HMAC, has an upper strength of $n$. The security of block cipher modes and block ciphers providing authentication is less clear to me. What parts of a MAC algorithm construction determine if it has a strength of $n$ bits as opposed to half that number?


texts:
Question: Is there any cryptanalytic leverage to be had from the fact
that some of the 56 "raw" keybits of DES are used more & less often than others?

Observation: over the course of the 16 rounds of DES each of the eight
DES S-boxes is used 16 times, so there are a total of 128 S-box "instantiations" or "instances".  Each S-box instance requires six bits
of the expanded and permuted 56 bit raw key, so 768 keybits are used in total.

Analysis: of the 56 "raw" keybits, 12 are used in 15 different instances;
20 are used in 14 different instances; 20 are used in 13 different instances; and four are used in only 12 different S-box instances.

Hence my question.  Is there any advantage for the cryptanalyst in knowing
that four of the raw keybits are only used 12 times, or that 12 are used 15 times?


texts: How can I show the new crypto scheme is still IND-CCA1 in proof of “IND-CCA1 does not imply NM-CPA”?

texts:
I am trying to show IND-CCA1 does not imply NM-CPA. From what I have read the "classical" proof goes by taking an IND-CCA1 scheme $E$ and modifying it so that the encryption of the inverted plaintext is appended to its ciphertext: $$E': m \mapsto (E(m), E(\bar{m}))$$
It is clear $E'$ is not NM-CPA since just swapping the two ciphertext parts leads to a non-trivial relation between the two plaintexts (i.e., inverting it).
But how do we show $E'$ remains IND-CCA1?
My work so far:
Assume $E'$ is not IND-CCA1 and can be broken by a PPT $\mathcal{B}$. Let us then construct a PPT $\mathcal{A}$ which breaks $E$.
$\mathcal{B}$'s decryption oracle for $E'$ can be simulated by $\mathcal{A}$ by using its own decryption oracle for $E$: it receives $(c_1, c_2)$ as query and decrypts $c_1$ while ignoring the redundant part $c_2$.
$\mathcal{B}$ chooses two plaintexts $m_1$ and $m_2$, which $\mathcal{A}$ forwards to its challenger. $\mathcal{A}$ receives $E(m_i)$ as challenge. This is where I am stuck.
It suggests itself to append, e.g., $E(\bar{m_1})$ to the challenge and forward it to $\mathcal{B}$, but it does not seem to work. If $i = 1$ everything is good, but as far as I can tell $\mathcal{B}$'s behavior is undefined if it receives $(E(m_2), E(\bar{m_1}))$ at this point.
What am I missing?


texts: Calculating power consumption by a cipher program

texts: When a block cipher program is run it consumes some power, how that can be calculated using software aspects? Is there any way to prove a cipher a lightweight cipher without using hardware parts?


texts: Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more secure than the others.


texts: Why are elliptic curves better than cyclic groups?

texts:
The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$.
What is the advantage of representing or conceiving the group as an Elliptic Curve instead of as a product of cyclic groups?


texts: Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

texts:
Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)? Why go through the trouble to create BLAKE?

What's wrong with using the core ChaCha primitive unaltered in a Merkle–Damgård like construction to construct a collision-resistant compression function/one-way compression function/Cryptographic hash function.

Is there a practical consideration, or is this just number theoretic?

Edit: The following reduces this question without changing it, and summarizes the answer.

Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)?

The chacha paper, linked in Lery's answer below, seems to specifically state that compression functions could, indeed, be built on the chacha core primitive. It's on the second to the last page.

  "[...] Modifying constants first is helpful for compression functions built on the [chacha] core."

At this point, it becomes safe to say the first question reduces to an argument about what the words "built on" and "good for use in" means. It's not productive to argue semantics, so discussing it further is moot.

Thus, the whole question reduces down to "Why go through the trouble to create BLAKE?" Lary's answer explains this best, so it was chosen. But I'd like to distill out some parts.

Why make BLAKE? What's wrong with core chacha + Merkle–Damgård?

Pure Merkle–Damgård has flaws. BLAKE uses the HAIFA construction, which fixes  these flaws by adding a salt and a hash count as extra variables/inputs. What's more important (and quite provocative IMHO) is that HAIFA, in fact, shares the same security requirements and proofs from its core primitive as for Merkle–Damgård.

From the HAIFA paper... (Technical Report  CS-2007-15 - 2007)

  The same arguments that are used to prove that the Merkle–Damgård construction retains the collision resistance of the underlying compression function, can be used to prove that HAIFA does so as well.

TL;DR: HAIFA basically just 1ups Merkle–Damgård. (Though, does so in a very important way!)

So then, in a practical sense, BLAKE (original) actually is or at least contains a collision-resistant compression function "built on" the chacha core primitive, in a Merkle–Damgård like construction.

In other words, my first question is flawed.

BLAKE doesn't change the core function of chacha in a qualitative way at all, rather it changes how and what data is input to it. (See SEJPM's answer for a reasoning as to why.)

The only modification to the function of the core was apparently a mistake. BLAKE creators fat-fingered the rotations. This, as explained, is not strictly a requirement. Pure chacha core would work just as well.


texts: Understanding the "cube-root math" behind an RSA signature forgery

texts:
I'm trying to understand the math outlined in this paper on a RSA signature forgery attack. I understand it except for one aspect of how the cube root (that makes the forged signature) is computed.

On page 8, it's shown that this expression (the forged block that needs to be cube-rooted):
$\sqrt[3]{2^{3057} - N*2^{2072} + G}$

is supposed to be equivalent this one after its simplified:
$2^{1019} - (N * 2^{34}/3)$

It's not clear to me how the $2^{34}$ was determined in the second expression. It looks like everything's being divided by 3, but since the exponent $2072$ doesn't divide perfectly by 3, something was done to it. Can anyone explain?


texts: X509 converted to Encrypted and Signing keys

texts:
We have proprietary tool which takes a p12 file and generates a .key file. Inside the key file, I see two PEM formatted sections: Encrypting Certificate and Signing Certificate. When I open them on my machine they have the same CN, Expiration and Issuer, etc.
This key file is used for mutual 2-way authentication and we provide the key file to the client.

What is happening here? I understand the regular mutual authentication where you and client exchange public keys and trust them but why do you need to implement this method?


texts: CSPRNG that cannot be used as random extractor

texts:
Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG?

In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any CSPRNG, and be done with it?

I've got the strong feeling that the properties of a CSPRNG are largely overlapping that of randomness extraction, but Wikipedia claims that the properties of a (generic) PRNG may not necessarily overlap.

  However, the general PRG definition does not specify that a weakly random source must be used, and while in the case of an extractor, the output should be statistically close to uniform, in a PRG it is only required to be computationally indistinguishable from uniform, a somewhat weaker concept.

I presume that any hash based extractor should work, as it hashes the input. Hashing the entropy is - as far as I understood - considered a good method of extracting the randomness out of the entropy.

The only property that I can come up with that should be required from a CSPRNG is that it has to mix in all the data containing the entropy.

Notes regarding NIST SP 800-90B:

It is not necessary here to let the TRNG be a full entropy source as defined in that document; CSPRNG's are normally used to generate more output than the amount of entropy provided;
Chapter 6.4 contains requirements for the randomness extractor;


texts: Are XOFs and KDFs more usable than DRBGs?

texts:
CSPRNGs have 2 design requirements:

output unpredictability,
back-tracing resistance.

In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization, b) operation administration (reseeding counter, etc.).

Of the three functions listed on Wikipedia page for CSPRNG, key and salt generation can be accomplished with any KDF (even ones based on plain hash functions), and nonce can be accomplished with a simple counter.

And with the introduction of dedicated-purpose XOFs in the SHA3 standard, the problem of producing arbitrary-length string from a finite-length one becomes solved along the way.

Both XOFs and KDFs are much easier to implement and use practically, so what's the point of designing DRBGs in the "NIST-SP-800-90A" way?


texts:
I'm currently writing a report for my Master's degree on the SSH protocol. Quite interesting!
However I'm having trouble getting into the inner workings of the host key algorithms.
For example, according to RFC4253, "ssh-rsa" is a key format where the server generates an RSA keypair. So far, so good. However, I don't seem to understand where SHA-1 comes into the play.
RFC8332 says

"SSH originally defined the public key algorithms "ssh-rsa" for server and client authentication using RSA with SHA-1".

My understanding is that the server computes a hash of the public key using SHA-1 and when appropriate, sends both the public key part and its SHA-1 computed hash with to the client.
Am I correct?
This isn't in any way related to the fingerprint shown when we connect to an SSH server for the first time, is it? If not, how can I calculate it (without ssh-keygen)?
Many thanks!


texts: Can I overcome ElGamal malleability with AES preprocessing?

texts:
So textbook ElGamal is known to be vulnerable to CPA, and although there are several proposals (DHAES/EIES) for modifications none of those are formally accepted or standardized.

My question is whether if I simply "preprocess" the plaintext with the good-old hybrid asymmetric method won't that solve the chiphertext modification problem? (yes I know a DoS-like error is still present if the AES key is altered midway)


texts: Is there something similar to a Bloom filter that allows you to test arbitrary predicates on the set?

texts: As I understand it, if you have a Bloom filter that was generated from the members of a specific set, you can test whether a given bit string is in the set (with some given false positive rate). The idea I had would be to run more complicated predicates on the set, like being able to query whether "there exists a member of the set which is less than target t" using a similar kind of filter. Does such a thing exist and allow you to make these queries without having to have the entire set on hand? How do they work if they exist?


texts: What is the exact meaning of the public key cryptosystem properties in New Directions In Cryptography by Diffie and Hellman

texts:
I'm quite new to cryptography and don't have much mathematical knowledge. I'm studying cryptography, especially public key algorithms. I have some basic knowledge of public key algorithms so I know how the RSA algorithm works. But I found lots of things I don't understand while reading New Directions In Cryptography by Diffie and Hellman.
In section III. PUBLIC KEY CRYPTOGRAPHY in the paper, they defined four properties of a public key cryptosystem which are as follows.

A public key cryptosystem is a pair of families {EK}K∈{K} and {DK}K∈{K} algorithms representing invertible transformations,
EK:{M} → {M}
DK:{M} → {M}
on a finite message space {M}, such that

for every K ∈ {K}, EK is the inverse of DK,
for every K ∈ {K} and M ∈ {M}, the algorithms EK and DK are easy to compute,
for almost every K ∈ {K}, each easily computed algorithm equivalent to DK is computationally infeasible to derive from EK,
for every K ∈ {K}, it is feasible to compute inverse pairs EK and DK from K.

What I understood is as follows.

EK is a public key and DK is a private key,
therefore EK is the inverse of DK.

EK and DK are easy to compute, so they can be computed in polynomial time.

DK should be computationally infeasible to derive from EK, such that it is not possible to derive DK(a private key) from EK(a public key) in polynomial time.

It is easy to compute pairs of a public key and a private key from K.

Here is what I don't understand.

What is the K? From what I understand, the K is like p and q in RSA? Because we choose prime numbers p and q first, and then we choose a public key e and derive a corresponding private key d from e using (p-1)(q-1) with the euclidean algorithm.

Why is that in property 3, for 'almost' every K, it is computationally infeasible to derive DK from EK? What is the exact meaning of for 'almost' every K? There could be an exception where it is feasible to derive DK from EK?


texts:
I can't seem to find a simple explanation of Mutual Index of Coincidence.

I am finding explanations of Mutual Index of Coincidence not Index of Coincidence.
I don't understand what the formula below means

$$\textit{MI}_c(\mathbf x, \mathbf y) = \frac{\sum_{i=0}^{25} f_i\times f'_i}{n\times m}$$

I want to write code to compute it.


texts: Multiple passwords per key with any allowing decryption

texts:
How to get secret key based on multiple passwords?
e.d we have cipher encrypted by combination of passwords "qwe" and "asd", and our purpose to decode the cipher using any of passwords above separately?

Thanks


texts: Is there a group where CDH is easy but DLog is hard?

texts:
The question is quite simple:

Is there a group where solving the CDH problem can be shown to be easy but solving the discrete logarithm problem is assumed to be hard?

Refresher on the problems:

CDH: Let $\mathbb G=(G,+,0,p)$ be a public cyclic group of order $p$. Given any $g\in G$ and $g^a,g^b$ with $a,b\stackrel{\$}{\gets}\{0,\ldots,p-1\}$, that is with uniformly random exponents, find $g^{ab}$.
DLog: Let $\mathbb G=(G,+,0,p)$ be a public cyclic group of order $p$. Given any $g\in G$ and $g^a$ with $a\stackrel{\$}{\gets}\{0,\ldots,p-1\}$, that is with a uniformly random exponent, find $a$.


texts: Pairing - Is it possible to map two $r$-torsion points to a $r^2$-torsion point?

texts:
Let $E(\mathbb F_{q^k})$ be an elliptic curve on finite field $\mathbb F_{q^k}$, where $\mathbb F_{q^k}$ is an extension of $\mathbb F_q$ with $k>1$. Let $e: G_1 \times G_2 \rightarrow G_t$ be a bilinear pairing, and $G_1$, $G_2$ are some subgroup of $E(\mathbb F_{q^k})$ of order $r$, where $r| \# E(\mathbb F_q)$ and $r^2 | \# E(\mathbb F_{q^k})$, and $G_t$ is subgroup of order of $\mathbb F^*_{q^k}$.

Is it possible to modify (Weil or Tate) pairing such that the order of $G_t$ be $r^2$? In other word, is it possible to map (with keeping bilinearity property) two $r$-torsion points to a $r^2$-root of unity?


texts: Reliability of a single-pass deniable authentication protocol?

texts:
I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution:

*Wei-Bin Lee, Chia Chun Wu, and Woei-Jiunn Tsaur. "A novel deniable authentication protocol using generalized ElGamal signature scheme." Inf. Sci.-177(6):1376-1381 (2007)*

Unfortunately later I found a forum archive where member claimed to have discovered an attack on this protocol:

http://bbs.pediy.com/showthread.php?t=91904

But in another modern works authors mention this protocol as a reliable: eprint.iacr.org/2013/783

I am not a specialist in mathematics and I can not assess the credibility of proofs.
I put the found materials for download:
http://torfone.org/download/Q-A.doc   (and nida.pdf for protocol description)

This protocol is still secure? Will it work correctly on the EC25519?


texts: Explaining modulo reduction of curve25519, multiply hi bits with 38 trick?

texts:
I have learnt that there is a trick where you can speed up the reduction modulo of a point (x-value) in a x25519 curve. Since, it uses the prime number $2^{255} - 19$.

From article:

  Reduction modulo exploits the fact that $2^{255} - 19$. $2^{256} \equiv 38$, so $38*r4$ is added $r0$ and $38*r5$ is added $r1$ and so on.

$r_n$ are registers with size 64 bits.

The problem I have. I don't really understand why this is the case? I wonder if anyone can expand on this?


texts:
Let $\mathbb{G}$ be a cyclic group of order $p$ with generator $g$, and let $m\in\mathbb{G}$.
Problem: Given $c=m.g^{k.a}$ and $v=g^a$, where $k,a \in \mathbb{Z}^*_p$, output $k$.
Is this an instance of a Diffie-Hellman problem? Because the only way I see to solve this is to try $v^i, i\in \mathbb{Z}^*_p$ until we stumble on $i=k$, but since $g^{k.a}$ is also hidden by $m$, I do not think searching for $i$ is a viable method.


texts: Why is ElGamal considered non-deterministic?

texts:
One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is).

What makes it non-deterministic? Is this advantageous to security? How else does this property affect ElGamal encryption or the ElGamal signature scheme?


texts:
In FFX mode the format of the ciphertext is same as plaintext. How does it ensure data integrity and authentication? Is there any bit flip attack in FFX mode?
Is it malleable?


texts:
Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2?

My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) and also a random IV (16 bytes) to use with AES-CBC. This adds 32 bytes to the final message, which can be a lot for short messages (plus another 32 bytes of HMAC and a couple of bytes of "header").

My thinking is that I can generate all three values (IV and two keys, 640 bits) from the salt and password:

Generate a 16-byte salt
Use PBKDF2 (for some number of iterations) to stretch salt+password into 512-bit pseudo-random key (PRK).
Use HKDF-Expand on PRK to generate IV, enc_key, and hmac_key.

The full specification is available at RNCryptor-Spec v4.

I believe that generating the IV this way is secure, and possibly marginally more secure than generating and sending a random IV, since the attacker cannot manipulate the IV if it is computed from the PRK. The inclusion of a 16-byte per-message random salt means that key/IV combinations should not repeat any more often than for a randomly-selected IV.

OpenSSL's enc format uses a somewhat similar approach, but I have never seen a cryptanalysis of it. TLS 1.0 computed the IV in a non-random way which could be manipulated by the attacker, which led to vulnerabilities (however, my approach includes a random seed, and I believe is not vulnerable to that, even if an implementation fails to verify the HMAC).

This approach is space efficient and seems possibly more secure than an independent random IV. However, I can't find any reference that explicitly approves it (other than Thomas Pornin's answer linked above, which at this point is good enough for me).

Are there problems with using a KDF to generate the IV with a random salt? Is there any document that explicitly evaluates it?


texts: How can I formally verify fuzzy commitment scheme based security protocol?

texts:
I am currently working on designing a security protocol which involves usage of fuzzy commitment schemes, for. eg Reed-Solomon codes which allows us to tolerate a certain level of error.

I was wondering how one would go about formally verifying a security protocol which would use a scheme such as Reed-Solomon codes.

I searched online, and found out about tools out there such as AVISPA. ProVerify and even Casper/FDR which would help me test security protocols, however they do not seem to work with fuzzy commitment schemes.


texts: How do we add the integer  points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?


texts: Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

texts:
Let  $(Gen,S,V)$  be  a  secure  signature  scheme  (existentially  unforgeable  under  a  chosen  message  attack)  with  message  space${\{0,1\}}^n$.   Generate  two  signing/verification  key  pairs $(pk_0,sk_0)\gets Gen$ and $(pk_1,sk_1)\gets Gen$.  Is the following a secure signature scheme? Show an attack or explain why the scheme is secure, that is, explain why an attack on the scheme leads to an attack on $(Gen,S,V)$.
The new scheme is :
$$ S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$$
\begin{align}&V_2((pk_0,pk_1), m,(\sigma_0,\sigma_1))= \text{'accept'}\\\iff&V(pk_0,m,\sigma_0) = \text{'accept'}\quad  \text{or}\quad V(pk_1,m,\sigma_1) = \text{'accept'}
\end{align}
I do not know how to give a formal proof (probably proof by reduction) that the scheme is secure. (Maybe by showing if there is an attacker for scheme $S_2$ we can use it to attack $S$ and calculating new attacker advantage and showing that it's not negligible.)


texts: Use of orthogonal vectors in lattice-based cryptography

texts: In lattice-based cryptography, given the basis of the lattice we compute the orthogonal vectors using Gram-Schmidt Orthogonalization process. What is the use of orthogonal vectors in lattices?


texts: How should one handle the identity value and other "obviously" weak secret random values?

texts:
In RSA, ECDSA, ElGamal and quite a few other schemes, using a secret (random) value equal to 1 might not provide any form of security, while still being mathematically sound.

For RSA, ECDSA or ElGamal, the secret random value might typically be the secret exponent, for example. Or for ElGamal and ECDSA, it might be the ephemeral secret we need to encrypt or sign (the infamous $k$ for ECDSA).

Arguably this holds for secret values smaller than 80 bits, as it might otherwise well be attacked using a brute force search attack.

The same might hold for secret values whose secrecy is crucial to the security of the scheme at hand, such as the ephemeral $k$ used in ECDSA signatures, although specific scheme might have specific guidelines depending on their specific requirements.

In order to avoid such obvious problems, are there any kind of (official or standard) recommendations regarding the rejection of "bad" random values based on certain criteria?

Or more broadly, in the same way that we have recommendations for the group size or the way to generate large primes (see keylength.com), do we have some kind of guidelines for the generation of the "secret random values" we have in cryptographic software. (For instance, I do not see any kind of "sanity checks" being performed on the $k$ values generated for ECDSA as per FIPS 186-4, even though it is crucial for $k$ values to be unbiased. The only "standard" that I'm aware of that specify how the secret random value should be generated, and it only covers the specific case of the generation $k$, is the RFC6979 and is using derandomization, like the standard for EdDSA (RFC8032). But this is not always possible for secret values.)

Is this documented in some other NIST document, or in some RFC?

PS: notice this question is assuming randomness is difficult for implementation, and that as such it might be best to have "fail-safes" in place in a way to have defense in depth.


texts: How to use OpenSSL in windows for encryption and decryption ?


texts: Signal/TextSecure multiparty Chat. Does the protocol transmits a symmetric key?

texts:
As I look over the TexSecures specifications for multi-party chat I have noticed this. Also as far as I understood in TextSecure (now known as Signal) the minimal steps required to do a secure multiparty chat using

Generate ephemeral symmetric key K
Encrypt the message.
Hash the message's plaintext and encrypt the hashes with the key K.
Send cyphertext,hashes and the key K.

Also by improving it, if client generated an ephemeral signing key as well it can rachet the key and send few messages as well. But whilst I read that and have looked the schema a few questions have been rised to me:

Is assumed the communication channel to be previously secured when the key K is being sent. I mean transmitting private keys is like you are asking for your security to be compromised.
What if the ephemeral key K actually has been compromised?

Can you help me to answer these questions?


texts: Can I change an encryption key used without decrypting first

texts:
I'm looking to solve for a little challenge I have in regards to changing the encryption on a message with asymmetric keys. I'd love to be able to swap the encryption to a different key in memory and without going via the plain text.

So clear text -> encrypted text with first key -> double encrypted text -> encrypted text with second key

I have a vague recollection that it can be done but the Googles are not being forthcoming. I'm far from an expert on this and my preferred implementation would be done in C#.

Thanks in advance.


texts: How we transfer 128bits cipher to a 4x4 matrix for AES input?

texts: Why the input cipher for AES encryption, can write in 4x4 matrix with 8 bits entires, and can said is 128bits? if each cell is 8bits in binary, how we said this matrix is represent 128bits?


texts: Changing the public key in an MD5 certificate

texts: Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being identical, not invalidate the existing digital signature when substituted into the certificate?


texts: Any case that can require to encrypt a certificate revocation list before distribution

texts:
As far as we know certificate revocation lists (CRLs) include public information so they do not have to be encrypted before distribution.

Is there a case that can require to encrypt it before distribution? A case in which eavesdroppers can capture some information from the CRL and use it to perform an attack?


texts: Some questions on building permutations from boolean functions

texts:
I've seen multiple examples of boolean functions being used as a permutation.
For example the Keccak Chi : 2.3.1 function:

from https://keccak.team/figures.html
Or as a formula: for $i=\{0..4\}$ $A_i=a_i \oplus (\neg a_{i+1} \wedge a_{i+2})$ with indexes calculated modulo 5
The first question would be, what is the rationale (or proof) why this is a permutation?
The second, related one: What are the properties, the boolean function has to satisfy that it results in a permutation?

And now regarding the inverse of such a permutation.
Are there any generic methods/algorithms to find the inverse of such a construction?
Also, what are the major contributing factors for the complexity of the inverse (number of variables, algebraic degree etc.)?
And if such a method is applied to a larger input - say $i=\{0..127\}$, is the inverse more difficult to calculate, if the function has only a few (like the 3 for Chi) or many, say 128, input variables?
Any answers/pointers are appreciated.


texts: Breaking ElGammal encryption of two different mesagges

texts:
I'm stuck with the following problem on ElGammal encryption.

  We work on $\mathbb{Z}_{p}^*$ where $p$ is prime and we are given $p$,
  the generator $g$ of $\mathbb{Z}_{p}^*$ , the public key used $y$ and
  five encryptions $(u_1,v_1), \cdots, (u_5,v_5)$ where each of them is
  a encryption of a message $m$ that can be $1$ or $-1$.

Please refer to the second scheme of this question if you need more details on the ElGammal cryptosystem I'm using.

As a hint I'm told to look for a subgroup of index two. I tried to solve the discrete logarithm problem in that subgroup with sage but as this post discusses the complexity is only reduced by a constant so that it is still intractable.

I give you the code I was using in case you have some comments.

F = Integers(p)
gmod = F(g)
q = p // 2
F2 = Integers(q)
gmod2 = F2(g)
ymod2 = F2(y)
gmod2 = F2(g)
ymod2 = F2(y)

Can you figure out how this could be solved?

Edit:

In my case $\frac{p-1}{2}$ is already prime.


texts: If hash functions append the length, why does length extension attack work?

texts:
I have understood that it's trivial to reconstruct the internal state of a hasher for many hash functions, if one only knows the output hash. Then, one can append data after the original data and obtain a valid hash for the original data plus the appended data.

However, recently I became aware that hash functions including MD5, SHA1, etc. actually append the length.

If hash functions append the length, why doesn't that stop the length extension attacks? For a good hash function, if the attacker knows hash(message || length), there should be no way to obtain hash(message) to be able to calculate hash(message || appended_data) which would allow calculating hash(message || appended_data || total_length).

Related: Understanding the length extension attack ...although the related question doesn't discuss appending of the length which MD5, SHA1, etc. do.


texts:
I'd like to know, is Learning With Error (LWE) (with modular noise) "secure" if one entry has no noise?

More precisely, I have:

a random matrix $A \in \mathbb{Z}_q^{m \times n}$
a random string $s \in \mathbb{Z_q}^{n\times 1}$
and a "small" noise vector $e \in \mathbb{Z}_q^{m\times1}$, such that the first component of $e$ is $0$, i.e. $e_{1,1} = 0$.

Then, can I distinguish between $(A, As+e)$ and $(A, b)$, with $b \in \mathbb{Z}_q^{m}$ chosen uniformly at random?


texts: How does recovering the public key from an ECDSA signature work?

texts:
It is possible to recover the public key from an ECDSA signature values $(r,s)$?

Please explain how this works.


texts: Determine RSA modulus from encryption oracle

texts:
Suppose we have an RSA encryption oracle $E(m)$ which basically just calculates $m^e \mod n$ for a given message $m$. Here $e=65537$ is known but $n$ is not. Can we determine the value of $n$ without trying all values below $n$, assuming $2^{1023}\leq n <2^{1024}$?

I thought of using $E(-1)$ but sadly only positive messages are allowed. Another idea that i had was to just use $E(2)$ and if $e$ was small it would wrap the modulus only a few times and we would be able to determine $n$. Sadly $2^{65537}$ is many times bigger than $n$ so it doesn't work either.


texts: How many collisions (identical pairs) are possible in meet in the middle attack on double DES with two unique keys?

texts:
I was reading my professors slides, I understand how meet in the middle works, but I have a few confusions. So we need two $\{(P_1, C_1), (P_2, C_2)\}$. Let $\lg{(k_1)} = \lg{(k_2)} = 56$, we generate $2^{56}$ of the $X = \{x_i = E_{k_{1,i}}(P_1)\}$ and $2^{56}$ of the $Y = \{y_i = D_{k_{2,i}}(C_1)\}$. So far it took us $2^{56}+ 2^{56}= 2^{57}$ steps to compute $X, Y$.
My understanding is that this is why we say that double DES only increases security by one bit?
Now our job is to find all $x_i,y_j$ such that $x_i = y_j$. I suppose we can use $2^{56}$ binary searches so we could do this in $2^{56}\lg{2^{56}}= 2^{56} \times 56$ steps?
Total steps are now:
\begin{align*}
2^{57}+(2^{56} \times 56) &= 2^{57}+(2^{56} \times (2^5+24)) \\
&=  2^{57}+(2^{56+5} + (2^{56}\times24)) \\
&=  2^{57}+2^{61} + (2^{56}\times24) \\
&=  2^{61}+2^{57} + (2^{56}\times24) \\
\end{align*}
Now we worry about how many candidate paires do we have to check on the second plaintext ciphertext pair $(P_2, C_2)$. This depends on how many collisions we saw from the previous step.  On average the probability is that $x_i = y_j$ is $1/2^{56}$ right? Here is one of the confusions, the slides I am reading say that it is $1/2^{64}$. Since I can't see why, for now I'll proceed with $1/2^{56}$. So the average number of collisions thus must be,
$$
\frac{2^{112}}{2^{56}} = 2^{56}
$$
So now we have to check the $2^{56}$ candidate pairs on $(P_2, C_2)$ meaning the average number of steps are now:
$$
2^{61}+2^{57} + (2^{56}\times24) + 2^{56}
$$
But the slides do this analysis like this, they say there are $2^{64}$ many $x_i$ thus the candidate checks are $2^{112-64} = 2^{48}$. This is followed by this slide which is entirely lost on me:

Could someone offer some clarification?
EDIT: I think I see my oversight, the $|X| = |Y| = 2^{56}$ are subsets of the exhaustive $|X'| = |Y'| = 2^{64}$ sets because $\lg{(x_i)} = \lg{(y_i)} = 64$. Hence $X, Y$ were sampled using encryption decryption. Therefore, when we calculate the collision probablity, we use the cardinalities of the $X', Y'$ yielding $1/2^{64}$.
Is this right?


texts: A mathematical explanation of the DES encryption system

texts:
I need a mathematical explanation of what does the DES encryption system really do.

This means I need more explanation than the one that offers FIPS, which is more an explanation for computer specialists.

Among other things, I want to know where do these permutation tables come from:
$$IP\\
\newcommand\T{\Rule{0pt}{1em}{.3em}}
\begin{array}{|c|c|c|c|c|c|c|c|}
\hline
  58 \T & 50 \T & 42 \T & 34 \T & 26 \T & 18 \T & 10 \T &  2 \\\hline
  60 \T & 52 \T & 44 \T & 36 \T & 28 \T & 20 \T & 12 \T &  4 \\\hline
  62 \T & 54 \T & 46 \T & 38 \T & 30 \T & 22 \T & 14 \T &  6 \\\hline
  64 \T & 56 \T & 48 \T & 40 \T & 32 \T & 24 \T & 16 \T &  8 \\\hline
  57 \T & 49 \T & 41 \T & 33 \T & 25 \T & 17 \T &  9 \T &  1 \\\hline
  59 \T & 51 \T & 43 \T & 35 \T & 27 \T & 19 \T & 11 \T &  3 \\\hline
  61 \T & 53 \T & 45 \T & 37 \T & 29 \T & 21 \T & 13 \T &  5 \\\hline
  63 \T & 55 \T & 47 \T & 39 \T & 31 \T & 23 \T & 15 \T &  7 \\\hline
\end{array}
$$

I know this kind of encryption systems have a lot to do with the mathematical concept of a field.

So I would like to know if someones has a PDF or any other real mathematical explanation of the DES encryption system.


texts: Why are access tokens so long in general?

texts:
I was looking at this Nano ID page where they generate a 21 characters long ID and it would take 149 billions years to find a collision, so that seems secure enough.
However I found that most APIs use much longer tokens for authentication. For example, Dropbox uses a 64 characters long token (made of complete alphabet and numbers) and OneDrive uses a 1180 characters long token (also made of complete alphabet and numbers).
So I'm wondering why do they use such long tokens? And related questions, what's an ideal size for a token made of random letters and numbers?


texts: Creating an SPN cipher from ChaCha20 or Salsa20's double round function

texts:
Given that ChaCha20's building blocks have been also used to construct a hash function, can the double round function from either ChaCha20 or Salsa20 be used to construct a secure SP-network cipher?

The double round function serves as the permutation function and 512-bit round keys are XORed with the permuted result for each round:

$F: \{0,1\}^{512} \rightarrow \{0,1\}^{512}$ is the double round function.
$G: \{0,1\}^{512} \rightarrow \{0,1\}^{512}$ is the inverse of $F$.
$R(rk, x)=F(x) \oplus rk$ is a single encryption round.
$S(rk, y)=G(y \oplus rk)$ is a single decryption round.


texts: Multiplying two additively shared values

texts:
Alice has $p_a,q_a$ and Bob has $p_b,q_b$, all elements of a ring $R$.
They want to obtain shares of the value $pq$ where $p=p_a+p_b$, $q=q_a+q_b$. How do they do this ? Does revealing their shares of $pq$ leaks their shares of $p,q$? I am supposing that in the ring $R$, it is hard to deduce $p$ and $q$ from $pq$.


texts:
I'm wondering what is the current knowledge regarding the difficulty of solving the Diffie-Hellman problem (DHP).
Obvisously solving the DLP (discrete log) is at least as hard as solving the DH problem.
What about the converse :

In a general setting (cyclic group, no other assumption) ?
With specific groups (multiplicative groups of finite fields, various EC, ...) ?

I found ftp://ftp.inf.ethz.ch/pub/crypto/publications/MauWol00c.pdf discussing the matter but this paper is more than 20 years old so I guess it might be outdated...


texts: Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?

texts: Can hash trees provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?


texts: I have seen in few places (mostly papers) talking about plain cascade and XOR cascade. I know what is cascade cipher is but I am not clear about what these are. Can anyone help to understand using simple words to define what is a XOR cascade? (how XOR is involved in cascade cipher?)


texts: Including the next random One Time Pad as part of the encoded message?

texts:
I've tried to do something very simple here, which is to encrypt a message with a one-time-pad (OTP) and include the next OTP as part of that same encrypted message. i.e. The first message consists of the actual text of the message and then the next OTP added to the end. The length of the OTP should always stay the same, so I did some simple bit manipulation to squeeze more than one character into a byte. So that means that every succesive OTP will be the same length as the original OTP.

My main question: Is the fact that the next OTP is included at a known location in every encoded message a factor that will allow decryption of the messages given a few encrypted messages? Or will it be as secure as a normal OTP?


texts: FIPS 140-2 compliance and RSA encryption

texts:
I remember reading that the RSA algorithm was only permitted for encryption when used to encrypt a symmetric key (essentially leading to hybrid encryption).
However, reading through Annex A: Approved Security Functions for FIPS PUB 140-2 this doesn't seem to be an option.
Did I mis-remember? Are there any approved asymmetric encryption algorithms?


texts: HMAC-SHA256 for hashing of credit card PANs?

texts:
Assume you had no option (really) but to store thousands of credit card PANs in a file.  You do not need to decrypt them ever, but you do need to use it for checking if a given (new) PAN exists in that list.

To protect the PANs, the idea is to HMAC-SHA256 them.  This scheme naturally relies on the HMAC secret remaining secret.  Please assume for this question we can take that as given (HSM).   Also, that the secret is a truly random 64 byte secret.

Is there any kind of attack that could be realistically mounted to crack this?  One can reduce the search space by knowing that credit Card PANs have an obvious pattern - from 15/16 digits,  one can remove the luhn digit, and the first (say) 6 digits (BIN).

An attacker would pick a likely BIN, and then iterate through the 10^9 possible PANs, hashing them against every possible key.

This looks to me like it would take longer than the universe's expected life, even with incredible hardware.  Exhaustive hashes required = 10^9 * 2^512.

Having prior knowledge that a given PAN is definitely on the list,and thus dividing the number of hashes by 10^9, does not make any real difference.

Have I missed anything here, or is this reasoning correct?


texts: Are there any digital signatures valid for multiple pieces of data?

texts:
Are there any digital signature algorithms that can be used to produce signatures valid for multiple pieces of data?

For example: Pick a private key $k_{private}$, which has public key $k_{public}$. Produce one signature $S$ which is valid for $h_1, h_2, \dots , h_N$, which are hashes of messages $m_1, m_2, \dots , m_N$.

Looking for a solution where the signature size is constant, or at least growing slowly as the # of messages increases. There may also be millions of messages, and they would typically be added one at a time.

I think you could do it with merkle signatures. I'm especially interested in solutions using elliptic curves.


texts: A hash function for sets that from a hash of a set and a subset of it doesn't reveal the hash of the remaining elements in the set

texts:
I'm looking for a function to compute a hash of a set.

It needs to satisfy two properties:

If someone published a hash $h(S)$ of a set $S$ and a hash $h(S')$ of some subset $S' \subset S$ of it, I should not be able to compute the hash of $S \setminus S'$ from $h(S)$ and $h(S')$.
From the hashes $h(S_1)$ and $h(S_2)$ of two disjoint sets $S_1$ and $S_2$, I should be able to compute the hash $h(S)$ of their union $S = S_1 \cup S_2$.

Does such a hash function exist?


texts: Algebraic cryptanalysis on public-key schemes

texts:
The book Algebraic Cryptanalysis (Bard, G.V.; Springer, 2009) speaks about transforming a symmetric scheme into a system of polynomial equations and solving these equations to break the scheme.

But is there no way to do the same with asymmetric schemes?
Is it impossible to apply the same techniques to this kind of scheme?


texts: Perfectly secure and indistinguishability property

texts:
I'm studying cryptography for my university course, but some doubts arose from reading a book.
In this book the author says:
"Now we present another equivalent definition of perfect secrecy. This is base on an experiment involving an adversary $\mathcal{A}$ and formalizes $\mathcal{A}$'s inability to distinguish the encryption of one plaintext from the encryption of another." referring to the eavesdropping indistinguishability experiment. Then he concludes saying that an encryption scheme is perfectly secure if $Pr[PrivK^{eav}_{\mathcal{A}, \Pi} = 1] = 1/2$.

In other pages, he says "Any scheme that has indistinguishable encryptions under a chosen-plaintext attack clearly also has indistinguishable encryptions in the presence of an eavesdropper."

My doubt is: if an encryption scheme is indistinguishable from an eavesdropper but it is weak against a chosen plaintext attacks, so how can the scheme be considered still perfectly secure?

Another doubt: "eavesdropping indistinguishability" and "perfectly secure" are both referred to information-theoretically secureness?


texts: Is my AES-128-CTR implementation secure enough to encrypt private keys and mnemonic seed?

texts:
I am building a cryptocurrency wallet online where everything is stored in the browser (No servers).

At this moment I am storing all private keys encrypted using AES-128-CTR I've chosen this method because is the standard for Ethereum keystore file format.

Is this algorithm secure to encrypt any other private key such Bitcoin (which is not hexadecimal)?

Would it be also secure to encrypt 12 words mnemonic or any other string?

Here is my implementation:
https://github.com/elevenyellow/coinfy/blob/master/miscellaneous/experiments/aes-ctr-128.js

Edit:
@SAI Peregrinus says on his response that my implementation is completely insecure which make me think, is the same for myetherwallet.com? Because my code is just a refactor of this:
https://github.com/kvhnuke/etherwallet/blob/44074daeef3f98ca15410158b5a5403ac734a08a/app/scripts/myetherwallet.js#L196

Edit2:
Studiying the geth (Ethereum go) client implementation I don't see any difference except for the parameter kdf.n where their value is 262144
and mine is 1024:

https://github.com/ethereum/go-ethereum/blob/bedf6f40aff0dd14bfab533a37c329ddc9a4bdd5/accounts/keystore/keystore_passphrase.go#L118


texts: Non-interactive Zero-knowledge proof signature validation without public key

texts:
I'm looking for a method for a scenario with following requirements:

At least 3 people (A,B,C,...) are in a Network where they can broadcast messages to everyone but not communicate with a specific person, so that they can't get answers to their broadcasts.

Every member has a public address "Apub, Bpub, .." (max ~100 bytes) which was derived from a private secret "Apriv, Bpriv, .."

A signs a message with Bpub and broadcasts it to the network.
B broadcasts a request (based on his Bpriv/Bpub without revealing these 2 keys) to validate, that the message from A belongs to him

Is C able to validate the request from B, without knowing Bpriv/Bpub and therefore not knowing his identity?

A shouldn't be able to proof, that the message was signed for himself without knowing Bpriv.

Are there existing code examples for this, which are free to use and free from patents?


texts: Using keys as Additional Authentication Data in GCM

texts:
In my opinion, it's not a good idea to use (symmetric/asymmetric) keys as Additional Authentication Data (AAD) in GCM as AAD is only authenticated but not encrypted. The key will be protected from modification but will not be confidential anymore. Is my understanding correct? (But maybe using a public key as AAD would be okay?)
Another side question is that, could the output of GCM, authentication tags, be referred to as digest?


texts:
Consider the following $(2n+1)$ protocol:

$\mathcal{P}$ and $\mathcal{V}$ engage in an interaction where $\mathcal{P}$ consecutively sends a message $a_i$ answered by $\mathcal{V}$ with a random challenge $b_i$ for $i = 1,\dots,n$. Finally $\mathcal{P}$ gives a final answer $z$ and $\mathcal{V}$ outputs either $1$ or $0$ (i.e., accepts or rejects the proof) checking the conversation $(x,\{a_i\}_{i=1}^n,\{b_i\}_{i=1}^n,z)$.

The protocol verifies the following properties:

Completeness: If an honest prover $\mathcal{P}$ knows a valid witness $w$ and follows the protocol, then an honest verifier $\mathcal{V}$ always accepts the conversation.
$k$-Special Soundness: From $k$ valid conversations $\{(x,\{a_i^j\}_{i=1}^n,\{b_i^j\}_{i=1}^n,z^j)\}_{j=1}^k$, and  $\{b_i^j\}_{i=1}^n \neq \{b_i^{j'}\}_{i=1}^n$ for all $j \neq j'$, it is possible to efficiently extract a witness $w$.
Honest-Verifier Zero-Knowledge: There exists a polynomial-time simulator that takes $x$ and random $\{b_i\}_{i=1}^n$ and output a valid conversation $(x,\{a_i\}_{i=1}^n,\{b_i\}_{i=1}^n,z)$ with the same probability distribution as conversations between honest $\mathcal{P}$ and $\mathcal{V}$.

This is a non-standard zero-knowledge protocol which I am trying to apply the Fiat-Shamir Heuristic to turn it into non-interactive. I am struggling  with the soundness property, since is quite different from a typicial protocol.

Is there anything in the literature that generalizes the Fiat-Shamir Heuristic to finite $(2n+1)$ protocols? Maybe that can help to solve this problem.


texts: What salt should be used when generating TLS 1.3 CertificateVerify message?

texts:
When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer?
I explored the source code of libnettle, especially method rsa_pss_sha256_verify_digest and found that salt which is used inside is 32 similar bytes - 0x22. Using this value I was able to generate a valid signature myself. But I found no information about the salt in any documentation. How is it actually generated for TLS 1.3 CertificateVerify message? Is this value fixed or depends on certificate or key...?


texts: Lattice-based cryptosystems for blockchain/ledger?

texts:
Are there lattice-based cryptosystems based i.e., SIS (Short Integer Solutions) and LWE (Learning with Errors) blockchain solutions for a post quantum world?

Has the Unique Shortest Vector Problem (SVP) been solved?


texts:
I have searched and my problem is exactly the same as shown here:

Decrypt simple CBC message with known IV using XOR encryption

However, when I implement the solution it doesn't work, neither does my own solution.
I will restate the problem:

I've been given a ciphertext message, encrypted using CBC. I know that the block size is 12 bytes and I know the plaintext value of the first block.

I also know that the encryption function is a simple XOR:

Ci=K⊕(Mi⊕Ci−1)
where C0=IV.

My (incorrect) solutions, programmed in Java:

Terminology:
"encrypted" is a byte-array holding the ciphertext
"decrypted" is a byte-array holding the recovered plaintext (decrypted cipher)
"first_block" is a byte-array holding the decrypted first block (which is the IV)
"key" is a byte-array, which will hold the key after it is recovered
^ is the java expression for XOR

The IV is known

attempt 1, using my own imagination:

// corresponds to K = IV (+) C0, where C0 = K (+) IV

for (int i = 0; i < 12; i++)
    key[i] = (byte) (first_block[i] ^ encrypted[i]);

// corresponds to K (+) Ci (+) Ci-1

for (int i = 12; i < 24; i++)
    decrypted[i] = (byte) (key[i-12] ^ encrypted[i] ^ encrypted[i-12]);

Result: I decrypt the first block of twelve, which is the IV that I already know, but the second block is just gibberish

attempt 2, using the information gotten from the previous question linked above copied:

//K = C0 + C1 + M1

byte[] key = new byte[12];
for (int i = 0; i < 12; i++)
    key[i] = (byte) (encrypted[i] ^ encrypted[i+12] + first_block[i]);

// Mi = K + Ci + Ci-1
byte[] decrypted = new byte[encrypted.length];

for (int i = 12; i < 24; i++)
    decrypted[i] = (byte) (key[i-12] ^ encrypted[i] ^ encrypted[i-12]);

Result: Still just gibberish, but different gibberish that I got above

What I'm looking for: Any kind of help


texts: Rationale of the SHA-256 sigma function definitions

texts: When the sigma functions are defined in equations (4.4) and (4.5) in FIPS PUB 180-4, the defined functions show the traditional sigma summation symbol, with limits 0 to {256} and 1 to {256}. The definitions, however, are in terms of circular right shift and XOR operations. Why is a summation symbol used here?


texts: Does the prime modulus have to be bigger that the generator?

texts: In the DH algorithm $ a^x \bmod b $ where $ a $ is the generator and $b $ is the prime modulus does $b $ have to be bigger than $ a $ or could $ a $ be larger for example $ 19^x \bmod 17 $ . Because I don't see a problem with the generator being larger because the answer can still only be $ b \ge \text{answer} > 0 $ . Obviously the prime modulus would still have to be large enough to provide good security but I was just curious if the generator could be larger.


texts: How to find $r$ for El-Gamal signature with known private key


texts: What is the proper way to generate a fixed length key from a variable length password?

texts:
The password is entered by the user and the key is processed locally. Neither the password nor the key will be stored, only used and forgotten (but hopefully not by the user). Is SHA256 by itself strong enough for this purpose? Do I really need a salt in this case?

I've looked around Google and other StackExchange questions, but they all assume the password and/or key will be stored. In any other case it probably would be stored, though my case calls for using it and forgetting it.