texts: Store hashed password using Digest authentication

texts:
Digest Authentication is something like this:

Server sends client a nonce.
Client hashes username and password with nonce.
Client sends hashed value back to server.
Server validates hash.

However, it seems like this requires the server to have access to the password plaintext, otherwise it wouldn't be possible to verify each hash with unique nonce values.

Is there some way to follow this authentication protocol without requiring the server to have access to password plaintexts?


texts:
I am using "secp192k1" curve to generate the key for data signing using ECDSA scheme. Signature is generated using "SHA3-256withECDSA" algorithm provided by BouncyCastle.

Theoretically, the length of the signature should be 192*2/8 = 48 bytes. Instead, this length varies from 54 to 56.

My application demands a signature of fixed length. How can I achieve this?


texts:
What is the difference between
soundness in ZKPoK and
special soundness for sigma proofs?


texts: Any scenario for using ElGamal-SIGNATURE over RSA?

texts:
On a homework assignment, we're asked to give an example in which scenario one would use an ElGamal-Signature over an RSA-Signature.
I found this question, but the answer also only describes why RSA is superior. I searched a while now, but I don't really find any reason why one would use a Schoolbook-ElGamal (not DSA or elliptic curves) instead of RSA.

Does anyone have an additional idea?


texts:
I am attempting to encrypty/decrypt a long message in RSA using javascript (with crypto-js and jsbn libraries).

I posted this on stackoverflow too but I figured someone here on crypto might be able to help as well.

so far, to encrypt/decrypt short messages I have the following code:

function encrypt(signedCert, msg) {
    key = new RSAKey();
    m = asciiToHex(msg);
    m = new BigInteger(m, 16)
    //n and e retrieved from the digital certificate
    key.setPublic(signedCert.msg.subject.pk.n, signedCert.msg.subject.pk.e);
    var ctxt = key.doPublic(m).toString(16);
    return ctxt;
}

function decrypt(sk, ctxt) {
    key = new RSAKey();
    c = new BigInteger(ctxt, 16);
    key.setPrivate(sk.n, sk.e, sk.d);
    var ptxt = key.doPrivate(c).toString(16);
    var ptxt = hexToAscii(ptxt);
    return ptxt;
}

this works like a charm when the message is short. but, for the life of me, I can't figure out how to encrypt/decrypt when the message is long!

can anyone help? thanks :)


texts: How does encrypt-then-MAC protect from CCA?

texts:
I am an application developer, implementing client-side crypto to protect data that is then transmitted to be stored on a server. The application uses AES with CBC mode with a resulting encrypt-then-mac HMAC to authenticate.

The process looks something like this:

key_material = kdf(password, salt)
mac_key = first_half(key_material)
enc_key = second_half(key_material)

iv = random_bits()
ct = aes_cbc(plaintext, iv, enc_key)
mac = hmac_sha256(ct, iv, mac_key)

This results in a ct, iv, and mac that are then transmitted to the server. The server then delivers that information back to the client each time the application starts (and user enters their password) in which the whole process is then reversed for decryption.

Validate mac. If validation fails, abort with error.
Decrypt to plaintext with enc_key, iv, and ct.

I understand the need for the mac in order to validate the authenticity of the message before the application proceeds to decrypt the plaintext to display to the user.

However, I am having trouble understanding how authentication protects against anything else. I have read that authentication will protect against things like Chosen Ciphertext Attacks (CCA). My understanding of a CCA attack is:

  A class of attacks in which the attacker modifies encrypted traffic in
  specific ways and may learn plaintext by observing how the decryption
  fails.

If an attacker obtains access to the stored ct, iv, and mac don't they have everything that they need to "observe how the decryption fails"?

From my understanding, mac validation is an application implementation. The attacker doesn't necessarily have to use my application to observe how the decryption fails. They could just write their own application that doesn't do the mac check (or just modify my open source application and remove the mac check).

Am I missing something here? How does authentication (more specifically encrypt-then-mac) protect against attacks like CCA?


texts: Understanding Lattice based cryptosystem

texts:
I have heard that there is one paradigm of Public key cryptosystem, called Lattice based crytography. Further, its security claims are such that it will not be affected even if the quantum computers are available.

Would any one be kind enough to help me to understand the basic philosophy behind it, with examples?

EDIT
As stated in comments, I don't any complete, state-of-the-art scenario of this system. I am only interested to know what are the basic pillars that constitute it. I mean, there has to be something like complicated non-linear operations, or finding prime factor(s) of a large number etc.


texts: How can we reduce indistinguishability-from-random to other security notions?

texts:
In probabilistic encryption schemes, different notions of security exists.  I'm interested in the relationship between two notions.  One is the indistinguishability-from-random notion of security and the other is the right-or-left notion of security.  In crypto literature, it's often asserted that the former is stronger than the latter.  But is there a crisp proof of that?

In Difference left-or-right CPA security, IND-CPA security, the answer seems to indicate that Left-or-Right CPA security and Real-or-Random CPA security are equivalent.  However, I have found in other papers like Rogaway's paper on Modes that Real-or-Random is a stronger notion.  On page 19, he defines the Real-or-Random security notion. On page 20, he defines the Left-or-Right notion among others.  Then he concludes: "In fact, the indistinguishability-from-random-bits notion is properly stronger than all four of the alternative notions sketched above."

Is there a proof for his claim or is this not settled in the crypto community?


texts: What if in AES-128 CBC, IV is very related to KEY?

texts:
while digging into some secured communication protocol, I noticed a  usage of AES-128 CBC that raised my attention.
In it, the IV is tightly coupled to the Key, being a xor of its values with the byte index:

for(i=0; i<16; i++)
{
  IV[i] = Key[i] ^ i;
}

Could it be an issue if an attacker knows the first blocks of a plaintext?
Does it weaken the implementation of the encryption?

Thank you in advance


texts: What is the public key length of RSA and Ed25519?

texts:
I have made some research but doesn't understand fully:

In this link, it says ed25519 has a length of 64 characters.
Questions:

Is this base64 encoded characters?
And does ed25519 limit to only 64 characters?

In the same link, it says rsa 3072 has 544 characters. I tried to generate a public private key pair here but:

rsa515 produces a public key with 128 characters
rsa1024 produces a public key with  216 characters
rsa2048 produces a public key with  392 characters
rsa3072 produces a public key with  564 characters
rsa4096 produces a public key with  736 characters

Question:

I would like to ask why?


texts: adaptation of NIST sp800-22 for short sequences

texts:
I would like to ask about the NIST test suite for randomness evaluation. The test suite consists of 15 subtests which evaluate the particular property of the sequence.
In fact, each test has an individual of the minimum number of the bitstream (e.g., $10^6$ bits for Random Excursions test or $100$ for Frequency test). What if I want to test the randomness of short sequences like 128 bitstreams. Is there any reference or suggestion about how to modify the NIST test for this task?

Or what if I just neglect those test which requires a huge number of the bitstream. In that case, is the result still reliable?


texts: Quantum security risk to present encryption

texts: Quantum computers will seal the fate of conventional encryption techniques. Of these, the hardest hit will be the RSA algorithm used by 99 percent of all applications the encryption standard for any secure transfer and storage of communication data or software updates. What are some solutions to the inevitable?


texts:
What exactly is the MOV attack, how does it actually work, and what is it used for?

It's explained briefly here and I'd like to know what it is more / what is it fully used for.


texts: Proving a user's identity after the user has forgotten his private key and password

texts:
First some background. I am building an application where people send each other emails with messages inside that need their sign-off. Once the participants receive the email they're also given a callback link (the link is generated by cc-ing an email address tied to our app server, and then the app sever sends all the participants an email back with a link). Users click on that link, gets taken to a site, where the site's frontend generates a pair of keys locally inside the browser's localstroage, and the user can either say yes or no to the message, while signing his response + message with the key. We then store the signatures, should there be disputes later on they can search and find who agreed / disagreed to what when.

We've accounted for when the user flushes the browser or the browser flushes itself. The secret key is encrypted with the user's password and stored on the server (like protonmail), so if the user still remembers the password the secret key can be recovered locally in the browser.

But the problem is that I would expect most people won't be using this on a regular basis, so they will likely forget the password or that this site even exists in the first place. This means that their signatures are essentially worthless since there's nothing tying those signatures to these user's identity if they forget and resets their password and gets a new key pair.

One bit of information I do know is the user's email address. When they click on the link to agree / reject the message I right away know they are the owner of a particular email address. Let's assume for a minute that they're not likely to lose access to the email. With that assumption, is there some way I can tie a signature to a user's identity, even after that user has lost the private key (he 99% isn't even aware what a key is or that he has one) and lost his password to our site? To prove that, "Yes, that was you and only you who signed this message 1 year ago". Somehow tie the user's ability to access a particular email address to a signature?

The reason to use signatures is that it is not fakeable. If we only used regular logins then an argument can be made that the app server can just make up whatever it wants. But now we're saddled with a new problem which is how to reliably tie that signature to a user's identity.

Any help / ideas would be greatly appreciated!!


texts:
ECDSA signatures depend on parameter k that is chosen by the signer. As a result, there are many signatures for the same private key d and message m.

What I want to achieve is a deterministic signature. That is, given private key d and message m, there should be only one valid signature. I could go with RSA (with deterministic PKCS#1 v1.5 padding) but would prefer ECDSA if possible as it is almost as widely deployed and has smaller key and signature sizes.

RFC 6979 describes how k can be generated deterministically but it doesn't solve my problem because those who verify the signature can't verify that the signer did actually follow RFC 6979 (I'm not aware of any such method).

I'm thinking about imposing some additional requirements on signers that others can easily verify.

For example, what if I require that all signers derive k using a formula like this:

k = H(m) * d

where d is private key, and H is hash function. Then in signature (r, s), r is x-coordinate of

k x G = H(m) * d x G = H(m) * Q

where G is generator, Q = d x G is public key, and x denotes EC multiplication.

Unless I'm getting EC math wrong, this choice of k derivation function has the  advantage that it can be easily verified by multiplying public key point by H(m) and comparing the x-coordinate of this point with r from the signature. At the same time, it seems, all the security requirements for k are still satisfied: it is private since it is derived from private key and it is different for each message as it depends on message hash.

Will it work? Any other ways to create deterministic signatures?


texts: Can we use fixed Beaver's multiplication triples many times?

texts:
In the secure computation based on GMW and SPDZ style approaches, we use multiplication triples to gain efficient online computation time.

Can a same triples be used multiple times?
Is there any need to update the triples?


texts: Constant time implementations of crypto algorithms

texts:
To protect against cache attacks (side channel attacks) generally constant time crypto implementations are advised. In some cases DJB released new algorithms (chacha) that are designed with this in mind (as one of objectives). If so --

Are constant time implementations feasible for all popular algorithms?
 I ask because AES, RSA, SHA*, EC* and DSA algorithms (at least some of them) are not designed with side channel attacks in mind. Given that, are these secure to use in software? ( I know secure is a loaded term here but I am speaking strictly from a side channel perspective).
Do all the standard libraries support this constant time implementations? I would like to see an implementation that does this compare against something that does not.
I know using an algorithm in hardware is the way to go. When a crypto algorithm is "implemented in hardware", does it usually mean its implemented completely in hardware or are parts of it implenented in microcode? I know AES is probably completely implemented in hardware, what about ECDSA or something thats a bit more complicated?


texts:
I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost.

According to the CCMP Encapsulation block diagram there are inputs like Plaintext MPDU, TK, PN, KeyId, etc. What is the temporary key (TK)? Which part of the diagram represents CTR and which one is for the MIC computation (CBC-MAC)? Construct Nonce from the image constructs the nonce for the MIC or for the counter computation?

If I've understood well, counter is a 128-bit value derived from Source MAC address, Packet number, Flag, Priority and Ctr which increment by 1 for each MPDU. Each message is broken into 128-bit chunk of data and then XORed with the encrypted counter.

CBC-MAC is a mode used to generate 64-bit MIC. Again, each message is splitted into 128-bit message blocks. First message block is derived from the nonce which is constructed from Source MAC Address, Priority, DLen and Packet Number. This message block is encrypted with AES and its result is then XORed with second message block and the result of XOR operation is encrypted again. This keeps repeating until the whole message is encrypted. Finally, this forms 128-bit MIC which is then discarded to 64-bit MIC.

I've got lost in RFCs since I've couldn't find any good explanation in my literature.


texts: How does Blowfish avoid successful cryptanalysis?

texts: I have researched the Blowfish algorithm and am curious as to why there  exists no effective cryptanalysis for this algorithm as of yet. What basic principles or features allow Blowfish to achieve this?


texts: If IV is sent/shared with the cipher text then where is the need to randomise the IV?

texts:
I have been reading to understand the need to randomise the IV but have failed to understand this yet.

Could someone please explain why do we need to randomise the IV if we somehow need to send the IV with the cipher text because the receiver, even though has the key would not know the random IV.

Therefore, wouldn't an adversary who has access to the cipher text can see the random IV for each message?

Why isn't it better to agree on a fixed IV like the key and not send it over with the cipher text?


texts: How does Skype hash the phone number to a fixed length?

texts:
I have a Skype account with a phone number and I noticed that my contacts and I
who created the accounts with a phone number have the Skype ID
in some form of a hash. But all the Skype IDs have the same length (16).
and the link prove skype hash the phone number
is herehow skype generate user id

What hash algorithm does Skype use for this?


texts: Retrieving correct ciphertext from additive ElGamal

texts:
I have been studying additive ElGamal and I think I have the hang of it except the part where the message $M$ must be retrieved by computing the discrete log of $g^M$.

From what I've read, the result of such computations is a function of $k$ e.g. for $g=3, M=4, \pmod{17}$ we have $3^4=13 \pmod{17}$ but computing the discrete log however gives $M=4 + 16k$. How do I know that $M=4$ and not $M=20$?

Note that for $g=3,M=20 \pmod{17}$ we also get $M=4+16k$.


texts: common ways / methods to try to break a SP network

texts:
I have a very little cryptography background (but a relatively solid maths background) so my below question is very general.

Basically I have been given a SP network with an output to reverse. I thought i could "easily" found the plaintext by reverse-enginnering all the process, using reverse of permutations / substitutions functions until i quickly realized that the S-Box were not bijective at all (several inputs are mapped to the same outputs).

What's more, and this is what is causing me the most trouble, the encryption algorithm has a final round where it does some mixing making the reversal quite complicated.

I am given the lookup table of the S-box and P-Box as well as the encryption algorithm.

I won't post the encryption since this is not the point, but i was wondering what are the typical approaches i can try to solve this, what readings do you advise, etc..

thanks a lot for your help.

Romain


texts: How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for?

texts:
Imagine Alice wants to encrypt for Bob and post this encryption publicly, so that only Bob can decrypt but no one can other than Alice or Bob tell that the message was encrypted for Bob.

The naive approach leaks some information.  If Alice posts $y = x^e \bmod{n}$, then an observer can conclude that the recipient has a public key $n > y$, and can therefore eliminate many guesses as to whom the recipient is. Potentially this advantage can be amplified, depending on the higher-level protocol.

My thought was Alice can generate a random $r$ of size $2^{\textrm{L}}$, where $L$ is the largest allowable key size, and post $y + rn$.  Then, Bob can consider the residue mod $n$ when decrypting.

Similarly, in ElGamal, Alice can pick random $r_1$ and $r_2$, then post $\langle c_1 + r_1 p, c_2 + r_2 p \rangle$.

Do these constructions achieve their intended goals?

A use case for this is in PGP encryption.  Assuming Alice strips the key id from the outer packet, can she post a PGP encryption without leaking information about her intended recipient?


texts: Can I prove that a message is part of a set of known messages without disclosing the message?

texts:
If Alice sends an encrypted message to Bob, how can Bob prove to Charlie that the message he received from Alice is part of a set of predefined messages, without disclosing the encryption key or the message itself.

Let's say we use El Gammal encryption scheme and let's say the predefined messages are M = {1,2}. Bob's pair of keys are x and y = gx.

Alice encrypts message m $\in$ M and sends the tuple (c,e), where c = gr, e = yr * m and r = random.

How can Bob prove that the decryption of (c,e) $\in$ M, without revealing the value of m ? Maybe some sort of zero-knowledge proof ?


texts: Looking for encryption function given decryption function (2048-bit ciphertext and key, addition and subtraction operations)

texts:
I have a decryption algorithm for 256-byte (2048-bit) blocks and want to find the matching encryption algorithm.
What I know about the algorithm and have:

256-byte ciphertext (I have multiple different ones for testing)
256-byte key (same for all ciphertexts)
Decryption algorithm to turn key + ciphertext into plaintext
Known plaintext (certain offsets contain certain values)

What I want to know is:

If this is a known cipher and what its name is (so I could get the encryption algo this way)
If the 256-byte key I have is enough to do the encryption

About the algorithm:

It takes a 256-byte ciphertext (as 64 x uint32_t): cipher_text
It also takes a 256-byte key (as 64 x uint32_t): key_buffer
It stores the result in another 256-byte buffer (also 64 x uint32_t): temp_buffer

This is the "outer loop" of the decryption algorithm (pseudocode):
# copy cipher_text into temp_buffer
for (int i=0; i<16; ++i) {
    combination_round(temp_buffer, temp_buffer, key_buffer);
}
combination_round(temp_buffer, cipher_text, key_buffer);
# the plaintext is now in temp_buffer

The interesting part (IMHO) is how the cipher text is combined back into the data after the 16 decryption steps. Even if I were to be able to come up with a reverse-function of combination_round(), how would I be able to put in the cipher text in the "first" (if done bottom to top) step?
The combination_round() function first combines the two first argument buffers to a buffer double the size (128 x uint32_t, i.e. 512 bytes) and then uses all three buffers to "subtract" values from the buffer contents, with handling of underflow. One would assume that the "encryption" step might just do addition here with overflow handling.
At the end of a combination_round(), the result is written to the first argument buffer (above: temp_buffer).
As part of the encryption, some values are derived by taking two uint32_t values, splitting them up into 4 16-bit parts (upper 16 bits of first value, lower 16 bits of first value, upper 16 bits of second value, lower 16 bits of second value). Those 16-bit values are then combined back into two uint32_t values by multiplication, addition and shifting by 16 bits.
Does this ring any bells? If this is a "standard" algorithm, knowing its name and plugging in the encryption function might be easier than trying to "reverse" the algorithm from the decryption function alone.
Also, does having access to a decryption function and its key automatically mean that I would have all the necessary information (key material) to also do encryption? Thinking about how public key cryptography works, decryption always needs the "private" key, and the "public" key can be derived from it.
Would there be situations where decryption can be done, but encryption needs additional key material, and if so, how is this property called?


texts: Definition of soundness (a different approach) in "Witness Indistinguishable and Witness Hiding Protocols"

texts:
In any other context where I encountered the concept of soundness it was very simple: if the input does not belong to the language then the protocol fails or fails with great probability.
But in the paper Witness Indistinguishable and Witness Hiding Protocols there is an interaction between a prover $P$ (with a set of valid witnesses $w(x)$), a verifier $V$ and an input $x$ and the definition of soundness is:
$\exists M\ \forall P'\ \forall x\ \forall w'$,
$$ P[V_{P'(x, w')}(x) accepts] < P[M(x, w'; P') \in w(x)] + negligible $$
Where the probability is over the random tapes of $V$, $P'$ and $M$. $M$ uses $P'$ as a blackbox.
I just can not grasp this, can someone explain it to me?


texts: Construct a specific length-doubling pseudorandom generator from a length-doubling pseudorandom

texts:
Let $G$ be a length-doubling pseudorandom generator (i.e., for any $n\in \mathbb{N}$ and for
any $s\in\{0, 1\}^n$ it holds that $G(s)\in\{0, 1\}^{2n}$). Can you construct a length-doubling pseudorandom
generator $H$ such that $H(0^n)= 0^{2n}$ for any $n\in \mathbb{N}$?


texts: If you hashed a hash an infinite number of times would you end up with a unique hash?

texts:
If you took a hashing algorithm for example MD5 and repeatedly passed the output hash back into the algorithm an arbitrarily large number of times would you eventually end up with one unique hash?

My idea is that the maximum number of hashes initially is $2^{128}$ however if you feed the hash back into the algorithm there would be collisions so two or more input hashes will map to one single output hash thus reducing the entropy, if this process is repeated indefinitely would it result in one single hash? or is it possible that there would be a point after which no collisions will ever happen?

This is a thought experiment and is probably not possible but I would like to know.


texts: Please could someone kindly give an example of McEliece cryptosystem with a detailed explanation, most especially, the decoding aspect


texts:
After reading this question, I understood that "game-based" and "simulation-based" have to do with the way that security properties are postulated. In particular, IND-CPA is a canonical example of game-based security property and semantic security is a canonical example of simulation-based security property. Then, I guess that the "game-based proof method" refers to doing proofs for this kind of security statements. Did I get this right?

By looking back at Shoup's tutorial on game-based proofs, I see that "semantic security" of ElGamal is his first example. How?! Isn't that the canonical example of the simulation-based proof method? Is it because he postulates "semantic security" as "polynomial indistinguishability" which is game-based? Where does my confusion comes from? Is that my intuition (a "simulation-based proof" is a proof of a simulation-based security definition) is wrong?


texts: By what modulo calculations with discrete logarithms are performed?

texts:
For odd prime $p$, I have been given a group $\mathbb{Z}_p^*$ of all invertible elements from $\mathbb{Z}_p$. Basically, $\mathbb{Z}_p^* = \{1,2,\ldots , p-1 \}$. I also have $a$ and $b$, which are two generators of $\mathbb{Z}_p^*$. My question is, by what modulo calculations with the discrete logarithm are performed for $\mathbb{Z}_p^*$? Or in other words, does it hold:
$$ a^k \equiv b \pmod p$$
$$k \equiv \log_a b \pmod{p}$$
Or does it hold:
$$ a^k \equiv b \pmod{p-1}$$
$$k \equiv \log_a b \pmod{p-1}$$
And also, a followed up question:
If $\mathbb{Z}_p^*$, $a$ and $b$ are as described above, does it holds, that if $k=\log_a b$ then $k\in \mathbb{Z}_p^*$?


texts: Comparison of different asymmetric signatures

texts:
Please forgive me, because I suspect I don't even know enough to ask this correctly:

Can someone speak to the pro's and con's of the various asymmetric signatures?

I have a use-case in which I put data and a signature of that data in a QR code, where storage size is limited.  As such, I'm trying to understand the trade-off's between security / size (and any others trade-off's of which I might not even be aware).

Thank you!

Edit: I'm using RSA-512 and it works, but I'm most curious if there is a signature method that is secure but uses fewer characters.


texts: How to check whether the permutation is random or not

texts:
Imagine that my friend gives me the permutation $\pi$. He pretends that the permutation was generated completely random.

I'm suspicious and worried, because the permutation (for instance) looks like: $\pi(x) = ax + b \pmod n$ for some $a$, $b$. My friend said to me that it happens by chance.

Of course it is not possible for me to actually prove that permutation is not random, because we always can generate this one by chance.

Is there any strategy using which I can rigorously state (as a mathematical statement) that this event is very unplausible?

I can try to say something like : well, there is a structure, and a chance that random permutation will have this structure is really small. But the structure can be more tricky (for example, k-round Feistel network over some group with some round functions or the like). And my friend is telling me: well you can always invent some tricky formula and get every my permutation. But this does not indicate that the permutation is not random.

So the question is: if I found some "hidden" structure in "random" object, does it indicate that the object is very unlikely to be random or I can always find structure in every object that friend gives to me? How this "suspiciousness" can be quantified in the rigorous mathematical sense?


texts:
Say that I have 16-32 GB of data, and I want to devise a system for storing this data in an encrypted form. This system needs to meet two core objectives:

The data needs to remain as pristine as possible for a very long time, which in this case means 10-50 years.
No one but me should be capable of decrypting the data.

Here's the system that I've come up with so far:

Two copies of the data are stored, each on its own flash drive.
These flash drives are encrypted using VeraCrypt.
Every year, on a specific date, I mount both devices, and copy the contents of one onto the other.

Are there any obvious holes in this system? Will copying the data as described above keep the data "fresh"?


texts: When we use a PRF to pad a message, do we need to worry about the PRF's output range and/or probability of collision?

texts:
My question is related to:

How to contruct a pseudorandom with a specific property
Collision in pseudorandom function when two different keys are used

Question: When we use a pseudorandom function to pad a message do we need to worry about the pseudorandom function's output range and the probability of collision?

Assume we blind (read: “add padding to”) a message $m$ as $r_1=m\cdot PRF(k,1)$, and next time we blind it as $r_2=m\cdot PRF(k',1)$, where $k,k'$ are two independent random keys. We give $r_1,r_2$ to an adversary.

If our PRF is not collision resistant then when $PRF(k,1)=PRF(k',1)$ then the adversary can learn the message $m$.


texts: What are the vulnerabilities of this OTP-like system?

texts:
I've read that a OTP is only perfectly secure if the key is perfectly random, and the pad is never reused.

If you encrypt documents using two keys, where one is random but stays constant for some period of time, and the other is only pseudo-random but unique to each message, is the security of the OTP better or worse than if you used only one key or the other?

And would it still be vulnerable to frequency analysis?


texts: Is a transposition cipher categorized as asymmetric algorithm?

texts: Consider a simplest transposition cipher, such as one with block size 8 and encryption key 43725681, the decryption key will be 84215637. As the keys are different, may I say a transposition cipher is an asymmetric algorithm, except for some special values of the keys, such as 87654321?


texts:
I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521, but notes the others as "unsafe" https://safecurves.cr.yp.to/index.html.
Would I be unwise to choose an "unsafe" curve over an RSA implementation? I see P-256 is widely used yet listed as unsafe. How should I reason about this?


texts: What are the rules regarding to numbers in RSA?

texts:
I'd like to have a small sanity check first: As far as I understand, diffie-hellman is all about that fact that, given the generator ($g$), the modulo ($n$) and the remainder ($c$), it's hard to find the exponent a in:
$g^a \bmod n = c$
But the conditions for this are that n is a big prime number, and g is a root primitive. So my questions are:

Does $n$ must be prime? or it's just better for security?
Does $g$ must be root primitive mod $n$?

Ok now to RSA. As far as I understand, RSA stands on another notion, and that is that it's hard to find the message (m) given the cipher (c), modulo (n) and exponent (e) in:
$m^e \bmod n = c$
So my question is: Does the same restrictions regarding diffie-hellman apply to RSA? Seemingly that's not possible since:

you can't impose restrictions on the message itself
$n$ is a composite of two (or more) prime numbers.

Am I right here? Please correct me if not.
I suppose that my questions comes down to this: Do Diffie-Hellman and RSA rely on the same mechanism of modular arithmetic, or is it completely different?


texts: In simulation proofs of MPC, why could random oracle extract adversary's input?

texts:
I am learning the simulation-based security proofs in MPC, and have read the great tutorial "How to simulate it" by Prof. Lindell.
Here's my understanding about why we need to "extract adversary's input" in writing simulation proofs against malicious adversaries (please correct if I am wrong): For a malicious adversary, it is not guaranteed to follow the protocol, so "a simulator is able to extract A's input" means "as long as the protocol does not abort, we could be sure that A must be inputting something valid (i.e. following the protocol) ". So the "extracting input" step is crucial for writing proofs against malicious adversary. If we can extract A's input, everything left are just the same as the semihonest proofs.
The example of changing semihonest OT into malicious OT with ZKP meets my above understandings, because ZKP could prove the prover's correct behaviors, and could extract the prover's input. However, when reading other proofs, I found it hard to understand why could random oracles extract inputs as well.
E.g. Proof of Theorem 1 in [1] says "SIMs builds two tables T1 = (x, φ) and T2 = ((h, t), ψ) to answer the hash queries to H1 and H2 respectively". How could SIMs know the inputs to H1 and H2? If SIMs could do that, does it mean we can extract inputs simply by asking the parties to hash their inputs, and any semihonest-secure protocols become malicious-secure ones by simply introducing an extra hash-input step (which is obviously not true) ?
I know there must be some basic mistakes in my understandings, and would be very grateful if someone could point it out. Thanks.
[1] Jarecki S, Liu X. Fast secure computation of set intersection.


texts: How does the wider cryptographic community view non-abelian group based cryptography?

texts:
Is there perhaps some neural expository article on crypto systems based on non-abelian groups?

I've gleaned that Anshel–Anshel–Goldfeld key exchange is the most well-known cryptographic algorithm based upon non-abelian groups.  Do people consider it respectably secure?  Why?  Why not?

Any opinions about the role of combinatorial group theory here?

I'm curious because, as I understand it, non-abelian finite groups aren't considered particularly useful in cryptography, due to the Coincident Group Orders Theorem that follows from the Classification of the Finite Simple Groups, but obviously infinite non-abelian groups are another matter.


texts: Can a partially homomorphic encryption scheme be made CCA1 Secure? like paillier ? what is the highest security for any PHE?


texts:
I am currently trying to understand this Ring-LWE article: http://www.cims.nyu.edu/~regev/papers/ideal-lwe.pdf and I have a question.

Firstly, it is mentioned in the paper that we can view the elliptical Gaussian distributions $D_{\textbf{r}}$ (which are initially defined on $H$) as distributions on $K_{\mathbb{R}} =K \otimes_{\mathbb{Q}} \mathbb{R}$. Even though there isn't any explicit isomorphism mentioned there, I believe that $\varphi:K \otimes_{\mathbb{Q}} \mathbb{R} \to H$, $\varphi(x \otimes a) = a\sigma(x)$ makes sense in this context.

What I dont understand is the claim that the distribution $x \cdot D_{\textbf{r}}$ is equal to $D_{\textbf{t}}$, where $t_i =r_i \cdot |\sigma_i(x)| $, where $x \in K$. What I obtained is the following:
if $x\in K$ and $y\in H$, $y=\sum_{i=1}^n y_i h_i$ (distributed $y \sim D_{\textbf{r}}$), then

(EDITED formula)
$$xy= \sum_{i \in [s_1]} y_i \sigma_i(x)h_i + \sum_{i \in [s_2]}(y_{s_1+i}\cdot Re\sigma_{s_1+i}(x) - y_{s_1+s_2+i}\cdot Im \sigma_{s_1+1}(x)) h_{s_1+i}) +\sum_{i \in [s_2]}(y_{s_1+s_2+i} \cdot Re \sigma_{s_1+i}(x) + y_{s_1+i} \cdot Im \sigma_{s_1+i}(x))h_{s_1+s_2+i}$$
Basically I obtained the coefficients of $xy$ in base $\{h_1,h_2,\ldots,h_n\}$, and they dont seem to follow gaussian distributions with parameters $t_i = r_i \cdot |\sigma_i(x)|$ (except for the first $s_1$ of them)

Can anybody shed some light on this one ?


texts: Do hash functions for digital signatures need to be preimage resistant?

texts:
I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" for two random documents with the same hash or for a second document, having the same hash as a given document, and just replace the "original document" with the "fake document", because then the signatures of the two documents are also the same.
However, I see no reason, why a hash function for signing documents needs to be preimage resistant, or is it indeed a superfluous property?


texts: How to develop a public key cryptosystem based on a hard problem?

texts: Recently, I found a function that is performed on a sequence to return another sequence. All known algorithms for finding the input, given the output are of exponential complexity. I want to propose this function for encryption in a public key cryptosystem. What steps I am supposed to take? Actually I am a beginner in cryptography.


texts: Padding on RSA signature and RSA encryption

texts: Why use a random padding on RSA encryption and not on RSA signature?


texts: Are specially designed fonts sometimes used in cryptography?

texts:
As a font designer, I was thinking that it would be very easy to design a special font that could either jumble characters of a language (or of a code) or simply (with the features offered by the OTF format) overlap into a complex design that only the other user (the reader) would be able to unscramble...
Is this something that exists and could be plausible?

EDIT: To better explain myself, I just created this image.
(A) represents a whole sentence. Each circle is a word.
(B) details two different kinds of "words" that could exist: wavy, straight lines... but always with 26 peaks (for example an alphabet with 26 letters). When one single letter from a font is typed, just one wave or peak would be drawn until the whole word is typed.
(C) is another detail of overlapping of two circles, each one is a word.
(D) explains how a word could be read: each circle having 26 peaks, the distance of the peaks from the center tells the reader what letter it is. I made the distance very visible in (D) but it could be extremely subtle / only visible when analysed by microscope/etc.

Such a code could exist on the front page of a newspaper and no one would notice. And it's all encodable in a "simple" OTF font...


texts: Is Quadratic Arithmetic Program NP-complete?

texts:
I'm reading this paper: Quadratic Span Programs and Succinct NIZKs without PCP
Is QAP NP-complete? as same as QSP?


texts: Does anybody know if the design of VIC cipher is attributed to anybody? I've tried Google and found nothing. There are quite a few sites describing the method in detail, a few implementing it programmatically, and ample stories of the code in the coin, but who actually came up with it? Who decided to put the ideas together in that way? Some Russian scientist I assume, but does anybody know who?


texts: Signature scheme against an unbounded rival

texts:
I've seen this:
Can a computationally unbounded adversary break any public-key encryption scheme?

And I've read the following theorem:

Theorem (Lamport, GMR, Naor-Yung, Rompel, Goldreich)
If one-way functions exist then there are signature schemes which are
existentially unforgeable under chosen plaintext attacks.

I was wondering if this implies, that given an unbounded rival, no signature scheme exists that this rival can't break. This is due to the fact that the rival can inverse the 'OWF'.

Any thoughts? Corrections?


texts: Universal hashing techniques based on matrix multiplication

texts:
The article here says below, about a universal hashing technique based on matrix multiplications.

"However, there is a little known method based on using a random matrix. It has lots of advantages - it's a universal family"

I tried to hard to find the source paper of the same to dig deeper but could not. Any references about the technique ?


texts: Lack of usage of secrets in ZK Bitcoin ownership proof

texts:
I read the paper "Provisions: Privacy-preserving proofs of solvency
for Bitcoin exchanges" which is available for download on http://crypto.stanford.edu/~dabo/pubs/abstracts/provisions.html and have some questions about it. For discussing the single question I want to address here, having read the entire paper is not necessary as it is limited to what the authors describe in section 4.1.

The authors claim:

  Now, to prove that $Z_\text{Assets}$ computed in (2) is a commitment to (a lower bound of) the exchange’s assets, the exchange proves knowledge of quantities:

  $s_i \in \{0, 1\}$ and $v_i, t_i, \hat x_i \in \mathbb{Z}_q$

When you read the definitions of these symbols right before that claim, you notice (or at least I think I did) that none of these values require knowledge of any secrets to be computed.

$x_i$ describe the private keys, $y_i$ the public keys. As $y_i = g^{x_i} \forall i \in [1, n]$, knowing the values of $x_i$ is not required to commit to the values of $x_i \cdot s_i$ when using Pedersen commitments.

I don't see how any secrets were used when computing the values the exchange is going to prove ownership of and therefore not how proving knowledge of these values proves knowledge of the $x_i$. Yet in their protocol 1 (page 9), these values constitute the entire input of the prover (apart from the publicly available data on the blockchain).

As this is a published paper, I assume that they're right with that this is sufficient and I'm wrong. But what am I missing?


texts: Can we implement AES with 16 bit block size ?if so what are its advantages and disadvantages?Is there any rule AES has to be implemented with 128,192,256 ?Can we use AES for odd number of bits(17,33,37..) ?


texts: How can I prove that a Feistel round is its own inverse for DES?

texts:
I'm having difficulty on proving the fact that each round of DES algorithm is its own inverse. Can someone put a concise explanation for it please?

If a function, say $f$ ,is its own inverse than $f(f(x))= x$  right? I try to prove that, given a round function $Rd$, that: $Rd(Rd(L_1\|R_1))= L_1\|R_1$.  Here $L_1$ and $R_1$ are the left and right portion of the input.

Then I get:
$$Rd(R_1\|L_1 \oplus F(R_1,K_1))=L_1 \oplus F(R_1,K_1)\|R_1 \oplus F(L_1+F(R_1,K_1), K_2)$$
... this must be equal to  $L_1\|R_1$.

But I cannot see how this would be equal to $L_1\|R_1$? Where am I making a mistake?


texts:
RSA-KEM is introduced by Yuliang Zheng and Jennifer Seberry

1992, Practical Approaches to Attaining Security against Adaptively Chosen Ciphertext Attacks

and compared the security against OAEP variant by Jakob Jonsson, in 2002

2002, An OAEP Variant With a Tight Security Proof – Draft 1.0

I've found some documents that may indicate the usage of RSA-KEM in the wild.

rfc5990: Use of the RSA-KEM Key Transport Algorithm in the Cryptographic Message Syntax (CMS)
Key Encapsulation: A New Scheme for Public-Key Encryption by XML Security Working Group F2F, May 2009

What are the noticeable usage of RSA-KEM in the wild as of 2020?


texts: Is it safe to use RSA as a proof-of-work system?

texts:
Suppose I devised the following challenge-response proof-of-work system:

A server generates a 2048-bit RSA modulus, and uses the "public" exponent (usually 65537) to sign a random nonce a fixed number of times, say, 256.

The server then sends the signed nonce to the client, along with the "private" exponent (which is much larger) and modulus, asking it to un-sign it using the private key 256 times, sending the answer back for the server to verify. Because the private operation takes about 300 times longer at 2048 bits, the client will take longer to un-sign the key than the server took to sign it.

Is this usable/secure? Or does the generation of the modulus outweigh any gains in the difference in signing time? If so, how could I make it usable, if at all?


texts:
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.

For example, start with Blowfish, move to AES, switch to DES, etc, in a defined, but semi-unpredictable fashion (maybe basing which one to choose next off the last 4 bits of the most-recently-encrypted block's original plantext).

Would changing algorithm (but keeping the key identical, for sake of argument) have any cryptographic value? Could such a scheme be more resilient to cryptanalysis?


texts: MixColumns layer in the last round of AES

texts: My prof said that the last round of the AES algorithm doesn't use the MixedColumns layer, yet this doesn't decrease security. If so, why the MC layer is used in the other rounds?


texts: Should I add randomness at the end before AES?

texts:
Seen AES, changing a character drastically affects the encrypted text. I want to make it harder to decrypt AES I send. So, it seems this can be done by adding some special code and some random bytes RNDBYTES at the end of plaintext, and when decrypting removing the ramdomness after the special code. This way encrypting the same text will look different, which is what I need. But is this secure? Should I use a special algorithm for this or a CSPRNG is enough? How long should it be?

I'm using it in CBC mode, but the implementation doesn't add the randomness I want, the same message when encrypted looks the same. But the receiver of the encrypted code should be able to decrypt knowing the key without the need to know the RNDBYTES. This is just to prevent someone smart outside the connection to observer the repetition pattern.

Edit: A hacker might know other ciphertext AND some parts of the plaintext.


texts: Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?  This is a common operation (ex.  PEM keys) and is variable time in typical implementations.


texts:
I was wondering why in the AES sub-bytes operation one can represent the inversion as computing $x^{254}$. What is the reason for this?

Moreoever, I was wondering what the text on page 212 of https://autonome-antifa.org/IMG/pdf/Rijndael.pdf means that the polynomial representation of the sub-bytes operation can be obtained by lagrange polynomial interpolation?

Thanks a lot, Peter


texts: How can Cleve's 1/r lower bound on the bias of coin-flipping protocols hold if parties can output random bits?

texts:
I was reading Richard Cleve's 1984 paper on coin flipping protocols, and he says that in the case where parties may abort prematurely and the honest party is forced to output a bit, then the honest party can be forced to be biased by at least 1/r where r is the number of rounds.

Recently Moran, Naor, Segev showed that this bound is asympotically tight.

Although I roughly understand Cleve's proof, I don't understand the premise that the chosen bit that a party outputs when the other party aborts is deterministic. Since they are PPTs, and they are notified when the other party abort, can't the honest party just flip a random coin and output that?


texts: Can I use SHAKE-256 on 32-Bit Microcontroller?

texts: SHA-512 cannot be really run on a 32-bit ARM microcontroller since it uses the 64-bit constants, but since SHAKE-256 uses only 32-bit values, can it be run on a microcontroller with 32-bit registers?


texts:
I have a PRF function $F(k, F(k,0)) = 0$.
So that means, $k \times F(k,0) \rightarrow F(k, 0)$.

I hope you can help me understand if the function $F(k, F(k,0))$ is a secure PRF or no?

Thanks for considering my request!


texts: Re-using information from the first factor for the second factor

texts:
Is it safe to re-use my username and password as information for the 2nd-factor?

For instance:

the first factor is the username and password;
the second factor is $H(H(username) \oplus H(password \| SK))$ where $SK$ is the private key.

Would this scheme be secure?


texts: Storing Encrypted data in a mobile client

texts:
We have a mobile client application which stores data in localstorage for offline use. The new GDPR requirements have to mandate us to encrypt the data we store in the client.

We used Stanford's sjlc.js package to encrypt the information using AES 128 before storing them in Local Storage. We did a brief performance test and it looks fine.

But the encrypted string is like below.

{"iv":"C8aBp2GjvPiZHCRtCPu+hg==","v":1,"iter":10000,"ks":128,"ts":64,"mode":"ccm","adata":"","cipher":"aes","salt":"duWxiMbE8TM=","ct":"cC4P/pMVozDpmnD/XzW2oif9GId8ZXCo7j/kP6QGlaT8C5pO09SBy6u6DneQz/AdeSQFtG9Ng05i0tASr8RcfNRYQGOFa17I7TI5xVSnd8L7322yihqxhsBbmBFSR0xesAEYmJcoIgPp1/MB+oXzm/pn0pzl0AfZNd8dTHrN+Wa9vcg107+2rVWY7K77BL1j7knRApU....................

We have to pass the whole string back to decrypt.

As you can see it contains the salt as well. Does that defeat the purpose?

I asked this same question in https://stackoverflow.com/questions/48275430/storing-encrypted-data-in-client. There was a suggestion to post it here.


texts: Using a hash (like SHA-256) vs AES as the source for pseudo-random values in Feistel network?

texts:
This question is in relation to Wikipedia article on Format Preserving Encryption

It says the following

  It is also possible to make a FPE algorithm using a Feistel network. A Feistel network needs a source of pseudo-random values for the
  sub-keys for each round, and the output of the AES algorithm can be
  used as these pseudo-random values.

However I was taking a look at an implementation of FPE (Botan Crypto library).   It is based on the scheme FE1 from the paper "Format-Preserving Encryption" by Bellare, Rogaway, et al

In the implementation I think it is using the SHA-256 hash to generate the pseudo-random values.

How does this compare (with respect to security) to the alternative of using the AES algorithm to generate the pseudo-random values?

Are both equally valid methods?


texts: Are there any specific weakness in this crypto implementation?

texts:
I am reverse engineering the firmware of a particular router/modem.
I am focusing on the functionality to export the router configuration.
I an searching for a way to decrypt the configuration backup file.

I have the source code of the open source parts of the firmware and the binaries of the closed source parts for analysis.

After an analysis of the binary responsible for creating the configuration backup file i discovered it does the following:

Takes the raw XML configuration file
Compresses the file
Encrypts the file using a key and an iv (more on that later)
Applies a PKCS7 signature to the file

To encrypt the configuration file a 256 bit AES key is used, in CBC mode. We will call this key file key.

To derive the file key two pieces of information are used: a user password and a device key, combined in the following way:

file_key = MD5(user_password) + MD5(device_key)

where the user_password is just a string choosen by the user during the config export process in the web interface of the router.

The device_key is an AES key, generated once (the first time is used)  and then saved on a file (and read from there when is used again). During the generation of the AES key also an IV is generated and saved along the key. The is generated once and reused the following times.

This device_key (and the associated IV) is used only to encrypt/decrypt the configuration backup.

The crypto library used is openssl-1.0.2k

This is a C code that describes how is generated the device_key (and the associated IV). Is called only once and the results are reused.

const EVP_CIPHER *cipher_algo;
const EVP_MD *digest_algo;

unsigned char salt[8];
unsigned char device_key[32];
unsigned char device_key_iv[16];

// yes, the secret key material is constant and is "secret"
char secret_data[] = "secret";

cipher_algo = EVP_aes_256_cbc();
digest_algo = EVP_md5();

// in the code the result of this call is NOT checked to be sure it succeded,
// maybe something here?
RAND_pseudo_bytes(salt, 8);

// here the device_key is generated
EVP_BytesToKey(cipher_algo, digest_algo, salt, secret_data, strlen(secret_data), 1, device_key, device_key_iv);

// from now on the device_key and device_key_iv is never regenerated

This is a C code that describes how is generated the file_key. It is called every time a backup configuration file is exported.

unsigned char device_key[32];
unsigned char device_key_iv[16];

char user_password[] = "test1234";
unsigned char file_key_raw[32];

MD5_CTX md5_context;
AES_KEY file_key_aes;

get_device_key_and_iv(device_key, device_key_iv);

// hash of user password
MD5_Init(&md5_context);
MD5_Update(&md5_context, user_password, strlen(user_password));
MD5_Final(file_key_raw, &md5_context);

// hash of device_key
MD5_Init(&md5_context);
MD5_Update(&md5_context, device_key, 32);
MD5_Final(&file_key_raw[16], &md5_context);

// now file_key_raw contains the raw bytes of the key

AES_set_encrypt_key(file_key_raw, 256, file_key_aes);

// now the struct file_key_aes contains the file_key

//to encrypt data, this is called:
AES_cbc_encrypt(input_data_buffer, output_data_buffer, len_of_input_data, file_key_aes, device_key_iv, 1);

Are there implementation/usage bugs that can allow to recover the file key without a full bruteforce?


texts: How do institutions like banks do RSA with big primes?

texts: When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small primes compared to those in used by banks, one would often choose the Fermat number $65537$ as public exponent $e$, then the private exponent $d$ is $4267793$, which is a huge number when used as an exponent. How do banks etc. decrypt their data when they choose primes for $p$ and $q$ which are 100s of digits?


texts: Access structure in Attributes Based Encryption

texts:
I thought that access structure and access tree are equivalent but I've read in a paper (page 3) that there are at least three types of access structures :

AND gates
Access tree
LSSS generating matrix

I would like to know what is the difference between them, are they equivalent or some of them are more expressive (better to use) than others?

Thank you in advance.


texts:
I recently began using PGP desktop and found several options for my encryption capabilities. Firstly, which of these (AES, CAST, Triple DES, TwoFish, IDEA) is the most recent? Secondly, may the NSA not have the keys to decrypt? Are there any encryption protocols not listed that are perhaps safer to use?
After reading that Outlook Email was forcibly(?) compromised, are there any secure e-mail sites left in the cyber world that anyone can recommend?


texts: Why does Signal repeatedly hash the secure passphrase?

texts:
Background: I'm working on creating a small program to extract my messages from Signal's newly-added (beta) encrypted backup feature.

In the Signal codebase for their Android app, I noticed that instead of just hashing both the salt and passphrase once, they repeatedly hash it 250,000 times.

MessageDigest digest = MessageDigest.getInstance("SHA-512");
byte[]        input  = passphrase.replace(" ", "").getBytes();
byte[]        hash   = input;

if (salt != null) digest.update(salt);

for (int i=0;i<250000;i++) {
    if (i % 1000 == 0) { EventBus.getDefault().post(new BackupEvent(BackupEvent.Type.PROGRESS, 0)); }
    digest.update(hash);
    hash = digest.digest(input);
}

return ByteUtil.trim(hash, 32);

(Source code can be found here)

I don't understand what benefits this offers over something that conceptually does:

sha512sum(sha512sum(concat(salt, passphrase)))

Am I correct in assuming that this does not add any extra security? Why exactly has this been done?

Additional Information:

The password for the backup is generated here and is 30 bytes long and then set contextually on line 37 of that file. This code was added in the commit 22 days ago, when encrypted backup was added and is currently only visible in the beta version of the app.


texts: How is the initial permutation of DES created?

texts:
I am creating a program in C language with DES (Data Encryption Standard) functionality, but don't know how to apply the initial permutation.

Is it achieved by swapping the values? If "yes", then how is the index of the original message created?


texts:
From the lecture notes I have learned the following:

$P \rightarrow V$: $T=g^t$ ($t$, randomly chosen from $Z_q$)
$P \leftarrow V$: $c$ (randomly chosen from $Z_q$)
$P \rightarrow V$: $s=xc+t \mod q$
$V$ accepts if $g^s=A^cT$, (where $A=g^x$)

Question: Can $P$ instead of sending $g^s$ send directly $A^cT$?

In other words, $P$ has all it need to generate $A^cT$ which is the same as $g^s$. Can someone explain what I am seeing wrong?


texts: Identify the value of the plaintext from a noised expression

texts:
Having the following instructions:

Using Paillier encryption to encrypt $m$. So, we get $Enc(m)$
Multiply $Enc(m)$ and $A$ to Get $C$. So, $C = Enc(m).A $
Decrypt $C$ using Paillier Decryption algorithm ($Dec(Enc(m).A)$

Knowing the value of $A$, is there a possibility to have $Dec(C) = A.Dec(m)$ ?
How can we get the value of $Dec(m)$ in this case.


texts: RSA reconstructing private key knowing MSBs

texts:
PREMISE: This question is purely theoretical because usually an attacker will not know private exponent d and can't compare it with obtained MSB bytes.

Suppose an RSA 1024 bit signature.

An attacker through a key exposure obtain the half most significant bytes of the private exponent d.

Can the attacker reconstruct the LSBs of d without bruteforce the LSB part? Can he make it in a reasonable amount of time?

There are best way to do it?


texts: Does this description of verifiable random functions seem accurate?

texts:
I've been thinking about verifiable random functions recently due to my interest in sortition (random selection of political officials). I wrote up this little paragraph below, and I'm wondering: Does this paragraph seem accurate? I'm not very confident in my thought process haha as I'm quite a newbie to cryptology and hadn't even heard of a VRF before yesterday.

If you do find problems in what follows, please let me know! I really want to understand at least the very basics of this correctly.

Of course, one time-honored method of random selection is to simply put some names in a big tub and mix them around. However, with recent advances in cryptology more sophisticated mechanisms could be used. In particular, verifiable random functions could be used to choose citizens. In general, the owner of a verifiable random function f employs a secret key and a chosen input x to compute f(x), which is essentially a random value. When x and f(x) are published, the owner also releases a proof that, combined with a previously disseminated public key, allows anyone to confirm that the published value f(x) was indeed correctly computed. However, the public never learns of the secret key and thus cannot evaluate the function for any input other than x. This is in part because verifiable random functions are a kind of “one-way function”: It is easy for the public to check the correctness of an output, but impossible for them to figure out how the function actually operates in general -- thereby preserving the secrecy and integrity of the procedure.


texts: Using same AES-GCM setup for multiple packets?

texts:
Most cryptographic libraries I've encountered uses some variant of processPlaintext(...) and then doFinal() to produce the ciphertext and resets the state.

In the context of packet communications, it feels like it would be optimal to setup key and IV once and then use that single initialisation in some way for all packets on the same channel.

In the case of CBC + padding, one could re-initialise the cipher with the last cipher block as IV.

(If I use a stream cipher, or manually implement CTR, it's straightforward of course.)

It would be nice to be able to use GCM to avoid manually adding authentication. However, it would appear that the usual implementations are geared towards encrypting a single packet - and resets all internal state on doFinal.

I would like to provide only a single IV for GCM, and then in some safe way either keeping the original state, or derive consequent IVs from the initial IV in a secure manner.

What I wonder is consequently:

Are there implementations that allow you not to reset the state when finalising a packet (i.e. making encryption and authentication dependent on the previous packet)? Failing that, what would be a safe way to derive consequent IVs from an initial IV value?

(I've not read about GCM sufficiently in depth - so I have no idea if there is a significant cost to setting up GCM with an IV)


texts: Why does TWINKLE use light instead of current?

texts:
TWINKLE is a device devised by Adi Shamir to optimize the sieving step of GNFS. It consists of a cylinder, at the bottom of which are LEDs corresponding to factor base primes which blink with frequency 1/p. If more than a certain number of the LEDs blink at the same clock tick, you've found a GNFS relation (smooth integer pair). This is measured by a brightness sensor at the top of the cylinder: if the light level is above some threshold, the necessary number of LEDs must be lit.

My question is: why use LEDs instead of just measuring current? You could replace the LEDs with transistors that alternate current instead of blinking, and if the current sums to a certain level you have a hit. Why wouldn't this worK?


texts: What is the reason for length differences in RSA?

texts: In NIST FIPS 186-4, "digital signature algorithm", the minimal length allowed is 1024 bit (page 22). On the  contrary, in NIST SP800-56B, page 63, RSA-OAEP encryption, the minimal length is 2048. Why 1024 is secure enough for digital signature but not for encryption?


texts: How is pipelined DES different from sequential DES?

texts:
I implemented DES Coder in VHDL using ISE IDE by Xilinx in sequential architecture which was pretty easy and straightforward. Now my task is to do the same using pipelined architecture so that the whole thing will work with maximum possible clock frequency. I read numerous papers from IEEE site concerning pipelined DES but still I couldn't fully get my head around the topic. What is different? So far I understood that I have to make it so:

There are no complex instructions in the code of every module. For example if I had instruction "x <= a * b * c" I'd have to break it down to two instructions in for loop and when iterator is equal to 0 do "temp <= a * b" and when iterator is equal 1 do "x <= temp * c". Just an example but shows the way of thinking - instead of one complex instructions - many simple ones (using loops or for generate).
Once input A gets to Feistel Round 2 then input B (for example next 64-bit plaintext word) gets loaded immediately to Feistel Round 1 and so on allowing us to process 16 words "quasi simultaneously". That would require us to have a synchronizing register before and after every Feistel Function module. Also I read something about modules for "pipeline" and "control module" although none of the articles mentioned how they worked. To be honest I have zero ideas about how to implement this part.

Are my presumptions wrong at any of the 2 points? Could anyone please explain to me in detail how to bite into this problem? Does anyone have an example of working pipelined DES Coder/Decoder on FPGA? I will be thankful for every bit of help.


texts: Is symmetric encryption with a key containing the userId passes as authentication?

texts:
The scenario:

There is a web application where ownership check is time expensive so during the development all users were able to access all other user's objects (let's say apples) by changing the ids in the REST urls.

The user is authenticated by issuing a signed (not encrypted) JWT to the client in which one of the claims is a userId.

There was an initial attempt to make proper ownership checks on the server, but since it was very slow now everyone is looking for workarounds.

The team has made a decision - which I was against - to implement a following solution instead:

Instead of sending the user the ids of his apples, the user receives the ids encrypted symmetrically on the server. This should prevent the user to randomly guess ids (ids are autoincremented numbers).
When the user requests a specific apple, he requests it with the encrypted id he received, and the server decrypts the id and fetches the resource by it.
To prevent one user to reuse other users' ids, the encryption and decryption is done with a secret key that has the userId coming from the JWT token concatenated to it. This way you have to have a matching JWT token for your token to be decryptable.
The encryption is done by Jasypt's BasicBinaryEncryptor, where the plaintext id is converted to bytes and the resulting bytes are base64 encoded. Decryption is the same backwards.

My problem:

I do not have the knowledge to properly argue against this, apart from reciting things like "do not invent your own security", but this seems like a horrible disaster waiting to happen.

The JWT tokens for signed claims part is something that does not seem too fishy to me. They are stored in localstorage, the signature algorithm is set by the server, the secret is very long, there is expiration in them.

What seems problematic to me is that the cyphertext is not signed so if the user can forge the request somehow he still has access to all other user data.

Is it possible to somehow forge a request here? For example by messing around with the bits and see if the server throws an error (or what kind of error).

I'm looking for easy-to-understand reasons on why it is a bad idea to do this to present a solid argument to my colleagues (or be convinced that it is not).


texts:
I create codes and ciphers and as a hobby and I was wondering if there was any outfit that would 'test' your output to see how resilient it is. Is there a group anywhere that will accept code, try to break it, and report back to you with results? Or is there anyone who would do it on their own?

Thanks,


texts: Is it possible to predict a randomly generated BigInteger that uses Java's default Random library?

texts:
I've seen it posted on different forms here and here that explain how java.util.Random library uses a linear congruential pseudorandom number generator which can be cracked using two values. Can this type of exploit go one level deeper and guess the nextByte data used to fill in the rest of a BigInteger value?

private static Random generator = new Random();

public static String uncrackableRandomNumber() {
    return new BigInteger(128, generator);
}

A snippet of the additional layer of byte generation using java.util.Random (rnd).

public BigInteger(int numBits, Random rnd) {
      this(1, randomBits(numBits, rnd));
  }

private static byte[] randomBits(int numBits, Random rnd) {
  if (numBits < 0)
    throw new IllegalArgumentException("numBits must be non-negative");
  int numBytes = (int) (((long) numBits + 7) / 8); // avoid overflow
  byte[] randomBits = new byte[numBytes];

  // Generate random bytes and mask out any excess bits
  if (numBytes > 0) {
    rnd.nextBytes(randomBits);
    int excessBits = 8 * numBytes - numBits;
    randomBits[0] &= (1 << (8 - excessBits)) - 1;
  }
  return randomBits;
}

The first two numbers are: 233458857748780331814340414981023411537 and 141610568161066839752374346774468879751, how can I determine the next number given only this information?


texts: Requiring a "supervisor" key pair and a "user" key pair to decrypt multiple-recipient messages

texts:
I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system.

So we have

Bob -- The person who sends the message (and knows it's recipients)
Jim -- The person who supervises who is capable of decrypting the message(but can not decrypt the message himself)
Alice -- The person who wants to receive the message
Mark -- The person who also wanted to receive the message, but after Bob sent the message his private key was compromised

For example sake, Bob must post his encrypted message on a public message board. Ideally, Alice and Mark would see the message and know it's intended for them, but they can't decrypt it by themselves. They must ask Jim to apply his decryption skills on the public data first. Jim trusts who is asking for the message because he knows their public keys(and asks for a dynamic signed piece of data or some such). Of course though, Jim won't apply his magic for Mark because he was notified that Mark had been compromised. So, Mark is left in the dark with an undecipherable message

Also, Jim is minimally trustable. So, if Jim wanted to hand the message to some untrusted party, it'd still be fairly useless, unless they themselves learned of one of it's intended recipient's private key as well.

I'm trying to work out the best way to actually do this. Here is one idea:

Bob encrypts his message with a symmetric algorithm.
Bob encrypts the symmetric key against Alice's and Mark's public key using his private key (two separate "key messages" are thus made)
Finally Bob encrypts both of the key-messages against Jim's public key using his private key

I think this would work. However, I have some concerns

I'm double-encrypting things, which sounds like trouble
I'd have to be encrypting basically the same piece of data against two different keys. Does this leave me vulnerable to cryptoanalysis? What about padding?

Ideally, the first algorithms that came to mind for symmetric encryption is AES. For asymmetric encryption, I was thinking RSA. Is there a better choice?

Is there any better way of managing such a scenario where you have a "supervisor" which mitigates the risks of a private-key compromise for messages sent to multiple recipients?


texts: Why is this authenticated Diffie–Hellman key exchange insecure?

texts:
I was searching for the information on authenticated Diffie–Hellman key exchange and found these slides. The author says, “Remember
$$A\to B: (A, g^x, \operatorname{SIG}_a((g^x, B)))$$
$$B\to A: (B, g^y, \operatorname{SIG}_b((g^y, A)))$$
insecurity”. I fixed the mistake with $A\to B$, replaced public keys with secret ones in the signature function and added sender identifiers. I do not understand why this protocol is insecure, and I can't find anything about this protocol. I understand it as follows. Upon receiving the first message $(C, X, s)$, Bob aborts if $s$ is not a signature of $(X, B)$ by $C$, otherwise generates $y$, sends $(B, g^y, \operatorname{SIG}_b((g^y, A)))$ and associates the session key $X^y$ with $C$. Upon receiving the second  message $(C, Y, s)$, Alice aborts if $s$ is not a signature of $(Y, A)$ by $C$ or $C\neq B$, otherwise associates $Y^x$ with $C$ (Bob).
I have been unsuccessfully trying to implement the attack described in “3.1 BADH and the identity-misbinding attack: A motivating example” in “SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols” by Hugo Krawczyk. This and related papers are the only material on the subject I could find. Suppose that Darth posesses a secret key $d$ and the corresponding public key $D$. Since Alice initiates the session, Alice will think that she is talking to Bob anyway. If Darth replaces the first message with $(D, g^x, \operatorname{SIG}_d((g^x, B)))$, Bob will send $(B, g^y, \operatorname{SIG}_b((g^y, D)))$. I do not see how Darth can persuade Alice to start the session using $g^y$ since Darth does not have $\operatorname{SIG}_b((g^y, A))$.


texts: Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

texts:
I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily.

Also, for every ciphertext the private key holder must be able to prove non-interactively that the plaintext was non-negative.

In Paillier it is rather simple to prove that the ciphertext is equal to the plaintext. The encrypting party must simply reveal the random salt. Now I need to prove that the plaintext is non-negative without revealing it.

Let's say the most significant bit of the plaintext denotes the sign.

My first flawed idea:
The verifier takes the ciphertext. Let's say the plaintext had at most N bits. The verifier homomorphicaly adds 1, then floor-divides by 2, then adds 1, then floor-divides by 2, ... and so on. After N cycles positive numbers will yield 1 while negative 0. The prover now has to prove that the resulting number is 0 or 1, which can be done by revealing salt. The whole procedure is deterministic (given the salt for encrypting 1s was deterministic), that means the prover may calculate the encrypted form of 0 or 1 in advance. The resulting salt would only be needed to be attached to the ciphertext as certificate.
The flaw is of course that the verifier can not floor-divide by 2, as this requires calculating of square root modulo n=pq, where p and q are unknown.

My second flawed idea:
It's the prover who does the square root. He can do it, as he has the key. The certificate would consist of the series of N numbers, each equal to the square root of the previous multiplied by encrypted 1. At the end, we get 0 or 1 and we reveal the salt.
The flaw is that only even numbers' encryptions can be squared. For odd numbers we would need to publish two numbers whose plaintexts differ by 1. This obviously reveals every bit of the plaintext in every step, so it's bad.

Are there any cryptosystems that can do it?


texts: Cracking lowest plaintext bit in Padding oracle attack with PKCS#5

texts:
I have been working on a C implementation of padding oracle attack on a block encryption algorithm using CBC mode of operation. I understand the concept fine but I can't seem to find an answer to the following question(despite looking up similar questions on stackoverflow and this site):

When we send a Ciphertext block concatenated at the end of a block we manipulate to the padding oracle, why do we assume that first success means that the XOR operation produced a 1 and not 2,3,4,5,6 or 7 for that matter?

To add more information for those not in the know, PKCS#5 is a padding scheme for plaintexts of blocksize 8 bytes where the last block contains n number of padding bytes each containing the value n. So, lets say we send (C1||C2) where C2 is the original Ciphertext and C1 is a block whose lowest byte we vary from 0 to 255 so as to get a successful validation from the padding oracle. A successful validation, in my opinion, means that the padding is correct, i.e. the resultant plaintext byte is 1 if there were just 1 padding byte and 2 if there were 2 and so on...

Why do all the implementations of this attack assume that the first success from Oracle means we got a 0x01 in the last byte from the oracle? Is it because the probability of getting a 0x02 in the last byte and the penultimate byte while only varying the last byte is lower? If yes, does that mean there may be instances where this algorithm would fail to decode ciphertext?


texts: I have two secret values $L_1$, $L_2$, and two Pedersen commitments $C_1 = C(L_1)$, $C_2=C(L_2)$. The commitments $C_1$, $C_2$ are public. Given a challenge $c$, I want to output $d = c*L_1+L_2$ and prove in zero-knowledge that $d$ is formed correctly. What should the zero-knowledge proof look like?


texts: Is a bit string pseudorandom if it starts with predictable bits?

texts:
Assume we have $k = n + m$ bits string $S$ where the first $n$ bits are predictable, and the last $m$ bits are pseudorandom (the HMAC of the first $n$ bits + IV). Can we say $S$ is a pseudorandom number?

What can we call S exactly?


texts: Security of OFB mode if PRP is used instead of PRF

texts:
In the cryptography lecture at my university, we had the theorem that (randomized) OFB mode is IND-CPA secure if the used pseudorandom function (PRF) is IND-PRF secure.

Afterwards, we investigated the security of rOFB if a pseudorandom permutation (PRP) is used instead of an PRF. As we can only distinguish a PRP from a PRF if the PRF produces a collision, we can use them interchangeably as long as the block length is large enough. This is the case as for large block lengths the probability of a collision is negligible.

From this result we deduced that we can also use PRPs in rOFB mode which results in a IND-CPA secure encryption scheme.

I totally understand that we can distinguish a PRP from a random function oracle (RFO) if the RFO produces a collision. Therefore, the PRP 'does not look random' if we can query many outputs. However, the security of rOFB mode requires that we do not have a collision in the ciphertexts. Therefore, I do not understand why the security of rOFB mode is lower when we use a PRP instead of a PRF (negligibly lower, but lower) as a PRP does rule out exactly this attack on OFB.

It is clear for me that the PRP-OFB mode does not look like an OTP for many queries, but I cannot imagine why the attack surface should be negligibly higher if there is NO collision possible.


texts: Is it possible to exactly reverse engineer an unknown cipher inside a black box?

texts:
Consider the following arrangement:-

There is an unknown cipher algorithm operating inside the black box. You can enter infinite key /plain text pairs, and observe   all of the outputs. The box might just as well be protecting a short friend/foe challenge as an entire 4K UHD movie. Any counter modes, streams, IVs, nonces or padding is handled inside the box. All you need to do is input any size of plain text. The cipher is a world class modern type with strength equivalent to *fish, Rijndael or ChaCha, but not one of those.  It may have come from outer space, or perhaps in a vision. The point is that no one has ever seen it. It might even be a totally unknown NSA Suite A algorithm.

Given unlimited input output tuples, is it possible to reverse engineer the algorithm exactly so that it could be  used reliably for future encryptions?

Note: Hypothetical unknown cipher - security in obscurity? came up, but honestly I can't understand   the question.


texts:
This might be a very short very obvious answer, because I've yet to come across a question similar to mine in my searches.

Given a lattice L, with a good base B1 and a bad base B2, what stops an attacker from simply re-creating the lattice structure from the public base B2?

It might just be a terminology mix-up on my part, but that's what I recall being the purpose of basis's in regular algebra.


texts: Would it be safe to implement Winternitz OTS+ using Poly1305 as a parameterized MAC? It's very fast and apparently very secure but with the caveat that keys cannot be used more than once, which is fine for this application. Does anyone know if Poly1305 has any features that differ from a normal HMAC that would make it unsafe for this application?


texts: Only remember part and format of BitLocker password

texts:
I am a complete novice to the field, however I made the mistake of locking my Macbook bootcamp partition with a bitlocker password which I cannot remember entirely.

There isn't much irreplaceable data on the partition, but I would like to know whether there's any way to recover the password.

the format was :

Dictionaryword&dictionaryword301

What I have forgotten are the two words, which were standard English words (albeit long ones). The first one was capitalised.

I would greatly appreciate any suggestions,

Thanks in advance


texts: Is an efficient integer factorisation algorithm a threat to security anymore?

texts: Nowadays, private key systems like AES have replaced RSA. Even for digital signatures, people mostly use ECC, so even if an efficient integer factorization algorithm is made, would it be a threat to digital security anymore? Or is this danger just an idea in the past?


texts:
Rivest and Kalisky's RSA problem considers various notions on security of the RSA One-Way Trapdoor Permutation. They do it only from the perspective of a single user.
What's the state of the art in the multi-users RSA problem and its reduction to other problems?

Assume a public directory of $u$ public keys $(N_i,e_i)$ all with the same bit size $|N_i|=k$. Assume $N_i=p_i\,q_i$ with $p_i,q_i\in[\,\lceil2^{(k-1)/2}\rceil,2^{k/2}\,)$. Assume these primes chosen independently and uniformly at random among those with $\gcd(p_i-1,e_i)=1=\gcd(q_i-1,e_i)$ for some odd $e_i\ge3$, unless that matters.
Adversaries succeed if they pass this test:

Challenger draws and submits random $y\in[0,2^{k-1})$
Adversary chooses and submits $i\in[0,u)$
Adversary submits $x$ and succeeds if $x^e\bmod N_i=y$.

Make this the multi-users RSA (authentication¹) problem. Add two-pass when we exchange 1 and 2 (forcing the adversary to choose its target before the challenger supplies the challenge $y$), which can only make the attacker's task harder. Add low exponent when $|e|$ is upper-bounded by a constant value. Add fixed exponent when $\forall i,\  e_i=e$.
For concreteness, consider an access control system using Smart Cards to authenticate users, where each has internally drawn a public/private key pair. Assume keys per² FIPS 186-4 appendix B.3, which wants $k\in\{1024,2048,3072\}$ and $|e|\in(16,256]$. Assume $e=65537$ when $e$ is fixed. Noticeably, there are special conditions on the primes mandated specifically when $k=1024$, and part of the question is: are they useful³ for some practical parameter $u$?

¹ Omit authentication unless relevant. We could define a multi-users RSA encryption problem, but it has less practical relevance. And when a legitimate user's ability to decipher random challenges is used to authenticate, that multi-users RSA encryption problem becomes equivalent to our multi-users authentication RSA problem: the restriction $y\in[0,2^{k-1})$ is minor, and using the multiplicative property of RSA can be shown irrelevant, I guess.
² This reference's $nlen$ is our $k$. We use the notation in the landmark proof of PPS by Bellare and Rogaway (1996), and improved proof of FDH by Coron (2000).
³ One of these precautions is that $p-1$ has a large prime factor. This is to guard against Pollard's $p-1$ factoring algorithm. This algorithm is a non-issue in the RSA problem, since factoring algorithms with a much better asymptotic cost are known. That's less evident in the multi-users RSA problem: this algorithm's probability of success grows markedly with $u$ at constant cost, when the parameters $B_1$ and $B_2$ of Pollard's $p-1$ are tuned so that all the $N_i$ can be tested. For $k$ in the low hundreds and $u$ in the millions, it seems this strategy beats ECM with random curves (which giveq the adversary an advantage independent of $u$ AFAIK).


texts: Emphemeral key creation from a long term shared secret (without DH)

texts: Assuming I cannot use DH scheme, and the long term key is known to both sides, is there a known algorithm / standard that defines how to derive a short term key from a long term key?


texts: Can there be a need for 1024-bit (symmetric) encryption?

texts:
I think we are all aware of the CAESAR-competition. Now the aim of this competition is to select a (portfolio of) winner(s) which provide authenticated encryption.
I'll now assume that the results produced by this competition are very good, meaning the cryptanalysis of the next 50+ (!) years won't yield any significant attacks (speed-up no more than $2^{80}$ compared to brute-force). Further it may be assumed that the scheme has 512-bit keys, to reach 256-bit security against quantum-computers.

So far for the assumptions, now to the background:
I recentely read this text by B. Schneier, where it was stated that the laws of thermodynamics disallow a counter to count to more than $2^{200}$, even in an ideal setting (3.2K, dyson sphere, kT for bit-flip,...). So I asked myself the following question as 512-bit seem to fully suffice forever (if we don't harvest the whole universe's energy...)

Now my question:
Besides performance and flexibility, will there ever be the need for 1024-bit symmetric encryption?


texts:
I wonder the Stream Cipher ChaCha20 only changes 96 bits each block,
         why it can produce 512 bits keystream block,
         I mean in the concept of  a random number generator,
         the entropy should be at least equal to the output.
         However,  change 96 bits to produce 512 bits keystream seems have some secure problem.


texts: Why is prime factorisation computationally intensive compared to normal factorisation?

texts:
Why do we use prime factors in asymmetric algorithms compared to other factors?

For example:

  lets say we use two prime numbers p = 53 and q = 59   our public key
  in RSA algorithm would be p * q = 3127

  while it is difficult to find the private key from this using prime
  factorisation, I feel it is equally difficult to find the factors for
  some   normal number too

  like p = 52, q = 58 where public key would be p * q = 3016

but why is prime number preferred over the others, is it because how the algorithm works? Think I am missing something trivial.


texts:
The paper Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage contains the following simplification:

  $$e(C_i,\text{GPK}_{uid})\cdot e(D_i, K_{\rho(i),uid})\cdot e({C'}_{i}, {K'}_{uid,aid_k}^{-\text{GSK'}_{uid}})\cdot e(g, {D'}_i)^{-1} = e(g,g)^{au_{uid}\lambda_i}$$

I'm not able do this simplification step by step. Note: I removed some of the unnecessary indices.

$$e(C_i,\text{GPK}_{uid})\cdot e(D_i, K_{\rho(i),uid})\cdot e({C'}_{i}, {K'}_{uid,aid_k}^{-\text{GSK'}_{uid}})\cdot e(g, {D'}_i)^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{\frac{r_i}{\beta}}, g^{u't\beta}\cdot H(x)^{v_i\beta(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't\beta}\cdot H(x)^{v_i\beta(u+\gamma)})^{\frac{1}{\beta}}\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't}\cdot H(x)^{v_i(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

How can I arrive at $e(g,g)^{au\lambda_i}$ from this?

What am I missing so that I can do this simplification? I don't think I can come any further with the bilinearity $e(g^a,g^b)=e(g,g)^{ab}$.

Symbols:

$e: \mathbb{G}\times\mathbb{G}\rightarrow\mathbb{G_T}$
$H: \{0,1\}^*\rightarrow\mathbb{G}$
$a,u,u',\beta,\gamma,r_i,v_i,\lambda_i,t\in \mathbb{Z}_p$
$x\in\{0,1\}^*$
$i$ denotes a specific attribute


texts: Is it possible to decrypt cryptowall-encrypted files?

texts:
I am writing regarding a certain ransomware program called cryptowall (prop 4.0).
I have lost many documents to this, and as it so happens, I have a few file duplicates before and after they were forcefully encrypted.

My question is whether or not it is possible for someone knowledgeable to figure out the key used and decrypt these particular files by comparing the two copies?
Thanks for taking the time to even read this; you can't imagine how important these documents are to me, pretty much 8 years of work.


texts: How to determine the security in bits of a scheme?

texts:
This may be a stupid question. But how would we determine the security bit of a crypto scheme?

For example, SHA2-256 offers 128 bit security due to birthday paradox, so do they measure the security bit by calculating $\log_2$ of best-known attack?

However, some scheme is defined as $(t,\epsilon)$-secure. how should we determine the security bit? some people define the security as $\log_2(t/\epsilon)$? but should it be inconsistent as $(t,\epsilon)$ can vary.

is there a standard way of measuring the security bit of a scheme?


texts: how can I draw from a set of characters using a seed for entropy?

texts:
Given a seed string S, I want to deterministically generate a password of the form:

N characters, each chosen from a set of characters C

Unfortunately neither N nor the cardinality of C necessarily play nicely with powers of 2, and I want to avoid introducing a bias towards any particular characters in C.

Is the following a sane approach to generating these passwords with a uniform distribution, or, is there already a well known approach to doing this?

To choose the i_th character of the password, I would compute for every character c in C the value sha256(S + i + c), then choose the character c for which this has the largest hash.


texts:
Given an SBox, how can I generate its component equations (in ANF)?
given in this link: https://en.wikipedia.org/wiki/Algebraic_normal_form
For example, let's say I have this SBox:
$$\{1, a, 4, c ,6 ,f ,3, 9, 2, d, b, 7, 5, 0, 8, e\}$$


texts: Example for point addition using Jacobi transformation and small integers

texts:
This video explanation is great because it shows an example using small numbers, if it wasn't for that example my code would be wrong.
Still: the code takes 0.5 seconds to calculate 300 point doublings using 256 bit numbers. I found it's faster to do point addition or doubling using the Jacobi transformation or Weierstrass transformation but I can't find explanation examples using small numbers.
Can someone write an example of point addition using Jacobi transformation?


texts: If we have multiple unique RSA signed messages produced from the same private key, can we always find new valid signatures?

texts:
Say Alice publishes $t$ unique signed messages with her private key $d$,
$$
m_1^d, m_2^d, m_3^d, ... , m_t^d \mod n
$$
For $t = 2$, we have $m_1^d, m_2^d \mod n$ and if we let $x \equiv m_1m_2 \mod n$ then we can produce a valid signature,
$$
x^d \equiv (m_1m_2)^d \equiv m_1^d\times m_2^d \mod n
$$
For $t$ signatures, I think we can have at most $\sum_{i=2}^{t}\binom{t}{i}$ new signatures. Is this correct?
This was inspired by a quiz question in which Alice published $t$ RSA signatures and we were asked to find a valid signature for $M \equiv m_1^{-1} \times m_2^{-1} \times m_3^{-1} \times ... \times m_t^{-1} \mod n$ and the solution was,
$$
M^d \equiv (m_1^{-1} \times m_2^{-1} \times m_3^{-1} \times ... \times m_t^{-1})^{d}
\equiv (m_1^{d} \times m_2^{d} \times m_3^{d} \times ... \times m_t^{d})^{-1} \mod n
$$
We assumed that all inverses existed. So, I was wondering why did this question involve inverses? Are they necessary to produce new signatures? Because as I showed above, I don't see why we could not do that otherwise.


texts:
Given an SBox, how can I generate its component equations (in ANF)?
For example, let's say I have this SBox:

6, 4, 7, 8, 0, 5, 2, 10, 14, 3, 13, 1, 12, 15, 9, 11

Then, the equations are:

$y_0 = x_1 \oplus x_0x_1 \oplus x_0x_2 \oplus x_1x_2 \oplus x_0x_3 \oplus x_0x_2x_3 \oplus x_1x_2x_3$
$y_1 = 1 \oplus x_0 \oplus x_2 \oplus x_0x_2 \oplus x_1x_2 \oplus x_0x_3 \oplus x_1x_3$
$y_2 = 1 \oplus x_0x_1 \oplus x_2 \oplus x_0x_2 \oplus x_0x_3 \oplus x_0x_1x_3 \oplus x_2x_3 \oplus x_1x_2x_3$
$y_3 = x_0x_1 \oplus x_3 \oplus x_0x_3 \oplus x_0x_1x_3 \oplus x_0x_2x_3$

The same question is asked in cs.stackexchange


texts: Can error be bigger - as in uniformly random? (Learning with Error)

texts:
Sketch of some basics of lattice signature schemes.

KeyGen: AS=T; S: private; A, T: public.

Signing:

Y <- random distribution.
C <- Hash(AY|message).
Z <- Y+SC.
Rejection sampling on Z, possibly restart. (Note here)

Verifying: Accept iff

Z is reasonably small.
c == Hash(AZ-TC|message).

What I know:

Rejection sampling is for making sure Z is independent of S so as to not leak info about secret key like NTRUSign. That's also why we need Y over a pretty wide range.

(Discrete) Gaussian distribution is used in BLISS to reduce signature size.

What I want to know:

What if the coefficients of S, A, Y are like one-time pads? Sampled uniformly within {0,1,2,..,q-1} - the full range of $Z_q$ where $q$ is the modulus of the coefficients?
Would we be able to eliminate rejection sampling then?
Would we be able to have smaller dimension with smaller coefficients?

Reason for asking.

Curiosity I had when working on the precision of BLISS sampler.


texts: Proving that 2 numbers are different without revealing them

texts: Imagine that Alice generates a number $a$ and Bob generates a number $b$. Is there a way that they can check that $a \not = b$ without revealing any information on $a$ and $b$ (Alice must not know $b$ and Bob must not know $a$) ?


texts: I understand that a CRC verifies data integrity by producing a checksum, which is the result of polynomial long division. I've heard hash values referred to as hash checksums, so my question is whether hash functions use some sort of polynomial division as well? I know they break the data up into block ciphers, so my guess would be that the hash functions create some relationship between the polynomial check value and how it's divided into the different blocks. Can someone let me know if I'm way off base here? I'm a crypto newbie so apologies if I'm way off.


texts: Is there any implementation of threshold BGN homomorphic encryption?

texts: The BGN paper (Evaluating 2-DNF Formulas on Ciphertexts) used a threshold variant of BGN. I also want to use this cryptosystem, however, I cannot find any open-source implementation. Is there any such an implementation? If not, how could I implement it (the secret key can be easily shared, but I do not know how to decrypt a ciphertext by each share and then combine these shares to get the final plaintext)? Thank you.


texts: Motivation of Adversarial Indistinguishability Experiment

texts:
I had a question about the motivation behind this definition provided in Katz and Lindell's cryptography book. I copied the paragraph in question along with the definition of the experiment.

  Perfect (adversarial) indistinguishability. We conclude this section
  by
      presenting another equivalent definition of perfect secrecy. This
      definition is based on an experiment involving an adversary passively observing a
      ciphertext and then trying to guess which of two possible messages was encrypted.

In the text, this is supposed to be an experiment where the adversary is passively observing a ciphertext and then trying to guess. My question is that in this game, it seems as if the adversary is choosing the two messages. Isn't this not simply an eavesdropping adversary, but rather one that can choose the messages being encrypted? I tried reading more about this, but I couldn't find anything regarding motivation behind this particular definition.

Rather than letting the adversary choose two messages, why not consider for any two arbitrary messages from the message space, sending an encryption of one of them to the adversary along with the two messages? More formally stated:

$$\forall (m_0, m_1) \in M^2,\; [m_0, m_1, E(m_0)] \approx_c [m_0, m_1, E(m_1)]$$

In this way, the adversary does not have a choice in what was encrypted, which seems more in line with the original definition.

Thank you in advance for the help.


texts: Are oracles needed in security proofs to prove that one problem is equivalent to the other?

texts:
I have seen a few security proofs where they show that solving one problem is equivalent to solving the other, via use of an oracle.

For example, when proving that problem A is equivalent to problem B. We assume an oracle which can solve problem A in polynomial time. Are there any other ways to prove that two problems are equivalent without an oracle?


texts: What is the difference between "wrapping" a key and encrypting?

texts:
I wanted to implement a way to generate an RSA public/private key pair and protect the private key with a password.

Looking into the Web crypto api, I thought the wrapKey/unwrapKey pair was the way to go. But then I got confused, and the documentation is not really helping because it seems to assume you know everything about cryptography.

What I'm really stumped on is, why do we need a wrapKey/unwrapKey in the first place? Can't you generate a symmetric key and encrypt the RSA private key with the symmetric key, and later decrypt it with the same symmetric key?


texts:
When using ECDHE with Curve25519 with openssl:

Server Temp Key: X25519, 253 bits

I thought when we use X25519, it use 256 bit key.  Why openssl shows the server temp key as 253 bits?


texts: Equality check in homomorphic encryption

texts:
Considering that we have a homomorphic encryption server working with integers mod p (a large prime number) with access to multiplication, addition and subtraction, is it possible to design an equality function which receives two encrypted values and returns an encrypted 1 if they are equal and an encrypted 0 if they are different?

This is obviously assuming randomized encryption, so direct comparison of the ciphertexts would be impossible.


texts: How to determine if a hash is pre image resistant or collision free

texts:
Let $H : \{0,1\}^*\to \{1,\dots, 2^{256}\}$ be a hash function.
Let $p > 2^{256}$ be a safe prime, and $\alpha$ a primitive root for $p$.
Define:
$$H'(m) = H(m || m),\quad H''(m) = \alpha^{H(m)}\bmod p$$
Where $m||m$ is the concatenation of $m$ with itself.

I am confused how when given hash functions like this, how to explain or tell if they are preimage resistant or strongly or weekly collision free? I also am confused on how the hashes, such as $H,H'$, and $H''$ connect to each other in that respect?


texts: Is CBC theoretically harder to brute force when compared with ECB?

texts:
Theoretically – is CBC mode harder to bruteforce when compared with ECB when assuming:

we ignore computational cost for the XOR operations, and
the IV is made public?