texts: Why is a non fixed-length encryption scheme worse than a fixed-length one?

texts:
I have the following definition (highlights by me):

  An (efficient secret-key) encryption scheme $(Gen,Enc,Dec)$, where $Gen$ and $Enc$ are PPT algorithms and $Dec$ is a Deterministic Polytime Algorithm, is one-time computationally-secret if for any PPT adversary $A$ it holds that the probability of the following experiment is negligibly biased from $1/2$:

  The adversary outputs two messages $m_0$ and $m_1$ of the same length.
  Let $k \leftarrow Gen(1^n)$ and let $b \in {0,1}$ be chosen uniformly at random. $c \leftarrow Enc_k(m_b)$ is computed and given to $A$
  A outputs the bit $b'$
  The output of the experiment is 1 $\iff b'=b$

I wonder why $m_0$ and $m_1$ should be of the same length, why is better than considering a non-fixed length encryption scheme?

The only drawback that comes to my mind is that if you are able to know something about the encryption of two messages of different length before they are actually encrypted (note that the key is generated in Step 2) then it would justify the choice of fixed-lenght. But I cannot think of a reason why it must be so.

Any ideas?


texts: Polynomially many iterations of one way permutation

texts:
I have seen that the existence of weak OWFs implies the existence of strong OWFs.
It comes from repeating the weak OWF polynomially many times on different random inputs.

However, I have a different question here : given a weak one-way permutation $f$, does the function $(f\circ f \circ f \circ \dots \circ f)$, where the composition happens polynomially many times, have to be a strong one way function? The first result seems to say this is untrue, because something like this would have worked in the previous case as well, but I'm unable to come up with a counterexample.


texts: How secure is role-based access control (RBAC). What kind of security does it incorporate to make sure no data is leaked and protected, especially from the admins responsible for assigning roles to users of the system. I am trying to compare it to cryptographic access control (CAC) such as ABE schemes, and therefore trying to understand the security behind it.


texts: Why are there $q^2$ keys for each equivalence class in Pedersen-van Heyst Signature Scheme?

texts:
How do you know there are $q^2$ keys for each equivalence class in the Pedersen-van Heyst Signature Scheme? My textbook says this is "easy to see", however, I am not seeing it.

Is it because in the signature  $Sig_K(\gamma_1,\gamma_2)$, the parameters $\gamma_1$ and $\gamma_2$ are both elements in $\mathbb{Z}_q$?


texts: Is more ECDHE or RSA currently recommended?

texts:
Lately I have seen that many websites warn us of changing RSA for ECDH, and that the latter is much better if we use its "ephemeral" form or better known as ECDHE.

So is ECDHE recommended to use more over other algorithms today?


texts: If I don't use XOR in Davies–Meyer, does it remain collision resistant?

texts: If I don't use XOR in Davies–Meyer construction like in picture 2, does the function remain collision resistant?


texts: In English, are there any words which encrypt to other words under the Caesar Cipher?

texts: Are there any words in the English language which, when encrypted using the Caesar Cipher with any key, result in another English word? How may one go about determining which Caesar shifts are weakest in this context?


texts: Sorted merkle tree versus rsa accumulator

texts: When compared to sorted merkle tree and rsa accumulator, which one is the best? Rsa accumulator has constant proof and it adds/deletes at constant cost. What is the verification cost for rsa accumulator? I think rsa accumulator's adding operation is better than sorted merkle tree. Is that correct?


texts: How to estimate the hardness of SIS instances?

texts:
The Short Integer Solution (SIS) problem is to find, given a matrix $A \in \mathbb{F}_q^{n \times m}$ with uniformly random coefficients, a vector $\mathbf{x} \in \mathbb{Z}^m \backslash \{\mathbf{0}\}$ such that $A\mathbf{x} = \mathbf{0} \mod q$ and $\Vert \mathbf{x} \Vert_2 < \beta$. This problem is at least as hard as the Shortest Independent Vectors Problem (SIVP) with approximation factor $\tilde{O}(\beta\sqrt{n})$ in $n$-dimensional lattices. Several proposed cryptosystems rely on SIS, most notable Ajtai's function in the original paper that defined the problem (link), the SWIFFT hash function (link), and several signature schemes (link) (link) (link).

However, I am confused about estimating the security offered by these cryptosystems in terms of the computational cost of a successful attack. Very few sources actually present a hardness estimate and those that do consider the appropriate root Hermite factor $\delta$ rather than a count of arithmetic operations.

For instance, the chapter by Micciancio and Regev (link) presents the following argument: There is an optimal number of columns of $A$ to take into account when attacking the SIS problem using lattice-based algorithms (presumably BKZ 2.0). Use too few columns and short lattice points might be too difficult to find (if they exist at all); use too many and the lattice will be too large. This minimum is found for $m = \sqrt{n \log q \, / \log \delta}$; at this point the average length of lattice points that can be computed in a "reasonable amount of time" is $2^{2\sqrt{n \log q \log \delta}}$, where $\delta$ is no less than $1.01$. So by requiring that $\beta < 2^{2\sqrt{n \log q \log \delta}}$, one guarantees that the SIS instance cannot be solved in a reasonable amount of time.

A similar treatment of the hardness of SIS instances is given by Section 3.2 of Lyubashevsky's 2012 signature scheme (link), which uses $\delta = 1.007$ for setting parameters. Micciancio and Peikert's 2011 signature scheme (link) mentions that setting $\delta \leq 1.007$ corresponds to $2^{46}$ core-years of lattice-redution, which is about $2^{100}$ cycles on a 1.0 GigaHerz CPU.

I have several questions regarding this. What makes it impossible or difficult to translate the parameters $(m,n,q,\beta)$ into an attack runtime estimate, and what is the significance of the root Hermite factor $\delta$ in this context? Given that $\delta$ is a useful tool, how does one translate between $\delta$ and attack complexity (in number of bits of security)? Given a target short vector length and lattice parameters, how to estimate the time before BKZ 2.0 finds a lattice point of this length? (Or, if this is not a sensible question, why doesn't this runtime matter?)


texts: Difference between HMAC-SHA1(key, msg) vs SHA1(key + msg)

texts:
Is there any practical difference from using HMAC-SHA1(key, msg) vs SHA1(key + msg) as a way to verify the authenticity/integrity of a certain message? Note that the plus sign means string concatenation in this context

Am I losing out on some esoteric detail that the HMAC-SHA1 offers in terms of mathematical immunity to cryptanalysis? Or do both approaches basically do the same thing?

Ive looked through the basic descriptions of both algorithms. And although HMAC-SHA1 seems to do some fancy things with padding and other stuff, I fail to understand any importance. To me both HMAC-SHA1(key, msg) & SHA1(key + msg) carry essentially the same strength/resistance against attacks aside from superficial details

How am I wrong, What am I missing?


texts: Multi-target attacks on AES-CTR with a random nonce

texts:
128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key.  A simple example:

Generate keys $k_1, k_2, ...,k_{2^{40}}$.
Pick a 128-bit message block $m$ and provide $m$ to the attacker.
Compute $E(k_1, m), E(k_2, m), ..., E(k_{2^{40}}, m)$ and provide these ciphertexts to the attacker.
The attacker can compute $E(k, m)$ for various keys $k$ finding a ciphertext that matches one of the ciphertexts provided.  This will take $2^{87}$ evaluations of $E$ on average.

I'm interested in what practical impact this has on the CTR mode of operation.  Some amount of known or controlled plaintext is clearly required for the attacker to get the block cipher output.  More importantly, this attack depends on the block cipher being fed the same plaintext block across many keys.

CTR mode encrypts blocks as $E(k, n \| c) \oplus P$, where $P$ is the plaintext block, $n$ is the nonce and $c$ is the block index.  Protocols that generate nonces deterministically would seem to be vulnerable to this attack.

My question: is it possible to adapt this attack to work against protocols that use CTR mode with a random nonce?  Does randomizing the nonce successfully protect CTR mode from multi-target attacks?


texts:
I am working on a project in which we will XOR two messages basically adding them together, $C_1= (M+K)$ and $C_2= (M'+K')$ the result should look like $K\mathbin\|K'$ and $M \oplus M'$.
My question is about the security of the resulting cipher after XORing two messages.

Note: Both the keys and messages have been chosen uniformly from the message space and keyspace in which we want to prove that, $\Pr [C=C \,|\, m=M] = \Pr[m=M]$


texts:
What's the meaning of "160-bit curve" in an elliptic curve? Or 192, 224, 256, etc. And what is the standard for selecting this number of bits?

Why they don't say "100-bit curve"?


texts: Does such a cryptographic protocol exist?

texts: Persons A, B and C put x€, y€ and z€ in a pot, respectively. Suppose that anyone can make a withdrawal from the pot as long as they prove they have such a right and that the y€ that B deposited is addressed to me. Is there a way for me to prove cryptographically that I am entitled to that amount without revealing that its origin was B?


texts:
One of the basic requirements of DSA is to choose some prime $p$ of certain bit length. The security then lies in the intractability of solving $y = g^x \pmod{p}$ for $x$.

Is there any “easy” way to solve the discrete log problem when $p$ is composite? I thought about the Chinese Remainder Theorem but can't seem to figure out how it would work. If there is no obvious way to solve for $p$ composite then what is the need for $p$ to be prime?


texts: Reusing same source for single-source randomness extractor

texts:
Let $ext$ be a single-source randomness extractor which takes a $d$-bit seed
and a $n$-bit source as input and produces a $m$-bit output.
Suppose we have a source $X$ with min-entropy $k$. Is it possible to reuse $X$ with different random seeds $S_1, . . . S_l$ for $l ≥ 2k$? In other words: Is $(S1, . . . S_l, ext(S_1, X), . . . , ext(S_l, X))$ statistically close
to $(U_{l(d+m)})$?

As a hint I was told to think of ext being the inner product over bits.

I know the answer is no, this is not secure, but why?
Especially in the case of $ext$ being the inner product over bits.


texts: Maximum steganographic embedding rate not detectable by steganalysis?

texts:
When using advanced steganographic methods (like F5) what is the approximate maximum embedding rate when advanced Steganalysis (like a machine learning approach) can no longer reliably detect it?

I have searched for papers dealing with this topic but have been unable to find any. Does anyone here know anything about this topic or any research papers dealing with this issue?


texts: Trying to understand the struct HkdfLabel from tls1.3 RFC8446

texts:
I'm looking at RFC 8446 section 7.1 and trying to understand the following:
HKDF-Expand-Label(Secret, Label, Context, Length) =
            HKDF-Expand(Secret, HkdfLabel, Length)

       Where HkdfLabel is specified as:

       struct {
           uint16 length = Length;
           opaque label<7..255> = "tls13 " + Label;
           opaque context<0..255> = Context;
       } HkdfLabel;

       Derive-Secret(Secret, Label, Messages) =
            HKDF-Expand-Label(Secret, Label,
                              Transcript-Hash(Messages), Hash.length)

HkdfLabel appears to be a concatenation of a few fields, to make it "fit" into the signature of Hkdf.Expand(...).  A few things I'm unclear on:

Are the pieces that make up the struct of HkdfLabel expected to be concatenated in the order they're defined? e.g. length||label||context
length = the hash length in bytes?
the first 0..6 bits of label are not specified, assuming 0?
"tls13 " + Label may be more or less bits than 7..255 allows for the assignment to label.  Is the expectation that it's zeroes if not long enough, or truncated to 256 bits if too long?
same basic uncertainty around context, is the idea that context will always be exactly 256 bits?
Assuming the above is correct, does that mean HkdfLabel will always be exactly 528 bits?

HkdfLabel = hashLength<0..15>||label<0..255>||context<0..255>


texts: Is this really the correct way to do an IND-CPA test?

texts:
In a description of IND-CPA (indistinguishability under the chosen plaintext attack), I have been reading the following, simple test:

  The adversary can generate as many messages as he wants. Then, he chooses two messages $m0$ and $m1$, those messages are encrypted, and one of the ciphertexts is sent back to him. The adversary should not be able to guess which message was used to generate that ciphertext.

Is that really the correct way to do an IND-CPA test?

I would imagine that — if I were the adversary and you the crypto-guru — I would pick and send you a one-liner saying "Hello world" and a copy of the front page of a news-paper article consisting of at least 100 words. Whatever you'll send me back encrypted will allow me to differ and identify the ciphertext as the average encryption won't pad that one-liner to the same length as the news-paper article. There's a pretty good chance that the newspaper article's cryptotext will be bigger than the one-liner's cryptotext.

Following that logic, it would mean that most (if not all) crypto currently used would fail that IND-CPA test.

Is that quoted test wrong or missing something?


texts: What is the role of the round counter in the key schedule of PRESENT?

texts:
Currently I am working on PRESENT block cipher implementation (Hardware) and I am unable to understand the role of round counter in key scheduling part of cipher.

Can some share some insight on round counter and its working?


texts:
I need my code to generate random elements from $GF(p)$ ($F_p$ or $Z_p$, if you will).

The Crypto API I have available provides one with random bit strings. To tailor that to my needs, I can think of two possible solutions, each with its downside.

Solution 1: Sample $\lceil\log_2p\rceil$ bits, and reduce its corresponding integer modulo $p$ or $2^{\lfloor\log_2p\rfloor}$. This is efficient and easy but the resulting distribution is not uniform.

Solution 2: Repeatedly sample $\lceil\log_2p\rceil$ bits until the output integer is less than $p$. This gives a nice uniform distribution but is not constant time and may leak something about the internals of the random generator.

Is either of these a good idea, or is another method commonly practiced?

Edit: The accepted answer works for any set of elements (not necessarily a field) of any size (not necessarily prime).


texts: Create a potential input for sha-256 hash given a substring of input?

texts:
Let's say I'm given a specific SHA-256 hash.

Further assume that the SHA-256 input, that yielded this hash contained a known sub-string.
Is there a way to find the input (containing the specific substring) that hashes to the given output?

If so, is it possible to further find an input of length N (containing the substring) to be hashed to the same SHA-256 hash?


texts: What are the advantages of TOTP over HOTP?

texts: HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What advantages does it introduce?


texts: Key escrow on indistinguishability games

texts: Does it mean that when PPT attacker is breaking an indistinguishable based (equivalent with semantic security) game with non negligible probability that he is able to infer the secret keys either on symmetric or asymmetric encryption?


texts: Any good links to learn the maths behind AES?

texts: I'm creating an academic poster for my EPQ on the mathematics of cryptography.  I would like to do a section on AES, however, I am struggling to find good resources to understand the maths.  I have watched the computerphile video on AES but it doesn't explain that much of the maths.  Is there any good resources out there that is able to explain the maths behind it in a not too complicated way so I am able to simplify the maths down so a sixth-former can understand it.


texts:
We recently learned about AES in class and it was heavily emphasized that encryption and decryption in AES are not the same because the functions are not reversible.
Why then, when we got to block ciphers, do certain cipher modes use the encryption function for both encryption and decryption?
The reasoning given was that XOR is reversible, but doesn't this contradict the first statement?


texts: How does one conduct a known-plaintext attack on an algorithm?

texts:
My question is two-fold:

Say I am given a total black box and I have n number of plaintexts as inputs that map directly to $n$-number of ciphertexts as outputs. This is all I know, and I do not have access to the algorithm. Is it possible to conduct a known-plaintext attack?
In the event that I do have access to the algorithm's internals, how would one go about attempting a known-plaintext attack on a cryptosystem? What specific weaknesses or traits in the algorithm would one generally be looking for? Is it algorithm-specific or is there a generic process?


texts: Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

texts:
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure.  So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$.  Why are these secure?  How do we know that they are secure?

(Here $E$ is a block cipher with $n$-bit key and $n$-bit plaintext; $E_k(x)$ denotes encryption of plaintext $x$ under key $k$.  This question is based upon one originally asked by yanglifu90.)


texts: Using bad generator in ElGamal Encryption

texts:
Suppose Alice chooses a random Prime $p$ and a random private Key $a \in \mathbb{Z}^*_p$. By accident, she also chooses a random number $g \in \mathbb{Z}^*_p$, which is not a generator of $\mathbb{Z}^*_p$ and therefore

$$\langle g\rangle \subset \mathbb{Z}^*_p$$

as opposed to $\langle g\rangle = \mathbb{Z}^*_p$, which would yield a valid key. Alice then computes $A \equiv g^a \pmod{p} $ and publishes the Tuple $(p,g,A)$ as her public key.

Bob now encrypts a message $M$ using Alices public key by computing

$$C_1 = g^b \pmod{p}$$
$$C_2 = M \cdot A^b \pmod{p}$$

Is it possible for an attacker (Eve) to distinguish a “real” ciphertext $(C_1,C_2)$ from a random ciphertext $(Z_1,Z_2) \stackrel{$}{\longleftarrow} \mathbb{Z}^*_p$ with significant advantage (say $Adv \geq \frac12$)?

Edit: I guess it should be enough to show, that the ciphertext cannot be random, if

$$\langle g \rangle \neq \langle C_1 \rangle \quad(\text{or $Z_1$, respectively})$$

But how can Eve check for this property efficiently? Can someone point me in the right direction here?

Edit: A real-world situation where this flaw occurred was recently found in the PyCrypto Library


texts: What cryptography primitives can help me (generate unforgeable tag)?

texts:
I have a read-only public bulletin board that It contains a series of information to form:
$$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$
where $a_i\in\{0,1\}^n$ and $a'_i, m \in \mathbb{F}^*_q$ ($a'_i$ is output a PRF on input $a_i$).

I want to produce tags that are not forgeable, and also are validated by their public information. For example, for pair $((a_i,a_j),t_1,t_2)$, first fetch $(a_i,g^{a'_i \cdot m})$ and $(a_j,g^{a'_j \cdot m})$, and then validate the tags as follows:

$$\big (g^{a'_i \cdot m} \big) ^ {t_1} \stackrel{?}{=} \big (g^{a'_j \cdot m} \big) ^ {t_2}$$

What cryptography primitives can help me?


texts: Hash functions to generate a one-time pad

texts:
Maybe this is a newbie question:

Stream cypher, will XOR message bits with one-time pad bits.
Suppose I have a pseudorandom number generator, like a Mersenne Twister or something similar. I could use the pseudorandom string to XOR the message.
Use the password as the seed of the generator. Same password = same pseudorandom sequence.
Could hashing blocks of the pseudorandom sequence create a stronger one-time pad stream?


texts:
Paillier cryptosystem has self-blinding property.
(change one ciphertext into another without changing the content of its decryption)

Is there any threshold encryption scheme (or just encryption scheme) which provides one time blinding?

(One time blinding means that the number of changing is limited to one.)


texts: How to encode and decode message into polynomial form on NTRU

texts:
This question is based on a previously asked question. How to make a message into a polynomial on NTRU encryption?
I am tasked to implement NTRU with toy parameters such as $N=7$ or $N=11$ and I have some questions.

Does the message length have to be smaller than or equal to the parameter $N$? Can I do encryption on a message larger than parameter $N$ or do I have to break them up?
One method mentioned was to convert the message into ASCII and then ternary form and then add them up to be the input as follow:

h 01101000 X^3+X^5+X^6
e 01100101 1+X^2+X^5+X^6
l 01101100 X^2+X^3+X^5+X^6
l 01101100 X^2+X^3+X^5+X^6
o 01101111 1+X+X^2+X^3+X^5+X^6
w 01110111 1+X+X^2+X^4+X^5+X^6
o 01101111 1+X+X^2+X^3+X^5+X^6
r 01110010 X+X^4+X^5+X^6
l 01101100 X^2+X^3+X^5+X^6
d 01100100 X^2+X^5+X^6

However, in this case, how do I decrypt the message given that the decrypted message would be the addition of all the polynomials? Or do I have to encrypt and decrypt each letter separately?


texts: Does it increase security if the CBC chunks of a AES-256 encrypted bytestream are uploaded to different clouds?

texts:
I want to backup my data according to the 3-2-1 rule. I already backup to 2 different drives (2 different systems) at home.  In addition i would like to use cloud storage (Google, Amazon etc.). Considering the future weakening of cryptography by advancements in computing power (e.g. key guessing by quantum computing) i want my data to be as safe as possible because once it's uploaded it's prone to decryption in the future (i can't guarantee the data is deleted if i delete it from the cloud(s)).
Does it increase securtiy of my data if i split the CBC chunks to let's say 2 clouds?
Uploading the even numbered CBC elements to e.g. Google and the odd numbered elements to Amazon.
Since one storage hoster is constantly missing the next part of the CBC-Chain (1/2 in total) shouldn't this increase security of the data even if the AES key is known by the hoster(s)?


texts:
Noob question:

It is my understanding that the raw output from

non-blocking /dev/random (where the kernel's   entropy_avail estimate is equal to or greater than the number of random bits required)

or properly-initialized /dev/urandom (i.e., after roughly 256 bits of entropy have been collected by the system)

can be used without further post-processing as strong keymat for long-term symmetric crypto keys.

The output is gathered thusly (for the symmetric key):

//output 256 bits of entropy in 64 hex digits
od -N 64 -x /dev/random

Is there any weakness in this method as I have been recently led to believe (with no justification other than 'it's common knowledge', supposedly), or is raw /dev/[u]random output usable for long-term (>10 year) keymat?

Edit: remove any reference to asymmetric crypto to make its own question.


texts: What is the difference between Scrypt and PBKDF2?

texts:
After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2.

As far as I understood, the similarity is:

both are password-based key derivation functions.

The difference is:

Scrypt is more resource demanding.

Am I missing something?


texts: Looking for a Non-textual hashing function

texts:
Pardon my terminology, but is there a hashing function of some sort which accepts a string as input and generates a non-textual output of some sort, or perhaps a unique output that can be used to draw a visual representation of the output.

I refer it to as "hash" because the same output should always lead to the same visual representation of the output i.e. behave like a hashing function, even though my use-case is highly tolerable towards collision as its only meant to uniquely identify in a small group of inputs when compared to another small group of inputs, and it need not be absolutely unique across the vast range of inputs that are possible. Though even the slightest change in input, should change the visual output considerably.
Objective: I am exploring the possibilities of using a visual cue derived from random strings that can aid in differentiation and quick identification in a small group. Eg: How CryptoKitties project generates a visual image of a cat by their genome representation which is just a textual input.
Use-case: I am building an air-gapped multi-accounts multi-currency cryptocurrency wallet which is a 2-device system (Vault + Wallet). Vault boots up as an ephemeral instance of OS, so it doesn't store any information across boot instances. So accounts that are once created in vault and imported into wallet using an xpub key and labels are added there. Vault doesn't and can't store any labels associated with the accounts. So when the same accounts are derived on the vault program upon initialization on next boot, I am trying to represent every account (essentially the xpub key by a visual character so that they are matched with the accounts on the wallet by simply looking at them without any communication required.


texts:
Which of these population tracking protocols is better from a cryptography point of view?

Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT)
Decentralized Privacy-Preserving Proximity Tracing (DP-3T)

I have read a paper discussing some of the security concerns, but it does not go into much detail about the cryptographic technology involved.

For example, what happens if Bluetooth keys are compromised? Is revocation possible in practice? How is key generation performed in the first place? Are keys generated locally by each device?


texts:
I have seen in some places that people use formal verification and/or computer-aided verification for cryptography (tools like ProVerif, CryptoVerif, etc.).

How do these approaches work?


texts: Picking a nonce in the context of CCM (CTR with CBC-MAC) mode

texts:
After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked.  The RFC says:

  A nonce N of 15-L octets.  Within the scope of any encryption key
     K, the nonce value MUST be unique.  That is, the set of nonce
     values used with any given key MUST NOT contain any duplicate
     values.  Using the same nonce for two different messages
     encrypted with the same key destroys the security properties of
     this mode.

If the nonce values must not contain any duplicate elements doesn't this imply that they should be known to all parties in a transaction. For instance if a client wishes to authenticate and communicate with a server, shouldn't they both have a predefined set of nonces. If not, how should they be exchanged, given that the context only allows for CTR-AES encrypted messages?


texts: Can you distinguish encryption methods from the output?

texts:
Suppose that you see all IP communication packets between two computers for a day, as they pass through a connecting router, and this amounts to 10MB. You additionally know that all data transmission follows the standard "RSA-1024 plus AES-128" protocol. To be even more specific, suppose you know only one computer is doing RSA decryption, which computer that is, its specific "public key", and that the RSA decryption is only done to re-initiate the AES key after the other computer is (instantly) rebooted.

Could you look at the 10mb and get any information about whether the computer was rebooted?

I wonder if these pseudo-random streams could be "hashed" in some way to help...e.g., maybe 0.03 bits of information is revealed ("Because of this abnormal X-X-X data series in the stream, there is a 60% chance it was rebooted, instead of the normal 50%.").

I know that any revealing (even a tiny part of a single bit as useless as the rebooting of a computer) is against the goal of this encryption, so I ask in a rigorous way for those familiar with these protocols and their outputs. I truly wonder if there isn't some blatant unencrypted "I need to login from scratch, please!" signal in the standard protocols. When a computer loses its AES key, they could be blatant to help the server, or they could rely on the server to use AES first, conclude it's gibberish, and then try RSA. I'm guessing the latter is done, but hoping for confirmation here.

To answer my own question, I do believe that 0.03 bits would be reasonable, mainly due to the timing of the packets. RSA encryption/decryption takes longer, so delayed responses correlate with a reboot (please notice I'm ignoring the actual power-down time and wrote "instantly rebooted" in the problem statement to focus just on the cryptography).

Note: We need more information on the protocol to confidently answer this, but I know nothing beyond the AES and RSA algorithms.  This is why I ask the question.  So, if you must, please just assume the server URL is "https://whatever.ext" or choose a common reasonable protocol.


texts: Name for crypto algorithm that preserves visual pattern

texts: Given some input plaintext and output ciphertext, is there a group of crypto algorithms that mean that a change in the ending x bytes of the input plaintext makes some y change at the end of the ciphertext as well? The point is to conserve the visual pattern, but to still be encrypted.


texts: Diffuse the 64 bit key into eight 8 bit blocks. Each block can be brute forced in 2^8 steps. Thus, eight 2^8 steps and in total 2^11 steps are required for brute forcing. Is this kind of brute force possible?


texts: How to sequence SHA256 block circuit to obtain hash of a message comprising multiple 512 blocks?

texts:
I am trying to obtain a circuit that computes the SHA256 hash for an input message that is greater than 512 bits.

I understand how the message is to be padded (we append a 1 and then some zeroes, and then the last 64 bits contain the length of the original message and so on).

After I do the padding, I have two 512-bit blocks.

I want to use the circuit (for the compression function) that is provided here:

https://www.cs.bris.ac.uk/Research/CryptographySecurity/MPC/

The first 512 wires of the circuit are the input; the last 256 wires are the output. I think I know how to use the circuit for the first block. I can simply feed my first 512-bit block into the first 512 wires of the circuit.

But I am not sure how to proceed for the second block. In particular I need to update the h0, h1, ... , h7 values but don't know how to as I cannot identify where the wires corresponding to them are in the circuit.

Any help would be much appreciated.


texts: Are the ECDSA public keys of a stable/fixed length relative to curve size?

texts:
I am working in an environment with strict bandwidth requirements, and we need predictable bit lengths of the stuff we send. We need to broadcast ECDSA public keys, and we are using OpenSSL to generate them.

So will the prublic key lengths vary from private key to private key? Or will they be constant?

I noticed there are many output formats, like DER, and one with base4 encoded public key wrapped in headers. I would like the shortest possible public key, possibly in bit format, with predictable length. What is the best way?


texts: Does an attacker gain an advantage if they have the initialisation vector?

texts: Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?


texts:
I am reading a paper on security analysis of a cipher image using the paper at the following URL:

https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8306512&tag=1

It indicates some test that a cipher image should pass for successful encryption. One of the simple test is to count the number of ones and number of zeros in the BINARY SEQUENCE of the image, and they should be equal, i.e 0.5 roughly of the total:

How is it possible to get a proper binary sequence representation of the image? Do I just convert each bit into its binary representation and form a binary sequence, do I have to do something else?


texts:
I have a doubt about AES-GCM on how can I avoid replay attacks. We have 2 users (Alice and Bob). After that the entities negotiate crypto parameters and generate a symmetric key, they'll exchange encrypted message.

The possible encryption algorithms are two: AES-128-GCM and AES-128-CBC.
By using AES-128-GCM, Alice and Bob choose the following parameters:

$IV=nonce$ where $nonce$ is a pseudorandom number
$AAD="static-data"$
$K$, a 128 bit key
$D$, the plaintext

Now we suppose that in order to avoid replay attacks, I want to use a timestamp $t$. Is it correct that Alice sends the ciphertext $CT=E_K(IV,AAD,D)$ to Bob together a timestamp $t$ like $CT||t$ or encrypt the timestamp in the ciphertext (and in this case the plaintext $D$ becomes $D||t$) in order to avoid replay attacks ?


texts: ZKP of the validity of a decryption key without revealing the message in public

texts:
Alice publicly shares encrypted message $E_k(m)$.
Alice publicly shares the key encrypted with Bob's public key $E_\mathit{bob}(k)$.
Alice wants to create a Zero-Knowledge Proof that this is indeed the key that unlocks $E_k(m)$ encrypted with Bob's public key, such that anyone can be convinced that Bob can now know the message $m$ by decrypting $E_k(m)$ without revealing any information about $m$ or Bob's private key.

Is this possible using cryptographic tools (ZKPs, SNARKS, hashes, etc...)?


texts: Does any operating system offer full system encryption, including RAM and SWAP?

texts:
I‘ve been looking around and did my research but I could not find any information if any operating system exists which would be able to encrypt all data, including RAM and the SWAP partition, to protects things while the OS is up-and-running.  I found infos about disk encryption, file encryption, and much more, but I seem to have a hard time to find infos related to a “complete system being protected by the operating system”.

Simpler said: I’ld like to know if it’s possible to protect a computer system with such an OS so that – when anyone steals the hard disk of a webserver while it’s running – the thieve can’t decrypt the data.

Is there something like a fully encrypted OS, or is that impossible for some reason(s)? If, which reason(s) would that be?


texts:
When a new client tries to connect with wi-fi, it enters a password which is provided by the wi-fi owner. I wonder what is so hard to capture this password by a hacker when it is being sent to router for authentication? Client can't encrypt this password because symmetric key for encryption/decryption are not exchanged till yet. Only the password is sent which must be in plain text.

Second thing, now suppose multiple clients are connected with the same wifi. Why can't they read traffic of one-another? Are all of them using different symmetric key?

Is pre-shared key same as the  password which your wifi owner provides you to enter? If it is a password then there is no sense to call it as key because there is a huge difference between a password and a key. Passphrase=Password but both are not equal to key.


texts: How can I protect against the failure of a block or symmetric cipher?

texts:
Can I protect against the failure of a block or symmetric cipher by chaining different techniques together?  If so what implementation details should I be aware of?

Are some combination of ciphers better or worse than others?

In my case I'm not concerned about the CPU expense, but am more concerned about defending against unintentional programming errors or malicious crypto implementation (in hardware or software).


texts: Minimum Nonlinearity of boolean function

texts:
I have studied many literature on boolean functions. The nonlinearity of a boolean function is defined as min of hamming distance of the function from all the linear functions in the set. There is also formulas for calculating nonlinerity of boolean function  in terms of no of inputs (n). Now i have following two doubts

Is the nonlinearity of all boolean functions in the same boolean space(say V5) is same or different for different functions ? IF different then how to calculate nonlinearity of each one seperatly ?
How to calculate minimum nonlinearity of a given boolean function in a given boolean space say(V5).


texts: Period of pseudo random sequence generated from (5, 2, 0) LFSR


texts: Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?

texts: In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.


texts: Why Curve25519 for encryption but Ed25519 for signatures?

texts:
NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different primitives for these operations? Why just not to use the same primitive for both key-sharing and signatures?

Are there some security or performance considerations? But both key-sharing  and signing rely on multiplication of curve point by scalar so I guess you can't gain anything here by using different curves. If one of the curves is faster it should be faster in both cases.


texts:
How does a hybrid argument work relating to PRG's?
I am working on a homework assignment where the problems say to use a hybrid argument to prove/disprove that something is a secure PRG, and I can't find an explanation of this idea anywhere online or in the notes which makes sense to me.
I think the idea is to have a sequence of distributions where each pair of successive distributions is indistinguishable, but I can't imagine how to construct such a sequence. And if I did have such a sequence, well I understand how to use a hybrid argument to show that something is a PRG from there, but not how to show that something isn't a PRG.
What I mean is that one of the problems says something like we'll construct a PRG $G$ from other PRG's $G_1, G_2,$ and $G_3$. Then use a hybrid argument to prove that $G$ is a PRG, by showing that a PPT which breaks $G$ can be used to construct a PPT that breaks $G_1,$ or $G_2$ or $G_3$. To be honest I have no clue how to do that, and I've been trying to figure it out for hours.
I think that the construction of $G$ is relevant, so I'll tell you it is defined like this: $G(s)$ is computed by taking $G_1(s) = s_2||s_3$, and then returning $G_2(s_2)||G_3(s_3)$. This is with $s, s_2$ and $s_3$ of length $n$, and $G_2(s_2)$ and $G_3(s_3)$ of length $3_n$. Oh and I'm using $||$ as string concatenation, I'm not sure how standard that is.
Any suggestions, or explanations of these concepts would be greatly appreciated! And let me know if this is the wrong place to post this, I wasn't sure.


texts: Explain the mathematical definition of a cryptosystem using words

texts:
So when googling "cryptosystem" I found a Wikipedia page which contained a mathematical definition of a cryptosystem. Find this definition below.

Could someone tell me what that what the last line means, in words instead of using mathematical signs? Maybe it will help my understanding of it.

  Mathematically, a cryptosystem or encryption scheme can be defined as a tuple $(\mathcal{P}, \mathcal{C},\mathcal{K},\mathcal{E},\mathcal{D})$ with the following properties.

  $\mathcal{P}$ is a set called the "plaintext space". Its elements are called plaintexts.
  $\mathcal{C}$ is a set called the "ciphertext space". Its elements are called ciphertexts.
  $\mathcal{K}$ is a set called the "key space". Its elements are called keys.
  $\mathcal{E}= \left\lbrace E_k:k\in \mathcal{K}\right\rbrace$ is a set of functions $E_k:\mathcal{P}\rightarrow \mathcal{C}$. Its elements are called "encryption functions".
  $\mathcal{D} = \left\lbrace D_k:k\in \mathcal{K}\right\rbrace$ is a set of functions $D_k:\mathcal{C}\rightarrow\mathcal{P}$. Its elements are called "decryption functions".

  For each $e\in \mathcal{K}$, there is $d\in \mathcal{K}$ such that $D_d(E_e(p))=p$ for all $p \in\mathcal{P}$.


texts: In interactive proofs, do we assume that the prover can always solve the problem?

texts:
I'm having a difficult time understanding a concept from interactive proofs:

A trivial interactive proof for the graph isomorphism problem is having the prover just send a permutation that shows an isomorphism between $G_1$ and $G_2$, and have the verifier check it.

But what happens when $G_1$ and $G_2$ aren't isomorphic? If the prover really does know a solution to the problem, he'll just say that they aren't and we'll move on. But what if he always says that they aren't isomorphic? We have no way of knowing whether they really aren't, or whether the prover is lying, right?

So the prover might just always answer "not isomorphic" for any problem given to him, and we'll have no way of knowing whether he's correct or not.

So when we discuss interactive proofs (and Zero-Knowledge Proofs especially) do we always assume that the prover is capable of solving the problem?

Thanks


texts: Is this an acceptable way to increase the block size of a block cipher?

texts:
Note: This is all for fun and learning. None of this will go into production code.

I'm studying something (sponge functions, specifically) that benefit from large block sizes. AES has a (comparatively) small block size of only 128 bits. Is this a safe construction for increasing the block size?

$E(x)$ and $D(x)$ are encryption and decryption in ECB mode respectively. The size of the input $b_0$ is a multiple of the cipher's block size. The encryption proceeds as follows.

$$c_n = E(b_{n-1})$$
$$b_n = shift(c_n)$$

This is repeated once for every blocksize chunk in the input. For example, encrypting a 512-bit block with AES (a 128-bit block cipher) will take 4 rounds, so the output will be $b_4$.

Decryption is a simple reverse of the above algorithm.

$$c_{n} = shift^{-1}(b_n)$$
$$b_{n-1} = D(c_{n})$$

$shift(x)$ is defined as lining up the blocks vertically and shifting each row by an amount corresponding to it's row. All operations are done on the byte level. It is similar to ShiftRows in AES.

For example, with a block size of 8 (bytes) and an input of aaaaaaaabbbbbbbb12345678, $shift$ would proceed like this.

ab1 <-- shift by 0            = ab1
ab2 <-- shift by 1            = b2a
ab3 <-- shift by 2            = 3ab
ab4 <-- shift by 3 (equiv. 0) = ab4
ab5 <-- shift by 4 (equiv. 1) = b5a
ab6 <-- shift by 5 (equiv. 2) = 6ab
ab7 <-- shift by 6 (equiv. 0) = ab7
ab8 <-- shift by 7 (equiv. 1) = b8a

The resulting output would be ab3ab6abb2ab5ab81ab4ab7a.

The intention is to diffuse it enough to make sure every plaintext bit has an effect on every ciphertext bit.

Are there any major flaws I'm missing here?


texts: Why the following attack in common modulus RSA works?

texts:
Suppose that i share a common modulus  $N$ with two users $u_1$ and $u_2$ with public, secret keys ($e_a,d_a$), ($e_b,d_b$).
Why then  $gcd(V,e_b)=1$ where $V=d_a*e_a-1/$W and $W=gcd(e_b,d_a*e_a-1)$  and as a consequence with extended euclidena algorithm i compute $α,β$ such that $α*e_b+β*V=1$ and it comes that $α=d_b$


texts: Is there a public key encryption scheme with optimal key size?

texts:
Symmetric encryption schemes such as AES have known security levels equal to their key sizes (i.e. breaking an encryption with an $n$ bit key needs about $2^n$ work steps).  Elliptic curve encryption gets halfway towards optimal: its security is half the size of the public key.

Are there any public key encryption schemes known which have security level equal to size of public key?  If not, do any do better than ECC?


texts: Why does encryption in STS protocol protect against identity attacks?

texts:
The basic STS protocol contains encryption of the signature as shown in Wikipedia.
https://en.wikipedia.org/wiki/Station-to-Station_protocol

If we would like to defend against MITM attack, this protocol will work even without the symmetric key encryption. A related question is asked here
In the STS Authentication Protocol, why are the signatures encrypted?

The answer points out that some identity protection is enforced. However, I am not convinced that the identity of Alice and Bob are protected. A MITM attacker can figure out where the traffic is coming from and where the traffic is going to. It should be easy to bind the traffic from specific machine. Then use other unencrypted traffic from that machine, it should be easy to figure out who the machine belongs to.

Another question:
Why A is protected against active attack while B is protected against passive attack?


texts:
I was wondering why someone would go and use HKDF (or any KDF) when they can use a stream cipher instead.

It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or DES key schedules for example). So using a KDF might be dangerous if you use it to both derive public and private values (although it seems like the most used one, HKDF, is constructed to be one-way. Which is good since it is used in TLS to derive private keys as well as public IVs).

I can see two reasons why a KDF might be of a better fit:

it takes a SALT parameter. So you can use it several times with the same key, but by varying the parameter you will get different output. If you would do that with a stream cipher you would need to remember a state.
it has a work factor. So with the SALT and that you can use it as a password hashing function. But then we're kind of off track.

But these two things don't seem to be specific to a KDF...


texts: I'm a high school student doing a project about blockchain. I'm trying to figure out why hashing algorithms are crucial for the existence of blockchain and other types of cryptography wouldn't work. However I've learned about pseudo random number generators and they seem to do the job. Any reason why these would not be qualified?


texts: Can the CRT speed-up Paillier decryption by more than a factor of two?

texts:
In the Pailler cryptosystem, decryption goes $m\gets\displaystyle\left\lfloor\frac {\left(c^\lambda\bmod n^2\right)-1}n\right\rfloor\mu\bmod n$ with $\mu<n$ being a part of the private key just like $\lambda=\operatorname{lcm}(p-1,q-1)$ for $n=p\,q$.

The Chineese Remainder Theorem allows to speed-up this computation knowing the factorization $n=p\,q$, as follows:

Evaluate $x=c^\lambda\bmod n^2$ by the Chinese Remainder theorem, that is

$x_{p}\gets c^\lambda\bmod p^2$
$x_q\gets c^\lambda\bmod q^2$
$x\gets\left(q^{-2}(x_p-x_q)\bmod p^2\right)q^2+x_q$
note: $q^{-2}\bmod p^2$ can be precomputed.

Then evaluate $m\displaystyle\gets\left\lfloor\frac{x-1}n\right\rfloor\,\mu\bmod n$.

This speeds-up decryption by a factor of at most two (each of the first two modular exponentiations is manipulating values half as large as for $c^\lambda\bmod n^2$, and is thus at best four times faster). In RSA, the CRT gives larger savings (sometime approaching four), because the exponents $d_p$ and $d_q$ have about half the size of $d$.

Can we improve the savings obtained and exceed a factor of two?

This question is an attempt to compute $m_p=m\bmod p$ and $m_q=m\bmod q$, then use the CRT to get $m$. If the computation of $m_p$ could somewhat we performed mostly modulo $p$ or $p^2$, perhaps the savings would be improved.


texts: Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?

texts:
background

In [Shoup2004], Victor Shoup synthesizes the 'sequence of games' technique for proving security properties:
Roughly it consists in a sequence from game_0 to game_n, game_0 consisting in the property. You prove that for any two games the two probability of success are negligibly close, then you prove that the probability of success of game_n is negligibly close to the target probability; it follows that the probability of success for game_0 is negligibly close to the target probability, which proves the property.

Shoup identifies 3 types of transitions, namely indistinguishability-based, failure-event based and bridging step (which is a bit apart).

In the failure-event based transition, the two games are equivalent unless a failure event $F$ happens; then Shoup states:

  to prove that $Pr[S_i ]$ is negligibly close to $Pr[S_{i+1}]$, it suffices to prove that $Pr[F]$ is negligible.

EDIT writing it as a theorem could make it clearer:

Theorem(Shoup's Framework)
Let $(G_i)_{i=0..n}$ be a sequence of games with their respective "Fault" event $(S_i)_{i=0..n}$
If $\forall i ~ |Pr[S_i]-Pr[S_{i+1}]|$ negl. ("transition lemmas")
and If |Pr[S_n] - Target| negl.
Then |Pr[S_0] - Target| negl.

Lemma(Shoup's Fault-based transition)
If $Pr[S_{i+1}|$ not $F] = Pr[S_i]$
And $Pr[F]$ negl.
Then $|Pr[S_{i+1}]-Pr[S_i]|$ negl.

Question

It is not hard to prove that this is true. However I think that the requirement on $Pr[F]$ is way too strong: one can prove security with much more frequent faults.
Namely I think I can prove it holds for non-negligible $Pr[\bar{F}]$ (proba of non-fault) as soon as the success probability $Pr[S_{i+1}]$ is negligibly close to the target probability (which is 1/2 here, didn't look if it works for target 0).
The latter ("$Pr[S_{i+1}] - 1/2$ negligible") will prove right later in the proof anyway thanks to the other transitions.

Question: does the following theorem hold, and has it been added to Shoup's framework for crypto proofs ?

Argumentation

Lemma(My Fault-based transition):
(we assume Target = 1/2)
If Pr[$S_1$ | not F ] = Pr[$S_0$]
and If Pr[not F] non-negl.
and If |Pr[$S_1$]-1/2| negl
Then |Pr[$S_1$]-Pr[$S_0$]| negl.

proof

Let "OK" be then event "not F".
When a failure event happens,
the algorithm can still make a random guess before halting,
thus $Pr[S_1 | \bar{OK}] = 1/2$

$Pr[S_1] \geq Pr[S_1 | OK ].Pr[OK] + Pr[S_1 | \bar{OK}].Pr[\bar{OK}]$
$Pr[S_1] \geq Pr[S_0].Pr[OK] + ½ (1 - Pr[OK])$
$Pr[S_1] \geq Pr[OK](Pr[S_0] - ½) + ½$
$(Pr[S_1] - ½)\frac{1}{Pr[OK]} + ½ \geq Pr[S_0]$
$Pr[S_0] - Pr[S_1] \leq (½ - Pr[S_1])(1 + \frac{1}{Pr[OK]})$

Then since $(½ - Pr[S_1])$ is negligible
and $(1 + \frac{1}{Pr[OK]})$ is polynomially bounded,
$Pr[S_0] - Pr[S_1]$ is negligible which ends the proof.

Recall that the hypothesis "$|Pr[S_{i+1}] - 1/2|$ negligible" will be proven right later in the proof, so it's not a problem having it.


texts:
There are currently FHE implementation for

AES
Simon
Speck, and may be more.

Except for speed testing, amortized or not, one meaningful usage is mitigating form side channel analysis. Intel, AMD, or ARM can implement this algorithms secured from known side channel attacks and even from cache attacks and , actually, we can have such software versions, too.

Are there any other meaningful usage for FHE block ciphers?


texts:
Is it mathematically possible to take a SHA256 hash and turn it into a 0-99 number where each number in 0-99 range is equally likely to be picked?

As a 256 bit hash means the highest value possible is 2^256, this is not a nice or "round" number for the purposes of simplifying a hash down to ranges more natural for humans.


texts: How Significant is the New Quasi-Polynomial-Time Attack on Fixed Characteristic Discrete Logarithms?

texts:
There is a new paper by Kleinjung and Wesolowski on eprint that claims and proves a new attack on the discrete logarithm problem in finite fixed characteristic fields in quasi-polynomial time.

Concretely a run-time of $$(pn)^{2\log_2n+O(1)}$$ is claimed for discrete logarithms in the group $\mathbb F^\times_{p^n}$.

Of course I did some calculations and they ended up showing that for a 2048-bit modulus, i.e. $(p,n)$ such that $p^n\approx 2^{2048}$ this expression evaluates to at least $\approx 2^{280}$ (and up to about $2^{310}$ for "bad" pairs). I also computed a guesstimate for varying modulus sizes and it showed that this function grows so fast that even at about 150-200 bits this already crosses the $2^{100}$ mark and the $2^{200}$ mark at about 1200-bit.

So my question:
What is actually the significance of this work? Does it merely provide a provably sub-exponential algorithm that can't compete e.g. with the non-provably fast GNFS / Function Field Sieve? Is it actually a practically relevant improvement over the GNFS / FFS?


texts: Signal vs Telegram in terms of protocols?

texts:
Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective companies, thereby "rolling their own crypto", which by agreement is bad.

At this point, stating that the protocol is "worse" was my action and shall not influence answers.

To get a more complete answer to this widely interesting question I'm hereby asking for a canonical answer that compares MTProto with Axolotl and uses well-defined and well-accepted cryptographic knowledge and standards.
A responder may (but does not have to) put a conclusion promoting one protocol over the other.

An answer may include, but doesn't have to or is limited to the following points:

Broken security ("On the CCA (in)security of MTProto" by Jakobsen and Orlandi).
Highly non-standard modes (e.g. IGE).
Highly discouraged modes (e.g. MAC-and-Encrypt)


texts: How to check runtime of e.g. Ed25519 signature algorithm

texts:
As mentioned here the verification of a Ed25519 signature takes roughly 3 times as the time for the generation of a signature. Two questions on that:

1) Can I assume that this is a rule of thumb for this algorithm? I can imagine that the ratio of the times differ for different CPUs

2) How can I exactly see (using the algorithm) why verification takes (much) longer?


texts: What is the fastest modular reduction algorithm available?

texts:
I have been browsing for the fastest and most efficient modular reduction algorithms and came across quite a few.

But the one in A Fast Modular Reduction Method (2014) by Zhengjun Cao, Ruizhong Wei and Xiaodong Lin is the fastest that I could find. This implementation is based on look-up-table.

Is this the fastest algorithm for performing modular reduction or are there faster methods out there?


texts: Are this recommendations from Colin Percival correct?

texts:
In this article: http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf

He has said:

AVOID: Poly1305. If your name is Daniel Bernstein, go ahead and use
this Otherwise, you’re never going to produce a secure and correct
implementation
DON’T: Use modes which provide both encryption and authentication
PROBABLY AVOID: Elliptic Curve signature schemes


texts: Is there a property comparable to IND-CPA for hash functions taking a random value?

texts:
I would like to have a function $F(x, rnd)$, where $rnd$ is a fresh random value, such that it is hard, given $x_0$ and $x_1$, to distinguish $F(x_0, rnd)$ from $F(x_1, rnd)$,
EDIT: but the values should be different, i.e., I should be able to recompute the value from $x_0$ and $rnd$ and see that it is the correct value.

I can do this with an asymmetric encryption function that has the IND-CPA property, but in my case, I do not need decryption. Thus, I thought about using a hash function, and my first simple idea was to simple concatenating the randomness, $H(x || rnd)$, but I'm not sure that this is sufficient.

I have looked into keyed hash functions, but I don't really want to use a key, just a random value. I did not really find a "randomized hash function" that would have a property comparable to IND-CPA.

Do I want something else, like a pseudorandom function, for my case? Can I construct one from a hash function?

Thank You for your help.


texts:
I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2.

I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right?


texts: Efficient hardware implementation of real-time asymmetric video encryption

texts:
I want to encrypt video directly at the source where it is being captured, e.g. inside a video camera. This way I can transmit the encrypted stream over WiFi securely.

I could use AES on the chip inside the camera, but this would be open to an attack on the semiconductor package, where an actor could retrieve the AES encryption key and use it to decrypt the data.

Is there an asymmetric encryption algorithm like RSA (which is unfortunately not efficient to encrypt a video stream), that is efficient at encrypting a video stream and that can also be implemented in hardware (like on an ASIC chip)?

This would allow me to store only the public key inside the ASIC, thereby increasing security. After receiving the encrypted stream I would be able to use the private key to decrypt it.

Would you recommend the video stream being compressed before being encrypted?


texts: Can AES-CTR add values without decryption?

texts:
I recently have studied AES cipher. On CTR mode, is it possible to add, subtract, or XOR plaintext values on encrypted data?

For example: we have an encryption of $4$ and $6$ under the same AES key, respectively denoted by $AES(4)$ and $AES(6)$.

Without decryption, can we achieve the following?

$$AES(4)⊕AES(6)=AES(4+6)$$

Where "$\oplus$" is any operation we can do over AES.


texts: How to compute accumulated values in bilinear map accumulators

texts: How to compute $ g^{1/(e_1+s)}$, where $g$ is the generator of group $\mathbb G$, and $e_1$ and $s$ are keys? I know only $s$ and $g^{e_1}$, not $e_1$. $\mathbb G$ has prime order for some prime $p$ and $e_1$ and $s$ are some elements of $\mathbb{Z}_p$.


texts: Strength of Hash obtained by XOR of parts of SHA3

texts:
I create a hash with SHA3-384. I split the resulting array into two. The first called head has the first 320 bits and the second called tail  has the last 64 bits.

Next, I XOR  head and tail. Which in fact means I XOR the last 64 bits of head with tail. This gives me a new hash of length 320.

The question is how is this resulting hash in terms of collision resistance compared to SHA-256 on one side and SHA-384 on the other side.

My goal is to produce a 320-bits hash. Is there a better way you would go about this?


texts: Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?

texts:
Related to "Is it possible to derive the encryption method from encrypted text?".

Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts be distinguished from random noise? Justify why, why not?

That is do the major asymmetric ciphers have any statical bias?

If you knew which asymmetric algorithm was used and you had a ciphertext of a random plaintext number and the public key that generated that ciphertext. Would it be easier than random chance to find the plaintext? Doesn't the fact that RSA requires extremely large keys imply that finding the plaintext is easier than guessing? If it is the case that finding a random plaintext is easier than randomly guessing a plaintext does this fact have any implications for the case in which the public key is not known and the attacker only has the ciphertext?


texts:
According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys.

The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is...  how is one supposed to expand a 128-bit key to fill in the 256-bits needed for the initial state?

The most obvious way would be to just append the 128-bit key to itself but in some ciphers, like RC2 or RC4 or Blowfish or the key goes through a key expansion step to expand the key to whatever size is ultimately needed - a key expansion step that doesn't simply append the orig key to itself.


texts: Solving for a One-time pad cipher help ; crib dragging doesnt work (no surprise)

texts:
Basically we're given the text

  7ECC555AB95BF6EC605E5F22B772D2B34FF4636340D32FABC29B
  73CB4855BE44F6EC60594C2BB47997B60EEE303049CD3CABC29B
  64C6401BAF45F6A930435F3DF875C4E102F8742A45C824AFCA9B
  7AC24F5EAF17F0A0754D5834BC3CC3A90ABD7B2A52C222ABC89B
  72C24A52B550B3B8624D4F22F86BD2B30ABD642C498122A1D29B
  73CC5457BF17E7A4750C5423B178D0A44FFF756355C03CABC28A
  74CC0155B443B3A8795F4224AA7E97B507F2632606CF3FA0D59B

And what we have to do is solve this, I understand the fact that if used properly the one-time pad is uncrackable but in this case we abuse the fact that certain characters are repeating ("ABC" and/or "AB") and have to use XOR in the process some how, unfortunately the problem is that it wasnt very well explained how to solve and other online resources dont really explain it very well in my opinion

How does one go about solving this?


texts: Algorithms for solving systems of quadratic multivariate polynomials

texts:
What are the best algorithms for solving systems of $k$ polynomials equations where these are quadratic multivariate polynomials on $k$ variables?

I've encountered such systems on my research and I'm in the position to say if they are somehow solvable or not, and what would be the complexity to run an "attack". I know about linearization and grobner bases but I'm not very sure if these are the best for quadratic mv-polys.


texts:
How does one decrypt the many time pad:

($R$ is a random string, $C$ is ciphertext, $P$ is plaintext)

$R_0 \oplus R_1 = C_0$

$R_2 \oplus R_1 = C_1$

$P_0 \oplus R_1 = C_2$

assuming that $R_n$ are perfectly random pads, plaintext is writing and $C_n$ are the encrypted pads. The key $R_1$ is used three times but it doesn't seem like Crib Dragging (the solution I've seen described to decrypt many time pads) would work (edit: to retrieve $R_0$, $R_2$, and $P_0$ or even just $P_0$) since the other values that $R_1$ is added to are random. Is there something I'm missing?


texts: How does DH work when combined with ECC or RSA?

texts:
I know that Diffie-Hellman is used to create keys in a secure way over an insecure channel. But there is one thing which I cannot understand: I see that a lot of sites use ECC or RSA alongside DH.

But why would you need to implement ECC or RSA if you already have a shared secret or key with each other? Can't you already use to strong symmetrical encryption?


texts: Discrete logarithm on Montgomery curve twist

texts:
So for some context I've been playing with some crypto challenges, and ran into this interesting problem.

There's Montgomery curve C, point A on its twist with small-ish order K (so K*A == 0), and B which is some unknown multiple of A.

We can brute force every value from 0 to K by generating C.ladder(A,i) and checking if it equals B. That's uncomfortably slow even for fairly small K.

I tried to optimize it a bit, generating 0*A, 1*A, 2*A, 3*A, ... by chained differential addition (from A, 6*A, and 7*A we can generate 8*A quite quickly etc.) instead of running ladder for each value, and that's about 10x-ish faster, but still not great and $O(K)$.

So if we worked on something which allowed arbitrary point addition, we could just pick U about sqrt(K) generate a bunch of baby step values 0*A, 1*A, 2*A, ..., (U-1)*A, a bunch of giant step values B+0*(-U*A),B+1*(-U*A), B+2*(-U*A) etc., and then when we find a collision between those two series by hashing then we know that k*A == B-j*U*A, so B=(k+j*U)*A, solving it in $O(\sqrt K)$.

Now awkwardly Montgomery curves don't allow arbitrary addition or subtractions, so what's the options?

convert to some other kind of curve (like Weierstrass) for sake of the attack, then convert result back? The obvious formulas are for points on the curve, not on its twist, but there could be some way to convert it?.
is there's some clever way to use differential addition to get those series I want?
is there some other algorithm which doesn't suffer from this problem?


texts:
I am unsure of how a padding oracle attack works.

What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines.

Can anyone explain this?


texts:
I've seen a large set of ECDSA test vectors for verification. In addition, I've seen some test vectors from NIST, and those can be found here.
Is anyone aware of ECDSA sign test vectors which, if "deterministic k" is used, where the algorithm in RFC 6979 produces a "not suitable k" (leading to rarely used code paths)? Please see below.

= 0 (or = 1)
> g (or n, the group order)
where the signature computation leads to r = 0
where the signature computation leads to s = 0


texts: How to configure Argon2d for commodity hardware?

texts:
You may already have heard it: KeePass v2.35 has support for a new database format (KDBX4) which allows for the use of Argon2 (more precisely: Argon2d) as the password-based key derivation function (PBKDF).

However Argon2 has three independent parameters, called iteration count, memory usage and parallelism in the GUI. Furthermore it offers to measure how many iterations it can squeeze into one second. But if you "just" hit the button for this it's gonna use 1MB and a parellelism value of 2.

So my question: Is "just" adjusting the iteration count the best strategy to get the most security out of Argon2 or is there a better approach?

OK, so here's the more concrete situation for which the best strategy is searched: An x86 architecture PC, with basically unlimited amounts of RAM (let's just take 4GB+ as an approximation of unlimited), with a very limited number of parallel cores and with a very "tight" time budget of up to 1 second.
Now for the definition of the term "best": Given the above scenario the best strategy for parameter-selection is the one that allows for the biggest hurden on an GPU- / FPGA- / ASIC- based (in terms of the time-area-product) attacker while fitting the constraints.
As this is also intended as a ressource for persons without much of a crypto background, please keep possible strategies as concrete as possible.


texts: Efficient proof of linear subspace membership

texts:
I am trying to find an efficient method of doing the following:

Let $U$ be a $d$-dimensional linear subspace of $\mathbb{F}_q^n$. I want a protocol between a trusted party $T$, a prover $P$ and a verifier $V$ that goes like this:

$T$ receives $U$ and produces a bitstring $c$.
$P$ receives $U,c$ and $v \in U$ and produces a bitstring $p$.
$V$ receives $v,c$ and $p$, and accepts or rejects the proof $p$.

I want the protocol to be complete, meaning that for any $U$, and any $v \in U$ the prover $P$ can produce a proof $p$ that is accepted by $V$.

And I want the protocol be sound, meaning that for an honest $T$, if $v \not \in U$ the prover $P$ can not produce a proof $p$ that is accepted by $V$ with a probability greater than some $\epsilon$.

An obvious way of doing this does not use $P$ at all:

$T$ produces $c$, which represents a basis for $U$
$P$ produces some $p$
$V$ knows a basis for $U$, so it can check if $v \in U$, and accepts the "proof" $p$ if and only if $v \in U$ (regardless of what $p$ actually is)

In this case the size of $c$ is quite large, representing (a basis for) $U$ takes $d (n-d) \log_2(q)$ bits. I am wondering if we can do better, in the sense that $|c|+|p| < d (n-d) \log_2(q)$


texts:
The man page of cryptsetup says:

  Whenever a passphrase is added to a LUKS header (luksAddKey,
  luksFormat), the user may specify how much the time the passphrase
  processing should consume. The time is used to determine the iteration
  count for PBKDF2 and higher times will offer better protection for
  low-entropy passphrases, but open will take longer to complete. For
  passphrases that have entropy higher than the used key length, higher
  iteration times will not increase security.

Does it mean that a binary keyfile of more than 64 random bytes (each having 8 bits of entropy?) is useless with PBKDF2 and a hash of 512 bits like SHA-512? The cost of testing all the hashes directly being cheaper than testing all the keyfiles.

Does it also mean that reducing the iteration time to 1 millisecond (or just to 1 iteration if it's even possible?) for such a keyfile doesn't affect the security?

And finally does it mean that using PBKDF2 with such a big keyfile, by reducing its size to just 512 bits, actually lower the security of a LUKS header?


texts: Is there a correct way to generate a symmetric key?

texts:
Looking in some cryptographic algorithms, I've realized that: The way the plain text is encrypted/decrypted is always specified, but what about the key? Every paper I've seen describing the algorithm never show a way to generate a key, but show the available key sizes.

This leads me to a question: How should I generate a key as someone who is implementing an algorithm? For example: The Twofish paper (https://www.schneier.com/paper-twofish-paper.pdf) says that Twofish has available key sizes of 128, 192 and 256 bits, but how should I create a 128 bit key? Not even the reference implementations I found contains code that seems to be aimed to be a key generation algorithm (again speaking of Twofish).

For a university work, I'll write a simple implementation of Twofish in C#, and I need a way to create a key but I don't know how to do it or even if there's a correct way to do this, that's why I ask this question.

A real example: When I encrypt anything with GnuPG (https://www.gnupg.org/) using symmetric keys, it does not generate any key or the like, it just asks for a password and does it. What's happening behind the scenes? How does GPG uses this password and how it's is related to the key generation?


texts: Paillier estimate attack costs on short keys

texts:
I was thinking about how to use the homeomorphic property of that cryptosystem to achieve not a "semantic security" but a less ambitous obfuscation of the source code (an ipotetical scenario in which a third party execute the obfuscated code, and get a still obfuscated result).
So i was asking myself how much computation time to break a small keysize? i am sure there is a way to calculate "resistance" per bit but i don't know how.


texts: Why is the Fiat-Shamir heuristic deemed secure in the ROM?

texts:
In their paper On the (In)security of the Fiat-Shamir Paradigm, Goldwasser and Tauman show that the Fiat-Shamir heuristic does not work with any hash function. From the paper:

  The most important question however remained open: are the digital signatures produced by the Fiat-Shamir methodology secure? In this paper, we answer this question negatively.

However, they do state that it is secure in the random oracle model:

  [Pointcheval and Stern] proved that for every 3-round public-coin identification protocol, which is zero-knowledge with respect to an honest verifier, the signature scheme, obtained by applying the Fiat-Shamir transformation, is secure in the Random Oracle Model.

I'm confused because it seems to me that they then (in my opinion) go on to show that the Fiat-Shamir heuristic is never secure, not even in the random oracle model.

From the paper:

  Intuitively, the idea is to take any secure 3-
  round public-coin identification scheme (which is not necessarily zero-knowledge) and extend
  its verdict function so that the verifier also accepts views which convince him that the prover
  knows the verifier’s next message. Since the verifier chooses the next message at random,
  there is no way that the prover can guess the verifier’s next message during a real interaction,
  except with negligible probability, and therefore the scheme remains secure. However, when
  the identification scheme is converted into a signature scheme, by applying the Fiat-Shamir paradigm, the “verifier’s next message” is computed by a public function which is chosen at
  random from some function ensemble and is known in advance to everyone. A forger, who
  will now know in advance the “verifier’s next message” on any input, will be able to generate
  an accepting view for the verifier. This makes the signature scheme insecure regardless of
  which function ensemble is used to compute the “verifier’s next message” in the identification
  scheme.

Doesn't this also work in the random oracle model? It seems to me that this is attacking the very concept of replacing new randomness by anything (except pseudorandomness), be it hash obtained by evaluating a hash function, or actual randomness chosen by the random oracle (but available in advance, so not new randomness).

Instead of evaluating the hash function on the arguments relevant for the randomness substitute, the prover can ask the random oracle for the hash. Sure, this will be true randomness, but the verifier will get the same randomness from the random oracle in the next step, so the prover still knows in advance what "random" value the verifier will choose.


texts: Why does AES-GCM not require an auth key, but encrypt-then-mac does?

texts:
The inputs to AES GCM mode appear to be:

an IV
a key
message to encrypt

The output is a cipher and auth tag.

However, if one were to manually perform an encrypt-then-mac scheme, the inputs required would be:

an IV
a key
an auth_hash (for decryption)
an auth_key
message

Then, you would compare auth_hash == HMAC(message, auth_key) before decrypting(message, key, IV).

So with the manual approach, there are 2 more inputs. Why is GCM able to do the same thing with less inputs?


texts: Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

texts:
Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same key are not known and as I understand AES-GCM is not so secure with many messages if random IV is used.

Would example of this solution be secure?

For each encryption generate 16 bytes random salt (16-BYTES-RANDOM).
TMP-AES-16-BYTES-KEY = HKDF-EXPAND-SHA1(STATIC-AES-KEY-16-BYTES | 16-BYTES-RANDOM, 16)
Write in message first plain 16 bytes generated random.
Use the TMP-AES-16-BYTES-KEY to authenticate first 16 random bytes and encrypt secret data and add tag using 12 bytes IV all zeros.

To decrypt do the opposite - derive temp key from message random and secret key.


texts: What kind of multiparty computation is this?

texts:
The classic multiparty computation protocols are defined around " Untrusted parties trying to compute something together".

But is there a cryptographic abstraction for, "Trusted parties trying to compute together in presence of untrusted server"?

Basically, I am looking for something like multi-player homomorphic encryption for cloud based services. Current homomorphic encryption schemes are two player setup (just a client and server), where client wants to outsource her computation to an untrusted server , but this abstraction does not stretch for most of the cloud based applications, say privacy preserving Facebook or tax processing cloud application where multiple people are involved using a cloud server.

There is a surge in research of functional encryption and its variants (IBE,PBE,ABE, etc.), but they reveal the end-result in plain text.


texts: How to XOR two hex values and am I doing crib dragging correctly? (OTP)

texts:
Let's say I have the two cipher texts

7ECC555AB95BF6EC605E5F22B772D2B34FF4636340D32FABC29B
73CB4855BE44F6EC60594C2BB47997B60EEE303049CD3CABC29B

According to this website http://xor.pw/? the result of the XOR is

d071d0f071f000000071309030b4505411a5353091e13000000

Is this correct? I don't know as I do not know how to XOR two hex numbers (I assume you turn them into binary but this would become incredibly tedious very fast)

And to further my question, is this the correct way to crib drag?

746865 XOR d071d0
Gives a419b5, which is a non ASCII-Character

Then I would to proceed to move one character down

746865 XOR 071d0f
which gives 73756a which in ASCII turns into 'suj' but likely gibberish

and so forth.

Am I correctly doing the procedure?


texts: Why a Unitary Matrix in Quantum Cryptography?

texts: I've read that in Quantum circuits the matrix that encodes the transformation has to be unitary. I understand that it must preserve the norm of the resulting qubit, but what is the intuition behind it?


texts: After implementing a novel encryption algorithm, how would one go about analyzing its security or get help from others in doing so?

texts:
Preface: This question was originally asked on Theoretical Computer Science and later on Computer Science. The kind people on cstheory.SE referred me to this web site. It is being repeated here in an attempt to find a satisfying answer.

Over the years, two novel encryption techniques have come to mind and been implemented as programming libraries that could be integrated into applications. However, how to analyze their security and vulnerability characteristics has never been very clear, and their usage has been limited to mainly experimental tests. Are there tools available for automated examination of such parameters one may be interested in understanding for an encryption library? Are there bodies of people who are interested in being introduced to new encryption concepts for the purpose of executing their own personal analysis on such a process? I'm not sure where to look.

The first encryption algorithm is a mono-alphabetic simple substitution cipher. It requires two keys to operate and is designed to frustrate frequency analysis. The longer of the keys forms a table by which plain-text has a normal substitution cipher applied. Each encoded byte is then split into four values of two bits each. The second, shorter key is then used to allow a random selection from four groups of sixty-four unique bytes each. Each two bit value from the encoded byte is used to select which group of sixty-four bytes to use. Encoding has two disadvantages: the output is four times larger, and repeated data encoding may allow some frequency analysis.

The second encryption algorithm is a stream cipher like the first but internally operates on blocks of data. It utilizes two keys to operate: the first is a two-dimensional array that describes how to construct a (virtual) multidimensional grid, and the second is an initialization vector for the encoding/decoding engine. It attempts to overcome frequency analysis by encoding bytes with a window of preceding bytes (initialized from the second key). A byte with its preceding window of bytes form a multidimensional index into the aforementioned grid. Unfortunately, encoding duplicate blocks of data longer than the window size starts yielding equivalent data.


texts: Disrupting MITM attack against 3DES by intermingling plaintext and inter-mediate ciphertext between rounds

texts:
Let's say someone implements 3DES with three separate 56-bit keys and an attacker is attempting to execute a MITM attack.
Here is the encryption plan designed to attempt to disrupt the MITM attack, or at least make it more expensive.  You grab 192 bits of plaintext and shuffle them into three 64-bit blocks, intermingling between all three sub-blocks, if less pad with PKCS#7 padding to be multiple of 192.
My initial suggestion would be byte 0 is 1st byte of 2nd block, byte 1 is 1st byte of 3rd block, byte 3 is 1st byte of 1st block, byte 4 is 2nd byte of 2nd block, etc.  A  matrix or maybe a key specific columnar transposition would definitely be preferable as long as it is not too expensive.
You then perform the first round of DES encryption on the first block with the first key, the second block with the second key, and the third block with the third key, in parallel if feasible.
You shuffle the 192 bits of intermediate ciphertext afterward, again intermingling bytes between the three blocks and then do the second round, encrypting what is now the first block with the first key, the second round with the second key, and the third block with the third key.
You continue to shuffle the blocks and repeat until 48 rounds of encryption have been performed.  You're not changing the keys, so I don't think there should be any re-keying penalty.  Shuffling blocks of binary data is a pretty efficient and simple operation that should not add much performance penalty or implementation complexity.
Would this make the MITM attack more difficult, while turning it into a 192-bit block cipher in the process?  How significant would the performance penalty be when compared to standard 3DES?


texts:
I'm researching a project idea, but have zero knowledge of development aspect. I hope that somebody here can help me or point me in the right direction.
Can NFT be set to exist a certain time and be automatically burned when time period is reached? For example, I issue a concert ticket which is valid for 1 month, user is able to transfer it to cold storage, sell it, exchange it, but after time is reached it gets burned?


texts: The "Square Root" Solution of Oblivious RAM Simulation

texts:
I am reading the paper Software Protection and Simulation on Oblivious RAMs by Oded Goldreich and Rafail Ostrovsky. And I wonder about the description of the "Square Root" solution of oblivious RAM simulation at page 20.

The algorithm seems simple: the aim is to 'simluate' the original RAM of size $m$ by an oblivious RAM of size $m+2\sqrt{m}$. So it uses the first $m+\sqrt{m}$ cells of the oblivious RAM to shuffle or to obscure,  and uses the last $\sqrt{m}$ cells as a cache (or shelter) in case of leaking information about access frequency.

However, the first step to use the shelter reads 'first, we scan through the entire shelter and check whether the contents of the virtual word $i$ is in one of the shelter's words. '

Here, we want to simulate an original RAM access at location $i$ (for fetching the virtual word $i$) by using the shelter, and then comes the question : since we haven't known what the contents of virtual word $i$ actually was yet, how do we check whether it has been in the shelter or not?


texts:
I need a PRNG which provides 128 bytes numbers.

Let's say that given a symmetric key $K$ and an internal state $s$ I use the PRF HMAC-SHA512 this way:

The output is PRNG($K, s$) = HMAC-SHA512$_K$($s$ || 0x01) || HMAC-SHA512$_K$($s$ || 0x02) where $||$ represents a concatenation. The next state is $s_{i+1}$ = HMAC-SHA512$_K$($s_i$ || 0x03) || HMAC-SHA512$_K$($s_i$ || 0x04).

I am wondering if my PRNG can be periodic?

I mean, is it possible that given the initial internal state of the PRNG noted $s_0$ and the symmetric key $K$, to have an integer $n$ such that $s_n = s_0$?


texts: Can Elgamal be made additively homomorphic and how could it be used for E-voting?

texts:
Elgamal is a cryptosystem that is homomorphic over multiplication.

How can I convert it to an additive homomorphic cryptosystem?
How can I use this additive homomorphic Elgamal cryptosystem for E-voting purpose?

Please explain with examples.


texts:
In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1.

there are no distinguishing attacks against AES-N-GCM that work with distinguishing advantage greater than $A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}$

there are no forgery attacks against AES-N-GCM that work with forgery advantage greater than$A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}-q 2^{-128}$

But I can not get the same result (the right corollary) from the theorem 1 & 2 as the paper described when I plug in the value of parameters.
Here are the Theorem 1 & 2:

I presented my calculating process below.
$A_{E} \geq A_{G C M}-q^{2} 2^{-129}\left(94^{2}+2 \times 2 \times 95\right)-q \times 95 \times 2^{-96}$
$A_{E} \geq A_{G C M}-q^{2} \times 9216 \times 2^{-129}-q \times 95 \times 2^{-96}$
$A_{E} \geq A_{G C M}-q^{2} 3^{2} \times 2^{-119}-q \times 2^{-89.4}$
I notice that my result has a  $-q^{2} 3^{2} \times 2^{-119}$  item.However,the corollary in paper displays a $+q^{2} 2^{-116}$ .


texts:
I am aware that MixColumns is a mixing operation which operates on the columns of the state, combining the four bytes in each column. So we multiply our state with the special matrix. To multiply, we’re computing many dot products. And for each dot product, we’re multiplying bytes as Galois fields $\pmod 2$, then reducing the answers $\bmod$ the magic polynomial: $x^8+x^4+x^3+x^1+x^0$.

Thankfully, the entire task can be greatly sped up by using a few look-up tables. The multiplication matrix consists of Galois fields for $1,2,3$. So we can pre-compute the results of all 256 eight-bit Galois fields (the possible bytes in our state) multiplied by these values.

How will I implement the inverse MixColumns for decryption process?


texts: Is this an effective obfuscation technique?

texts:
Long ago I created a simple program which obfuscated a file by taking the first byte, then XORing it with the second, taking the (original) 2nd byte and X-ORing with the 3rd, etc, down the line. The file size is unchanged, and I could invoke the same program to undo the obfuscation. No key or password was required. It was just a simple way to hide the contents of a file from casual view.

My Question Is: Does this result in a uniform distribution of byte values such that it appears to be encrypted, and the usual analysis would not turn up anything?

I know that this is not encryption. Also that the first byte is plaintext, but one could simply stick a random value in the source file, use a space or some other harmless byte there.


texts:
From "mid-square random number generation", let me simply define the "128-hash" as
the middle bits of the square of a 128-bit number.

Does this hash have any known collisions?

Are there any known impossible hashes?  In other words, is there a known "128-hash"
which would never occur even if all starting 128-bit numbers were tried?


texts: Is there a deterministic number generator that allows me to share some (not all) numbers I've generated using a smallish seed?

texts:
I was just wondering, is there a type of deterministic number generator that allows me to share some (not all) numbers I've generated using a smallish seed?

I have pairs of random numbers and need to make one number from each pair public. The point of sharing with a type of seed is, that my application needs to do hundreds and thousands of these and any space saving will result in massively decreased storage and transmission costs. Which one of the pair I want to make public is not known during key generation.

A really basic insecure example would be to use sha256(seed + n) where n starts at 0 and increases for each number. You would share the seed plus all the n values you want to share. Obviously this means people could generate the numbers I don't want them to by filling in the missing n values.

I'm not sure if such a thing exists, but I figured the folks at Crypto.SE would know if it did, or be able to invent it. Oh, and half of the pairs of numbers is about 2048 bytes, so any solution would have to be smaller than that to be worth it.


texts: What is the entropy per Diceware word if a random symbol is inserted into a random position in the word?

texts:
On the Diceware page is this little gem:

  For extra security without adding another word, insert one special character or digit chosen at random into your passphrase...  Inserting a letter at random adds about 10 bits of entropy.

By that statement, does that mean adding a random character to a random position in a Diceware word adds 10 bits to each word?

What would be the entropy per Diceware word if random printable ASCII character is used instead?

What would be the entropy per Diceware word if a random Diceware word is used as the random symbol in a random position per Diceware word?

How exactly can this be calculated?


texts:
Hello guys I am looking to calculate the Inverse of a given polynomial in Galois field
I have found the little Fermat's algorithm and the Itoh-Tsujii
I am getting a bit confused with both algorithm as
if having a squaring and multiplication operation
should a reduction modulus be used [A.A mod F(x)] and then A.[A.A mod F(x)] and so on
or the modulus operation should be used at the end of the final answer [A.A.A.A....]mod F(x)

Are they applicable to polynomials basis and not normal basis ?
or is this operation for the GF(2) and not the extended fields ?

Thank you


texts: Are Fujisaki commitments binding if the factorization of the group is known?

texts:
If I understand correctly, a Fujisaki commitment is as follows:  $g^m \cdot h^r $ mod $n$, where $m$ is a message, $r$ is a random number, there exists $a$ such that $h^a = g$, and $n$ is an RSA modulus.

Usually, when I read discussions about this scheme, the holder of the commitment does not know the prime factorization of $n$.

Is it a requirement that the order of the group be unknown to the creator of the commitment?  (Note added assumption below.)

EDIT:  Note that the message can be replaced with $m+k\cdot \lambda(n)$, where $\lambda(n)$ is the order of $n$. Though this is a threat to the commitment, I am more concerned with commitments of small values ($m << \lambda(n)$), so opening the commitment like this would be rejected.  So I will rephrase:

Assuming $m << \lambda(n)$, is a Fujisaki Commitment binding if the prime factorization of $n$ is known?


texts:
When a server is under attack, it send the client the following data:

Nonce - a byte array of Y length
Hash - the hash digest of the puzzle solution

The client has to find X such as Hash(Nonce||Counter) = Hash where Counter is a 32-bit integer value starting from 0.

The client has to return the correct Counter to the server.

Is this construction safe?
What should be the ideal length of Nonce?
Does anything change if the length of the Nonce is the same length of the hash's block length?
What hash function would be ideal in this scenario?


texts:
Given a set of SHA1 hash code, if we knew a portion of the plaintext for each particular hash code, and also the remaining portion of the plaintext is a constant value for each hash code.
Is it possible for us to recover what is the constant value?


texts: Are there any Cryptography Algorithms that involve Lots of Number Theory?

texts:
I am looking for a good, meaty cryptography algorithm that involves a good amount of number theory in which I can explore. I'm researching, and AES (Advanced Encryption System) seems interesting, but does not really seem to involve number theory all that much.
EDIT: Not RSA.


texts: Equivalent security of KMAC and different HMAC instances?

texts:
In the August 2016 draft of SP 800-185, SHA-3 Derived Functions (pdf) there is a table for equivalent security settings for KMAC, the MAC derived from SHA-3, and some previous MACs (Table 1 on pages 19-20). According to that table, both HMAC-SHA256 and HMAC-SHA512 have security equivalent to that of KMAC256, just with two different output lengths – 256 and 512 bits, respectively.

Why is this?

According to SP 800-107 (pdf, see 5.3.4) HMAC-SHA512 can have up to 1024-bit security if the key is exactly that long, while HMAC-SHA256 tops out at 512 bits.

Does KMAC256 really match the security of HMAC-SHA512? And if KMAC256 is meant to have that security, would KMAC128 not be sufficient to match HMAC-SHA256? What is the actual security strength of these KMAC variants?


texts: Can you derive ed25519 keys from secp256k1?

texts:
Alice has a secp256k1 key pair that she used some time ago when she communicated with Bob. Bob can no longer user secp256k1 but he only uses ed25519 instead.

Is there a secure algorithm that Bob can use to derive an ed25519 pubkey from original Alice's secp256k1 pub key and also Alice can derive the matching ed25519 private key from her original secp256k1 private key such that they can communicate securely via ed25519 encrypted messages?

Thanks!


texts:
Looking for the language to describe a solution I am looking for...

As a systems admin for an educational institution, I would like to:
a) post our tests in an encrypted form
b) at a certain time, make the contents available to the user (online or not)
c) after a certain time, re-encrypt the file, and/or delete the content.

During the unencrypted time, I would like to prevent copy operations, cut/paste etc. to protect the content...

Is this "mission impossible" type encryption style even possible to protect our content?

If so, what would it be called?

Many thanks for your assistance


texts: Is format preserving encryption suitable for use with words or names?

texts:
Is it possible to use FPE to encrypt names and language words like 'Bob' 'the' 'tree', in order to preserve both length and format (like keeping characters within a certain range like A-Z a-z)

The only way I can think of at the moment is to reduce each character to it's decimal value  and encrypt that.  But that doesn't seem very secure (wouldn't each character map to exactly the same value each time?)


texts: Where is factoring if discrete logarithm is broken?

texts:
Assume given $g^X\equiv h\bmod p$ where $g$ is of order $\frac{\lambda(p)}2$ where $\lambda(p)$ is Carmichael Lambda function applied to prime $p$ (so $2$ is invertible in exponent) we can compute $X$ in polynomial time on an assumption $2$ is invertible in exponent (we can assume we take square roots and make the generator of order $\frac{\lambda(p)}2$ and we assume $2$ needs to be invertible in exponent).
Consider the scenario where $N=PQ$ and $P$ and $Q$ are equal bit primes and $e$ is encryption key and $d$ is decryption key satisfying $ed=1\bmod\varphi(N)$ where $\varphi(N)$ is Euler totient function applied to $N$:

Find $r$ such that $g^r\equiv1\bmod N$ where $r$ is period of the multiplicative group modulo $N$ and $g$ generates it.

In the above two cases since we do not know $\varphi(N)$ we cannot assume $2$ is invertible in exponent.

Is $RSA$ attackable if discrete logarithm is broken using an algorithm which makes essential utilization of $\lambda(p)$?

PLEASE DO NOT CONNECT TO Reduction of Integer factorization to Discrete logarithm problem and please see comments on reasons. Bach utilizes blackbox notions which encompasses knowledge of $\lambda(p)$.


texts: Representations of secret keys on Curve25519

texts:
https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo:

         S_a = 0x6A2CB91DA5FB77B12A99C0EB872F4CDF
                 4566B25172C1163C7DA518730A6D0770

         P_a = 85 20 F0 09 89 30 A7 54 74 8B 7D DC B4 3E F7 5A
               0D BF 3A 0D 26 38 1A F4 EB A4 A9 8E AA 9B 4E 6A

https://tools.ietf.org/html/rfc7748#section-6.1 gives another secret key / public key combo:

Alice's private key, a:
  77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a
Alice's public key, X25519(a, 9):
  8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a

Note how the public key is the same for both but the secret key is not.

sodium_crypto_box
_publickey_from_secretkey seems to concur with the RFC but not the IETF Draft:

https://3v4l.org/i61aE

My question is...  what is the RFC doing that the draft is not?

I ask because I have an implementation that is giving me the correct public key from the secret key in the IETF Draft and I'm wanting to make it so that I can use that same implementation to get the public key from the secret key in the IETF RFC. But, more than that, I'm just curious.

Thanks!


texts: What to do with a last chunk of 503 bits in SHA1?

texts:
I was trying to implement a SHA1 algorithm last night, and I got stuck at preprocessing the chunks in SHA1.

As I have understood it, the message that has to be hashed, has to be broken into chunks of 512 bits, and if the last chunk is not equal to 512 bits, a 1 is appended to the bits, followed by '0', and at the end the number of bits of the last chunk of message is appended. So an example:

abc = 97 98 99
abc = 01100001 01100010 01100011
chunk = 0110000101100010011000111... ( 482 x 0) ...11000

But what would happen if the last chunk is 504 bits? Then 9 bits (2^9 = 512), should be used to describe the length of the message, but that does not fit, because there are only 512 - 504 - 1 = 7 bits left to describe the length.

I've looked into Wikipedia and the SHA documentation, but could not find my answer in there.


texts: Encrypting user data with their password?

texts:
I had an idea once that all of the user data (including the username) could be encrypted with the user's password. Obviously, most sites would store different data, so using the same password and username would not make the same output in the database. For extra security, you might use a salt. A table in a database might look something like this:

Username    User data (normally encrypted with password, but put in plaintext for demonstration)
johndoe     {"username":"johndoe","latestSearch":"funny cat videos"...}

Would this work, are there better ways to do it, or does this have flaws?


texts: Asymmetric format preserving encryption?

texts:
I would like to encrypt a string asymmetrically.

I would like the ciphertext to be as short as as plaintext. (or shorter)

I've read about format preserving encryption functions - are there asymmetric variants of them?


texts: In RSA $(e,n)$, $(d,p,q)$, why does it work even if plaintext $M$ is not coprime with $n$?

texts:
I read this post
Does RSA work for any message M?, but I cant prove that $(M^e)^d-M\equiv 0\pmod{p}$ like this: