texts: Extendable hash collision resistance of multiplication

texts:
I have a hash function $HashSet(A) = H(a_1) *\cdots * H(a_n)$, where $A = \{a_1,\ldots,a_n\}$ and $H$ is a hash function which generates values of $b$ bits (and $H$ has no collision attack that requires less than $2^{b/2}$ of work for 50% chance of finding a collision).

Given $n$ how large should $b$ (the size of the output from $H$) be to resist attacks that create a collision by generating another $A$, assuming the attacker knows the initial $A$. I am assuming it is worse than $2^{b/2}$ for 50% of finding a collision and that for high $n$ there are slightly better attacks, but hopefully not enough to make it non-viable.

From what I have read the expected largest prime factor in any given $H(a_x)$ will be effectively $H(a_x)$, but I am worried that the algorithm will break down in some way due to the chance of really bad numbers (numbers with very low large prime factors), or due to something involving many non-prime numbers being multiplied.

EDIT: I made my assumption on the largest prime factor of $H(a_x)$ being effectively $H(a_x)$ based on this assumption:

  The prime number theorem means the chance a number is prime is close to
  $\frac{1}{log(n)}$, so the expected size of the largest prime factor
  is at least $\frac{n}{log(n)}$. So for any given $b$ the expected bits
  in the prime number is $log_2(\frac{2^b}{log_2(b)}) = b - log_2(b)$.
  Which can be effectively considered to be $b$, as the difference
  between 1024 bits and 1014 ($1014 = 1024 - log_2(1024)$) is not
  significant to the security of the algorithm.


texts:
I stumbled across a forum thread where security researcher Thomas Ptacek
seemed to have negative feelings towards GCM. I had always thought from prior readings that GCM was the current gold standard for efficient, secure, easy-to-use AES modes?

Here is a summary of the “news.ycombinator” thread:

  tptacek: But CTR+HMAC is, in fact, a composed authenticated encryption mode. If you have a working system with CTR+HMAC, I'd recommend against spending effort switching to GCM, which is actually harder to get right.

  sargun: I thought AES-GCM was on its way out? Isn't poly1305-chacha20 what we should use now, given that it's quite a bit cheaper in terms of cost, and the keys are much smaller (32 bytes)?
  Also, the code for chacha is easily available.

  tptacek: I definitely personally prefer ChaCha/Poly to GCM, but GCM is unfortunately quite popular right now; of the unencumbered AEADs blessed by NIST, it's very performant and thus widely implemented.

I get that if you have a working crypto scheme like CTR+HMAC working, it isn't worth the effort to switch. What confused me is that he said GCM "is actually harder to get right." What would make GCM mode harder than CTR+HMAC?


texts: How can I prove/disprove that a construction yields a secure PRG?

texts:
Let $G:\{0,1\}^{*} \mapsto \{0,1\}^{*}$ be a secure PRG. Prove or disprove that the following construction also yields a secure PRG.
$$G'(k) = G(k||0),$$
where $||$ denotes the concatenation of two strings.

I understand that proving/disproving such constructions usually involves a proof by reduction or a counterexample. Intuitively, I would say that $G'$ is a secure PRG, since we only fix a bit of the input, which should not make the output distinguishable (in polynomial time). However, for some reason I can't finde the right reduction, since I don't see how a $w \in \{0,1\}^{*}$ and a distinguisher $D'$ for $G'$ can be used to construct a distinguisher for $D$ for $G$.

So is $G'$ a secure PRG? If yes, how can I construct a valid reduction and if no, how does a distinguisher for $G'$ work?

I don't know if it is appropriate, but I would prefer hints, which point me in the right direction instead of complete solutions.


texts: Why does the time complexity of RSA encryption and decryption depend on the size of the modulus?

texts: I would think that the time complexity would depend on the exponent, not the number of bits in the modulus. For example, if the exponent were 5, using the "naive" method, we would perform 5 multiplications. Squaring and multiplying would reduce the number of multiplications dependent on the exponent as well. However, I don't see where the number of bits in the modulus comes in to play.


texts: Using the Babai's Naive Rounding algorithm to decode, in the conditions of the SIS problem, is secure?

texts:
Given the SIS Problem: Given an integer q, a matrix $A \in \mathbb{Z}_q^ {n \times m}$ uniformly random, a real $\beta$, a syndrome $u \in \mathbb{Z}_q^n$, find a nonzero integer $e \in \mathbb{Z}^m$ such that $Ae=u \mod q$ and $ || e||_{2} \leq \beta$.

Sampling an uniform $A \in \mathbb{Z}_q^ {n \times m}$, along with a relatively short full-rank "trapdoor" set of vectors $S \in \Lambda^{\perp}(A)$ as in the paper of Ajtai of 1999 (Generating hard instances of the short basis problem). Choosing $ t \in \mathbb{Z}^m$ via linear algebra such that $At=u \mod q$ and using the Babai naive rounding algorithm with basis $S$ to decode $-t \in \mathbb{Z}^m$ to a point $v \in \Lambda^{\perp}(A) $ yields the solution to the SIS problem $e=t+v$. Therefore it is difficult to obtain $e$ right?

But on the other hand doesn't the attack of Nguyen and Regev of the GGH scheme ( Learning a Parallelepiped:
Cryptanalysis of GGH and NTRU Signatures ) work in this case?
Is this a contradiction to the SIS hardness? I'm wrong somewhere!


texts: what is the public information in Elliptic curve cryptosystems

texts:
Currently my knowledge about Elliptic curve is quite limited to the textbook and I don't know how a practical Elliptic curve cryptosystem works.

I read an example about key exchange using Elliptic curves. And I am wondering what is the public information (key) of a practical Elliptic curve cryptosystem.

First, the equation of the Elliptic curve should be public.
How about other parameters? Such as the order of the curve ( number of points on the curve), the generator point of the curve and so on.

Can you give me a good reference about how a practical Elliptic curve cryptosystem works?

Thanks in advance.


texts: Known Plaintext attacks using standard greetings etc

texts: In all modern ciphers, even if one bit of input changes, then half of the output will change because of diffusion. Considering this, how exactly will knowing standard salutations, etc. ("Hello Alice" or other known parts of the message) be used to launch an attack. You don't know the whole PlainText but only part of the PlainText. So how exactly will it help?


texts: Given a collision in a MAC function, is it possible to work out how the MAC function works and generate valid MAC values for any message?

texts:
So given you can find a collision for any MAC value, would this be viable without knowing the key.
Even if you couldn't figure out how that MAC function works, could you find valid MAC values for a message without needing to know how it works.
If so how would you go about doing this.


texts: Is there a studied notion of "party independent transfer"?

texts:
I've been thinking about the following set-up involving three parties, Alice, Bob and Charlie:

Bob and Charlie decide among themselves who is going to receive a bit from Alice (perhaps by a coin toss)
Some protocol is then executed in which Alice transfers a bit to the decided on person.

The protocol is defined as secure if:

Alice cannot change her bit based on which of Bob or Charlie it is that receives the bit (the transfer is "party independent")
Supposing Bob was decided on to receive the bit, Charlie cannot learn the value of the bit handed over by Alice, and vice versa.

My question is this: is there a studied task which is similar to what is described above? Or is this perhaps secretly equivalent to some apparently distinct task? (it sounds a bit like some form of oblivious transfer)


texts: HSMs: Encrypt/Decrypt - But Not Read or Export Key

texts:
Can HSMs be configured to store a key, and allow encryption or decryption with said key, but prevent any export or backup of the key itself?

We're basically trying to develop a system using asymmetric encryption to perform some custom signatures. We ultimately want a black box where a user inputs some plaintext and gets out the ciphertext, but is unable to access the key used to encrypt.


texts: Hill Cipher - Unknown plaintext attack, known key

texts: I was wondering if I have the key and the encrypted Hill Cipher message(s). I can definitely figure out the charset involved. But the order is missing. Assuming that I use 37 modulo or higher. How would I go about cracking it?


texts:
Warning: The link in the answer explain the S-Box well, but there is an error in the pseudocode.
$K_i = K_{i-8} \oplus K_{i-5}  \oplus K_{i-3} \oplus K_{i-1} \oplus  0x9e3779b9 \oplus i$;
Instead, it should be :
$K_i = K_{i-8} \oplus K_{i-5}  \oplus K_{i-3} \oplus K_{i-1} \oplus  0x9e3779b9 \oplus (i-8)$;
The loop start from 8, but in the paper, i is worth 0 as the beginning of the loop.

For DES, you take the 4 inner bits as the column to choose from the S-Box, and the two outer bits to choose the row.
However, for Serpent it doesn't make sense to me as the prekeys that are used to choose the row and columns are 32 bit words, and the 8 S-boxes are one dimensional arrays.
Now the paper tells us that the S-boxes are 4 bit permutations, but what does it mean? Would it mean that the two outer bits are used to choose one of the 8 S-box, and the 4 inner (ignoring thus 2 bits in the process) would be used for the columns? However, the paper directly specifies which S-box to use, like so:
${k_0 , k_1 , k_2 , k_3 } := S_3 (w_0 , w_1 , w_2 , w_3)$
I've searched online, but serpent doesn't seem to be as documented as Rijndael or DES.


texts: A self-shrinking generator is a LFSR sequence processed with an algorithm that is different from von Neumann unbiasing. Does this imply that using von Neumann unbiasing instead would lead to an inferior result of security?


texts: Difference between Symmetric and Asymmetric. Is this answer correct, based on a written test?

texts:
I asked the following question on a final exam:

  Symmetric Ciphers (e.g. AES, DES, Blowfish) use up to 256 bit on the
  best case, which are considered strong against brute-force attacks. On
  the other hand, asymmetric cryptography (e.g. RSA, DSA, Elgamal) use a
  higher amount of bits (~2048). Explain the reason of the bit
  difference between Symmetric and Asymmetric Ciphers.

His answer was:

  Asymmetric Ciphers use more bits because generally it uses powers,
  which generates a bit increase. Additionally, Asymmetric Encryption
  requires more processing time than Symmetric, which leads to a higher
  cost on a bit level.

By “powers”, he meant “math powers”. He quotes the following from the internet to support his answer:

  "The algorithm is slow, since it uses math operations which have a high
  cost and works with big key sizes. Part of the problem is on the
  choice of the exponent"

And finally:

  "Although is not mathematically exact, the first operation could be
  accepted as linear since the number of operations is directly
  proportional to the size of both operands. On the other hand, the
  second operation is an exponential type because doubling the input
  size, the number of operations to make does not double, it increases
  exponentially in time."

Although the answer is here, I see that part of his statements are correct, but is he answering the question correctly?


texts: How can the Enigma's plugboard settings be found with partially known plaintext?

texts:
I don't quite understand the procedure described on wikipedia, is there a generalized procedure you can follow to rule out a pairing on the plugboard?

For example, let's say the cipher text is

XOIWN LUKLV FPHZH VMWPX GLIEV NZTTC EKYEB QJP

And the known plaintext is

ATTACKATDAWN

What would i have to do to find out the original wiring on the plugboard, or which possibilities can we rule out?


texts:
Background

I have recently started to get into web development and thus I have been creating databases for users.

After some research, I discovered that password encryption is not password hashing.
My next spell of learning was that I needed to add salts to my passwords to make them harder to crack.
For this I implemented a hard-coded salt to the start of all my passwords; I later learned that actually the salts should all be different, otherwise they are just peppers.

Storing data

I created a table in my database that stores the passwords and the salts (maybe a question for a different day, but I am not sure where to store the salts).

The passwords are hashed using MD5 and then stored. (There is not really a reason as to why I chose MD5 and if it is better to use another one then I will.)

I currently use a PRNG to create the salt upon registration to the site. The salts are not hashed and are simply just stored in a separate field to the password.

Question(s)

What is a good salt?

Assuming someone gains access to the databases. They would see a series of MD5 hashes and then a series of random numbers and letters (8 bytes currently).

I understand that the question may appear open-ended.
Would I need to hash my salts (that sounds weird to me), create longer salts, or do something else?


texts: DH: Is it possible to solve for A private if all other variables are known with 90-bit modulus

texts:
$g^{ab} \pmod{p} = B^a \pmod{p}$ where all variables are known except $a$. In this case, I have an equivalent value for $a'*b'$, but this is not the same as the real values of $a*b$ due to the modulus.
Everything else including the generator, the prime, $B$ public, the shared secret (or value of both sides of the equation) are known.
Since $p$ is a 90-bit value, this is would be difficult to calculate, but if there is some $\mathcal{O}(\sqrt{n})$ optimization, this may put it on the edge of the possibility to brute force.


texts:
I'm going to encrypt the characters Zhu, and decrypt them using RSA. I'm using the public key $\{e, n\}$ and private key $\{d, n\}$. The values of $e$, $d$ and $p$ I get from my textbook: $e = 17$, $d = 53$, $n = 77$.

It works fine when the number is smaller than 76, but in my example below, it doesn't work:

z = 90
h = 104
u = 107
e = 17
d = 53
n = 77

print z,h,u

c_z = z ** e % n
c_h = h ** e % n
c_u = u ** e % n

print c_z, c_h, c_u

p_z = c_z ** d % n
p_h = c_h ** d % n
p_u = c_u ** d % n

print p_z, p_h, p_u

The outputs are:

90 104 107
62 69 46
13 27 30

Do you have any idea what's going wrong?


texts: XChacha20poly1305 vulnerability to known plaintext attacks

texts:
During a security audit, the guy said our cryptosystem is vulnerable to known-plaintext attacks. He said that's because «the implementation uses a crypto_stream_xor() approach» (from libsodium). That's way above my skill, and I did not find anything relevant so far so I'm trying to understand if that's really a problem.

Here is what we do: we derive a key using a global (password, salt) pair. This key −always the same− is used in order to cipher all the documents using xchacha20poly1305. We initialize the stream using xchacha20poly1305::Stream::init_push: it provides us with a header (the nonce ?) that we store with the file for decryption later on. We use rust's implementation of libsodium, sodiumoxide.

Is its assessment correct? (= is xchacha20poly1305 or our usage vulnerable to KPA, and is it due to the fact it uses a xor ?) Didn't the guy mistakingly mixed things with the fact that we reuse password?
How bad is it? Does it mean that someone who can cipher a known document in our system can decipher anything else it puts its hands on?

Edit:
As requested, here is what we do, with more details, using pseudo rust code. I edited out all the irrelevant details but hopefully left enough relevant information and comments.

password, salt, chunk_size are stored in environment variables and never change.

function encrypt(file, password, salt, chunk_size) {
    // first, we derive a key
    sodiumoxide::crypto::pwhash::derive_key(
        &mut key,
        &password,
        &salt,
        pwhash::OPSLIMIT_INTERACTIVE,
        pwhash::MEMLIMIT_INTERACTIVE,
    )

    // Then we initialize the encryption stream
    let (stream, encryption_header) =
        xchacha20poly1305::Stream::init_push(&key);

    // we store the IV
    let encryption_header_bytes = Bytes::from(encryption_header.as_ref());
    store encryption_header_bytes in the output file

    // then we encrypt the file
    buffer = read file content
    while (there are data in the file) {
        // cipher the buffer using xchacha20poly1305's stream
        let encoded = stream.push(&buffer[0..chunk_size], None, Tag::Message).unwrap();
        buffer.advance(chunk_size);
        store `encoded` in the output file
    }
}

function decrypt(encrypted_file, password, salt, chunk_size) {
    // first, we derive a key
    sodiumoxide::crypto::pwhash::derive_key(
        &mut key,
        &password,
        &salt,
        pwhash::OPSLIMIT_INTERACTIVE,
        pwhash::MEMLIMIT_INTERACTIVE,
    )
    // then we read the file in a buffer
    buffer = read encrypted_file content

    // then we read the header, and create a stream out of the header and the key
    let header = Header::from_slice(&buffer[0..xchacha20poly1305::HEADERBYTES])
                        .unwrap();
    stream_decoder = Some(xchacha20poly1305::Stream::init_pull(&header, &key).unwrap());
    buffer.advance(xchacha20poly1305::HEADERBYTES);

    // then we decrypt the rest of the file using said stream
    while(there are data to decrypt in the buffer) {
        let (decrypted, _) = stream
                        .pull(
                            &buffer[0..(xchacha20poly1305::ABYTES + chunk_size)],
                            None,
                        )
                        .unwrap();
        buffer
            .advance(xchacha20poly1305::ABYTES + chunk_size);

        store `decrypted` in the output file
    }
}
```


texts: Are low security curves for ECDSA not supported?

texts:
I am working in a very bandwidth restricted environment, and we are looking to implement ECDSA digital signatures. Although they are no longer recommended, we might be looking to use curves that are not listed as supported by most libs, including OpenSSL: https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Supported_elliptic_curves

We are looking at curves such as secp112r2, secp128r1, sect131r1 and so on. This is not to discuss security of these, but their support.

In Cygwin, a huge load of curves is available, including the mentioned low-secutity curves. But in the URL these curves are not listed. Our team has observed that in some other OpenSSL sources (that are not through Cygwin), these curves are not supported. Are they no longer supported by OpenSSL, and if so - why are they available to me through Cygwin?

And by the way - I assume curve support is rather complicated, so that it is not possible to "import" a curve that is not supported in a given library.


texts:
For multiple OTP keys, why not do this:

Key = Hash[(EC)DH Shared Secret + Counter]

The counter will increase per message, and the output of the hash will be random for each new unique input into it. What are the problems or weaknesses with this design??

EDIT:
For clarification: both parties will have the shared secret from an ECDH exchange, random numbers from Pythons os.urandom for generating the ECC key


texts: Calculating G for a give cyclic group mod P

texts:
For DH key agreement, one must begin with a generator of a cyclic group g.

However, intuitively to me at least, it seems that g may be expensive to calculate for a random cyclic group mod some large prime p.

How is this done efficiently on the fly for Diffie Hellman?

Probably this is naive, however it would seem one must check each element of the group to test it's generative properties...


texts: Software timing attack using Kocher method

texts:
What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$?

I'm working from this paper: Volker Müller, Experimental Results for Timing Attacks on Elliptic Curve Cryptosystems (pdf), in Proceedings of the National Seminar on "Penerapan dan Pemanfaatan Mobile Application dalam Dunia Bisnis, Industri dan Pendidikan", Atma Jaya University, Sep. 2003.

There, it is guessed 10 bits of $k$ from $Q=k\times P_i$, but there is no explanation of how many random points $P_i$ he tests.


texts: In SRP-6a, the public key $B$ of the server is normally sent after receiving the public key of the client $A$. Is it okay to send $B$ and $s$ after the client sends its username $I$, but before the client sends $A$?


texts: Selective format-compliant JPEG encryption?

texts:
I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping the rest unaltered. The aim would be, for instance, being able to publish a picture on any given social network, making the "sensitive" regions visible only to a limited number of people, probably a subset of your friends, whom have been granted permission.

I had some (arguable) ideas regarding pixel permutations and BMP, but I have stumbled face-first on the fact that most social networks use exclusively JPEG, and any other format is compressed, essentially ruining the scheme.

So now I am stuck trying to find a new encryption scheme. Ideally, it should have the following properties:

Format-compliant: the image should be still a valid JPEG, openable and viewable.
Unobtrusive: as much as possible, the encrypted image should not have a chunk of randomly colored pixels on the encrypted areas, but keep somewhat close to what it "should" look like - something like blurring or pixelation, but reversible. The rest of the image should be unaltered.
Secure: aside from the crypto perspective, from a perceptual point of view the image should be obscured enough so as to make, e.g. a face unrecognisable without decoding.

2 and 3 are somewhat opposite, so my aim is finding some acceptable middle ground between them.

I have been trying to work with Droogenbroeck and Benedett's "Techniques for a selective encryption of uncompressed and compressed images", which proposes, for every 8x8 square, keeping the DC (aka most significant) coefficient of the DCT, and encoding the rest. However, it works pretty badly for mid-large images: since encryption is done on small squares, and the DC coefficient -which holds most of the energy- is left unaltered, the larger the image is, the "smaller" those 8x8 become in proportion, eventually becoming useless for images over about 500x500.
Other than that, most papers I have found use JPEG2000 - which apparently would make everything much easier, but basically isn't supported by anything, so it doesn't seem a reasonable solution for now.

I know this is a bit on the open-ended-questions side, so specifically, my question is: Is there previous work, or any already discussed solution, for this problem or some other similar one? Do you have any ideas about how to approach this?

Thank you for your time, and please let me know if there is I can clarify - ideally I should link pictures of what I mean, but I don't think I'm allowed below a certain rep threshold :(

EDIT

As fgrieu noted, this has an added problem [please see below]. For example, Facebook apparently decompresses and recompresses the image on uploading, which means an additional, unavoidable quality loss. That means "fine-grained" tricks with coefficients – especially the least significant ones – would not work. (Also thanks to Ilmari Karonen for linking the paper!)

The problem pointed by fgrieu is avoidable in other social networks - for instance, Google+ does not recompress the image, so no problems there.


texts: Best password hashing strategy with Argon2 in a web app

texts:
What are reasonable parameters for Argon2 to hash passwords in a web application? On the one hand we need good performance, fast responses and DDoS resistance, but on the other hand we need protection from brute force on modern GPU, ASIC, FPGA etc. I see an example in Django - they use Argon2i with p=2, t=2 and 512kb of RAM, so is it enough nowadays?

Update: Basically I need to keep response time as low as possible, say 5ms for a user to hash his password. Taking into consideration theoretical throughput of RAM I can afford from 2 till 8Mb per password, so I can either spend more time doing calculations on CPU or consume more RAM with less calculations. What is the best strategy for such a case (do more CPU calculations or consume more RAM per password) to get as maximum brute force resistance as possible? The password hashing algorithm is Argon2, as it's mentioned in the title.

Update 2: Those who vote against some answers please do describe your point in comments.


texts:
What are the properties a generator $g$ should have to be secure for ElGamal signatures (original scheme)?

I am aware that it is poorly chosen and not secure when $g|p-1$ or $g^{-1}|p-1$, where $p$ is the large prime so that $g$ generates $Z_p^*$ and $g$ has maximum order (that is, $p-1$).

Are there other properties one should consider? Additionally, should $g$ be picked randomly over $[1..p-1]$ or is it safe to choose it to be a small integer to start with?


texts: AES-256-ECB to encrypt VOIP audio-stream?

texts:
I need to encrypt a live audio-stream that is being sent over the internet. The details are:

The stream contains spoken language (VOIP)
Only the raw stream is transmitted (no meta-data or container)
Latency needs to be low. Therefore, the stream is send via UDP
The Stream needs to be decryptable, even if a package goes missing (because of UDP).
I can't use TLS, because the SOC on the embedded hardware only supports TLS 1.0, which seems insecure.

For ease of implementation and because packages can get lost, I would like to use AES-256 in ECB-mode. I know that ECB can leak information and is prone to pattern detection. But is that still a concern with audio-data?

As an alternative, I could also use CTR-Mode and transmit the counter along with each package (unencrypted). Would that actually gain me anything?


texts:
A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode for block ciphers is usually described as turning a block cipher into a stream cipher.

It is now widely known that the CTR-mode of operation provides IND-CPA security. Katz proves this in his book.

Does this result imply that all stream ciphers are IND-CPA?


texts:
I understand how ECC works for the point multiplications and stuff.
All we normally do is to multiply a scalar number (lets say d as a private key) with the base point generator G to get a public key point on an elliptic curve.
I am trying to tweak the algorithm for some other purposes so I am just wondering whether an operation like G*G which is a point multiply another point is possible or not. And if it is possible how can we calculate that?


texts:
This is the PSKC standard

https://tools.ietf.org/rfc/rfc6030.txt

In Section 6.1

  6.1.  Encryption Based on Pre-Shared Keys

They have the following

Plain Text = 3132333435363738393031323334353637383930
Algo = aes-128-cbc
pkcs#5 padding
Encryption Key = 12345678901234567890123456789012
IV = 000102030405060708090a0b0c0d0e0f
Encrypted text = ESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1sbeBMSvIhRejN9vJa2BOlSaMrR7I5wSX

How do they get this? I tried using openssl command line

echo 3132333435363738393031323334353637383930 | openssl enc -aes-128-cbc  -nosalt -iv 000102030405060708090a0b0c0d0e0f -a -pass pass:12345678901234567890123456789012

I get the following

HgFUJvBN9ztHcsIXNjvoTJJfOsoIq7XlOpdYCn+nk2TxQFrOJGhN+dYOHpFuIBQn

Likewise for the hmac-sha1

key = 1122334455667788990011223344556677889900
hmac-sha1 = Su+NvtQfmvfJzF6bmQiJqoLRExc=

I do it with openssl command line

echo  3132333435363738393031323334353637383930 | openssl sha1 -hmac 1122334455667788990011223344556677889900 | openssl enc -base64

(stdin)= eb6093578fdb69477f9a3322dcda28ce28b8aa1e

echo eb6093578fdb69477f9a3322dcda28ce28b8aa1e  | openssl enc -a -e

I get

ZWI2MDkzNTc4ZmRiNjk0NzdmOWEzMzIyZGNkYTI4Y2UyOGI4YWExZSAgDQo=

What am I doing wrong?


texts: Negligible function defined as product of polynomial and a negligible function

texts:
How do I prove that a function $f_2$, defined as the product of a negligible function $f_1$ and a polynomial $p$, is itself negligible?

$$f_2(n)= p_1(n)f_1(n)$$

I see $f_2$ as negligible simply because I know that if you have something that has a negligible probability of happening $(f_1)$ then if you try a polynomial number of times $(p)$ we are still left with a negligible result. But I do not know how to prove this. I would appreciate if someone could point me in the right direction.

I have had a look here in  particular the proof for the second Lemma, I think my question is related to the necessity part of the proof, but it seems to have confused me more than it helped.


texts: Pardon me if this question seems a bit obvious, but if someone has a key to your encryption, knowing what type of encryption you are using (or running outputs against a lot of common encryption types) gives them the opportunity to reach your data using said key. So wouldn't it be better if you encrypted according to a non-standard form of encryption, hence removing the need for standards?


texts: Efficiency of finding sub group order vs factorization

texts:
Suppose you got a prime $p = 2\mathbb\Pi_{i=0}^{n-1}q_i+1$, where $2^{k-1} \lt q_i \lt 2^k$ for some $k$ and all $0 \le i \lt n$, and that you also got a generator $g$ of one of the prime order sub groups of $\mathbb Z_p^*$. Also assume that the factorization of $\frac{p-1}{2}$ is unknown.

Question #1:

Are there ways to find the order of $g$ faster than using the elliptic curve and number field sieve methods for factoring $\frac{p-1}{2}$? The expected running time of the generic meet-in-the-middle algorithm for finding the order of $g$ is $O(\sqrt{2^k})$, which might be assumed to be greater than the running time of ECM.

Question #2:

Suppose Alice picks an element $x$ uniformly from $\mathbb Z_{q_0}$ and that $g$ is a generator of the $q_0$ order subgroup of $\mathbb Z_p^*$. Alice calculates $y = g^x \mod p$ and gives $(p,g,y)$ to Bob. Bob's goal is to find $q_0$ and he gets to do that either by factoring $\frac{p-1}{2}$, by finding the order of $g$ and $y$, or by collecting solutions $(a_j,b_j)$ to the equation $BS2I(a_j) \equiv xBS2I(b_j) \pmod {q_0}$ using the following protocol:

Bob: Pick an element $a_j \in \{0,1\}^k$ and send it to Alice
Alice: Calculate $c = x^{-1}BS2I(a_j) \mod {q_0}$. For some deterministic function $f:\mathbb Z_{q_0} \rightarrow \{0,1\}^k$ such that $BS2I(f(z))\equiv z \pmod {q_0}$ for all $z\in \mathbb Z_{q_0}$, calculate $b_j=f(c)$ and send $b_j$ to Bob.
Bob: Verify that $g^{BS2I(a_j)} = y^{BS2I(b_j)} \mod p$.

Question #3:

If we regard the protocol in question #2 as a simple instance of polynomial evaluation, where Alice picks two polynomials $r(), s()$ with coefficients in $\mathbb Z_{q_0}$ and provides Bob with the means to verify if $r(BS2I(a_j)) \equiv s(BS2I(b_j)) \pmod {q_0}$, where Bob picks $a_j$ and Alice provides the solution $b_j$ - would choosing polynomials with higher degree than 1 make it significantly harder for Bob to solve $q_0$?


texts: Key equivalence across different elliptic curves

texts:
Is it possible to prove key-equivalence across elliptic curves of different order? Specifically:

Suppose I have a key $x$ valid for both curves listed below
On curve $g$ (for example, Curve25519) it maps to $X_1 = x*G$, where $G$ is the generator point for $g$
On curve $h$ (for example, Curve1174) it maps to $X_2 = x*H$, where $H$ is the generator point for $h$

Is it possible for me to submit some public proof that $X_1$ and $X_2$ are generated using the same key $x$, but without revealing the value of $x$?


texts:
I have a public key:

MIGJAoGBAKv4OKlpYBAQEFAAOCADqTnisSvdLP+mTswZJdbtk1J+4+qAySJuENCe
+1rcnERjdNa2LTS2y//REwXWo8Jd3mU42GfZJrJhSLFOgYnX3efuMBVebWlqUNGt
sMedxuVaFBL3SoqU7e5RELIsuArCJJIgz86BQDX0x63VpXAgMBAAE=

which, if you use any online base64 decoder, will say it’s invalid Base64 encoding – which is why decoding fails. But I can get it to decode using the Apache Commons Base64.decodeBase64() function.

My current implementation in Java is:

String PUB_KEY = "MIGJAoGBAKv4OKlpYBAQEFAAOCADqTnisSvdLP+mTswZJdbtk1J+4+qAySJuENCe+1rcnERjdNa2LTS2y//REwXWo8Jd3mU42GfZJrJhSLFOgYnX3efuMBVebWlqUNGtsMedxuVaFBL3SoqU7e5RELIsuArCJJIgz86BQDX0x63VpXAgMBAAE=";

byte[] keyBytes = Base64.decodeBase64(PUB_KEY);
X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
try {
    KeyFactory factory = KeyFactory.getInstance("RSA");
    PublicKey key = factory.generatePublic(spec);

    Cipher cipher = Cipher.getInstance("RSA");
    cipher.init(Cipher.DECRYPT_MODE, key);
    byte[] decrypted = cipher.doFinal(Base64.decodeBase64("Zm/qR/FrkzawabBZYk7WfQJNMVZoZrwWTvfQwIhPMzAuqEO+y+sb/x9+TZwTbqmu45/GV4yhKv0bbDL8F6rif7RJap7iQUFQBDEIAraY42IGZ8pB6A0Q0RSnJWW+tLTLJg5cTrgZQ8sLoO+U03T6DE1wy73FU5h6XhXxZERo0tQ="));
    String tada = new String(decrypted, StandardCharsets.UTF_8);
    tada.length();
} catch (Exception e) {
    e.getMessage();
}

There already exists a C++ implementation of this – which works – but the moment I get to factory.generatePublic(spec) I get an InvalidKeySpec error.

I can tell you that with this public key and with the encrypted text I should get this unencrypted text: 2ABB43E83F7EC33D0D33F64BA5782E42.

What is wrong with the public key where I am getting an error about it being the wrong key spec?


texts:
One of the notes defined perfect secrecy (PS) as

Let E = (E,D) be a Shannon cipher defined over (K,M, C).
Consider a probabilistic experiment in which the random variable k is uniformly distributed over K.
If for all m0, m1 , and all c, we have

Pr[E(k, m0) = c] = Pr[E(k, m1) = c]

it is perfectly secret.

My only concern with definition is that I think it lacks to say "for all K", isn't it? Or I am missing something?


texts:
So I've run into this challenge where I was given the guess $g$, and the power $p$ of Shor's algorithm.

All I have to do now is $g^{p/2} - 1$ and then GCD the result with n. But the problem is computing $g^{p/2}$ takes a RIDICULOUS amount of time, even with the exponentiation by squaring method.

Is there any possibility to optimize this process? Or at least is there a better way to compute $g^{p/2}$?

Note: g and p are both of the order of 40 digits or so, and I was doing the exponentiation by squaring using python 3.7


texts: Is there a source(book, thesis, paper) that explains Lattice basis reduction algorithms (LLL, HKZ) and provides an in depth analysis of the same?

texts:
I want to give a slight background about me: I've Bachelors in Computer Engineering and I've been interested in Cryptography since my college days and have been following the field ever since. I'm also actively following the state-of-the-art, particularly in the area of Lattice-based-cryptography. I'm independently researching in this field and have been particularly interested in Lattice basis reduction algorithms and their involvement in cryptanalysis.
I've been trying to get a feel of Lattice basis reduction algorithms since somedays and would like to share the timeline that I followed up until this point.

Motivation for why lattices are important from a cryptographers standpoint.
Introduction to Lattices, sub-lattices and related terminology.
Hard Problems in Lattice based Cryptography
Lattice basis Reduction Algorithms

Q1. I'm stuck at HKZ and haven't been able to get a feel of these concepts in particular. I haven't found some resources that could possibly help me in understanding it a bit better.
Q2. I have usually found problems in 2 dimensions. Is there a resource where someone have worked out on problems for a few more dimensions (maybe, 3,4,5 and 6)?

The resources that I've been taking help from are:

LLL Algorithm
Chapter 10 and 13 of Algorithmic Cryptanalysis by Antoine Joux
Regev's Lecture Notes
Also from Nigel Smart's Crypto Made Simple for the basics of Lattice based Cryptography.
A Complete Analysis of the BKZ Lattice Reduction Algorithm


texts: Are there secure MPC schemes that support uneven load balancing between the parties?

texts: In a scenario in which some of the parties have more data / compute power / trust reputation (or other meaningful properties) than other parties - are there known methods to do secure multiparty computation with load balancing that takes into account the above-mentioned (or other) parameters?


texts: Why are RSA keys encoded with ASN.1 for TLS?

texts: Browser vendors use ASN.1 encoding for RSA certificates in the TLS protocol. RSA public keys are just a number, so why do we need encode them to something else? That increases the risk of security problems.


texts: Any implication of a Yale result to security of quantum cryptology?

texts:
Quantum key distribution depends, if I don't err, on (irreversible) damages done by MITM's measurements on qbits. Now news.yale.edu/2013/01/11/new-qubit-control-bodes-well-future-quantum-computing says:

"The Yale physicists successfully devised a new, non-destructive measurement system for observing, tracking and documenting all changes in a qubit’s state, thus preserving the qubit’s informational value."

Wouldn't the new technique, if not immediately practically, at least in long term render the security of QKD questionable?


texts: Is there such a thing as a hash function with a fixed size input?

texts:
That seems like it would be a useful primitive. Using it in place of a block cipher in the Merkle–Damgård construction would give a variable-length hash, maybe without the tricky business with related keys? Using it to hash a key+nonce+position would give you a stream cipher. Though maybe the collision resistance we need from hashes is wasteful for a cipher?

Relatedly, why is it that block ciphers seem to be the low-level building block of choice for hashes and stream ciphers? Especially when the decryption operation doesn't seem to get used very often.


texts: PYFHEL - Concatenating two encrypted strings and then decoding them

texts:
I'm trying out the PYFHEL (PYthon For Homomorphic Encryption Libraries) library, and was wondering if it was possible to concatenate two strings while encrypted and then decrypt the result.
This probably better explains what I want to do:
string1 = "hi"
string2 = "there"

*encrypt both strings separately*

encrypted_string1 + encrypted_string2 = result

*decrypt result*

decrypted_result = "hi there"

So in short, I have two strings - "hi" and "there". Upon encrypting both these strings separately, I would like to be able to concatenate both of them, to form a result that, when decoded, reads "hi there".
I understand that PYFHEL doesn't allow you to directly encrypt a string, it has to be an int in order to be encrypted/decrypted, so am I able to do anything in order to convert both these strings into integers, encrypt them, then "add" them together so that when decrypted and turned back into a string, it reads "hey there"?
What I'm asking may be impossible, I don't know. I'm new to all this and am just very bored on the school holidays. I hope someone understands what I'm trying to do.


texts: Are there any digital signature algorithms in common use that result in 32-byte signatures?

texts:
I don't consider myself to be an expert in this field, so forgive me if there is an obvious answer.  I am having a tough time finding an algorithm that can sign data and output a 32-byte signature, that is in common use.  Specifically, I'd like to find an algorithm that frequently available in many security APIs that are in common use, across multiple architectures.  In other words, any algorithm that could be considered ubiquitous.

Is there a reasonably "standard" signature algorithm that generates 32-byte digital signatures?  To be clear, I'm not asking for any Github projects, or library APIs but I would like to find an algorithm that is pretty standard and is accessible to a broad group of developers.

Is such an algorithm in use or are most, if not all, common signature algorithms in the 64+ byte range in size?


texts: Are there any secure commutative ciphers?

texts:
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.

My question is, here there any commutative ciphers out there that are secure enough for sensitive data encryption / decryption (money is involved) and at the same time not burdening enough on the computer to be run in real time on less powerful devices (say, a smartphone)?


texts: Symbolic models and security under algebraic attacks

texts: It seems that algebraic attacks against cipher algorithms have not succeeded in practically breaking ciphers. The reason primarily is that the algebraic models of ciphers under with a known plaintext ciphertext pair and unknown key bits are too complex both in structure and number of variables. However if number of variables are brought down in a model to a sufficiently small number then it is possible to find structural weaknesses of equations or systematic algebraic heuristics of solution algorithms to find key bits. Although current algebraic models of AES have 9000+ variables and equations, these models contain mostly latent variables which can be eliminated algebraically offline. Hence in principle a 128 variable model of AES128 with a given plaintext ciphertext pair of blocks can be developed from an offline algebraic model. Should this not be a warning that AES can in principle be broken even with classical computers? Some agencies might already have such models.


texts:
Is it possible to develop a scheme where two parties, unsure if they have the same secret, can verify that the other does or does not share the same secret, without one party being able to cheat and come away with more knowledge than the other? (Or that if one does, that this can be detected by the other party.)

Let me explain using an example from our friends Alice and Bob. Their boss Charlie has just given Alice and Bob symmetric keys he requires them to use to communicate with him; $K_a$ and $K_b$, respectively. Alice and Bob expect their keys to be different, but are concerned that perhaps Charlie has reused the same key out of laziness.

Alice and Bob would like to verify each other's keys in such a way that, either:

They both come away certain that $K_a = K_b$; or
They both come away believing that $K_a \not= K_b$.

In other words, they want to prevent the possibility that:

One party can discover that $K_a = K_b$ but conceal this, so the other party comes away believing that $K_a \not= K_b$ and unaware that foul play has taken place.

Note: Let's assume here that Alice and Bob are communicating on a secure channel and have authenticated each other. Let $h()$ be a secure hash function.

A naive approach would be a scheme like:

---> Alice sends $h(h(K_a))$ to Bob
<--- Bob sends $h(K_b)$ to Alice

The problem here is that Bob could receive $h(h(K_a))$, calculate $h(h(K_b))$, discover they are equal but instead send $h(\textrm{random data})$. Alice might now believe her key is different to Bob's, when in fact he is able to decrypt all her messages.

I have tagged this with commitments since my guess is that the only way to solve this problem, if indeed it can be solved, would be for both Alice and Bob to both commit to something about the verification messages they are about to transmit, so that they cannot later change what they send without the other party realising. They might also be able to use some zero-knowledge proofs on each other, so I tagged that too.

Another idea I had was that Alice and Bob could reveal their keys one bit at a time through a commitment scheme. That is, each sends $h(\textrm{bit}_i||\textrm{nonce}_i)$ for each bit $i$ of their keys. They then take it in turns to reveal the nonces; as soon as there is a mismatch, they stop sending nonces. A cheating party learns at most a few bits more than the other (depending on how well they can guess bits), which is still not ideal, but I suppose it is better than one party learning everything.


texts: Attack on a key-exchange,symmetric-key cryptography protocol

texts:
This is an exam question in Oxford 's Computer Security course:

  Here is the start of a protocol, based on a long-term secret key $k_{AB}$ previously shared between Alice and Bob, designed to offer bilateral authentication and establishment of a session key $k_s$. The session, which begins at message 4, is supposed to be confidential and secure against reflection, replay, and re-ordering of the contents.
  1.$A \to B$: Alice, $nonce_A$
  2.$B \to A$: $nonce_B$, $E_{k_{AB}}$$(nonce_A \| k_1)$
  3.$A \to B$: $E_{k_{AB}}$$(nonce_B \| k_2)$
  Alice and Bob both compute $k_s$ = $k_1$ ⊕ $k_2$
  4.$A \to B$: $E_{k_s}(...)$
  5.$B \to A$: $E_{k_s}(...)$

  a) Why would Alice and Bob want a session key $k_s$, rather than simply using the already shared secret key $k_{AB}$ for session encryption?
  b) How should Alice and Bob format the contents of their session, messages 4 onwards, to meet the aims of the protocol?
  c) If they additionally wish to ensure the integrity of the session, what should they add to the protocol?
  d) Does this protocol provide key agreement or does it provide key transport? Explain your answer.
  The following appears to be a man-in-the-middle attack on the protocol, under the usual Dolev- Yao model:

  1.$A→I_B$: Alice ,$nonce_A$
  1´.$I_A→B$: Alice, $nonce_A$
  2´.$B→I_A$: $nonce_B$,$E_{k_{AB}}$$(nonce_A ∥ K_1)$
  2.$I_B→A$: $nonce_B$,$E_{k_{AB}}$$(nonce_A∥K_1)$
  3.$A→I_B$: $E_{k_{AB}}$$(nonce_B∥K_2)$
  3´.$I_A→B$: $E_{k_{AB}}$$(nonce_B∥K_2)$
  Alice and Bob continue their sessions with the intruder.
  e) Why does the above sequence not constitute an attack on the protocol?
  f) Although not subject to man-in-the-middle attacks, there does exist a flaw in the protocol. Find it, and explain carefully why it does constitute an attack on the protocol.

Part f) is where I'm currently stuck.

One attack I can think of is when $nonce_A = nonce_B$ a Dolev-Yao attacker can pose as B and send A $E_{k_{AB}}$$(nonce_A ∥ k_1)$ in message 3 then $k_s = k_1 ⊕ k_1 = 0$ then the attacker know s$k_s$ and he can send message and decrypt message. But the chance $nonce_A = nonce_B$ is very small, so I'm not sure if it constitutes an attack.


texts: How to prove knowledge of discrete logarithm in a product?

texts:
Definitions

Suppose I have two large safe primes $p$ and $q$, and a composite number $N=pq$. I have $G$, a large cyclic subgroup of $\mathbb{Z}^{*}_{N}$; $g$ and $h$ are generators of $G$. I commit to $x$ using a random value $r\in{_{R}\mathbb{Z}_{N}}$ as $(x,r)=g^{x}h^{r}\mod{N}$.

I have a set of valid messages $S=\{p_{1},p_{2},...,p_{m}\}$, and a message $x\in{S}$. The set $S$ is public, while $x$ is private.

Problem

I must prove knowledge of two secret integers $\mu$ and $\nu$: $$\mu=(\prod^{m}_{j=1}{p_{j}})/x$$ $$\nu=\mu r$$ using the commitment: $$C=g^{\prod^{m}_{j=1}{p_{j}}}h^{\nu}$$ I know this supposedly can be done using a combination of two Schnorr signatures. I just need a little guidance as to how to utilize those two signatures to prove knowledge of $\mu$ and $\nu$.

What I have so far

Given the definition of $\mu$ I have $C=g^{\mu x}h^{\nu}$. I also know I can express $g^{\mu x}=h^{-\nu}C$ and $h^{\nu}=g^{-(\mu x)}C$, so that gives me $$\mu x=\log_{g}(h^{-\nu}C)=\log_{g}(h^{-1})\log_{g}(\nu)+\log_{g}(C)$$ $$\nu=\log_{h}(g^{-(\mu x)}C)=\log_{h}(g^{-1})(\log_{h}(\mu)+\log_{h}(x))+\log_{h}(C)$$ I'm really not sure where to go from here, because I seem to be making it more complicated instead of less...


texts: Are all homomorphic encryption schemes not CCA secure?

texts:
Homomorphic encryption is hyped by computer sciences because it offers great potentials. For example you can perform cloud based calculation while nobody gets to know you data.

I am wondering if there is any homomorphic encryption scheme that is CCA secure. Can't you always just choose a random message, encrypt it and link the ciphertext to the challenge? A decryption oracle will decrypt it without hesitation. As the attacker know one plaintext message, he can easily calculate the second one. By doing so he always wins the CCA experiment.


texts: Is the logarithm in the private set intersection protocol mentioned in Section 3.4, Step 5 of http://www.ece.umd.edu/~danadach/MyPapers/set-int.pdf, a base 10 or 2? How do we find this out?


texts: What is the difference between PKCS1 v1.5 and PKCS7? Is PKCS7 a superset of specifications in PKCS1 1.5?

texts:
I have a requirement wherein we have to verify the PE binaries generated for an aarch64 platform.

These binaries are then signed using the opensource sbsign tool to generate a signed PE binary with PKCS7 signedData structure included in the SECURITY section of the binary. These binaries have to be verified by the bootloader (in our case uboot) before they are loaded.

I stumbled across a patch which made use of the ARM-software/u-boot to verify the signedData section. As can be seen, the functions in this file such as rsa_verify() and rsa_verify_with_keynode() refer to verifying an RSA PKCS1.5 signature.

My question is, is this the same as verifying the PKCS7 signedData structure? It would be great if someone could help me understand.


texts: Proof of correct construction of a private key in distributed cryptography

texts:
In an exponential ElGamal encryption scheme where the key generation is done in a distributed way among $n$ trustees we have that each trustee $i$ (where $1 \leq i \leq n$):

Selects a private key share $x_i \in \mathbb{Z}_q^{\star}$.
Computes a public key share $h_i = g^{x_i} \mbox{ mod } p$, where $g$ is the generator of the group.

Then, the public key of the cryptosystem is computed as $h=h_1 \cdot \ldots \cdot h_n \mbox{ mod } p$, while the secret key of the cryptosystem can be considered to be $x=\sum_{i=1}^n x_i$. Clearly, with this setting all shares $x_i$ of the secret key will be needed in order to decrypt any ciphertext, and thus no individual trustee is able to decrypt ciphertexts on his own.

Among some other things not relevant to my question, we usually have that every trustee $i$ is asked to prove that $h_i$ was correctly constructed (that is, $x_i= \log_g h_i$). This is usually proved by means of a Schnorr proof of knowledge.
The goal of asking the trustee to prove such thing is, as I've read in the literature, to prevent the trustee from constructing his public key share $h_i$ as a function of the public key of the other trustees.

My question is: what would be the dangers of doing so? That is, what could a trustee gain by constructing $h_i$ as a function of the public key of the other trustees, if he still doesn't know the private key which would allow him to decrypt ciphertexts on his own?


texts: Can there be different representation of the same public PGP key?

texts:
I have two PGP public key files:
File1 was created with Kleopatra / Gpg4win.
File2 was created by the following procedure:

Import File1 as public key for EmailAccount1 into Thunderbird 78.4.0
Send this imported public key via email from Thunderbird 78.4.0 from EmailAccount1 to EmailAccount2
Save the public key file that was attached to this email received at EmailAccount2

File1 and File2 seem to have the same fingerprint.
Just like File1, File2 can be used to encrypt messages, which both can successfully be decrypted with the private key that had been created with Kleopatra when creating public key File1. So, both File1 and File2 seem to work as the same public key in combination with the private key.
But interestingly, File2

is 14 bytes smaller in size than File1
has a longer line length than File1
has less lines than File1
differs from File1 in the first 3 bytes after the "-----BEGIN PGP PUBLIC KEY BLOCK-----" line
differs in the last 5 bytes, just before the "-----END PGP PUBLIC KEY BLOCK-----" line

Is it normal and permissible to have differing versions of one and the same public key? Or should the public key string never get changed, no matter what?


texts: Finding Galois LFSR and its initial configuration

texts:
Suppose recursion for output of Galois LFSR is $u_1=u_3=u_4=0$

What kind of taps are here, and initial state? How to uncover this information?


texts:
Assume I want to make my RSA secure because I heard that textbook RSA, especially in conjunction with low exponents, is very risky. I decide to limit my message length to 100 and subsequently construct my padded message as follows:

m = '\x01'*70 + m + '\x01'*70

To improve performance, I choose $e=3$.

Why is this risky? After all, the padded message is large enough, i.e. knowing that $c=m^3 + k*n$, $k$ will be too high to bruteforce. At first glance I don't see any attacks that could work here therefore it should be safe?


texts: Is the "secure-as-worst-case" version of NTRU patented?

texts:
Does the improved version of NTRU — which is described in "Making NTRU as Secure as Worst-Case Problems over Ideal Lattices" by
Stehlé and Steinfeld — fall under the same patents as the original?


texts:
say there is an homomorphic cryptosystem on elliptic which allows unlimited addition and only one multiplication.
So in order to same the mult operation for a later functionality, I need to add a scalar to a ciphertext.
That is not a defined function. Still, is there some way to go about it ?


texts:
this is probably a fairly simple request, but I have'nt been able to find it anywhere.
A lot of cryptography schemes have security games associated with them. In the Book by Katz, a bunch of schemes have a security game involved with them. This usually involves an Adversary trying to break the scheme, and a Challenger on the other side.
I was wondering what a security game for factoring would look like?
I really find the games very pedagogical, in making me understand the gist of different problem.


texts: IPsec : transmission of Initialization Vector

texts: I am currently carrying scholar research about IPsec protocol, and I have a question regarding the  IP Encapsulating Security Payload (ESP). Is the initialization vector of operation mode transmitted in clear in the message ESP Payload ? If it is transmitted in clear, why is it not a security issue ?


texts: Affine Cipher - Pair of plain to cipher text

texts:
Consider an affine cipher.

  The cryptanalyst observed the following plaintext/ciphertext pairs $(p,c)$: $(8,15)$ and $(5,16)$.

  Recover the key $(a,b)$ used in the encryption system above.
  What is the ciphertext corresponding to the plaintext $p=3$?

For #1, I came to this result:

$$\begin{aligned}
8 \cdot a + b &\equiv 15, \\
5 \cdot a + b &\equiv 16 \\
\implies
a &\equiv 17, \\
b &\equiv 9.
\end{aligned}
\pmod{26} $$

For #2, congruence gave me:

$$\begin{aligned}
3a &\equiv -1, \\
\text{which is}\quad 3a &\equiv 25, \\
\implies 3^{-1} &\equiv 27,
\end{aligned}
\pmod{26} $$

not $17$. Am I doing something wrong?


texts: I searched "ECDSA threshold signing" recently and found a lot of papers where it is said that their authors solved the problem of ECDSA threshold signing efficiently: e.g. here  and here. Why there are no practical implementations of those (e.g. in cryptocurrencies)?


texts: How can SSL secure a two-way communication with only one key-pair?

texts:
As I understand it, SSL involved the use of a public-private key pair.  How does this enable two-way communication?

Suppose I have some server with which I wish to communicate securely.  I connect to it, and it supplies me a certificate, which contains its public key (assume the certificate is valid).  I then take my request, and encrypt it with this public key, and transmit the resultant ciphertext to the server.   This communication is secure from eavesdropping.  But how does the server return to me my results securely?  I lack a public/private key pair, and have no certificates.


texts: Is it possible to decrypt the entire message with one half of the key in this example?

texts:
In this scheme, a 256 bit key is split into two 128 bit sub-keys. Message blocks are 256 bits and are also split into two sub-blocks. Before encryption, each sub-block is xor'd with it's partner and then xor'd with the opposite sub-key, in order to link the entire key to both blocks.

From the example below:

sub_aes_key1 = a
sub_aes_key2 = b
sub_block_1  = w
sub_block_2  = x
ciphertxt_1  = y = aes(message= sub_block_1 ^ sub_block_2 ^ sub_key_2, key = sub_key_1)
ciphertxt_2  = z = aes(message= sub_block_2 ^ sub_block_1 ^ sub_key_1, key = sub_key_2)

Essentially, the crux of my question is whether or not the hypothetical Susan, who somehow aquired one half of the key, would be able to infer the rest of the text. I'd also like to know if there are any other obvious vulnerabilities to this variant if you can see them.

  Pseudocode example

function func_1(a, b):
 encrypt message "a" with key "b"

function func_2(a, b)
 decrypt message "a" with key "b"

John knows:
a, b = 255, 100
c, d =  83,  97
w, x =  86, 205      (b XOR c XOR d), (a XOR c XOR d) #
y, z =  44, 196      func_1(w, a),      func_1(x, b)

Susan knows:
a, b = ___, 100
c, d = ___, ___
w, x = ___, 205      ???,               func_2(z, b)
y, z =  44, 196

a = c ^ d ^ x   =   ___ ^ ___ ^ 205
d = a ^ c ^ x   =   ___ ^ ___ ^ 205
c = b ^ d ^ w   =   100 ^ ___ ^ ___
w = b ^ c ^ d   =   100 ^ ___ ^ ___


texts: order of elliptic curve divisible by prime

texts: Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?


texts: What is the fundamental difference between multipartite and multilevel secret sharing?

texts:
According to this paper ,
Multipartite secret sharing scheme is a scheme in which the set of participants is divided into disjoint parts and all participants in the same part play an equivalent role in the scheme.
I am not sure about the exact and formal  definition for Multilevel secret sharing scheme.
What is the fundamental difference between multipartite and multilevel secret sharing scheme?


texts: Can we use different mode for decryption instead of using mode which is used in encryption?

texts: I am decrypting the Apple Payment Token in Demandware, the apple pay token is encrypted in GCM mode, but in Demandware, we don't have GCM mode in Cipher class, so can I use other modes for decryption? Can anyone suggest me regarding this?


texts:
I am currently working with the NXP NTAG 424 chips, which feature AES-128 encryption.

In the end, one will be able to read an NDEF message; for example, with a smartphone, the backend server will then verify whether the message was delivered.

However, NXP often implies that the UID should not be communicated in the clear. They even have a setting that disables the communication of the UID in the clear (it is then replaced with a fake UID). NXP also states the following in their application note:
" Therefore
verification side does not have immediate info on UID, which is usually used as input for
key derivation function. In this case, KSDMMetaRead key shall not be UID diversified and
high attention on secure storage on the system level of this key is required.
"

Why is the open communication of the UID such a problem? Can the UID be used to crack the key? How should one diversify the key instead?


texts: Can a Cramer-Shoup public key have two different private keys?

texts: Since I am new to the Cramer-Shoup algorithm, I would like to know: Is it possible to have two different private keys for a public key due the key pair generation algorithm that Cramer-Shoup uses? I know that in public key algorithms, this is not possible in all cases, but I want to make sure what the answer is for Cramer-Shoup.


texts: How does use of HMAC affect hash function combiners?

texts:
In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions:

$HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)$

The OP also talked about hash function combiners in general and preserving collision-resistance of the underlying hash functions, so I was wondering how the introduction of MAC into a hash function combiner, and this construction specifically, would work.

It appears obvious that this scheme will do a good job of preserving (or even enhancing) the PRF properties of the underlying hash functions (it's quite similar to the TLS PRF combiner, which Lehman10 showed was 'somewhat robust'), but I'm unclear what it will do to the collision resistance.

The results of Boneh06 and Pietrzak07 require the combiner output size to be roughly the concatenated size of both hash functions for CR to be preserved.
On the surface this would appear to rule out the $HMAX$ function above as CR preserving, but I'm not sure whether these proofs extend to covering a keyed construction.

Mittelbach13 showed combiners with weaker security guarantees, but shorter output sizes could be produced, as long as it was assumed that one of the hash functions was Indifferentiable from a Random Oracle (IRO) (which also appears to assume a proof in the random oracle model).
Again, I'm not sure whether a) $HMAC$ has an IRO proof, or b) whether the Mittelbach proof covers the use of a keyed construction in the combiner.

I'm also aware that the 'folklore' $\oplus$ combiner does not preserve collision resistance (i.e. it can even create collisions where none existed in the underlying hash functions).
Does this simply (ignoring the use of $HMAC$) apply to this usage, and imply that the combiner cannot preserve CR?

I'm interested in two things:

Does the introduction of $HMAC$, or any keyed function in general, complicate/negate the Boneh/Pietrzak/Mittelbach results, or do they apply to any construction?
Do any of the results above apply specifically to the $HMAX$ construction described above?


texts: Did the formalization of PKCS#1 RSA key formats come before or after X.509?

texts:
The paper introducing the RSA cryptosystem titled "A Method for Obtaining Digital Signature and Public-Key Cryptosystems" was published in 1978.

The initial version of X.500 published by CCITT (predecessor of ITU-T) dates back to 1988, with the then X.509 document specifying in its Annex.C a version of RSA cryptosystem with public key format as the ASN.1 structure:

SEQUENCE {INTEGER,INTEGER}

Versions 1.0-1.3 of PKCS #1 were circulated among participants in RSA Data Security, Inc.'s Public-Key Cryptography Standards meetings in February and March 1991. (according to RFC 2313)

Obviously formal RSA specs come after X.500 framework, but is it because of that reason, PKCS #1 choose to specify its key formats in terms of ASN.1? What happened during those early meetings?


texts: How do I safely anonymize/hash a unique identifier to protect privacy?

texts:
I am building a system to collect a unique identifier (MAC addresses from 802.11 probe requests). The system will have several collection points over a large area, submitting to a central database. I want to do traffic analysis without allowing a known MAC address to be mapped to the points where it was seen.

My goals:

Anonymize the MAC addresses the same way for each device, to allow tracking of an anonymous device over time, regardless of which collection point sees the device.
Anonymize in such a way that an attacker with a user's MAC address and a copy of the database can't trace the user's movements.
Ideally, the addresses are secret from shortly after the moment of collection and unknown even to me (I can be considered an attacker, especially by the users being collected).

It's like I'm designing a web service where the username and password are the same. Anywhere I store instructions for generating the hashed MAC address (either a per-address salt or a general hashing instruction) I'm providing an attacker with the means to de-anonymize users.

Could I encrypt the MAC addresses using a public key for which I don't have the private key? That's really just a fancy way of hashing, and considering there are only 334 billion addresses in the registered IEEE namespace (considerably fewer for common manufacturers like Samsung and Apple), it's only partly resistant to attack.

I'm just not sure where to go from here, except to start making security tradeoffs.


texts: How can breaking the ElGamal encryption scheme break the Diffie-helman protocol?

texts: I have been studying how ElGamal is a public-key algorithm built on top of the Diffie-Hellman key exchange but I got confused. How exactly could an attacker break the Diffie-Hellman protocol (i.e. compute $g^{ab} \bmod p$ efficiently given $p, \space g, \space g^a \bmod p$, and $g^b \bmod p$) if they can efficiently find the plaintext messages from their ciphertexts (encrypted using ElGamal)?


texts: Conforming to best practices in password file (keyring) encryption

texts:
In order to implement a plaintext password file safe (keyring), while adhering to best Crypto practices today, I came up with this scheme:

A user's master password is hashed with Argon2 (\$argon2id\$v=19\$m=65536,t=15,p=2)
Hash is used as key for encrypting auxiliary plain text passwords with AES 128 GCM
The public plaintext password values (called service and username) are authenticated (providing them as associated data for GCM)

The resulting data structure looks like this

(for breverity, the base64 encoded json value is decoded here):

[service]
username = {"nonce": "CusUx2wp0pHzPAqEaRsKAw==",
            "mac": "kStM+2I4+L5Jy3fl13BVYQ==",
            "data": "UK9Txr4aEY1Yd1FQKApbpK2aFzdbKLCfgffF",
            "salt": "1ACl3k9CWQ9sXKdqVAQlew=="}

Questions:

Somebody suggested to additionally authenticate nonce and salt? Does this make sense, since all values together constitute the input for a successful decryption anyway? (nonce is the GCM nonce, mac the GCM MAC, data the encrypted payload, salt is used for Argon2, mac contains service and username as associated public data)

In my humble believe, this adheres to todays best practices already. Am I missing something?

What are the downsides of NOT authenticating the number of records? For now, I like the fact, that these files can be edited manually (e.g. records can be added and removed, since each record is still tamper resistent in itself).
Am I missing something?


texts: How to compute a smooth-degree isogeny given a generator point of its kernel?

texts:
I need to compute an isogeny from $E: y^2 = x^3 + ax + b$, given a generator point for its kernel subgroup, using Python.
The point has smooth order.

I need both the parameters for the curve and polynomials for point mappings.

I have already read about Vélu's formulas, but it seems it will take a lot of time to compute each point in the subgroup, and more time to evaluate the curve parameters.

I know PARI and MAGMA provide an algorithm for that, but I need to understand the algorithm to write it on my own.

I am trying to use this for computing SIDH.


texts: What does "overwhelming" mean in cryptography?

texts:
I found the term "overwhelming" when I study cryptography.
According to the definition, we call $f$ overwhelming if $1-f$ is negligible.
I already know the negligible function and its way to use but I don't understand why we consider the overwhelming function.
Can someone teach me how to use it and some examples?


texts:
I wondering about the formula for calculating the number of AES rounds.

The formula is $R=(\text{Keysize}/32)+6$

I would like help understanding why we divided by $32$ and add $6$ in this formula.


texts: Service to expose all encrypted messages its users sent. How protected would this data be?

texts:
I have recently started a new side project for an open-source messaging system with end-to-end encryption.

My key idea with this project is that everything should be as transparent as possible, with the server only being an intermediary - a repository for encrypted messages that can be accessed by anyone but can only be decrypted by their intended recipients, who will keep their private keys safe locally.

My choice for encryption is PGP as my knowledge is that there are no known attacks that can crack it; that it is protected against attacks where both the plaintext and its encrypted version are known and that using initialization vectors you can make sure two instances of the same content don't produce the same encrypted output.

However, allowing everyone to access all encrypted messages seems risky because:

There are no known attacks for the time being but that can change in the future
Brute-forcing would take ages with current hardware but hardware is only going to improve
Quantum computers will probably become a thing in the future

I really don't want the server to handle authentication and sessions as I want to treat it as something the user can't really trust (with recent history showing it's often just a matter of time and interest whether a server will get compromised). I also want to provide users with more anonymity and privacy - if the server can't know who a user really is (because it won't know if they could decrypt the messages they accessed), an attacker who has gained control over it and is monitoring its connections can't either, at least not for sure.

My question is, is it reasonable to allow everyone to access all messages? Are the points I mentioned about possible attacks in time reasonable? Is this improved "privacy and anonymity" really not a good trade-off for the possibility messages would eventually be cracked?


texts:
The discrete logarithm problem is to find $z$ when the inputs are $g,h,p$ where $g^z\bmod p$.

Supposing if you fix $p$ then does the problem become any easier to attacks and is there a $(\log p)^c$ complexity algorithm?


texts: How is a per round key generated in DES algorithm?

texts:
I am reading over a slide that I found online regarding the DES algorithm for encryption and I am a little confused about the per round key generation. From the slide below, I understand that each per round key is obtained by shifting left either 1 or 2 bits depending on the round. The thing I do not understand is the permutations for Left half C_i and right half D_i

In the slide, it says that the left half C_i is 14 17 11 24 1 5 3 28 15 6 21 19 23 19 12 4 26 8 16 7 27 20 13 2. Are the numbers in this example random? A textbook I am reading also uses the same numbers for round C_i and I cannot see the connection here. C_0 does not contain 14, so I am not really sure how left shifting bits causes the 14 from D to go to C. Am I misunderstanding the problem here?


texts: Attack on BB84 algorithm for quantum key exchange?

texts:
I have a question which is related to the BB84 cryptosystem.

We are not able to send single photons so instead we send $K$ photons at a time all with the same polarization. An enemy can separate one of these from the remaining $K-1$.

If the enemy can detect the polarisation by only looking at one of the photons, the others may remain undisturbed and so the enemy will not be detected - is this correct?

Why can the enemy find our common key if $K=3$?


texts: Python. RSA common modulus attack problem

texts:
I have:

N = /*500 decimal numbers*/

E1 = 3740453

E2 = 4226171

M^E1 = /*500 decimal numbers*/

M^E2 = /*500 decimal numbers*/

I must use RSA common modulus attack on it.

Using gmpy2.gcdext() i have:

a = 624366
b = -552607

So E1*a+E2*b == 1 is True.

Now i need to know M. For this i must to do follow things:

M = ((M^E1)^a) * ((M^E2)^b) #Just a formula...

In python 2.7 i do like that:

M = pow(ME1,a) * pow(ME2, b) #Where ME1 = M^E1, and ME2 = M^E2

And i have a problem here!
Function pow() can't work with negative "b".

How can i calculate last expression ?


texts: How long random value is required in random masking method?

texts:
I heard that random masking method requires a random number whose length is as long as a message to be sent, but I’m not sure that. So, I'd like to ask about that.

1. Boolean masking : $ x_i \oplus r_i$

Assume that a message is $ (x_7, x_6, \cdots , x_0)$ where $x_i$=0 or 1. Then, a random value of 8 bits is required! That is $(r_7, r_6, \cdots , r_0)$ where $r_i$=0 or 1 and the Boolean masking is $(x_7 \oplus r_7, x_6 \oplus r_6, \cdots , x_0 \oplus r_0)$

2. Arithmetic masking : $x + r$

Assume a message $x$ of 8 bits where $x \in \Bbb Z_{2^8}$. Then, a random value $r$ of 8 bits where $r \in \Bbb Z_{2^8}$ is required!

2-1. Arithmetic masking

Assume that the length of all message $x$ to be sent is 4 bits (that is, $0 \le x < 2^4$) where $x \in \Bbb Z_{2^8}$.

(Question 1) Is it possible to hide the message $x$ with random number $r$ of 4 bits using arithmetic masking method $x+r$ in $\Bbb Z_{2^8}$?

3. Multiplicative masking : $x*r$

Assume that the length of all message $x$ to be sent is 4 bits (that is, $0 \le x < 2^4$) where $x \in \Bbb Z_{2^8}$.

(Question 2) Is it possible to hide the message $x$ with random number $r$ of 4 bits using multiplicative masking method $x*r$ in $\Bbb Z_{2^8}$?

(Question 3) Where can I find the related references?

Thank you in advance.


texts: How come Public key cryptography wasn't discovered earlier?

texts:
I became interested in crypto lately and read about symmetric and public key crypto algorithms. I understand how crucial the discoveries of the 1970s like RSA, DES and DH were in advancing the technology.

I just don't understand how public key cryptography as an idea just came less than 50 years ago while it was a highly desired solution throughout history and kingdoms/countries/intelligence services would pay handsomely to whoever discover this simple yet revolutionary idea.

Things like integer factorization and elliptic curves were studied since the 19th century, how come nobody thought of using such known mathematical problems to create strong crypto systems, especially in WW1 and WW2 where confidentiality and integrity of data could decide the fate of a whole nation, instead of relying on centuries-old futile crypto techniques?

I am sure that this wasn't a lack of human resources, every European country had lots of geniuses, so why  wasn't public key cryptography discovered until so late?


texts:
Let $\mathbb{G}_1,\mathbb{G}_2,\mathbb{G}_T$ be yclic group of the same order and $ e: \mathbb{G}_1 \times \mathbb{G}_2\rightarrow \mathbb{G}_T$, such that $u\in \mathbb{G}_1, g \in \mathbb{G}_2, a,b,r \in \mathbb{Z}$.

Question 1: is the following equation correct? Is there any situation under which it might be correct? If not why?

$e(u^a,\frac {u^b}{u^a} g)=e(u^b,g)$

Scenario: assume we have two parties: $A$ and $B$, where $A$ has two messages $m, m'$ and $B$ has a message $m$. $A$ commitments to a message $m$ as: $(r.u^m)^a$, and B commitments the same message as $(r.u^m)^b$. They send their commitments to a server. It's clear that if $A$ gives $g^{\frac{1}{a}}$ to $B$, $B$ can compute $w=g^{\frac {b}{a}}$, and send it to the server to let the server check whether two messages $m$ for different parties are equal: $e((r.u^m)^a,g^{\frac {b}{a}})=e((r.u^m)^b,g)$

Question 2: Given $g^{\frac{1}{a}}$ can B generate $w'$  to convince the server that it has commited to $m'$ rather than $m$?

All operation are $\bmod p$ where $p$ is a large prime number.


texts: What does Shor's algorithm tell us about the complexity class of RSA and the DLP?

texts:
If quantum computers operate in BQP and (using Shor's algorithm) they are able to factor large integers and break the discrete log problem, what does that tell us about the complexity class of these problems?

I just read an article that claims that it is unlikely that RSA or ECC will ever be reduced to NP-complete problems, but given Shor's algorithm isn't that impossible?  Or what about the other way: if someone does find such a reduction, does that tell us anything about the relation of BQP and NP?


texts: Converting a point in a finite field to its real (x, y) coordinate

texts:
Let curve $A: y^2 = x^3 + 7$ and curve $B: y^2 \equiv x^3 + 7 \pmod{p}$
Curve $B$ is secp256k1, assume the usual parameters for that curve.
Let $k$ be any private key, and compute the corresponding public key point $[k]G$ in curve $B$.
Now, from this point $[k]G$ in curve $B$, how can we find what the point $[k]G$ in the "real" curve $A$ is? You don't know the value for $k$, but you do know all other parameters.
Point $G$ in curve $A$ is the positive $y$ solution to the curve $A$ with $x$ equal to the $x$ value of $G$ in curve $B$.


texts: How can I break a Vigenère cipher with partial plain text?

texts:
I have an exercise to do regarding Vigenère encryption.

I've got the cipher text: WNZTNVIEEGTJYKRRWYUELWNZTNV
and a partial plain text: S''''R''R''''R''''PASS'''''

The key length is unknown.

The question is: is it possible to find the key and the plain text?
Regarding what I've seen in class, I don't think it's possible.

But I was wondering if it was possible in some way with a computer to find the rest of the plain text and the key?

PS: neither the plain text or the key are in English.


texts: Given infinite unencrypted and encrypted texts, can I find the algorithm?

texts: Given an infinite amount of both unencrypted and the corresponding encrypted text, would I be able to calculate the algorithm? I am relative new to cryptography and don't know if I would be able to find how the unencrypted text is encrypted... Is this possible? If so, what should I study?


texts: LIL (PRNG) statistical test does not appear to be in a stable state

texts:
I am trying to run the LIL statistical testing tool that can be found here
http://webpages.uncc.edu/yonwang/liltest/

When I execute the jar with:

java -jar LILtest.jar -s -p -a -b binaryfile.dat -l 0

The program says it has written data to lilCurve.pdf and lilSnap.pdf but no such files exist anywhere on my computer instead there is a file called LILSnap that contains at most one floating point number. I have R installed and I have tried running the tests with the -r flag to no avail. My current theory is that the program was created on top of an older version of R which is causing problems. Additionally, there are certain times where I run the software and get this as output (Infinity and NaN are unexpected and are usually outputted as floating point numbers):

It is 1070MB long. I divided this file
into 2140 sequences (each sequence is 512KB) and
carried out LIL testing on them.

You have requested to generate the LIL curve pdf file. The resulting
LIL curve file could be found in: lilCurve.pdf

You have requested to carry out the snapShot testing. I generated
the snapShot curve in the file: lilSnap.pdf. The statistical
distances are as follows (if the actual value is smaller than the expected
value, then your sequence passed the LIL test):
Total Variation:
                Infinity(expected)
                0.0 (actual)
Hellinger distance:
                Infinity(expected)
                NaN (actual)
root-mean-square deviation:
                Infinity(expected)
                NaN (actual)

This test is referenced in a number of relevant papers and it's a bit disappointing that it does not work out of the box.

If anybody knows of any secret debugging tips I would appreciate your input.

EDIT 1: I am trying to run the program with the different major versions of R, it looks like the program was written in 2015 and R 3.x.x was released in 2016/7 ish.


texts: How to protect traffic metadata from a malicious cloud provider?

texts:
What can be a theoretical and efficient way of protecting traffic metadata (packet size, timestamps, packet count) of enterprise when traffic is redirected to the SGX enclave residing in a cloud provider for processing. I have setup an IPSEC tunnel between the gateway located in enterprise domain and enclave but after I did some debugging it seems that metadata are not protected. One simple way of protecting packet size is using padding making all packets the same size but this way is not efficient and also does not protect timestamps and packet counts.

Is there any efficient solution to protect such metadata? Any answer is appreciated.


texts: Worth taking performance hit of HMAC to gain additional security?

texts:
It seems like SHA-512 truncated to 256 bits is usable as a MAC [1].  The advantage is that it's ~50% faster than HMAC-SHA-256 on 64-bit CPUs and ~50% faster than HMAC-SHA-512 on short inputs.  (My use case involves mostly short inputs.)

However, the HMAC construct provides an extra layer of protection in case of collisions in the underlying hash function [2].  This extra protection ended up being practically useful when weaknesses were found in MD5 and SHA-1.

Because of this, it seems better to use truncated HMAC-SHA-512 over truncated SHA-512.  Is that a reasonable (e.g. not-overly-paranoid) choice?


texts: Performance metrices of cryptographic algorithms

texts:
I'm a beginner and working on cryptography performance metrics.

My question is that what are the important metrics to check the performance of Cryptography Algorithms.


texts:
Is there an algorithm that can be used to verify the contents of a cyphertext, but not the order of the elements?

I am thinking that a deck of cards could be shuffled, and it must be verifiable that the deck contains all cards, but not to know what order they are in.

Any ideas how to approach this problem?


texts:
Trying to study ZKPs, I have seen that proofs qualify players (a part from -of course- simulator and extractor): so honest prover, honest verifier.
Is it needed because usually examples deal with interactive schemas which require players to act in specific ways (so it's not needed when Fiat-Shamir heuristic is used on sigma-protocols to get non-interactive flavours)? Or are there more technical, subtle reasons?
Thanks!


texts: Is it true that Serpent and twofish are much stronger than AES?

texts:
I heard that Serpent and Twofish are much stronger than AES, but it was chosen because it is faster. If that's true, please tell me why it is stronger.
Also: is it true that Twofish and serpent are better protected from brute force attacks because they take longer to en/decrypt?


texts: Is it possible to retrieve the original hash of a digital signature using a public key?

texts:
I am running a server that is receiving packets. Each packet is signed with an RSA 512 SHA-256 digital signature. I have a public key and exponent that I use to verify the digital signatures.
I'm currently trying to do this in Python using Cryptodome. I am able to verify signatures but am unable to get the original hash.
If verification is failed, I want to obtain the original hash that was signed. Is there a way to do this with the public key?


texts: Which precautions to protect against side-channel attacks on ARX ciphers?

texts:
In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples include Threefish, Salsa20 and ChaCha20.

One of the nicer, claimed properties of such ciphers is that they are supposedly easier to implement in a side-channel resistant fashion.

Assuming one would want to implement Threefish (on a multitude of architectures such as ARM, x86 and x64), which precautions does one need to take to avoid side-channel attacks for such implementations? And are there any precautions which would be applicable to ARX designs specifically? If, which precautions against side-channel attacks can/should be taken?

What I don't count here: attacks that would work by exploiting unproperly erased/freed memory. I'm looking for the standard cryptographical side channels: cache-timing, "normal" timing and maybe (differential) power (/EM) analysis.

What I would consider "pre-cautions": any code solely intended to defeat side channel attacks while not being documented in the original specification (which usually gives only a mathematical approach).


texts: DES with the bitwise complement of a key

texts:
I was reading upon Biham and Shamir's paper and a fact has been presented over there:
if $ P_1 = \bar P_2$ and I choose a key $K_1 = \bar K_2$ then in that case
$$T_1 = DES(P_1, K_1)$$
$$T_2 = DES(P_2, K_2)$$

then $T_1 = \bar T_2$ . Does this hold for only that particular combination of S-box or it will be same for any S-box combination. I mean if I change S-boxes randomly then will it still be same?

Also there is one more thing mentioned on the paper, but I am not able to get it. PFB the image.

Here output $T$ will be $\bar T_2$ only if I $P_2$ was inserted with $\bar K$. And clearly I am entering $P_1$ (which is $\bar P_2$) hence the output can never be $T_2$. Please correct.


texts: Is it theoretically possible for the output of SHAKE to be an infinite concatenation of the same 512-bit block?

texts:
Let $X$ denote a particular 512-bit sequence.
Let $A,B,C$ denote sequences of bits such that:
$$len(X || A) = len(X || B) = len(X || C) = 1600$$

$$\operatorname{Keccak-}f(X||A) = X||B$$
$$\operatorname{Keccak-}f(X||B) = X||C$$
$$\operatorname{Keccak-}f(X||C) = X||A$$

then we have a loop, so the output of SHAKE (if my understanding of how the sponge construction works is correct and if $X||A$ happens to be the state which was output after xoring the final block of input) is nothing but an infinite concatenation of the same 512-bit block. Is it possible?


texts: How exactly is the input message of SHA-256 (pre-)processed?

texts:
I’m very interested how SHA-256 handles messages, but I’ve got 3 questions. (As I have already read in some answers before, SHA-256 is not directly performed on the message but on an array, thanks for that.)

In my understanding after padding the message to a multiple of 512 bit length, we put the message into a

  64 entry message schedule array w[0..63] of 32-bit words

Is this an array with 64 elements, each allowed to be 32 bits long?

  copy chunk into first 16 words w[0..15] of the message schedule array

But then I ask myself, if we have a message that is, for example 4096 bits long and we only fill the first 16 elements of the array with the original message, what happens to the other (4096-16*32 = 3584) 3584 bits of the message?

  s0 := (w[i-15] rightrotate 7) xor (w[i-15] rightrotate 18) xor (w[i-15] rightshift 3)

What are the rightrotate and rightshift operators doing to the elements in the array?


texts: Is timestamping possible without publishing?

texts:
The Wikipedia article Trusted Timestamping states that we can timestamp data by publishing it's hash. Publishing can be done either independently or via a third-party publisher, as explained by DrLector on another thread.

However, can we timestamp data without the capability to publish anything?

What solutions can a person (or a computer) employ to timestamp data if it is not connected to the internet for several days or weeks?


texts:
Just a quick question:
I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended.
Though when I looked up HMac to implement my own MAC in CBCBlockCipher, I found people using HMac with only SHA256, which results in MAC's length of only 32 bytes.

So what route should I take? Should I implement something like SHA512 to gain some MAC length?


texts:
I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do:

Get a password P from the user. Generate a 16-byte random salt S. Derive a key K1 = PBKDF2(HMAC-SHA1, P, S, iter=2000, bits=256). Divide the data into blocks of 1024 bytes each. For each block, generate a random 16-byte IV. Encrypt each block with AES-256 with key K1 and this IV. For each block, calculate D = HMAC-SHA2 of the concatenation of IV and encrypted data. For each block, write out the IV, the ciphertext and D.

Now I need to store and distribute the salt too. For this, I derive key K2 = 1000 iterations of SHA2("somefixedtext" + P) and IV2 = 500 iterations of SHA2("someotherfixedtext" + P). The salt is then encrypted with AES-256 with key=K2, IV=IV2 and stored alongside the ciphertext.

OK, so is this secure enough?


texts: Obtain Information about hash algorithm from ECDSA public key

texts:
I have an ECDSA Public Key in DER Format.
I viewed the file in an ASN1 Editor and there's the OID 1.2.840.10045.1.1 whose superior (1.2.840.10045.1) is ecdsa-with-SHA1. So I thought that SHA1 is used here. But it turns out that a signature generated with the corresponding private key could only be verified with openssl when I used EVP_sha256().

How do I get this information about which hash algorithm is used from the whole key?
This is the whole key:

308201333081EC06072A8648CE3D0201
3081E0020101302C06072A8648CE3D01
01022100A9FB57DBA1EEA9BC3E660A90
9D838D726E3BF623D52620282013481D
1F6E5377304404207D5A0975FC2C3057
EEF67530417AFFE7FB8055C126DC5C6C
E94A4B44F330B5D9042026DC5C6CE94A
4B44F330B5D9BBD77CBF958416295CF7
E1CE6BCCDC18FF8C07B60441048BD2AE
B9CB7E57CB2C4B482FFC81B7AFB9DE27
E1E3BD23C23A4453BD9ACE3262547EF8
35C3DAC4FD97F8461A14611DC9C27745
132DED8E545C1D54C72F046997022100
A9FB57DBA1EEA9BC3E660A909D838D71
8C397AA3B561A6F7901E0E82974856A7
0201010342000448E231AF19DF341C82
63521A9436ACBCA5ACB7E3C56A63187B
F22539BE8242FF82F5521F619977FEE1
3457490123F04915671C7AF755E98465
FD20AECAAF7F58

EDIT:
This is a signature in plain format, verifiable with the public key posted above:

93 ea c4 0a 7e 26 04 dc b9 a1 05 34 b1 52 57 2a
0e 1a c8 d2 d5 fc 96 e5 95 c2 45 3d 71 c7 82 8a
0c ac 72 96 01 8c ef 87 b6 9c e2 55 74 e6 de 2d
c6 a3 5c f0 c6 5e 72 27 3a 30 e0 50 33 16 ed 2d


texts:
Apologies in advance, I'm a beginner and my knowledge of terminology in this field probably reflects that.

I have a question about one-time codes being used with passwords. What inspires me to ask this question is that some prominent government computing agencies (NERSC in particular) has implemented multi-factor authentication. I have google authenticator setup to generate my OTP codes.

The method they show requires one to input the password and the OTP in separate fields. However, in different places I noticed they require 'password+OTP', which led me to discover that this works site-wide, one can just concatenate the OTP to the end of the password and everything works fine.

Which bring me to my real question: Is that vulnerable to timing attacks? The only way I can imagine this to work is by iterating through my supplied password, and checking for a match to the hash/whatever of the password up to the checked point, which as far as I know would let someone time-attack a password out, as theoretically NERSC would not know the length of your password, and thus not know what part of the concatenated password+OTP is password and what is OTP, which leaves brute-force to check if it's a valid password and OTP.

Is this valid logic, or is there something I don't know? I haven't checked if its actually timing attack resistant since it's government property... (they could just wait a set time to return if the password is correct or not?). Is this a concern I should send to the powers that be because there is a better way to do it or am I just a clueless but paranoid beginner?


texts:
I am struggling to understand how to perform a sextic twist over a BN elliptic curve. This is what I understood so far:

Let's consider a BN elliptic curve:
$$
E: y^2=x^3+b
$$
And let's consider a point $Q \in E(F_{p^{12}}) $. What I would like to do is to "easily" go from/to $Q \in E(F_{p^{12}})$ to/from $Q' \in E'(F_{p^{2}})$, where $Q'$ is the sextic twist defined as
$$
E': y^2=x^2+b/\xi
$$
In fact I can use this isomorphism (I guess) to move from/towards $E$ and $E'$:
$$
\psi: E'(F_{p^2}) \rightarrow E(F_{p^{12}})
$$ $$
\psi((x',y')) = (\xi^{1/3}x',\xi^{1/2}y')
$$
$$
\psi^{-1}(x,y) = \left(\frac{x}{\xi^{1/3}},\frac{y}{\xi^{1/2}}\right)
$$
My questions are:

Is the isomorphism I wrote correct?
Is $\xi$ an integer number in $F_p$?
Can I choose any value I want for $\xi$? I guess that I should choose it so that $\xi^{1/3}$ and $\xi^{1/2}$ are integers, but I'm not sure...


texts: RFC6979: error in reference implementation?

texts:
If I correctly understand RFC 6979, there is an error in the ref implementation section 3.2.

In the step H2, RFC specification says

 2.  While tlen < qlen, do the following:
              V = HMAC_K(V)
              T = T || V

but in Java implementation in the RFC appendix, we found the comparison with rolen

That does not provide the same result.

For example if used with Stark curve with prime field equal to 0x0800000000000011000000000000000000000000000000000000000000000001, qlen is 252 and rolen is 256

As consequence the loop occurs twice with rolen, but only once with qlen. it doesn't change the first k value but the subsequent k change.

The RFC code has been used now from third software.

Any thought about that?


texts: Can a Password be Derived from a AES key?

texts:
This thought randomly popped into my head and I have not been able to find a clear, defined answer for it. Given an AES key, lets say an AES-256 key which is derived from a user password, is there any way to analyze the key and reverse engineer the password used to generate the key?

I understand if the key has been revealed and is known to an attacker they already have what they need, but this is a theoretical. Alternatively, a hacker may leverage a weakly protected system, stealing the key for a particular user from that system, reverse engineer the password then hope the user used the same password on a more secure system that the hackers primary goal is to access that.

I apologize if this is an obvious question, I am a software developer trying to break into the security field and attempting to develop my understanding of cryptographic principles.

Thanks!


texts: Novice here. Is there a MPC function where no information is leaked even if all parties are not trustworthy ?


texts: What is the "standard model" for block ciphers?

texts: In this paper and this the authors speak of a "standard model". What is the "standard model"? How does it differ from the "ideal model"? Why does the decision to use it or the "ideal model" impact the security bounds of their schemes?


texts: Zero knowledge proof of possession of key

texts:
Suppose Alice has at some point in time produced ciphertext $C$ from message $M$ with key $k$.
Suppose Alice has then passed $C$ to Bob, and also made a commitment to her key $k$ (thanks to nightcracker for this addition).

Bob then stored it and passed it to a third party Dave, who also possesses $k$ and decrypts to get $M$, and based on $M$, performs certain operations.

Assume that Dave has no contact with Alice and Bob.

Now Alice is incentivised to lie about the contents of $M$ to Bob.

Suppose at a later time that Alice provides Bob with the message $M$. Is there any sequence of actions that Alice can perform to prove to Bob that $M$ was the message she encrypted to give $C$, without handing over the key $k$?

Is there any connection with this: Zero knowledge password proof?


texts: How does the squeeze function in the NaCl Poly1305 implementation work?

texts:
The NaCl ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()):

static void squeeze(unsigned int h[17])
{
    unsigned int j;
    unsigned int u;
    u = 0;
    for (j = 0;j < 16;++j) { u += h[j]; h[j] = u & 255; u >>= 8; }
    u += h[16]; h[16] = u & 3;
    u = 5 * (u >> 2);
    for (j = 0;j < 16;++j) { u += h[j]; h[j] = u & 255; u >>= 8; }
    u += h[16]; h[16] = u;
}

I understand globally what is done in the first for loop, namely that each integer in h is reduced to 256 bits, with the carry being carried over to the next integer. I only don't grasp what happens from the h[16] = u & 3; on. Where does the u & 3; come from? and the u = 5 * (u >> 2);?

Also, if I would want to change the radix here, say from 2^8 bits to 2^16, would that require me to change the above mentioned fragments? I would need to change al the 8's to 16, and the 255's to 2^16-1, but would that be it?

Does anyone know how this squeeze function works, and provide an explanation, as well as an answer to my second question?

The implementation itself provides no documentation, and the answer on How does NaCl Poly1305 implementation do modular multiplication? does not delve into the squeeze function. See this stackexchange question for the full code.


texts: Does there exist a hash function which has a fixed point?

texts: Does there exist a hash function $h$ and an input $x$ such that $h(x) = x$? I believe this is a special case of collision-resistance. I imagine such a case is guaranteed not to be possible (otherwise such a hash function wouldn't always be guaranteed to be useful), but how is such a case proven to not be possible?


texts:
I am new to cryptography and I am very confused. In fact, I am so confused that I have trouble providing a suitable title for my thread...

I know that a Substitution Cipher is designed to substitute one letter or character for another, to produce a ciphertext as shown in the picture below

With most symmetric cipher, the final step is to combine the cipher stream with the plaintext to create a ciphertext using XOR binary logic encryption.

My question is

why is the plain text, cipher stream and cipher text all in binary?
In the first picture, it is all in letters, now in the second picture, it is all in binary.
Where does the single key from the symmetric cryptography take place?


texts:
Let's say: an error is induced into an implementation of the AES-128 to produce a faulty ciphertext. The error is a one-byte eror and is always induced on the last state byte, during round9, before the MixColumns operation. The induced errors are unknown and can be different. However the key is the same in both cases.

Then how can I recover 4 bytes of the last round key? Which bytes of that round key can I recover and what's their value?

ciphertext1 = 0xe719f8ab9e0b846f0cf2e5c32a0e5b45
faultytext1 = 0xe719f86f9e0beb6f0c97e5c38b0e5b45

ciphertext2 = 0x78f272c7cf5383085fa240236d97130f
faultytext2 = 0x78f27277cf53e7085f944023fa97130f