texts: Explanation of a proof of one of Shoup's lemmas

texts:
In Lower Bounds for Discrete Logarithms and Related Problems, Victor Shoup states the following lemma:

Lemma 1 Let $p$ be prime and let $t \ge 1$. Let $F(X_1, \dots, X_k) \in \mathbb{Z} / p^t[X_1, \dots, X_k]$ be a nonzero polynomial of total degree $d$. Then for random $x_1, \dots, x_k \in \mathbb{Z} / p^t$, the probability that $F(X_1, \dots, x_k) = 0$ is at most $d/p$.

The lemma is proved as follows:

For $t = 1$, this is proved in Schwartz [1]. For $t > 1$, one divides the equation $F = 0$ by the highest possible power of $p$, and obtains a nonzero equation of no greater degree that holds modulo $p$. If $x_1, \dots, x_k$ are chosen from $\mathbb{Z}/p^t$ at random, then their images in $\mathbb{Z}/p$ are random as well, and so we can apply the result for $t = 1$.
[1] J. T. Schwartz. Fast probabilistic algorithms for verification of polynomial identities. J. ACM, 27(4):701-717, 1980.

What does division by the highest possible power of $p$ mean in this context? Division, when understood as multiplication by the inverse, requires calculating the inverse of power of $p$, but the power of $p$ is not co-prime to modulus $p^t$ and thus does not exist.


texts:
Would reseeding a PRNG with the PRN from the previous generation have any effects whatsoever on the quality of the generated numbers; if so, does this depend on the PRNG used, or are the effects generally applicable to any algorithm?

Perhaps I'll enhance the question with some pseudo-code:

firstSeed := get_seed_from_entropy_pool()
seed(firstSeed)
firstPrn := rand()
seed(firstPrn)
nextPrn := rand()

Is nextPrn already of inferior quality? Would quality decrease if repeated?


texts: Building a cryptography system by combining a block cipher and a stream cipher?

texts: I have to come up with a design for a cryptography system by combining a block cipher and a stream cipher. I can't seem to come up with anything on my own. Can someone point me in the right direction with helpful resources and information to tackle this problem?


texts: Does collision resistance imply (or not) second-preimage resistance?

texts:
I've seen contradictory results. Sometimes hash functions are collision-resistant but not necessarily second-preimage resistant. I've seen this kind of things in papers from Bart Preneel:

“Security Properties of Domain Extenders for Cryptographic Hash Functions”
(See the chapter "Other Domain Extenders").

How that can be possible ?

We have theorems that say that if a hash function is collision-resistant then it is second preimage resistant as well:

http://en.wikipedia.org/wiki/Preimage_attack


texts: Any (proposed) internet standard (RFC) for trusted hosting of signed documents?

texts:
There's a problem with digitally signed documents - in particular that any print-out of them will be only a copy, not an original (by print-out I mean the print-out of the human readable form of the document, not the sequence of bits that makes up that document).
That makes it difficult for digital signatures on official documents finding adoption, since any agency who will offer to accept digitally signed documents will have to maintain two archives - a physical one for the physically signed originals and a digital one for the digitally signed ones.
It would be great if digitally signed documents could be printed out and stored in a physical archive the same way as physically signed documents are stored, without sacrificing their authenticity - and it seems like it wouldn't be technically too difficult to achieve this.
What you would need would be a trusted hosting service.
When a signee then would sign a digital document, the protocol could go something like this:
1. Signee requests a new storage url from the trusted hosting service (maybe with certain validity, like 10 years)
2. The trusted hosting service answers with a signed "hosting-token" containing:
  - Timestamp
  - The generated download link
  - The guaranteed hosting duration
3. This hosting token is digitally attached to the document
4. Signee generates a new, symmetric encryption key
5. Signee includes a visual QR code in the document containing (either on an extra page or somewhere on the document):
  - the download link that was pre-generated by the trusted hosting service
  - the generated encryption key
  - (probably the date and guaranteed hosting duration would be added visually too)
6. Now the document is signed using the signee's certificate (optionally timestamped using RFC 3161)
7. The signed document is encrypted using the generated symmetric encryption key
8. The encrypted data is sent to the trusted hosting service and from then on will be available under the preallocated download url for download

Verification of digital document would now consist of:
- download the data from the link in the QR code and decrypt with the key in the QR code
- confirm that the hash of downloaded and current document are identical (i.e. that indeed the correct document was uploaded to this hosting address)
- confirm the signature of the hosting-token
- confirm the document signature

The download step during verification could be skipped by encrypting the current document with the key inside the QR code, taking the hash of the encrypted file and then asking the trusted hosting service whether the hash fits the hash of the file under the speicific download link.
So long as the hosting service is trusted (and during the guaranteed hosting duration), this document could now be printed out and the printed copy could be physically archived and treated like any other physically signed original, since the digital original could be produced at any moment. And because the document is hosted in encrypted form, only those who already have access to a copy of the document can decrypt the hosted copy.
Government servers implementing such a protocol could make it very easy for all agencies and companies of a country to start accepting digitally signed documents as originals, while still using their physical processing and archiving workflows.
Now, since I'm certainly not the first one facing this problem, I'm pretty sure that there are already proposals or solutions to it and my question therefore is whether there is a proposed internet standard for such a signature scheme?


texts: Secret key is included in cipher text. so how can we say that if hacker grab the cipher text he will not be able crack the code? if he cannot do with cipher-text then how receiver can crack the message from same cipher-text? what is difference?


texts: Why use 256-bit symmetric encryption when the key is exchanged using asymmetric cryptography that only provides 112 bits of security?

texts:
Since a 2048-bit RSA key or a DH shared secret obtainet using a 2048-bit prime only provides the equivalent of 112-bits of security in symmetric encryption, what's the advantage of using AES-256 with a key derived from this level of asymmetric cryptography?

Why many protocols such as SSL use it? Is there any advantage?


texts: Security analysis of LWE with unequal error and secret distribution

texts:
Analysis of security of recent LWE based Key-exchange schemes, the error and secret vector is always chosen from the same Gaussian distribution. What will be the impact on the security if $\sigma_s\neq \sigma_e$? In particular, if  $\delta=$root-hermite factor, $d=$dimension of the lattice $m+n$, $m=$number of samples, $q=$ LWE modulus, and $\sigma=\sigma_s=\sigma_e$.

The primal attack the BKZ block size ($b$) is optimized such that $\sigma\sqrt{b}\leq \delta^{2b-d-1}\cdot q^{m/d}$, where  In the dual attack, we try to find a short vector in the dual lattice $w \in \Lambda' = \{ (x,y) \in \mathbb{Z}^m \times \mathbb{Z}^n : A^t x=y\mod q\}$. We try to find a short vector ($w,v$) of length $l$ such that, if ($A,As+e$) is a LWE sample ($w^ts+v^te \mod q$) is distributed as Gaussian. The advantage with which this vector can be distinguished from a random vector is $\epsilon=4e^{-2\pi^2\tau^2}$ where $\tau=l\sigma/q$. Now. if $\sigma\neq\sigma_s\neq\sigma_e$ how will the above equations change?
For the primal attack can I replace $\sigma\sqrt{b}$ as $\sqrt{\sigma_s^2+\sigma_e^2}\sqrt{b}\leq\delta^{2b-d-1}\cdot q^{m/d}$ or in the dual attack $\tau=l\sqrt{\sigma_s^2+\sigma_e^2}/q$.
My second question is if $\sigma_s<<\sigma_e$ will the above equations hold?  Is the new dual attack by Albrecht et al. for small secrets applicable here even though the secret is not binary?

The bounds are obtained from the security analysis of Newhope (Section 6.3 and 6.4) or this recent presentation by Albrecht


texts:
I am planning to develop a more secure version of the RC4 algorithm. Since I´m not an encryption expert, I´ld like you to help me find answers to the following questions:

Does the value of the key array(T) have to be in this range [0-255]? If the answer is “yes”, could you please explain why?
Why did they use s[t] to generate the key and not the key array which is defined as t array in RC4?

Output = S[(S[i] + S[j]) mod N];


texts: What are usable entropy sources in a headless machine without /dev/random or any cryptography API?

texts: If I have a headless machine (no mouse movements, no keyboard presses, or user input), without any cryptography CSPRNG APIs, where can I collect entropy from?


texts: Safely store data before moving to air-gapped machine

texts:
This is related to an earlier question, Is it possible to use an algorithm to generate an OTP?

I have two machines: A, and B.  A is connected to the internet and files are uploaded regularly.  B is air-gapped.

When files are uploaded to A, I want to encrypt and store them in the most secure way possible.  They will then be transferred via USB to machine B, where they can be decrypted and read.  What's the most secure method of going about this?

My understanding is that this is a pretty standard encryption problem.  However, as far as I can see, the nonce for each message is transferred along with the message itself.  I would rather some method where the nonce could be generated by an algorithm that both A and B knew, with a seed that was secret shared between them.  Is this possible?


texts: Encrypting a string as smaller pieces vs. encrypting it as a whole

texts:
Is there any difference between these two ways to encrypt a string using FPE?

Say the string has the format is specified by this rule
First part is in the set
$S = \{\text{AA,AB,AC,BA,BB,BC,CA,CB,CC}\} = \{0,1,2,3,4,5,6,7,8,9\}$,
second part is in the set
$T = \{0,1,2,3,4\} = \{0,1,2,3,4\}$

Example string = $\text{BA2}$

Usage 1.
Break the string as parts defined above, determine the integer representing each part as defined by the bijective mapping, and encrypt those integers individually using encryption function $E$.

$\text{BA = 3}$

$2 = 2$

$E(3) \Rightarrow 6 = \text{CA}$

$E(2) \Rightarrow 4 = 4$

Concatenate the parts together to get output

Output string = $\text{CA4}$

Usage 2
Encrypt the entire string by ranking all possible values.

$S=\{\text{AA0, AA1, AA2, AA3, AA4, AB0, AB1 ,AB2 ,AB3, AB4, AC0, AC1, AC2, AC3, AC4,}$ $\text{BA0, BA1, BA2, BA3, BA4, BB0, BB1, BB2, BB3, BB4, BC0, BC1, BC2, BC3, BC4,}$
$\text{CA0, CA1, CA2, CA3, CA4, CB0, CB1, CB2, CB3, CB4, CC0, CC1, CC2, CC3, CC4}\} = \{0,1,2,3...43,44\} $

$E(17) \Rightarrow 8 $

Output string  = $\text{AB3}$

Is Usage 1 equally valid as Usage 2?  Are there any negative side effects to breaking the string into pieces first compared to encrypting the string as a whole?


texts: How to break a vigenere cipher with a period of 2, and knowing a part of the plaintext

texts:
the encrypt code is "ARJHNRIUCGQHPFGQFHTXPDEHTLNOC", and the part that i know of the plaintext is "DERUNA".
The key is period of 2, so the key are 2 letters. Each letter of the code would specify in turn the magnitude of the cyclical shift.
How i can find the key? And how I can break the cipher?
I have to create a program in c++ that automatically decrypt the message.


texts: RSA attack with continued fractions (Wieners attack)

texts:
I found an article on the internet about an RSA attack with continued fractions.

Given are the following numbers:

$n = 205320043521075746592613$
$e = 70760135995620281241019$
$\frac{e}{n}=[0;2,1,9,6,54,5911,1,5,1,1,...]$

The method says that if $d<n^{\frac{1}{4}}$, then $\frac{e}{n}$ is an approxiation of $\frac{k}{d}$

In an example of these method, they take $\frac{k}{d}=[0;2,1,9,6,54]$.

They say that they stop the continued fraction before 5911, because it's a big number. Can someone please explain me why?


texts: Any known cases of lucky collisions resulting in security breaches?

texts:
This isn't a deep technical question, but I feel like this is a good place to ask. Modern cryptography generally rely on statistical chances of collisions according to current computing powers. Are there any known cases where someone was lucky and cryptography was broken?

Also, would it be an interesting thing to do to gather as many keys as possible and try to break them all. Would it increase the chances of breaking some of them? I could see organizations like the NSA do something like this.


texts: Is there any symmetric key cipher (block or stream cipher) providing partial decryption?

texts:
symmetric key cipher (block or stream cipher) providing partial decryption of data at some points. Although the entire data has not been decrypted, the data decrypted to that specific point should be viewed or accessed.

The partial decryption keys can be inherited form the main symmetric key to do partial decryptions successfully.

Can anyone refer to me any good stuff or papers worked out in this area?


texts: Would a non-deterministic (read: randomized) compression algorithm be crypto-safe?

texts:
Would a compression algorithm that randomly shifts stuff around every iteration be TLS/crypto-safe?

This randomization would prevent the same byte sequence from appearing twice in a row, thus making it harder to figure out the key and stuff. Altho I don't have any crypto knowledge...

Note that it would only apply to the compression step. The decompression step would always produce the same output when given the same input.


texts:
I'm actually searching some particular primitive compatible with Groth Sahai commitment.

I would like to know a signature scheme (on group elements), such that there exists an algorithm $\mathtt{SigCom}$ such that it takes as input the commitment key $\mathtt{ck}$ , the signing key $\mathtt{sk}$ and a commitment $\mathtt{c}$ and outputs a committed signature $\mathtt{c}_\sigma$ with a (Groth-Sahai) proof $\pi$ that certifies the signature committed is the signature of the value (in the commitment of the input).

I found this article : https://eprint.iacr.org/2002/014.pdf
It does exactly what I want except that the value are on a precise type $\left(G^m, H^m\right)$, and it's too restrictive for me.

If you know a more general result (or something that fit with two group elements without any relation between them), it would be amazing.


texts: Will publishing two or more public keys of the same RSA private key cause a security risk?

texts:
I want to make an end-to-end messaging platform where everyone is identified with a unique random private key. Everyone uses other peers' public keys to identify and send encrypted messages and verify received messages signed by the public keys. Now I want to use multiple public keys for each peer and maybe give peers access to two or more public keys of a private key.

Can other peers find out if some known public keys belong to the same private key or not? And if they found out, does it put the private key at risk of being cracked or create other security issue?


texts: Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure?

texts:
I am developing a symmetric en-/decryption routine written in c# for a database containing user-specific, sensitive information.

I have narrowed down the implementation to 3 different approaches, but simply cannot determine which is the "best". So, which of these is the most secure?

AES in GCM mode. Using either BouncyCastle or CLR Security implementation.
For those who don't know, GCM mode utilizes CTR mode with a provided counter (not sure of the exact implementation) and an additional message authentication process (definitely not HMAC)
AES in CTR mode. Using Bouncy or CLR security again. In this instance I would use the .net HMAC and utilize a 16 byte IV randomly generated (securely) as the unique nonce.
AES in CBC mode. Using the .NET implementation. Again the HMAC from .net and rand IV.

The simpler the better cause I'll probably mess it up

Thanks a bunch


texts: Offline Group Key Agreement - Cross Device Syncing

texts:
I have a specific use case I am interested in. I have spent the better part of the night reading research papers. I am beginning to believe what I want is not possible so I wanted to confirm here.

Scenario: I have customers with a private key. However, this private key is on the device they installed my software on. They have no clue what or why they have a private key and could care less. This is important for using the software. They can also use the software on their phone, not just their desktop. I need a way to get that private key on both devices without them communicating with each other but only through me. I, however, do not want to be in contact with the raw private key.

I am happy to store an encrypted version of this key but I don’t want the ability to decrypt it.

I am also aware of the fact that I can use a password. So device A can have the user enter a password which can be used to encrypt the key and then they can send it to me to store. Then on device B, I can send them the encrypted key and they can use the password to decrypt it. This is trivial.

The key requirement I am trying to get to is I don't want a user to have to enter a password on each device to be able to decrypt the key. The only passwordless solution I found in my research requires the devices to communicate to agree on a key. This would mean both devices have to be online at the same time. So the only real-world way to do this is to have a user perform an action on device A ( if not online ) to be approved for device B which I do not want as it is friction for the user. Again this is all in the background and not applicable to their usage of the app. So to summarize:

Do not store a key or decryptable key on my servers
Customer does not have to enter a password or anything like it
Both devices do not need to communicate (offline)


texts: Normalization of points on an Elliptic Curve

texts:
The Bouncy Castle source code (Java edition) has a ECPoint.normalize() function. It seems to calculate the modular inverse of a coordinate of a point on the curve. Without it point compression - for instance - seems to fail.

It seems that usually this normalization is performed as part of Elliptic Curve calculations automatically when other libraries are concerned.

So I've got the following questions:

After which operations is normalization required for elliptic curves?
What's this normalization about, is it just calculating the coordinates with a "positive" Y value on the curve?
Could leaving out the normalization of points trigger invalid calculations, or is this just about the representation of the point on the curve?

If there is any reference material available then I'd be interested to know about it.

For reference, the Java source code of Bouncy Castle:

/**
 * Normalization ensures that any projective coordinate is 1, and therefore that the x, y
 * coordinates reflect those of the equivalent point in an affine coordinate system.
 *
 * @return a new ECPoint instance representing the same point, but with normalized coordinates
 */
public ECPoint normalize()
{
    if (this.isInfinity())
    {
        return this;
    }

    switch (this.getCurveCoordinateSystem())
    {
    case ECCurve.COORD_AFFINE:
    case ECCurve.COORD_LAMBDA_AFFINE:
    {
        return this;
    }
    default:
    {
        ECFieldElement Z1 = getZCoord(0);
        if (Z1.isOne())
        {
            return this;
        }

        return normalize(Z1.invert());
    }
    }
}

ECPoint normalize(ECFieldElement zInv)
{
    switch (this.getCurveCoordinateSystem())
    {
    case ECCurve.COORD_HOMOGENEOUS:
    case ECCurve.COORD_LAMBDA_PROJECTIVE:
    {
        return createScaledPoint(zInv, zInv);
    }
    case ECCurve.COORD_JACOBIAN:
    case ECCurve.COORD_JACOBIAN_CHUDNOVSKY:
    case ECCurve.COORD_JACOBIAN_MODIFIED:
    {
        ECFieldElement zInv2 = zInv.square(), zInv3 = zInv2.multiply(zInv);
        return createScaledPoint(zInv2, zInv3);
    }
    default:
    {
        throw new IllegalStateException("not a projective coordinate system");
    }
    }
}

protected ECPoint createScaledPoint(ECFieldElement sx, ECFieldElement sy)
{
    return this.getCurve().createRawPoint(getRawXCoord().multiply(sx), getRawYCoord().multiply(sy), this.withCompression);
}


texts: Is it possible to compute permutations of a sequence of bytes by using exactly one pseudo-random number?

texts:
Suppose I have a certain sequence of bytes, for example 0102F4829hex, and I can pick from a pseudo-random number generator exactly one number.
Is it possible, by using exactly one pseudo-random number each time, to generate all the permutations of the initial sequence of bytes following a uniform distribution?


texts: I'm trying to understand which cryptographic algorithm is this

texts:
I'm reversing a cryptographic algorithm. This is part of the encryption function translated to python (starting from assembly code):

cleartext = [ 0x24,0x11,0x33,0x63,0xbc,0x59,0x07,0x5b,0x96,0x4b,0x07,0x15,0x2d,0x23,0x4b,0x70 ]
clearlen = 16

# Init the dictionary
cdict = [ 0 ] * 256
for i in range(256):
  cdict[i] = i

v1 = 0
# Load the dictionary
for i in range(256):
  v1 += (cleartext[ i % clearlen ] + cdict[i])
  v1 = v1 & 0xFF
  v2 = cdict[v1] ^ cdict[i]
  cdict[i] = v2
  v3 = cdict[v1] ^ v2
  cdict[v1] = v3
  cdict[i] ^= v3

Then this array of 256 bytes is used to extract clearlen bytes which are XORed with a key. I didn't translate it to python yet.

I was trying to understand if this was a known cryptographic algorithm, or it is completely custom. So far I was not able to identify it. Do you?


texts: Quantum key exchange skepticism/confusion

texts:
I was hoping somebody could explain some issues I have with quantum key exchange that I don't quite understand. I've read bits and pieces about BB84 but I'm sure my questions probably apply to other schemes also. My understanding of quantum key exchange is the following (please correct me if I'm wrong):

Alice creates a random bit string and for each bit, selects a random filter (say x or +).
she encodes these choices as a polarized photon and sends over the quantum channel to Bob
Bob guesses which filter to use, if he guesses correctly (assuming no Eve messing around for the moment), he'll get the bit Alice intended. If he guesses the wrong filter, it's 50% chance he gets the bit Alice intended
Alice and Bob exchange what filters Bob should have used; they ignore the bits where Bob used the wrong filter
Alice and Bob then pick a sample of their bits and find out if there are any discrepancies, if there are a lot, they try the key exchange again. If there aren't that many, they proceed to do parity checks to agree on the exact right key, then then use the leftover hash lemma to make sure Eve doesn't know anything much

Please correct me if I'm wrong with the above.
My questions are the following:

What's to guarantee authentication or message integrity (particularly when Alice and Bob are exchanging which filters were correct and so on)?
If Alice and Bob only count the bits where they have the same filter, then isn't it 50/50 whether or not Eve guesses the correct filter also? So can't Eve see about half the key without Alice or Bob even knowing!?
What proportion of discrepancies is too much and why?
We always assume Eve is passively observing, can't she do more than that (like change the polarization to whatever she likes and so on)?
How does the leftover hash lemma actually work?

Apologies if any of the above are stupid questions but I'm very confused with this protocol. 1) and 2) are particularly important to me because they seem like major, major problems I can't seem to understand and I can't find a good article that really explains it properly so an explanation from here would be great.

Many thanks for any help with any question.


texts:
So I need to write a piece for school about ECDSA and how it is secure. Now I thought I had a simple question, however, I can't seem to find an answer anywhere:

Why does the p in the formula need to be a prime number?

Now I understand how you can only have modular inverses of prime numbers, and I thought maybe that had something to do with it, but I can't see how though.

This is the site where I found the formula from the ECDSA algorithm: https://andrea.corbellini.name/2015/05/23/elliptic-curve-cryptography-finite-fields-and-discrete-logarithms/


texts: What is a simple 8-bit cryptographic hash function that I can use in a quantum simulation of Grover's algorithm?

texts:
I'm taking a quantum computing course in which, for our final project, we must create a proof-of-concept implementation of Grover Search for finding hash collisions up to a difficulty (similar to blockchain).

I need a (relatively) simple hash function. As this will be running on a quantum simulator, I'm limited in the number of qubits which I can simulate. Ideally, the hash function should output 8-bits for arbitrarily sized input, should not be crackable (trivially, for example by hand), and should be relatively fast as the hash function (although classical) will be implemented with quantum logic gates.

I was considering an 8-bit version of SHA-1, however I'm not sure how adaptable SHA-1 would be in this situation.


texts: NTRU has some homomorphic properties modulo q, supporting both addition and multiplication. Due to its nature, it cannot support many of them. My main focus currently is in the addition, so the question is how many additions could it support to consider the result reliable? I believe that a naive bound would be $q/2$ but is there anything better?


texts: Can adding nonces make challenge response authentications weaker?

texts:
In a custom protocol we want to replace an aged tiger32 based challenge response authentication. I suggested that we use something existing, so threw HMAC into the room. As per wikipedia it works as:

$\textit{HMAC}(K, m) = H \left( (K \oplus opad) | H((K \oplus ipad) | m)\right) $

where $m$ would be the nonce. Now The Architect™ suggested "Let us put a few more nonces in there, more randomness does not hurt." and came up with this:

$\textit{HMAC}(K, m_{0..4}) =
H \left(m_0 | (K \oplus opad) | m_1 | H(m_2|(K \oplus ipad) | m_3)|m_4\right) $

Although I could not see anything immediately wrong with it, my reply was "We are no cryptographic experts, let us stay with something that has proven to be good in real world applications already."

So we are kind of still arguing and now need input of cryptographic experts. The two main questions here that arise are (Always under the assumption that key, nonce and hash are sufficiently good):

In this specific instance, will adding those nonces hurt security? That is, will it make authenticating without knowing $K$ any easier, or will it make recovering $K$ from intercepted traffic any easier?
For the general case, if possible, will in similar situations ("hashing stuff for authentication") adding nonces always make things better, or are there situations to be aware of were adding them could make things worse?


texts: Does Cut-Choose technique for yao garbled circuit provide statistical security?

texts:
Yao Garbled circuit is 2 parties secure computation protocol between Semi honest adversaries. However, the cut-and-choose mechanism complies semi-honest garbled circuits into the one secure against malicious adversaries. Specifically, it provides statistical security against malicious garbler (circuit creator).

My question is as cut-and-choose provides statistical security, can garbler be "unbounded"?


texts: Use the Index Calculus to solve for $19^x \equiv 205\pmod{337}$, using the factor base $B=\{2,3,5,7\}$


texts: diffie hellman digital signatures vs MACs

texts:
I have the following homework question that im not sure about.

Alice and bob are going to use the diffie-hellman key agreement protocol to agree on a key for use in AES. Explain briefly why they would need to use digital signatures and why they cannot use Message Authentication Codes (MACs) instead.

I find the question a bit hard to understand, im aware that MACs require a shared secret key to compute the MAC so this would have to be done first but am not sure why digital signatures need to be used ?


texts: Is there a 3-D alternative for elliptic curves?

texts:
As I understand the most widely used method to exchange encrypted data over untrusted network is Diffie-Hellman protocol. Protocol itself doesn't define how to encrypt data, but it defines a usage pattern of public/private keys and implementation can vary.

So, original idea was to use big prime numbers (1 number, 1-D) and their combinations as public/private keys. After a while elliptic curves (x and y coordinates, 2-D) was discovered, so now everyone using them.

Do elliptic curves have more cryptographic strength than classical approach because of 2 dimensions? Is there any research related to 3rd (or even more) order polynomial that potentially can provide even more cryptographic strength than elliptic curves?


texts:
Here's a sample ECDSA private key (I don't use it for anything):

-----BEGIN EC PRIVATE KEY-----
MHQCAQEEIFL3sLnioGcDvHWM/BPlNw96BOx1KKco2qsq4UwhQUosoAcGBSuBBAAK
oUQDQgAEXs1Fmq4QdPAbn3NycdEU+HOjc3kW9efbso2kI/vdDTWcSCMk310s53G3
tRClDBPPuuJAsKghbPfaTaUpmXFCNA==
-----END EC PRIVATE KEY-----

Here's what OpenSSL's asn1parse says about it:

    0:d=0  hl=2 l= 116 cons: SEQUENCE
    2:d=1  hl=2 l=   1 prim:  INTEGER           :01
    5:d=1  hl=2 l=  32 prim:  OCTET STRING
   39:d=1  hl=2 l=   7 cons:  cont [ 0 ]
   41:d=2  hl=2 l=   5 prim:   OBJECT            :1.3.132.0.10
   48:d=1  hl=2 l=  68 cons:  cont [ 1 ]
   50:d=2  hl=2 l=  66 prim:   BIT STRING

My question: where is this format defined?


texts: How to find a collision with a given prefix and a known key in an AES ECB symmetric block cipher?

texts:
I should be able to find a collision for a vulnerable hash function which uses AES ECB given a prefix, but I am unable to find a reasonable solution (besides brute-force attack).

The hash function is really simple, it uses AES ECB with a known IV with all 1's. The result is then bitwise XORed and used as key for next ciphering block (if any). More formally:
$$S_0=1^{128}, S_i=\operatorname{AES}_{S_{i-1}\parallel S_{i-1}}(M_i)\oplus S_{i-1}$$ with $M_i$ being the current 128-bit message block, AES using a 256-bit key and the $S_i$ of the last message block being the output.

I have been reading about the Chosen-prefix collision attack, but my case is slightly different (and even easier) because what I search are two words $w_1$ and $w_2$ that, given a known prefix $p$, $\operatorname{hash}(p \| m_1) = \operatorname{hash}(p \| m_2)$ with $w_1 = p \| m_1$ and $w_2 = p \| m_2$ and $w_1 \neq w_2.$


texts: AES or cryptobox() for authenticated encryption

texts:
I need to encrypt some packets on a constrained hardware.

I was enthusiast about the NaCl suit, since Chacha/Salsa20 is a nice and fast symmetric cipher algorithm when no AES-NI instructions is available.
But I discovered that poly1305 (the authentication layer) is based on AES!

Why? If I plan to use cryptobox it's because there is no AES; but if AES is available in hardware, may I prefer AES-GCM?

What is the logic behind this? Why poly1305-AES and not poly1305-Salsa20?


texts: Blowfish-448 Secure Key Generation Algorithm

texts:
I am using blowfish-448, until now the keys have been generated using a crypto random number generator full filling the 448bits vector.
I read about exploit in case of weak keys and reflection keys attack.
Mine concern is if the generation approach we are using is secure or if does exist a more secure way.


texts: How to Formalize Noise Protocol Messages

texts:
I try to understand the messages of the Noise Protocol Framework. The handshakes are based on Diffie-Hellmann key exchange.
This is an example for a handshake pattern:

-> e
<- e, ee, s, es

I try to formalize the handshake with mathematical descriptions.
For example the mathematical description of the first message is:
. Where  is a generator and  is the private ephemeral key of the sender.
But I don't understand how the values ee and es are calculated.
How can these patterns be descriebed mathematically?


texts: How to calculate how long it will take to break deliberately weakened AES encryption?

texts:
for a project I'm looking to make as an art project a series of encrypted "time capsules" that have deliberately weak encryption, enough that it isn't feasible to crack them now, but could be done with say a month of CPU time in in {10, 20, etc} years (making some assumptions about how computing power will increase).
The plan I'm toying with is to zero pad short keys for AES-128 (assume the amount of padding is known to whoever is trying to decrypt them).
How do I calculate the difficulty of guessing an AES-128 key with N known bits?
Phrased differently, are there more efficient methods for guessing an AES key if we already know the first N bits of the key? Or, if we know N bits, we simply need to guess 2^{128-N} bits?
As a bonus, if you could come up with a formula for estimating the amount of CPU time we would need to brute force a key with N known bits in M years, that would be helpful as well. If you have any other suggestions for what I could do to implement this time capsule idea that would be interesting as well.


texts:
There is an abundance of tools and tutorials on how to break WEP encryption. However, I fail to find a nice resource that gives a clear break-down of why the attacks are possible. For example, I know that one of the attacks relies on fake authentication. I however fail to understand how this works because whenever an entity tries to authenticate, the AP will give it a challenge which it will not be able to answer correctly; meaning the fake authentication will be fruitless. How does the adversary gain from this fruitless authentication?

I also read that a short IV means that after a large number of packets, keys will begin to repeat. This kind of makes sense to me -- but I still dont have an understanding of how one might exploit this fact to retrieve the key. What precisely is the implication of IVs beginning to repeat after a certain  number of messages?

Then there is the weakness with the message checksum -- that a modification in the message comes with a predictable change in the checksum. How does one exploit this to break the key? Insights into the mechanisms of these attacks will be so helpful.


texts: IPSec vs SSL : Similarities and Differences

texts:
I am studying SSL and IPSec. I can pretty much nail down the "very high level" differences and similarities between the two, but am struggling to find a "lower level" (but not too deep) look.

This may seem like a dumb question, but do SSL and IPSec use different key schemes and algorithms from another to establish contexts? Or am I overthinking this and does one not even use these at all?

Best


texts: How is a sponge construction better than cycling the output of a hash back to the input?

texts:
Wikipedia has this diagram of a sponge construction.

Why is this better than just cycling the output to the input? Like this, assuming $p$ is a list of blocks that are equal to the size of $f()$, and $z$ is the corresponding output.

$$c_{-1} = 0\\
c_{n} = f(c_{n-1} \oplus p_{n})\\
z_{n} = f(z_{n-1})$$

Or in other words, why not have $r$ be the whole block?


texts: Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?


texts:
I'm looking for some suggestions on what to read (papers, notes, book chapters?) on homomorphic encryption in order to understand the most recent (more optimal) schemes, as well as optimized use cases (e.g. Gazelle for CNNs).
My end goal is a list or DAG, that has at least these components:

Math background, e.g. rings/polynomial fields. I don't need a list of resources, just a list of topics. You can assume a basic intro cryptography class that covers things like defining computational indistinguishability. (It may even introduce homomorphic encryption and garbled circuits, but in my experience, these classes don't have enough time to dive into HE). I'm only asking for the math background so that I can give this to colleagues, who may not know about polynomial fields, etc. If it is needed for HE (like understanding lattices may be necessary), please include it in the background.

Borrowing from Fully Homomorphic Encryption without Modulus Switching
from Classical GapSVP terminology, first-generation schemes which are really Gentry's first construction with optimizations.

Second generation schemes (e.g LWE, RLWE)

Whatever else there is (I should admit that I don't know the history after LWE, although I'm aware of the schemes).

My motivation is that I seem to be studying this backward. I read papers on accelerators (think GPU/FPGA) for HE in use case X, which uses scheme D, which is a straightforward optimization of scheme C, which is an improvement over scheme B (uses a different setting i.e. RLWE instead of LWE), ... etc.


texts:
Consider the following

Alice and Bob agree to an encyption system based on a solution to a complex chemical simulation
Alice announces publicly that her "key" is the chemical tryptophan. Therefore any solutions with tryptophan as an input belong to Alice.
A public distributed ledger exists.
Alice publishes her tryptophan choice on the ledger.
Now alice can create simulations combining tryptophan with other unclaimed chemicals.
The simulations are computationally expensive and can't be readily solved by quantum attacks. (Nobody is proposing a cheap way to simulate chemical reactions using quantum computers, and replicating the reactions directly requires manual effort).
Alice does not publicly publish the solution. She only publicly publishes that she has a solution for converting tryptophan to another specific chemical.
Bob values that solution and offers to trade with Alice.
Alice privately transfers the solution to Bob as payment for a good/service
If Alice decides to double-spend the solution, Bob can publicly publish it (and make it worthless).
If Eve steals the solution either can also reveal it and make it worthless.
Therefore as long as it is kept secret, the solution to this chemical reaction serves as a transferable store of value that is not subject to attack.
The value of the solution depreciates as it is spent more because more people have it.

What are the problems with this?

Also, you could also have it so the data in the solution is so enormous that it cannot be easily published or stolen. Bob would receive permission to access Alice's cluster to use the data but it would be impractical to steal it.


texts: Would a symmetric cipher with a keylength a big as the data length be information theoretically secure?

texts:
One-Time-Pad is information theoretically secure as long as the random number stream is evenly long or longer than the data stream it encrypts, for a "deciphered" message could have been any message with the same length as the given with the same probabillity. Does the same apply to symmetric ciphers, too?

For instance if I have 1024 bits to encrypt, break it into chunks 128 bits and encrypt it with AES-128, each with a different (assume: true) random key,
will that be information theoretically secure just as OTP?
Or would a hypothetical algorithm (let's assume it would be as quick as the encryption function) impact the (theoretical) security?

In other words: Does using a symmetric encryption algorithm (such as AES) lower the probabillity of a ciphertext being originated from a specific plaintext even if the used key has "OTP-length" and is completely unknown?


texts: Are commutative digital signature possible?

texts:
Say we have a message $m$. Signer $S^1$ will sign this message using his digital signature to produce:

$$\operatorname{Sign}_{S^1}(m)$$

Now, say another signer $S^2$ wants to sign the output of the previous stage to generate:

$$\operatorname{Sign}_{S^2}(\operatorname{Sign}_{S^1}(m))$$

Is there a way to verify that $m$ has been signed by either signer without having to remove the signature of signer $S^2$?

Also, can I verify that $m$ was signed by signer $S^1$, even if I am not interested in verifying that it was signed by signer $S^2$?


texts: PKI Multiple Samples start to expose Private Keys?

texts:
My understanding is that using a PKI, public/private key pair is generally secure to send message to people.  That is, encrypt a message using the recipient's public key so they use their private key to decrypt the message. My question is if encrypting the same "String" and sending them to multiple people starts to increase the possibility of cracking the private keys of the recipients as the number of samples go up.

For example, lets say I have the public key for the following people:

ALICE
BOB
CAROL

I would like to secretly send each of them the same string so I encrypt that string in each of their public keys.  In each data-set, it is clear to attackers that the same string is encrypted and sent to these 3 people.  The public key would likely be present so it is clear to which private key the sample of encrypted data belongs.  The hacker would not know what string has been encrypted, just that it is the same to all recipients.

Does this pose a situation where discovering the private keys can become simpler with more samples (More strings send to the users) and/or by increasing the number of recipients?  Ultimately, does this condition decrease the effective privacy of the PKI encryption/decryption method?


texts: Why can't I break ElGamal encryption by brute-forcing the secret exponent?

texts:
I am doing a course on cryptography on coursera and one of the topics covered was the ElGamal Encryption system.
I am using the terms as defined in Wikipedia.

Alice publishes $g$ and $g^x$. Theoretically an attacker could calculate $g^i$ for all $i$ from 0 to $n$. At some point the attacker will get the value which is the public key $g^x$. However big a number $n$ is, surely it might be computationally feasible to try to get the value $g^x$ in this way, and thus $x$, especially if the pre-computations are done for using repeated squaring.

I am sure I am missing something obvious :-)
I am guessing it could be the size of the group $G$ is much larger than I am assuming.

Why wouldn't the above method work?


texts:
I have to show that the following construction of $q$ allows to factorize $N$ :

  $p \in \mathbb{P}$, the set of primes
  $q \gets p \cdot \left((p - 1)^{-1} \bmod e\right) \bmod e$
  $k=1$
  while $q \not \in \mathbb{P}$:

  $q \gets q + k \cdot e$
  $k \gets k + 1$

  end while

I tried to analyse $N \bmod e$ and transform the expression but without success.

If some can give me some hints

Edit:

$p$ is 512 bits size,  $e$ is 504 bits size.

Let's $\alpha = (p - 1)^{-1} \bmod e$ then $N = p \cdot (\alpha + 1 + k \cdot e)$

Finding $q$ is equivalent to finding $\alpha$.


texts: Threshold encryption with threshold on encryption part

texts:
For a thought experiment I'm looking for a threshold encryption scheme where $k$ out of $n$ shares are needed to encrypt the data and everybody can decrypt the data. However, I only found schemes needing $k$ out of $n$ for decryption. I know that it would be an uncommon scenario.

The problem behind this is that I would have multiple groups and some data and I want to store that data in a replicated way and be able to ensure the replication.

An assumption is that more than $k$ member in a group $G_i$ are honest and follow the protocol. Now if I provide a piece of data, then based of its hash $r$ (replication factor) groups are selected and 1 member per group $G_i$ is selected. The group then collaborates to encrypt the data and the selected member stores it.

The above would be performed to prevent the member $M_j$ from just reading another replica's state and returning it when asked for it instead of actually storing it.
The group member's would have a way to see if a storage request is valid and was not already executed and would not re-encrypt the data if they already have or if its invalid.

Additional Information
After some further research I think what I'm looking for is a message recovery threshold signature scheme. But my search did not yield Any results. Does anybody know about such a scheme?


texts: Why do algebraic proofs apply to cryptography?

texts:
How do we know that the number theoretic and algebraic results used in cryptography provide a perfect model for the behavior of integers as implemented in computers? Does there exist a bijection between the purely mathematical integers and the two’s complement integers, and are subsets of the two’s complement integers under the modulus operator isomorphic to the corresponding (mathematical) integers mod n?

If so, are these conditions sufficient for all cryptographic proofs relying on algebra and number theory?


texts:
I am on cryptography course and there is a homework question to show that Hill cipher doesn't have perfect security.

So assume we have an cryptosystem $(P,C,K)$, where $P = C = \mathbb Z_{26}^N$ and $K$ is the set of invertible $N \times N$-matrices modulo $26$. Now we also have some probability distribution on $P$ and also some distribution on $K$.

A cryptosystem has perfect secrecy if $p(x) = p(x|y), \forall x\in P \wedge y\in C.$

Now, one option I considered is that according to Bayes rule, if system has perfect secrecy,  the cardinalities of these sets $P,C,K$ must fulfill $|K| \ge |C| \ge |P|$. But this seems to be the case, so I can't use that.

The $p(x)$ is whatever the original distribution says it is. Now $p(x|y)$ cannot be the same as $p(x)$ for this homework to make sense. $$p(x|y) = \frac{p(y|x) p(x)}{p(y)}$$ $p(y) = \sum p(k) p(d_k(y))$, so probability that key used was $k \in K$ times the probability of decrypted message being $d_k(y)$. I would think $p(d_k(y))$ is same as $p(x)$, as $x$ is $y$ encrypted and as we sum over all the keys, for any key there is some $y \in C$ which maps back to a given $x \in P$, this is same as $p(x).$

Thus $p(x|y) = p(y|x)$. I would think that as we know $x$, and every key maps every plaintext to different cryptotext, they would have same distribution, so $p(x|y) = p(y|x) = p(x)$.

So we have perfect secrecy.

Now, what am I not getting here? I am sure I do something wrong, but help would be welcome.


texts: How do Alice and Bob perform key exchange through a third-party (server) in end-to-end encryption?

texts:
Understanding end-to-end encryption, I ran into an issue which I wasn't able to find a solution for.

Given three parties: Alice, Bob, the chat endpoints, and the server party owned by Eve. The server party allows Alice and Bob to communicate.

Let's say Alice and Bob wanna start an encrypted chat session with each other. How do they prevent Eve from gaining and replacing the encryption keys (performing the MiTM attack) and compromising the whole session?

A meeting in person to share the secret is not an option.

I have read about OTR and Double Ratchet Algorithm. They claim to be secure and OTR claims to use the Socialist millionaire protocol, which, as I understand, should prevent the conversation to be compromised. But I don't quite understand how it works.

The main question is, is there a way for two parties establish a completely private conversation though a compromised server without using an outside channel?


texts: How to make PKCS conformation oracle for trying Bleichenbacher’s RSA attack?

texts: I was trying to understand Bleichenbacher’s CCA attack and thought of work it out in python. Can some one throw some light on the the logic behind the oracle used to check PKCS conformation? Will a cipher's parity check yield anything useful?


texts:
I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves.
I am unable to figure out how a signature is generated , a description of it is here.

To state what i understand.

e = private key
G = generator point
P = Public key
k = Ephemeral key

The public key is a point on the curve computed as

  e.G = P

The signing algorithm starts by taking a random target R

  kG = R

The guide straight up represents R as follows (where u/v are chosen by user):

  uG + vP = kG

I sort of fail to understand how or why this relation holds true. It seems to be starting with a random point on the curve uG and it adds a scalar multiple of the public key (which could be further expressed v.e.G)


texts: Is changing $H(R\mathbin{\Vert}A\mathbin{\Vert}M)$ to $H(R\mathbin{\Vert}A\mathbin{\Vert}H(M))$ in EdDSA secure?

texts:
EdDSA calculates $s=(r+H(R\mathbin{\Vert}A\mathbin{\Vert}M)\cdot a)\bmod\ell$ and $r=H(h\mathbin{\Vert}M)$, with

$H$ being the hash function (SHA2/512);
$B$ being the generator;
$A$ being the public key;
$a$ being the secret exponent;
$r$ being the per-signature random;
$h$ being the secret seed ($h[b~.\!.~2b-1]$ in the paper).

What is the effect on the security of the signature if $M$ is replaced by $H(M)$ or $H(A\mathbin{\Vert}M)$, thus producing $s=(r+H(R\mathbin{\Vert}A\mathbin{\Vert}H(A\mathbin{\Vert}M))\cdot a)\bmod\ell$ and $r=H(h\mathbin{\Vert}H(A\mathbin{\Vert}M))$?

This would mean the message needs to be hashed only once during signing, which is more efficient for long messages, but would the signature lose any security quality? Specifically the paper says that the signature provides collision resistance, would this disappear with $M$ being replaced by $H(M)$? What about $H(A\mathbin{\Vert}M)$?


texts: How does one provide a secure and authentic communication channel?

texts:
Let assume two participants Alice and Bob who perform a given protocol which is a sequence of messages exchange between them.

My question is: How can I provide a secure and authentic communication channel using cryptography, so that when Bob sends a message "M" to Alice, the latter will be able to know whether or not the message "M" is from Bob?

Is there a solution without using certificates?


texts: Kryptos : K1. What is the origin of the "palimpsest" keyword?

texts:
I'm studying the Kryptos sculpture with its cryptographic puzzles K1 to K4.

I understand that the keyword "palimpsest" was reverse-engineered using the tableau (and brute-force computer processing), but Sanborn always said that all sections could be solved using pencil and paper.

There are theories about the Morse, but I haven't come across a good explanation of how to tease "palimpsest" out of it.

I've been frustrated trying to find this in the Kryptos Yahoo group.

I'm not concerned that it has any "meaning" just whether or not there is any other way to derive the keyword other than brute-force, from e.g. the Morse code.


texts: When only using one-way hashing, is it possible to tell the number of characters changed between the old and new password?

texts:
The other day when changing my password on a Solaris 10 system I was surprised that Solaris was able to detect that I hadn't changed enough characters between the new and current passwords.

MINDIFF is the password security configuration parameter that specifies the minimum number of characters that need to be different between the current and new password when the password is being changed.

I'm pretty sure that Solaris is using one-way hashes to protect the secrecy of the plain-text password.

That got me thinking, how can Solaris (or any system) detect which characters have changed between passwords if it is using a one-way hash to validate passwords?


texts: How many bits of cryptographic security do these XOR Mid-Square random numbers have?

texts:
This pseudo-random number generator uses only XOR and Mid-Square operations:

Get one secret 128-bit truly random seed $R_0$
Generate a million secret $R_j$ by the recurrences (for $1\le j\le 1000000$)

$X_j=\lfloor{R_{j-1}}^2/2^{64}\rfloor\bmod2^{128}$
$R_j=X_j\oplus R_0$

Output $R_j\oplus R_{j-1}$ only for $j>16$

Notice that the first 16 rounds above are completely kept secret to help obscure $R_0$ from the output (at least this is my hope...and maybe I could have reduced this to 4).  Also, notice that I'm only generating about a million random numbers, and therefore willing to ignore the possibility of cycles.

So, what's the fastest algorithm to crack this?  If I need to define "crack" better, let's say I withhold whatever output bit you want me to, give you the other ~$10^8$ output bits, and you then must prove some tendency in the withheld bit.  Of course, the crudest brute-force approach is $2^{128}$ guesses to span all possible $R_0$, so the title question is about how much more efficient you can make this exponent.

(In a previous question, I've learned about some standard problems with the mid-square method, but have made some slight changes which give me hope here.  I guess there is some trick to cracking this, but I can't figure it out.  As @fgrieu said, "It seems plausible that $R_j\oplus R_{j-1}$ has quite recognizable characteristics".)


texts: Considering the fact that a block cipher is a bijective function on the set of possible plaintexts, if one views the encryption of a  datum with a key $K_2$, which has been already encrypted with the same n-bit block cipher, using key $K_1$ as a single n-bit mapping $\text{F(plaintext}, K)$, is not bruteforcing through $2^n$ keys not more efficient than performing a Meet-In-The-Middle Attack (or MD-MITM, as the case may be)?


texts: Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

texts: Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?


texts: Using encryption for authenticating messages (instead of signing)

texts:
I want to be able to verify the authenticity of a QR code text without internet connection.

Let's say I have a peanut butter store, and I have an online store too. After purchasing at my online store the customer will be given a QR code. They print that QR code and bring it to my actual store, which doesn't have internet connection, and by scanning the QR code with my mobile app I will give them the amount they have purchased.

The QR code plain text will be something like : "John, Doe, 3 jars". Upon scanning this I will give John Doe 3 jars of peanut butter.

Now as far as I know the conventional method for this is to sign the message. But that adds a lot of overhead because I will have to generate the QR code for plaintext+signature. QR codes size is very limited and my messages are very short. So any performance consideration about hashing the message and encrypting that hash are of no importance. While ciphertext size is very important.

So I was thinking, is there any security flaw if I just encrypt the message instead of signing it? If I can decrypt the message in my offline store it means it has really come from my online store and that it has not been tampered with. This way I will avoid the size overhead of signatures, since my messages are not much longer than an SHA-256 hash themselves.

Here's the steps that will be performed:

In online store's web application:

create a text message that says a certain customer has purchased a certain amount of peanut butter
encrypt the message with my private/public key
convert to base64 and generate QR code

In actual store:

scan QR code and base64 decode
decrypt the message with my public/private key
if I'm able to decrypt the message it means the message is authentic and I will give the customer the amount of peanut butter specified in the QR code

Currently I've been able to successfully perform these steps with ECIES encryption in Java. I was just wondering if this is secure. I chose ECIES because after some research I figured it produces small sized cipher text. And I'm using "secp192r1" keys as a compromise between ciphertext size and key security.

Also I want the encryption to be asymmetric, because for security reasons I don't want to hard code my symmetric key into the mobile app.

This is not an actual work project, but it's something that's always been on my mind and I want to be able to do this in a real project if need arises.


texts: Can Alice prove that she *did not* send an unsigned message to Bob?

texts:
Suppose Alice wants to send messages to Bob. However she doesn't trust Bob. She believes that Bob may publicly disclose a fake message, claiming that it came from Alice. This message will cause the public to have a negative opinion of Alice.
Alice can use signing to prove that a message came from her. However, she cannot prove to the public that the fake message did not come from her. Bob can always claim that the fake message was not signed by Alice because then Bob could publish the signature along with the message and prove to the public that the message came from Alice.
Assuming that the public trusts Bob more than Alice, how can Alice prove that the message is fake? Ideally, she should not be able to prove that the message is fake if she really did send the message to Bob in an unsigned manner.


texts: How are keys mapped to cipher texts in block ciphers with large block sizes?

texts:
What I understand so far:

For n-bit block size, there are 2n plaintexts (P)
there are P! possible keys
The bits necessary to represent each of the possible mappings is log2(P!) rounded up

Basically, my calculator craps out at a block size of 8 bits because the key length is so massive to map all possible keys for 8-bit block size.
What I am led to understand is that there is some way to use much smaller key sizes (like 128 bits), but from what I have read, there are encryptions that use larger block sizes like 32 bits, 64 bits, etc where there is no feasible way to map every possible ciphertext to a key.
It seems to me that if there was a 32-bit block size being used, for example, then with 128 bits, you can only map a very small chunk of the possible ciphertexts. I'm not even sure how to ask what I'm trying to understand...how does this work? I'm just confused by this. I guess what I'm trying to ask is, if it's impossible to map a specific key to a specific, unique ciphertext value, what does it actually map to if I just pick 32 random bits? It seems that each possible key would have to map to multiple ciphertexts.


texts: For RSA cryptography, how long does it take to factor out P -1024 if given Q - 1024 and N - 2048?

texts:
So doing a little research on RSA, and knowing the public key contains N. So breaking down the steps to cracking it, I'd have to search for P and Q (which takes a very long time as I understand it), (where P*Q = N). aka, prime 1 and prime 2.

So it takes a long time to find a suitable prime pair. For me I see 2 actions and I want to know which action takes the longer time.

Finding a 1024 prime number.
Having 1 prime number and dividing N by testable prime number to see if it produces another prime, aka prime 2.

So is the time mostly spent finding prime 1 and THEN trying to factor out N, or is the time spent finding a large prime, but its easy to divide N by prime 1 and see it not work?

Sorry if this is confusing, I am having a hard time constructing the question.


texts: In what sense addition modulo $n$ ($n>2$) isn't linear in the field $\mathbb{F}_2$?

texts:
I've been reading the Reason why “XOR” is a linear operation, but ordinary “addition” isn’t? question, in which one of the answers states that addition modulo $n$ ($n>2$) is linear in $\mathbb{Z}_n$ but not in $\mathbb{F}_2$, it also states that - conversely - $XOR$ is linear in $\mathbb{F}_2$ but not in $\mathbb{Z}_n$($n>2$).

But in what sense?

I mean, how can I think about a $n$ ($n>2$) modular addition in $\mathbb{F}_2$?

When I've to sum modulo $n$ I usually sum the digits modulo $10$ (or directly reducing them modulo $n$ before doing the sum) and then reduce the result modulo $n$

F.i.: Taking $n = 3, x_1=2, x_2=2$

$$x_1+x_2 = 2+2 = 4 = 1 \pmod 3$$

But how can I think about a sum modulo $n$ in $\mathbb{F}_2$ ? And why it isn't linear in $\mathbb{F}_2$?

Conversely, how can I think about a $XOR$ in $\mathbb{Z}_n$, and why it isn't linear?


texts: Will non-ECC algorithms like RSA eventually become too inefficient?

texts:
The strength of symmetric and asymmetric encryption schemes scales with the key length, but there is a difference between symmetric algorithms like AES and asymmetric algorithms like RSA.

For example, according to some sources, 128 bit symmetric keys are equivalent to 3072-4096 bit asymmetric keys; but to get 256-bit equivalent security, asymmetric keys need to be more than 15000 bits long.
Elliptic curve keys, however, are often stated to be comparable to symmetric encryption keys (with a constant factor of about $1/2$).

Is there an exponential relation between the key length for symmetric/ECC and asymmetric encryption schemes, and what are the theoretical and practical implications of that? Will there be a point in time where using RSA and DH/DSA will be impossible because of the huge key sizes and the resulting computations?

How does this relate to the notion of computational security, especially the security parameter of an algorithm – is the security parameter exactly the key length, or can the key length be a (polynomial? exponential?) function of the security parameter?


texts: Clipper chip (SKIPJACK) key exchange protocol

texts:
According to the Wikipedia page for NSA (emphasis mine):

  However, NSA's Fortezza hardware-based encryption cards, created for
  the Clipper project, are still used within government, and NSA
  ultimately published the design of the SKIPJACK cipher (but not the
  key exchange protocol) used on the cards.

However, the NIST publication describing SKIPJACK also describes a Key Exchange Algorithm (KEA).

My question is simple: Is the Wikipedia page wrong, or is it talking about something else?


texts: Proof that no DES key makes encryption identity

texts:
How can we prove that no DES key makes encryption the identity function?
That is: $\;\forall K\in\{0,1\}^{56}\quad\exists M\in\{0,1\}^{64}\quad E_K(M)\ne M$
Note: anyone disproving this proposition would gain instant celebrity, which is a meta-proof that this proposition is true, but not an acceptable answer!

That proposition is false for 2DES (EE), even restricted to one key, because twice  applying encryption with the all-zero key (and the Final Swap built into the Final Permutation) yields identity.
For the same reason, the proposition would be enough to prove that DES is not closed under function composition, hence not a group [but Keith W. Campbell and Michael J. Wiener's DES is not a group in proceedings of Crypto 1992 (free access) also proves other facts. See a more extended bibliography there].
Variants of the question:

3DES (EDE) with 3 or 2 keys
3DES EEE variant
what if we remove the Final Swap of the Final Permutation (then the proposition becomes very plausible for 2DES)
$r\ge1$ rounds of DES and independent subkeys, with or without Final Swap; clearly the proposition must become false for some $r$ !

Inspired by this question.

Update: towards a solution, I have thought of

Pure brute force. Plausibly, that requires no (or very little) more than $2^{55}$ DES encryption of a constant plaintext block $M_0$, say all zero (for we can fix a key bit thanks to the DES complementation property, and a single test is enough to eliminate overwhelmingly most keys). Using the all-zero block for $M_0$, or any one invariant under final swap, has the advantage that we can answer the question for DES both with and without final swap using essentially the same amount of work.
Some work reduction, possible by enumerating the keys in a way that allows caching of the external rounds (as was done in DESCHALL, see this).
Devising a function $F:\{0,1\}^{56}\to\{0,1\}^{64}$ that slightly simplifies the evaluation of $E_K(F(K))=\!\!\!\!?\;\,F(K)$ compared to that of $E_K(M_0)=\!\!\!\!?\;\,M_0$; it seems possible to save even more work.
Expressing the problem as a Boolean satisfiability problem in Conjunctive Normal Form and throwing a state of the art solver at it. I'm pessimistic about this approach, though.

Update2: the brute force approach might have been carried as early as 1999, when:

The EFF DES cracker first solved a challenge posed more than a year ago by world-renowned cryptographer and AT&T; Labs research scientist, Matt Blaze. The "Blaze Challenge" was designed to only be solvable by "brute force" cryptanalysis of DES. Mr. Blaze challenged the world to find matching pairs of plaintext and ciphertext numbers, consisting of nothing but repeated digits. Blaze himself was unaware of any such pairs until the EFF DES Cracker revealed the first known pair. It found that a hexadecimal key of 0E 32 92 32 EA 6D 0D 73 turns a plaintext of 8787878787878787 into the ciphertext 0000000000000000.

That's nearly enough to prove the question's proposition. What's missing is  that the key found is the only solution of the Blaze challenge with all-zero ciphertext, or making an exhaustive list of those that do and ruling each out from being counterexample to the proposition.


texts: Why is SHA256/SHA512 not broken for shortish passwords

texts:
I don't get why SHA-256/SHA-512 hasn't been broken, at least for shortish (10-12 character) passwords
It is perfectly plausible to pre-compute a password/hash-pair table using numerous very fast computers (thereby significantly increasing the speed at which this is done).
Clearly I am misunderstanding, so I would appreciate some input as to why this would not be considered breaking SHA256/SHA512 especially as most people use passwords shorter than 10-12 characters


texts: Group Signature Scheme without Opening but with Revocation

texts:
After reading many papers about group signature schemes, I saw that basically all of them employ the possibility of "signature opening": The Group Manager (GM) can identify any signature made by his group's members. But I would like to completely eradicate that feature and rather revoke group members by their public key/ID token, preserving signature anonymity at all times.

(I am thinking about very dynamic and large groups with their members "expiring" after a certain time: the GM keeps a public key list and revokes keys when they expire. Maybe existing cryptography is not scalable enough for that yet, though.)

An option would be to take a GSS that seperates the issuer GM and the opener GM and just throw away the opener's key. But that gives me two issues:

Firstly, the users should stay anonymous even if the GM (the server) is compromised.
Secondly, existing GSS do not actually seperate the opener's and the revoker's key, but since I need to revoke users' access rights, this is unfeasible.

Is there any such GSS that satisfies my security requirements? Are there any existing GSS that I could alter a little bit to remove the opening ability - preserving their security proof - and use? Are there entirely other options?

(The actual problem giving me headaches is more general security related and I didn't want to explain it here because it is rather complex. But if you have any further questions about my requirements, please go ahead!)


texts:
Suppose that primes for RSA modulus are generated using formula:
$P_i(x,y) = \operatorname{next\_prime}(x^{z_i}+y^{z_i}) = x^{z_i}+y^{z_i}+d_i$
where $x,y$ are unknown random numbers with size 128 bits
$z_i$ - are known small integers exponents, lower than 16
$d_i$ - unknown small integer to make it prime
$0<=i<=4$

There is given number of primes(5) and exponents:
$Z = [4, 5, 7, 9, 11]$

It gives modulus with size about 4600 bits, primes are very unbalanced(~512,~640,~900,~1150,~1400 bits).
And finally modulus equation:
$N(x,y) = (x^4+y^4+d_0)*(x^5+y^5+d_1)*(x^7+y^7+d_2)*(x^9+y^9+d_3)*(x^{11}+y^{11}+d_4)$

Is that system of primes generation weak?
Can modulus be "easily"(on home computer) factored for given Z? Maybe for other Z too?
Can we use some variant of Coppersmith attack to factor(here are primes lower than $N^{1/4}$)?


texts: Why is 128-bit considered "medium term" security?

texts: Why is 128-bit encryption considered good enough for medium term security only?  How is expected to be eventually broken?  Quantum computing or brute force attack?


texts: Should I delete cryptographic data from memory?

texts:
When dealing with cryptographic data, is there a chance that attacker recovers portion of data I used in my program? Should I try to delete every bit of keys and encrypted data that I used, overwrite it with zeroes?

And one extra, how is situation different in languages with garbage collection like Python or Java?


texts: Computational indistinguishability and example of non polynomial algorithm

texts: The wikipedia page on computational indistinguishability says that two ensembles are not distinguishable if "any non-uniform probabilistic polynomial time algorithm A" cannot tell them apart. To help me better understand the definition, I searched for an example of an algorithm that did not fit the above restriction---in particular a non polynomial time algorithm---that could differentiate between two computational indistinguishable ensembles. Rather to my surprise, I found none, so I ask, could anyone provide me with an example of one?


texts: It is well-known that a pseudorandom function (PRF) can be used to build a CPA-secure symmetric cryptosystem. My question: is PRF necessary for this, i.e., can one show something like "If there exists an IND-CPA scheme then there exist PRF?"


texts: Are there two known strings which have the same MD5 hash value?

texts: Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?


texts: Where do I securely store the key for a system where the source is visible?

texts:
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.

I've used Rijndael as the algorithm of choice, but I'm struggling to find the correct approach to storing the encryption/decryption key, since an access database is inherently source-visible.  How can I provide decent security on this one to prevent someone grabbing the database (by local access - this machine is NOT Internet connected) ?  I feel I'm omst of the way there, but missing this vital piece of the jigsaw


texts: Is it OK to use r-value from ECDSA signature (r, s) to prevent replay attack?

texts:
ECDSA signatures are malleable. Given a valid signature (r, s), one can create a second valid signature by negating the s value.
I have searched workaround for this issue, and https://yondon.blog/2019/01/01/how-not-to-use-ecdsa says:

One solution to defend against signature malleability based attacks is to enforce a single canonical signature for a given public key and hash which is the approach taken by Bitcoin. More specifically, the Bitcoin core client software will only accept “low s-value” ECDSA signatures where a signature has a low s-value if s is less or equal to half the curve order [3]. The secp256k1 curve library used by the client will always generate signatures in low s-value form and the verifier expects provided signatures to also be in low s-value form [4].

Another solution is to avoid using signatures in identifiers or at the very least making sure to use unique values in the identifier creation process i.e. a nonce in the signed message. Unless there is a single canonical signature for a given public key and hash, signatures cannot be relied upon as unique identifiers.

What I wonder is, is it okay to use r-value instead of s-value for replay detection? One the first thought one should use s-value, because it is derived from a given message. r-value is not derived from a given message, but it uses k-value, which should be a random value. If duplicated k-values are used with same private key the key can be leaked, so signer have to generate distinct k-values. This makes me think r-value can be used to prevent replay attack.
Is there any problem if I use r-value to prevent replay attack?


texts: Why can an RSA signature be authenticated ONLY with the signer's public key?

texts:
I'm an undergraduate Math student currently taking a cryptology course. I have a question about the RSA signature authentication mechanism.

An RSA signature can be authenticated with the public key of the signer. However, I'm wondering why it can ONLY be authenticated with the signer's public key. Why can't it be mistakenly authenticated with someone else's public key?

Let me clarify with an example. Suppose two people use random texts $p_1$ and $p_2$ for their signatures. Their private keys are $d_1$ and $d_2$ respectively, and their public keys are $(e_1,n_1)$ and $(e_2,n_2)$ respectively. So, the signature of the first person is

$s_1 = {p_1}^{d_1} \mod n_1$

Now, I understand the Math that this signature can be authenticated with the first person's public key i.e.

${s_1}^{e_1} \mod n_1 = p_1$

However, how can we claim that the following is never true?

${s_1}^{e_2} \mod n_2 = p_2$


texts: How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

texts:
I need to write a procedure for calculating the MixColumns's operation result in the following form:

$M*X^T,$

where $M$ is a 128x128 binary matrix, $X$ is a 128-bit vector (the state).

My question is how to build such $M$ matrix.

Help much appreciated. Thanks!

EDIT:

As far as I understand, the MixColumns transformation can be represented as

$\begin{pmatrix}MDS & 0 & 0 & 0\\0 & MDS & 0 & 0\\0 & 0 & MDS & 0\\0 & 0 & 0 & MDS\end{pmatrix} * \begin{pmatrix}s_0\\s_1\\\vdots\\s_{15}\end{pmatrix},$

where $MDS = \begin{pmatrix}02 & 03 & 01 & 01\\01 & 02 & 03 & 01\\01 & 01 & 02 & 03\\03 & 01 & 01 & 02\end{pmatrix} - $ matrix with elements over $GF(2^8)$ and

$s_0, \dots, s_{15} \in \overline{0, 255} - $ elements of the state.

I need a hint how to convert each element of the $MDS$ matrix into a 8x8 binary matrix over $GF(2)$. For example, I guess that the element $01$ would be converted into the 8x8 identity matrix.

Is that correct?


texts: I am reading the paper "Toward plaintext-aware public-key encryption without random oracles" by Bellare and Palacio. So I can't understand what is the tape and random tape?


texts: Can I find two specific words with the same md5 hash?

texts:
I want to find two strings containing special words like "yes" or "no", mixed with random characters, for which the MD5 hash is equal.

An example of what I'm looking for:

First string : YES/d6g45d78h74jfhcf     MD5 : 4cf349066ce85e0c947eb1d0c94c13b1
Next string  : NO/djf986f98edf8dfv4     MD5 : 7fdefd9bd8a46db9b48a323e8e366150

As you can see the MD5 hashes are different; Is it possible to change the random characters to get equal MD5 hashes?


texts: great discovery in the field of elliptic curves cryptography?

texts:
Prof. Adi Shamir says in The Cryptographers' Panel 2016:

  i think that NSA has made a great discovery in the field of elliptic
  curves cryptography and NSA wants to avoid the increased use and
  growth of ECC, so the NSA's argument of the quantum computer would be a
  smokescreen.

i know that ECC is faster and better than RSA but my questions:

is ECC resistant against quantum computer? i know that RSA isn't!
what could be great discovery? is it on implementation?
professor shamir says that quantum computers aren't risk for cryptography nowadays(in the near future) but i read in internet that the rate of progression in quantum computer is faster than what was predicted for it. am i true?

note:my main question is 2 ;in another words which aspect of ECC can be a great discovery that this aspect is not clear and known for cryptographers? what does professor shamir talk about?


texts: Quantum Cryptography Algorithms Implementations

texts:
The Post Quantum Cryptography is a type of cryptography that lies on physics properties instead of mathematics , it has many algorithms and implementations like NTRU , McEliece , SIDH ... etc

But there is a difference between Post Quantum Cryptography and Quantum Cryptography , i'd like to know some algorithms of that and also if they have implementations for example on Github or any thing like that

Thank you


texts: What's the actual difference between RSA encrypting and Descrypting and RSA Signing?

texts:
this question arised because I'm working with Windows' CNG library and it has 4 functions for RSA:

BCryptEncrypt (private key, message)
BCryptDecrypt (public key, message)
BCryptSignHash (private key, hashed message)
BCryptVerifySignature (public key, signature, hashed message)

So I was wondering, is there any difference between "Encrypting + Decrypting" and "Signing + Verifying"?
I mean, if I hash the message and then encrypt it, wouldn't that be the same as Signing it? or Am I missing some logic that is behind that function? (talking about RSA in general, not about how windows' CNG work).

The only visible difference I see is:

For Encryption and Decryption I can use OAEP and PKCS1 padding.
For Signing and Verifying I can use PKCS1 and PSS padding.

But again, is this because of how those functions are made in this library? or because the "operation" and the output are done in different ways depending on if it is Signing or Encryption?

If they are different, then why do we need the Signing part? Isn't encrypting with private and decrypting with public secure enough to "sign" it?


texts: What encryption schemes to hide the plaintext length exist besides padding?

texts:
From this answers comments a statement came up about padding that I don't understand: "If we need to keep the length of the plaintext confidential to some degree, there are better methods."

Are there any methods of hiding the plaintext length besides padding?

Assuming:

The data to be sent is incompressible.
If Steganography is used then leaving random data unchanged is equivalent to padding with random data.
Plaintext length and plaintext rate are related, |2x| every hour is equivalent to |4x| every two hours.


texts: 6 Byte for HMAC in wireless system secure?

texts:
A wireless system has 8 byte payload and 6 byte for message authentication.

Scheme:

m := 8 Byte Message
k := 128 bit key
c := Encrypt(m,k)
hmac := secure_hashfunction(c, k) //(6 byte output)

Questions:

Is bruteforce possible when transmitting a single wireless package will take 7ms? If an attacker do a bruteforce attack it will take $2^{48} * 0.007  /\  60 /\ 60 /\ 24/\ 365 = 62478.59\ years$ . So my assumption is that this system is secure if secure_hashfuncion is a cryptographically secure hash function.
Is there a hash algorithm that is cryptographically secure (only brute-force attacks possible) with a 6 byte output?
Can I maybe just use SHA-1 and only use the first 6 byte output?


texts: Why is it impractical to generate a semiprime dictionary?

texts:
This might be a very simple question. However, I am just learning the concept, so just excuse me.

I am wondering why there is not any attempt to generate all semiprime numbers? (as an dict. attack to RSA-xxx algorithms). Because as far as I can see, all one is to do is as following:

get a database of prime numbers
multiply each prime number with each one. (which will require O(n^2) space)
save the product.
Of course, you will not do this for all of the prime numbers:)

You will do this to prime numbers which will fall to the domain of RSA's random prime generator. In other words, which will create a $x$-bit number for RSA-$x$ (2048 bit for RSA-2048, for example).

I am sure one of these steps is impractical. Can you tell which one?


texts: Show number of affected blocks using CFB DES decryption of altered ciphertext

texts:
I have encrypted a file using -des -cfb and now I want to view how many blocks it contains once I decrypt it.

I have done this on the Linux terminal. I know that 9 blocks will be effected if there is an error in the ciphertext.

I need to show proof that this is true. But I'm unsure how to do this in a Linux terminal.


texts: RSA How to find the exponent ($e$) of the Public key with the values $p$ $q$ and an example are given

texts:
I'm wondering if it's possible to find the public exponent ($e$) with an example and the (rather small) values of $p$ and $q$ given.

Currently the only option I found is bruteforcing this value, but this can be very slow for a large $e$.

And if there is no perfect technique, is there a way to limit the amount of options significantly?

Is it possible to find $e$ with $p$, $q$ and an example encrypted message + answer given?


texts: Homomorphic encryption - Why does addition not imply multiplication?

texts:
As far as I know:

There are some partially homomorphic encryption (PHE) systems that support either addition or multiplication.

A fully homomorphic encryption (FHE) system can do addition as well as multiplication and thus supports arbitrary computation on ciphertexts.

My question is (disregarding computational efficiency):

Why does a PHE-system that allows addition on ciphertext not directly imply that it also can do multiplication, since

$$a \times b$$

is the same as

$$\underbrace{a + a + \cdots + a}_{b\text{ times}}?$$

Are there some computations that are only possible with a direct multiplication instead of a continuous addition?


texts: Collision resistant hash functions with prime domain

texts:
In order to use RSA accumulator the elements must be primes.
Is there examples of collision resistant hash
functions with prime domain?


texts: What's the difference between a known-plaintext attack and a ciphertext-only attack in terms of performance?

texts: I know that in the KPA the attacker has access to both the plaintext and the ciphertext, but in the end it all comes down to performing an exhaustive key search. I'm not sure if having the corresponding plaintext for a given ciphertext makes such an attack any less laborious. So I wonder, are they equally effective? And why do we make this distinction if they're practically identical?


texts: Enc-Mac (AES CTR+CBC) mixing AES-256 and AES-128 and splitting keys

texts:
I'm looking to accomplish a Enc-then-Mac approach using
AES-CTR
and
ECBC-MAC

Now ECBC-MAC requires 2 distinct keys, one for the MAC, and one to encrypt the Tag.

If I do this:
Use AES256-CTR for the encryption.
Then split the AES256 key into 2, and use each 128 bit key to do
AES-128-CBC-MAC
and
Encrypt the Tag using AES-128.

Is this semantically secure? Or do I definitely need 3 distinct keys?


texts: I've been researching RC4 and implementing it, and I was wondering, from the perspective of a cryptographer (a real one, not a fake one like me), what could be added to the RC4 algorithm to improve on its security?


texts: How to prove that an integer is hard to factorize when sampled from a known distribution

texts: Suppose that an $n$-bit integer $c$ has been randomly drawn from a distribution $\chi$, whose description is known. Is there a general method to check if this particular sampling helps factorize $n$? Are there any results in this direction (i.e. results like "don't choose an RSA modulus whose factors were sampled with this or that distribution")?


texts: Is it necessary to use an IV in CBC mode when just encrypting one file?

texts: As far as I know, CBC mode, even with a null IV, will encrypt identical plaintext blocks to unique ciphertext blocks within a single file. The purpose of an IV is to obscure the similarities between multiple ciphertexts, not to obscure the similarities within a single ciphertext. So, would it be just as effective to use a null IV as it would be to use a random IV when encrypting a single file? As far as I see it, it's just one less value to store.


texts:
My question is about security defined through space complexity. Suppose I have an encryption function $C=E(K,P)$ for which it can be proved (algebraically) that given $P,C,$ the possible keys which match the equation belongs to a set $S(P,C)$ of exponential size but $$|S(P,C)|\ll O(2^{\ell(K)})$$ where $\ell$ is the key length.

Then the key can be verified in parallel in polynomial time breaking the scheme in polynomial time by parallel computation but far better than brute force search. If no other estimate of $S(P,C)$ of smaller size is known, can this be considered a secure scheme? In such a case can the security be be considered weak if $|S(P,C)|$ can be shown to be bounded by sub exponential size?


texts:
Sorry about the horrible title, didn't now what to say.

I'm trying to avoid having to send an IV with every message purely to keep packet sizes down, so I thought of a method to establish a "IV Pool".

This is how I thought it should be:

Client ---- Handshake ---> Server

Server ---- Handshake ---> Client

Client and Server now have a shared 1024-bit secret

First 256-bit's of the key are used as AES Key.

Now what I thought is, could I take the next 128-bits of the secret as the IV for the first encryption, and then send a massive list of random bytes to the server to use as IV's? For example:

Client ---- Sends 1024 bytes of random ---> Server

Then the client and server both take 128-bits of the random bytes each time they send a message as the IV. That way the IV is synced across both parties and the IV does not change and is theoretically "not-predictable".

My question is, is this safe? Or does it still defeat the purpose of having an IV?


texts: Does a two-way fixed-length hash function exist?

texts: Just wondering if a two-way fixed-length hash function exists. I'm not talking about encryption where your output is the same size if not larger than your input. I guess the best way I can put it is "like SHA or MD5, but also reversible." (I know SHA and MD5 aren't reversible by design, but you get the point).


texts: SHA256: Padding a 512 bits length message

texts:
I am currently implementing the SHA256 hash-algorithm for a "custom-built" embeded-device. Obviously I have a problem with message padding. The routine I wrote does not work with message whose size equals exactly 512 bits.

In that case, how should the message be padded ? i.e.

M = "AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPAABBCCDDEEFFGGHHIIJJKKLLMMNNOOPP"

I mean, what should be the hexa-decimal representation of the last padded block?


texts: Is there any research on the problem of making a number more memorable to humans?

texts:
Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that the fingerprint of the server is the expected fingerprint. The user can phone the owner of the server, and confirm that the sequence of 32 hex digits are the ones shown on her screen.

The process seems vulnerable to the shortcomings of human perception, memory and energy. In practise, users do not check the fingerprint, because it is too tiresome.

The fingerprint could be made more memorable. For example, it is conceivable that a sequence of 32 hex digits could be reversibly converted to a sequence of eight English words. This would work as long as all implementations share the exact same bidirectional mapping between a tuple of four hex digits and between an English word. (I'm not asking for a review of this example, I'm just trying to explain the problem by explaining a naive solution.)

Within the cryptographic community, what is this problem called? Has there been any research on it?


texts: Security of Keccak/SHA3 against birthday attacks

texts:
If I understand it correctly the security of $\operatorname{Keccak}$ depends on the capacity $c$, which means that I get a security level of $2^{128}$ for $c=128$ (I omitted the value $r$ here because I think that it is irrelevant to my question...but correct me if I'm wrong).

But in every publication I found (and even on the $\operatorname{Keccak}$ website), it is said that the security does not depend on the output length. I don't understand how the value of $c$ is relevant to birthday attacks. For every single hash function, I can just run a birthday attack regardless of the inner construction of the hash function, right? Which means that for a $\operatorname{Keccak}$ implementation with $c=128$ but an output length of let's say $64$ bits, I can find a collision after $2^{32}$ steps using the birthday paradox, regardless of the value of $c$, right?

Let's even take it one step further. How is Keccak with $c=128$ and an output length of 1 bit still secure? For practical applications, it simply just can't be...


texts: A card game (for mental poker or any other card game)

texts:
I thought of a way to produce trustless card game in a flexible way. One feature that I want is it should be flexible (It should work for any type of card game, though I indeed started it as a solution for mental poker) and scalable (the number of players should not be limited by anything other than the rules of the particular card game). One feature of this scheme is that it uses no private channel for messages between players, everything to be communicated is to be published on a public ledger (e.g. a block chain). I want some confidence about this part.
Do ECDH and the DH on groups of quadratic modulo a safe prime $p = 2q + 1$ with prime $q$ support the property such that given: $a,b,A=a^x,B=b^x$, with $a,b$ generated pseudo-randomly (replace with scalar multiplication in case of ECDH groups), and $A$ and $B$ coming in any order, no polynomial time algorithm should be able tell whether the order is changed or not with probability greater that of a random guess (1/2) by a non negligible amount. This is an absolute key to my design.


texts: Can I use aes-gcm to authenticate a user based on his ability to decrypt a payload?

texts:
I'd like to authenticate my users without storing their password, even in a derived form with scrypt/pbkdf or other derivation methods.

I'm exploring the idea of encrypting a random payload with AES GCM, and storing it alongside its IV and tag. Then, authentication would simply be a matter of decrypting that payload with the provided password. I'm counting on the fact that the GCM algorithm will fail to decrypt/authenticate the data if the password is wrong.

When creating a new user, I would generate a key based on the provided password, a random IV and a random payload.

# Password is provided by the user
password := get_password_from_user()

iv := generate_random_iv()
payload := generate_random_payload()

encrypted_payload, tag = encrypt('aes-256-gcm', password, iv, payload)
store_authentication_info(iv, tag, encrypted_payload)

The authentication process would simply decrypt the payload, checking the tag.

# Password is provided by the user
password := get_password_from_user()

# IV,
iv := get_iv_from_storage()
tag := get_tag_from_storage()
encrypted_payload = get_payload_from_storage()

decrypt('aes-256-gcm', password, iv, tag, encrypted_payload)

I'm using PHP in this case, and the openssl_decrypt function returns false if the decryption didn't work.

Is that a sound authentication method? Can I assume that being able to decrypt the payload successfully validates that the user knows the right password?

Well it sounds obvious now that I'm writing it, but anyway, it's written so I might as well publish the question.

Can I use aes-gcm to authenticate my user? Am I missing anything important? Is there any obvious security issues to this approach?


texts:
The problem is described as follows. Let $c_1=p_1q_1+r$, $c_2=p_2q_2+r$, $\cdots$, $c_n=p_nq_n+r$, where $p_i$'s, $q_i$'s, $r$ are all large positive integers, and $p_i$'s and $q_i$'s are randomly chosen. Notice that $p_i$'s and $q_i$'s are different while $r$ is the same. Now one knows $c_1,\cdots,c_n$, and he knows the above structure of $c_1,\cdots,c_n$, but he does not know $p_i$'s or $q_i$'s. He aims to extract the value of $r$ from $c_1,\cdots,c_n$. Is this problem hard (either proven to be hard, or no polynomial solving algorithm found yet)? Does this problem have a name?

A similar (but easier) problem is solving the system of linear congruences: by knowing $c_1,\cdots,c_n$ and $p_1,\cdots,p_n$, solve $r$ from the equations $r\equiv c_1\mod p_1$, $r\equiv c_2\mod p_2$, $\cdots$, $r\equiv c_n\mod p_n$. This problem is related to the Chinese remainder theorem and I know that it has polynomial-time solving algorithms. However, in my question in the first paragraph above, one only knows $c_1,\cdots,c_n$, but does not know the moduli $p_1,\cdots,p_n$ (or $q_1,\cdots,q_n$), the problem of my question might be harder. I can only find works on linear congruences but cannot find related works on my question. Is anyone familiar with this question? I just wonder is this a problem that has been ever studied.


texts: Are private and public key sizes of Elliptic curve related?

texts:
I'm new to elliptic curve cryptography.

I just want to know in the case where I take a random number (private key) and find its associated public key, does the size of the public key depends upon the size of the random number chosen?. If so then how is it related? If not then what determines the size of the public key?


texts:
This is a setup to produce a secret key for symmetrical encryption with TweetNaCl:

1) K1 consists of 32 random bytes

2) K2 consists of 32 random bytes

(By "random" I mean "obtained from /dev/urandom")

3) KC is the concatenation of K1 and K2

4) K consists of the first 32 bytes of the SHA-512 sum of KC

Questions:

a) Is it safe to use K as a secret key? ("safe" meaning "as safe as using 32 random bytes"; it is assumed that K1, K2 and K are kept secret)

b) If an attacker gets his hands on K1 or K2 (but not on both), does he obtain any real advantage?

Rationale: keep K1 and K2 in separate media (e.g., K1 on a pen and K2 on disk)


texts: Collision likelihood from /dev/urandom for VMs using the same underlying hardware

texts: We have multiple virtual machines sharing the same physical hardware. We use /dev/urandom for session key generation. But a question comes up: if /dev/urandom utilizes metrics from the physical hardware for entropy, isn't there an increased risk of duplicates for VMs on shared hardware if calls are made at the same exact time?


texts: Where does signing/decrypting take place on a YubiKey 4/5 PIV private key?

texts: I have a YubiKey 4 and want to use it to store a private key that should never enter a computer system's memory. After importing the key to the device I understand it never leaves it.  Do the signing/decryption operations that take place for plain text using the private key happen on the device's hardware? Also, if this does happen on hardware, then can it be used like an HSM if proper compliance does not require that it generate the key on the device?


texts:
I am an undergraduate student looking for resources (books or lectures) explaining mathematics involved in cryptography, such as number theory, elliptic curves etc.
I found the book 'A Course in Number Theory and Cryptography by Neal Koblitz' hard to follow.


texts: Recovering El Gamal secret key from signatures

texts:
Assume out of a set of ElGamal signatures, I've discovered that two have the same y i.e. $signature_{1}$ on $m_{1}$ = $(y,s_{1})$ and $signature_{2}$ on $m_{2}$ = $(y,s_{2})$.

The public keys for $signature_{1}$ and $signature_{2}$ and messages $m_{1}$ and $m_{2}$ are available.

How can I recover the secret keys from this information?


texts:
Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to prevent repetition, but why does a Feistel network need it?

If $F$ is a good PRF, then the output should be indistinguishable from random after the first few rounds. Under the random oracle model, one would expect that $L_0$ is made pseudorandom after the first round, then $R_0$ is made pseudorandom right after that. Continuing this should never return you back to the plaintext in a reasonable amount of time.

So my question is why are round keys used in the Feistel network as opposed to making all the round keys the same? Did I get anything wrong in my reasoning?


texts: Is it possible to hand-negotiate an SSL/TLS session?

texts: I'm interested in trying to hand-negotiate an SSL/TLS session. Similar to how one would use telnet to port 80 and type GET / HTTP/1.1. I know there's a lot of steps involved, and I'm aware of the structure that should be used (per RFC 5246). I know eventually I'd have to start doing my own crypto, (which I suppose I could use an external source for) but I'm not concerned about that. I'm just wondering if there's a way I could do this seeing as connecting on 443 over telnet just causes the connection to be immediately reset.


texts: Which encryption algorithm is sensitive to an attacker having access to it?

texts:
We are contemplating hiding a sensitive information from our business partner by encrypting it.
However, customers have access to both the sensitive and the encrypted information. Furthermore, they can influence the 'sensitive information' to their liking.
I am curious which security algorithms are sensitive to an attacker being able to encrypt whatever they choose to (and see the result). Also, is there a known guide (or a googleable name) of this property of crypto algorithms?


texts:
I was asked to implement traffic encryption between the game server and clients.
Currently, the traffic is not encrypted in any way, which lets players use cheats to listen to the traffic in order to obtain information about the location of the opponents.

Traffic packets are small (50-70 bytes) and the developers are not ready for a big overhead for encryption.

When the session is started, the client communicates with the server via https; and in this moment, we can send a secret key. We think that the player will not be able to get this key by extracting it from the memory or somehow else.

AES in CTR mode will be used for traffic encryption. A fast hash function with a key will be used for authentication. 4-6 bytes (not 16) will be used for the tag.

How safe is this implementation? Which hash function is better to use? Can we use the same key for both the hash function and AES?