texts: Quadratic residue zero knowledge proof - simulator with identical distribution

texts:
I am looking at the zero knowledge proof for quadratic residues and am confused when it comes to showing a simulator that can give a transcript of the proof with the same distribution as the proof output itself.

In all explanations/proofs I have seen online the simulator has an element of iteration in it. For instance, taken from here:

Why is that iterative aspect needed?
I don't quite understand whose distribution we are trying to show is identical to whose too.

The first message from the prover is random just like it is in the protocol itself, b is a random value in both cases too. The second message from the prover to the verfier is distributed like b. what is this simulator gaining from generating two different messages based on b' and then executing something different based on b?

I've read the paper and other sources too but none seem to directly explain the need for this looping and what exactly it is that we want to be distributed the same way.

Any help is greatly appreciated.


texts:
Say that there are different live situations where you have to select own PIN numbers.

Can someone say if it is possible to guess a 8 digit pin within 3 tries, given any methods or resources?

Is this too hard with today's technologies or possible? What about quantum computing?

And if you know, could you tell me the entropy for this case?


texts: Semantic Security Active or Passive attacks?

texts:
I'm reading A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack and here define Semantic Security ...

  Semantic security, dened by Goldwasser and Micali [14], captures the intu-
  ition that an adversary should not be able to obtain any partial information
  about a message given its encryption. However, this guarantee of secrecy is
  only valid when the adversary is completely passive,

but in the abstract of other paper Semantically Secure McEliece Public-Key Cryptosystems –Conversions for McEliece PKC say

  we propose slightly modiﬁed versions of McEliece PKC that can be proven, in the random oracle
  model, to be semantically secure against adaptive chosen-ciphertext attacks.

I'm confusing Why if semantic security is for passive attacks exists the term "secure against adaptive chosen-ciphertext attacks", when Adaptative Chosen ciphertext attack is a model to active attacks?


texts: How to calculate secret key size of a CP-ABE scheme

texts:
How can I calculate the real size of key in a CP-ABE scheme. For example, I have this GSWV scheme:

Fuchun Guo, Willy Susilo, Duncan Wong, Vijay Varadharajan: CP-ABE with constant-size keys for lightweight devices.

In both papers I have that $\mathbb{G}_1=160$ bits and $\mathbb{G}_2=512$ bits, and length of decryption key is: $2\mathbb{G}$.

In this paper, the size of key is: $|S_K|=|\mathbb{G}_1|+|\mathbb{G}_2|=2\cdot 160+2\cdot 512=1344$ bits for $80$-bit security. ($\mathbb{G}_1$ and $\mathbb{G}_2$ are elliptic curve bilinear groups).

In this paper (original paper), the same key is: $|S_{K_\mathbb{A}}|=|\mathbb{G}_1|+|\mathbb{G}_2|=672$ bits.

I'm confused.

I don't understand, how can I calculate the size of key correctly if I only have $\mathbb{G}_1$ and $\mathbb{G}_2$ ?

How can I calculate the size of key in this case: $n\mathbb{G}$ ?

I'm confused if I must calculate $n\mathbb{G}=|\mathbb{G}_1|+|\mathbb{G}_2|$ or $n\mathbb{G}=n\cdot|\mathbb{G}_1|+n\cdot|\mathbb{G}_2|$.


texts: Is it possible to find what is the random generated key if I know the plaintext and ciphertext?

texts:
Is it possible to find what is the key with only plaintext and ciphertext?

For example,

My plaintext is: hi

My ciphertext is: 0x1db5


texts: Given that the plain text(P) and the ciphertext is known, and there's a random string(8 bytes)(S) concatenated to the plain text(P || S), how to go about figuring out the random string. Querying of black box is unlimited.


texts: OpenSSL not producing messages of expected size

texts:
I have a 16 byte file, and after encrypting it, its size weirdly changes.

> hexdump -C 1.txt
00000000  61 61 61 61 61 61 61 61  61 61 61 61 61 61 61     |aaaaaaaaaaaaaaa|
0000000f

> openssl enc -v -aes-128-ecb -nosalt -base64 -in 1.txt -out 2.txt

...

bytes read:    16
bytes written: 45

It becomes 45 bytes.

Why is it not a multiple of 16, since AES has 16-byte blocks?
If OpenSSL adds a header of some sort, how large is it, and is it fixed size? I can't find anything in the documentation that mentions this.


texts: Integrity of format preserving Encryption

texts:
In this question regarding integrity of FPE, the main point of the answer is that:

  FFX is not malleable. [...] FFX can provide integrity protection in very limited circumstances.

So I was wondering, in practice how does one enforce integrity of the data? For instance if the systems stores credit card information and expects the correct format, it will be impossible to append a MAC or something like that.

What are the current best practices for FPE?


texts: Is it possible to recover the key to a decrypted file?

texts:
Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged in CBC mode? If so how?

The file I want to recover the key from is a xml that looks like this without encryption. It has a xml element called Test.

<?xml version="1.0" encoding="utf-8"?>
<Test />

When it is encrypted with the key stackoverflow (73868cb1848a216984dca1b6b0ee37bc = md5 hash) and the initialization vector below, the file look like this ¥4!¬Hw[î!71ôtž|!¢¬TÞ;u?þª-†•ÈÏ‰eßŽKtSsbZ®ÕµR©Ù«í‹:

Initialization vector:

byte[] iv = new byte[]
{
    55, 66, 77, 192, 57, 100, 11, 111,
    25, 86, 96, 66, 22, 122, 133, 43
};

Is it possible to reverse the key from that or are it bulletproof?


texts: How does cryptanalysis of the Playfair cipher work?

texts:
I have a set of Playfair-enciphered data that I'm trying to crack without the key. I know I need to analyse bigrams; I've currently worked out what decrypts to th, er, in, and he, and have figured out where th and he are in the grid. However, now I'm stumped.

I've looked at the "Solution to Polygraphic Substitution Systems" field manual, but it didn't help. How do I complete the cryptanalysis of Playfair having a few bigrams decrypted and knowing where two of those go in the grid?


texts: Is there any hash function for which a preimage of a fixed element is always known?

texts:
I'm wondering if there is any collision-resistant hash function $h^s(\cdot)$ satisfying that there is a fixed value $c$ such that, for each $s$, a value $x_s$ satisfying $h^s(x_s) = c$ is known. This would not contradict the collision-resistance property, nor preimage-resistance, but I have not been able to come up with any construction of this kind.

Does anyone know if this is possible, and if so, can point me to a particular construction?

Thanks

Some context...

I'm working on an exercise which asks to analyze the security of Merkle–Damgård transform when no $IV$ is used (or, equivalently, when it is set as the first block of the message). If a hash function like that I mention can be constructed, then I can build collisions on this construction.


texts: Does selecting a set of random numbers for the key and IV insure security?

texts:
For AES 256 - if I use a random 32 byte sequence for the 256 bit key and another 16 byte for the 128 bit initialization vector, does this insure that my cipher text cannot be broken in any short amount of time when the byte sequences are only known to me?

Related to this: how would one transmit the key to another party, so he/she may decrypt the cipher text keep it secret? Is there a preferred method, for instance by word of mouth only?


texts: Serpent cipher : Osvik S-Boxes confusion and test vectors

texts:
I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. Here's my implementation of $S_0$ as an example :

UInt32Vector Serpent::S0(const UInt32Vector &Y)
{
   UInt32Vector X = Y;
   X[3] ^= X[0]; uint32_t X4 = X[1];
   X[1] &= X[3]; X4 ^= X[2];
   X[1] ^= X[0]; X[0] |= X[3];
   X[0] ^= X4;   X4 ^= X[3];
   X[3] ^= X[2]; X[2] |= X[1];
   X[2] ^= X4;   X4 = ~X4;
   X4 |= X[1];   X[1] ^= X[3];
   X[1] ^= X4;   X[3] |= X[0];
   X[1] ^= X[3]; X4 ^= X[3];

   return {X[1], X4, X[2], X[0]};
}

As you can see, this is exactly the $S_0$ from the paper. I have to precise that I checked my s-boxes 3 times to be sure there are the same as the one in the paper. Now, here's how I use $S_i$ for $i=0,\ldots,7$ :

subkeys.push_back(S[k & 7]({W[j], W[j+1], W[j+2], W[j+3]}));

where $k = 3$ and decreasing by 1 as it is mentioned in the algorithm specification.

What's confusing me is the Osvik implementation of his s-boxes compared to the ones described in his paper. This seems to be different. Moreover, in his key schedule, $i = 3$ is increasing instead of decreasing.

Now, here's my questions :

Where can I find test vectors to test my s-boxes ? I found one for the key schedule in Floppy 4 (ecb_iv.txt) from the full submission package, but nothing about the s-boxes.
Why his s-boxes implementation are different than the ones in his paper ?
Are my $S_0$ implementation and usage corrects with what I gave or did I miss something important ?

Thanks a lot for your helps.


texts: How does a "Tiger Tree Hash" handle data whose size isn't a power of two?

texts:
Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two.

root = H(H(A+B)+H(C+D))
         /            \
   H(A+B)             H(C+D)
   /    \              /   \
  A      B            C     D

In other cases, there is some flexibility. The missing blocks could be replaced with zeroes...

root = H(H(A+B)+H(C+0))
         /            \
   H(A+B)             H(C+0)
   /    \              /   \
  A      B            C     0

...passed up the tree...

root = H(H(A+B)+C)
         /      |
   H(A+B)       |
   /    \       |
  A      B      C

...hashed up the tree...

root = H(H(A+B)+H(C))
         /       |
   H(A+B)       H(C)
   /     \       |
  A       B      C

...or something different...

root = H(H(A)+H(B+C))
         /       |
      H(A)     H(B+C)
      /        /    \
     A        B      C

...and I'm just assuming that they do anything else like padding incomplete blocks before hashing.

The term "Tiger Tree Hash" seems to be used to refer to the root of a specific type of Tiger-based hash tree, but I haven't been able to find the details documented anywhere. How are such hashes constructed?


texts: Secure communication between multiple peers on a public channel

texts:
I am wondering how can I secure communications between multiple peers over a public channel, like an IRC channel.

With two peers it is easy - they exchange their encryption keys and decrypt the secret messages using their private keys, but how would this work with multiple peers without creating excessive duplication of messages?

Is there some way to encrypt a message that would be readable by multiple peers not sharing the same secret key?


texts: The strength of ECDH public keys with small order

texts:
I am trying to get my head around the methods involved in ECDH and am confused by the public keys that are used. Alice picks a random number A from 1 to P - 1 and then computes A⋅g (g being the publicly agreed generator, with a high order) using point addition and multiplication. She then publishes this value. In order to arrive at a shared secret, Bob must then also pick a random number B and compute B⋅(A⋅g).

Now, the shared secret can only be one of the points which can be generated from A⋅g through point addition and multiplication and, as such, if A⋅g has a low order surely there are very few potential results of Bob's calculation of the shared secret. Because an attacker would have access to A⋅g and the parameters of the curve (as they are publicly agreed) would they not be able to discern whether Alice's public key had a low order? If this was the case would a brute force attack not be sufficient to discover the shared secret?

There must be a mistake in my reasoning somewhere and I just can't see it, else are the random numbers re-computed if A⋅g has a low order to avoid this very attack?

Thanks for the help.


texts: Preimage attack on cbc-mac with constant key

texts: Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a given digest?


texts: Ciphers like PRINCE or LED seem to use identical round keys. Does anybody know other cipher (may include hash functions, MACs or AEADs) that has the same property?


texts: Using Microsoft SIDH library for messages signing

texts:
SIDH library looks good but lacks documentation and samples.
The only signature-related code was found at http://github.com/yhyoo93/isogenysignature/blob/master/tests/kex_tests.c appeared not able to sign/verify message (just measure abstract performance of some partial calculations).

Thus it's not clear how to mix arbitrary message to SIDH signature and then verify the signaure corresponds to initial message?


texts: length extension attack on an MD5 hash of a text file of about 10K Bytes?

texts: How much computing time on a typical desktop computer would it take to find a new length and new data to extend a text file of about 10K Bytes with a given MD5 hash?


texts: Comparing Difference Distribution Tables

texts:
I have been studying the Diff. Cryptanalysis and finding it hard to do a problem. The problem is

I have calculated the tables programmatically and found that the second table has a max value of 6 where as the first has a max value of 4.What can i infer from the tables?
PS:I started reading this recently and need help in atleast the direction to think


texts: Why work in a subgroup for Naor and Pinkas oblivious transfer?

texts:
In section 4 (protocol 4.1) of the paper by Naor and Pinkas [1], why did the authors decide to operate in a subgroup? When they say "the messages are in the subgroup" does that mean $x, y, z_0, z_1$, $w_0, w_1$ and the encryption keys are in the subgroup but the private values such as $a, b, r_0, s_0$, etc. are not? Does the construction work for any subgroup or is it more typical to use group of quadratic residues modulo prime?

Sorry if this is a bit elementary, any references regarding how subgroups are used in DH-based protocols are also appreciated.

[1] "Efficient oblivious transfer protocols" http://www.pinkas.net/PAPERS/effot.ps


texts: How does GPG verify succesful decryption?

texts:
How does GPG (or other programs using the OpenPGP file format) verify that it has succeeded with decryption (for symmetrically encrypted data)?

Is something appended to the clear text so there exist some expected data?

For example, I'm using these command lines:

gpg -c test.txt
gpg -d test.txt.gpg

The second command outputs

gpg: decryption failed: bad key

when a wrong key is entered.

How can the program know that it is a bad key? Why doesn't it simply return the random data generated by decrypting with a wrong key?

First I thought that maybe it used letter density to determine if it was plaintext, but then it manages to decrypt binary files too (and complain about wrong keys), and specially key files which should be completely random.


texts: What characteristics define a function to be a block cipher

texts:
I'm trying to understand what characteristics or properties make the result of a function a block cipher. I understand that for a function to be a block cipher it has to be invertible and can't be a one-way function.

What I don't get is how to compute a cipher. So for example, I have the following cipher: $F_k^r(m) := r(k,m)$. Now $r$ is defined as a random compression function such that $r: \{0,1\}^{3n} \rightarrow \{0,1\}^n$. The length of $k$ and the number of bits for the message $m$ are both $n$, i.e. arbitrary.

What I don't know is how to compute the cipher and why it may potentially not be a block cipher? I think it isn't a block cipher because you are starting with $3n$ and then getting an output $n$ in the random compression function. But I think I am going wrong something.

I know I am getting close in better understanding it, I just kindly need someone to clarify the cipher and why it may not be a block cipher


texts: Commit and prove as a general trick for malicious security

texts:
After reading through Lindell's excellent tutorial (https://eprint.iacr.org/2016/046.pdf), I wonder about the following.

To make a protocol secure against fully-malicious security, it seems that forcing parties to commit to their input and then prove knowledge of that input (using a zero-knowledge proof of knowledge) is a useful tool. Basically, the zero-knowledge proof of knowledge allows the simulator to extract the adversary's input and fabricate data as required.

My question is about the usefulness of the zero-knowledge proof in reality. Is the ZK proof only required to make a proof of security go through?

On Page 43, Lindell states that decommitting is essentially the same as that ZK proof. So for a new protocol, is it sufficient to decommit a commitment at some point in the protocol's real-world implementation, but replace the decommitment by a ZK proof in my protocol's security proof?


texts: Is the simulation-based proof difficult and needed?

texts:
What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries?
I agree with that a view of a some party is important to prove that a protocol is secure under some assumption which is semi-honest or malicious setting.
I'm wondering if a proof of simulation-based for a protocol makes sense. I see some papers providing proofs using simulation-based technique under semi-honest adversary.
But I don't think it is needed since its semi-honest. Most of cryptographers take care of the information leakage.

In other words, I think a simulation-based proof under the semi-honest adversary is not reliable. Often it's trivial while a proof for malicious adversary is NOT trivial.
Moreover, when non-experts read that paper, the proof makes paper difficult to read.

So, is the simulation-based proof under semi-honest model really needed in the literature?


texts: ChaCha20 - How confidentiality is lost if reusing nonce?

texts: I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt their own messages (messages of peers would be different).


texts:
I'm trying to follow Schneier's self-study course in cryptanalysis and am ashamed to say I am stuck on the very first problem of breaking 8-round RC5 without any rotations (i.e. just XOR and modular addition)...

I've obviously found the algorithm which can decrypt any ciphertext using only a handful of chosen plaintexts, by observing that the carries from addition only propagate one way so the plaintext can be brute-forced bit by bit starting from the least significant bit.

Now I'm trying to recover the subkeys, but am struggling, I've been spending nearly 6 days on it with no real progress... this is where I am at:

I tried some kind of backtracking search over the subkeys working from the LSB but it just fans out too quickly; there's 18 subkeys with 32 bits each, I can't get past 3 or 4 bits with this approach, and there doesn't seem to be any way to infer anything about distant subkey bits. I can't find any good linear approximation between plaintext and ciphertext bits beyond their least significant 4 bits or so...

I also found that if I tried to determine how often some linear relationships between the lowest plaintext and ciphertext bits hold for a given key and tried to guess the first few bits of each subkey based on these relationships I was able to glean some information about the first few bits of the very first subkey, but I don't see how to extend that.

Finally I noticed that the most significant bit of all subkeys but the last two are redundant; they can be folded in the last two subkeys since there is no carry. But this doesn't seem too helpful if I am to recover subkeys working from LSB to MSB.

My question is, was the exercise just about recovering the plaintext bypassing the key completely, or is there something utterly obvious that I'm not seeing that would allow to recover the subkeys efficiently? If there is, I need a hint or some pointers as I'm really completely stuck...

Thanks


texts: What is the meaning of h(r) in this protocol?

texts:
Could somebody tell me what the meaning is of $h(r)$ in the protocol below?

$A\leftarrow{B}\quad:{h(r)}{,B}{,P{_A(r,B)}}
\\A\rightarrow{B}\quad:r$


texts: Why is the re-encryption algorithm in Universal Re-encryption for Mixnets more complicated than apparently necessary?

texts:
This is the paper.

On page 6, the paper describes a variant of El Gamal and a way of re-encrypting ciphertexts.

I thought an easier way to do encryption is to output $(m(g^x)^y,g^y)$, and universal re-encryption can be done by $(m(g^x)^y(g^x)^z,g^yg^z)$ for randomly chosen $z$. Instead the paper used a ciphertext with four components. Why?

Does it have something to do with CCA security?


texts:
I am trying to find the average of hash rate (benchmark) for SHA-3(Shake128) for a normal and supercomputer in order to estimate the brute-force attack which I can get if from ( keyspace / hash rate )...then I found this website:

https://bench.cr.yp.to/results-hash.html

I could not understand these tables i.g. (Cycles/byte for 8 bytes) what do they mean by cycles/byte? Is it that hash rate for 8-bytes?


texts: How to use Botan to verify a web3 wallet/password?

texts:
The specification here seems quite clear, but unfortunately I'm still doing something wrong...
I have this (single small c++ file) repository which very straightforwardly follows the password/wallet verification process. However, the result of my cryptographic operations do not match with the wallet's mac key (the signal that the password is correct).
I have verified that thisisatestwallet.json (included in the repository) does open with the password thisisatestwallet, and the spec seems so simple there isn't much room for me to screw up. And yet...
If anyone could glance at that and tell me what I'm doing wrong, I'd appreciate it!
The output I'm currently getting is as follows:
pkey:           2F299FEF2CA3390C63DABA7A13BA4CE9D60B7FC1E58DAFD5E1089D32CFD7219C
ciphertext:                                                                     C6D18F78AF6E5E7CEA4AB804D8B9A5F974CCF92EA2537416B90ABEBD77C6B580
cipher input:                                   D60B7FC1E58DAFD5E1089D32CFD7219CC6D18F78AF6E5E7CEA4AB804D8B9A5F974CCF92EA2537416B90ABEBD77C6B580
keccak out:     7D31B612939A26418CAB1DF332D27B711CAACAA7A119013A01E1DB75DE508DAA
mac:            89655FD4BB9CCF9DE0D8F1A78025A8616C9416EC700CFAAFEF17E76C7C47338E


texts: Is it possible to change PGP / GPG Key Size on an exisiting key?

texts:
Is it possible for myself to change the key size (say from 2048 to 4096) on an EXISTING PGP / GPG key, and just republishing that key?

Or do I have to generate a new key all together?

I want to say that you have to create a new key pair, but I don't have enough documentation either way to support a claim.


texts: Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input?

texts:
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".

So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.

Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?


texts:
AS explained in section 4.5, decomposition for relinearization (2nd step of ciphertext multiplication in bfv) can be done using RNS components of ciphertext. In other words, they proposed a way to do CRT decomposition. My question, if it is possible to do this CRT decomposition when the polynomial is in NTT (point- value) form.
My understanding of NTT is very little, but it looks like NTT representation is friendly to multiplication and addition, and CRT decomposition requires something like modulus switching.
I will really appreciate it if you could share some useful references.


texts: Is the "Pico" alternative to passwords vulnerable to man-in-the-middle?

texts:
Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting.

Regarding the paper, there is described the initial "Pairing" between the Pico and an application (thats the action when a user enters the app for the first time). I have a question about that action. If an attacker compromises the users system by wrong DNS records or another technique, so that the users visits a phishing version of the app (for example a website of a bank). Now the user tries to pair with his Pico and the phisher tries to be man-in-the-middle. The keys are now changed between Pico and the phisher and between the phisher and the real website.

Is it correct, that in this situation, an attacker would be able to break into the system? And furthermore, is Pico secure only under the assumption that the key-exchange is not attacked by a man-in-the-middle?


texts: How to derive two keys from one password

texts:
What is the best way to generate two independent symmetric keys from one user-entered password or passphrase?
Would using both scrypt and pbkdf2 achieve this?


texts: What does ''latency'' really mean when a block cipher is partially unrolled?

texts:
Typically，I think latency should mean the time from the first plaintext input to the first ciphertext output, when the block cipher is not totally unrolled (such as AES unrolled with 2 rounds).

If I use a pipeline to increase the throughput, the latency should relate to the amount of pipelined data. E.g. with AES unrolled with 2 rounds, and 100 group data to create the pipeline, then the latency must be larger than 500 cycles (except the time to calculate).

But in many papers, latency in this situation does not include this number, just the clock cycles of 10 rounds' critical path.

I do not understand why.

Also, what is the requirement of latency which limits the number of blocks which are pipelined?


texts: What is the key size currently used by RSA and Diffie-Hellman for secure communication over Internet?

texts: What is the key size that RSA and Diffie-Hellman are using now that can guarantee secure communication over Internet and will not be able to break by the best available algorithms (NFS & FFS or any others) in feasible time?


texts: Which ciphers produce random ciphertext?

texts:
I already know AES produces a "random" output.
5e4e6440826d6afc4535fbf078455f791159701a9df624ddd4e4dda84523b6a7
Its ciphertext doesn't follow a pattern and is indistinguishable from noise.

Is this common for most ciphers?


texts: Is a MAC a valid way to ensure tamper-resistance?

texts:
According to some government standards I need to be able to ensure some data in a database has not been tampered with.

My current idea is to store a MAC (HMAC-SHA256) next to each instance of the serialized data. The key will be stored in a separate location but the same key will be used for every MAC.

To detect tampering, I will read the data, compute the MAC again with the same key, and compare the computed MAC with the one stored in the DB. If they are equal, the data has not been tampered with, if they are different, than the data has been tampered with.

A weakness I am aware of is that if the key were to be compromised, we no longer can trust the MACs or the data. It would be possible to recompute the MACs, but they would only be valid for the data in the DB which we can no longer trust.

A few questions:

Is this a valid use case for a MAC?
Are there any major or minor flaws with this technique?
Is it OK to reuse the same HMAC key forever?
Would an asymmetric or AEAD solution be preferable?


texts:
On page 89 Remark 3.5 in the Handbook of Applied Cryptography the following is written:

  A non-trivial factorization of $n$ is a factorization of the
  form $n = ab$ where $1 < a < n$ and $1 < b < n$; $a$ and $b$ are said to be non-trivial factors
  of $n$. Here a and b are not necessarily prime. To solve the integer factorization problem, it
  suffices to study algorithms that split $n$, that is, find a non-trivial factorization $n = ab$. Once
  found, the factors $a$ and $b$ can be tested for primality. The algorithm for splitting integers can
  then be recursively applied to $a$ and/or $b$, if either is found to be composite. In this manner,
  the prime factorization of $n$ can be obtained.

I think that this argumentation is flawed. At the time the book was written there were no efficient primality tests available (or at least none are given in the book, but to my knowledge the first of these test was the AKS algorithm back in 2002), so the statement

  Once found, the factors $a$ and $b$ can be tested for primality.

does not make sense to me, as a primality test can not be done efficiently in the context of this book. Am I getting something wrong?

EDIT:

I am aware that probabilistic primality test like Solovay-Strassen or Miller-Rabin were already around at the time, they are also covered in the book. But I do not see why the existence of Miller-Rabin should be an argument that a primality test can be done efficiently, since said tests have an error bound when returning "n is prime". And by the definition of polynomial reduction (again taken from the book on page 88:

  Definition Let $A$ and $B$ be two computational problems. $A$ is said to polytime reduce to $B$, written $A \le_P B$, if there is an algorithm that solves $A$ which uses, as a subroutine, a hypothetical algorithm for solving $B$, and which runs in polynomial time if the algorithm for $B$ does.

If I understand this definition correctly we can not use Miller Rabin as a primality test in the argument $\text{factoring} \le_p \text{splitting}$ above, since then we can not be certain that the factors we found are indeed primes. (If I am not mistaken an algorithm is said to solve a problem if it can give 100% accurate answers.)

I hope it is clear what I mean, if not please let me know and I will reformulate my question.


texts: What are the two parts of SHA1's compression function called?

texts: SHA1's compression function has two distinct parts: one where 16 words are expanded into 80 words, and one where the 80 words are used over 80 rounds.  Are there specific names or terms for each of these parts, and if so, what are they?


texts: How does RSA blind signature calculation works?

texts:
I am having a struggle calculating (ii) and (iii), Can anybody help me with the calculation?
RSA blind signature algorithm:
Given two prime numbers: $p=11$ and $q=3$
The message to be signed is: $M=6$
The public key is: $e=7$

(i) List all the possible candidates of the blinding factor $R$.
$n=33$
$\phi(33)=20$
$\{1,2,4,5,7,8,10,13,14,16,17,19,20,23,25,26,28,29,31,32\}$
(ii) If the chosen $R$ is $2$, find out $R^{−1}$(inverse).
(iii) Calculate the signature with blinding factor $S’$.


texts: What does the mask generation function in PKCS#1 output if the generated mask is shorter than the specified mask length?

texts: I am implementing RSA-OAEP with the mask generation function as specified in PKCS #1. It says after producing the variable T to "output the leading maskLen octets of T as the octet string mask". However, in one part of RSA-OAEP, where the mask generation function is used on a random seed, maskLen is greater than T. I don't believe I put in the wrong maskLen. RSA-OAEP does not work unless the output of the function is of the specified maskLen. Should I copy T to a byte array of length maskLen?


texts: How should I encrypt filenames in my scenario?

texts:
I'm writting a tool to save files (to external drive, cloud,...), it can already crypt file content with AES/GCM/NOPADDING; and as I'm not an expert, I've read some documentation, and understand that I have to generate (for each file) a random IV, that I can store directly into the crypted data (prepend). This part is OK (I hope).

But now I want to "obfuscate" the filename. As I want that the resulting string is "secure" (so not use a easy rot13/caesar cipher, that can be hack), I've tried to use the same approach (base64 the crypted byte array). But if I'm doing this, my resulting filename will never be the same! Encrypt "test.jpg" can give "abc", but encrypt again the original string "test.jpg" will give another result like "drsdf"... as the IV is generated randomly each time. And so my backup tool can't compare "filename" to do its checks.

Is there a way to obfuscate in a secure way a string but giving always the same result?

Update

Ok, I continue with my questions / investigations. So I use AES/GCM for content encryption with unique random IV (for each file). As I understand, I can't really use IV for filename encryption (need to save the IV into the crypted filename, which is problematic).

So new question for filename encryption:
What is better to do:

Use AES/GCM (or CBC) with the same IV for all filenames?
Or use ECB mode which does not require IV?

And do I need to use or not use the same secret KEY for file content and file name encryption (as I will use 2 different approachs)?


texts: Quantum Resistance Characteristics - why symmetric?

texts:
I have heard that public key cryptography may be “totally broken” by Quantum computers running Shor’s algorithm, whils symmetric key ciphers are safe, but Grover’s algorithm may require twice as many bits in the keys.

Can someone please elaborate on what exactly is going on underneath, to say these things? What exactly does Shor’s algorithm do and how bad is it? How exactly are symmetric key ciphers not susceptible to this? How do we know we can’t do better than Grover’s algorithm later, making ALL ciphers susceptible? And finally, if you can fit it into your answer, what are the measures taken by the latest public key ciphers submitted to NIST that purport to overcome these problems?


texts: Does this computation lead to solving DL?

texts: Imagine we have $g^x$, $a$ and $g^b \in \mathbb{Z}_p$. Is it realistic to compute $g^{(a+x)b}$ without knowing $x$ and $b$? Or is it equivalent to solving the Discrete Logarithm problem?


texts: Using xor encryption in the following use case

texts:
I use an encryption scheme based on a symmetric cipher, with the corresponding symmetric key encrypted with RSA/OAEP using the public RSA key of the recipient.
I now want to use ECC crypto in replacement of RSA. Looking at the openssl API I can see that there is no RSA equivalent ECC encryption of a key, but only key derivation.
As the same symmetric key has to be encrypted for several different recipients, each of them owning its own encryption public ECC key, I can't directly use the derived key as the symmetric key.
So I am considering doing this:

create a "one time" ECC key pair,
derive a shared secret with this key and the recipient public key,
xor the symmetric key with the derived shared secret, ensuring that the latter is at least as long as the symmetric key,
sign the public part of the "one time" ECC key and transmit it along with the xor encrypted symmetric key so the recipient will be able to decrypt it.

I think that using xor encryption here is safe as:

the derived shared secret is supposed to be random looking and will never be reused, as one of the keys used for derivation is a one time key,
the derived shared secret is at least as long as the xor-ed content.

But maybe have I missed something?


texts: Edwards / Montgomery ECC with Weierstrass Implementation?

texts:
So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required.

But the problem is, that I have only a constrained device given, which only allows for Weierstrass-Computations. Alternatively I have a software library that can perform Weierstrass-Operations but not Montgomery / Edwards operations. "Operations" here denote point addition and scalar multiplication. Note further that both devices / libraries support arbitrary (Weierstrass) curves.

So this provokes the question:
Is it possible to perform Edwards / Montgomery operations using a Weierstrass engine and if so, how?


texts: Elliptical Curve Cryptography decryption resulting point at infinity?

texts:
I am building a web app to encrypt and decrypt using an ECC algorithm.

I use the following curve parameters:

Prime p = 43
a = 7
b = 3

public key e1 = 11
private key d = 3
let say i want to encrypt character that is on point (38, 12)

So I calculate its cipher which results in

c1 = (11, 32)
c2 = (27, 40)

I'm sure that both of my cipher is correct because I already calculated it manually.

The problem is, when I want to decrypt it, I have to calculate

M = c2 - d * c1
d * c1 = (27, 3)

so,

M = (27, 40) - (27, 3)

Since point (27, 40) and (27, 3) is a straight line, it will resulting point infinity. Beacuse we can’t calculate the lambda since

x2-x1 = 21 - 27 = 0

and the lambda formula is

y2-y2 / x2-x1

and we can’t divide number to zero.

How to solve this problem? How do I get my original point if my cipher resulting point at infinity?


texts: Build a scheme that is CCA secure but not authenticated

texts:
Trying to understand a solution from this paper:

Summary:

$E'_K=0||E_K(m)$ and $D'_K(0||c)=D_K(c)$ and $D'_K(1||c)=1$
IND-CCA secure (how?) as $1||c$ and $0||c$ are are easily decryptable
Not authenticated because $(1,c)$ is easy to decrypt because it will equal to 1. So, an adversary can append 1 to any ciphertext so that $1||c$ and say it was from him

Could someone explain what step 2, I can see why they are easily decryptable but cannot make the link between that and IND-CCA. My confusion is that the decryption looks like IND-CCA insecure because you can easily append 1 to c to get 1, so adv will always win.


texts:
I can understand that the basic Hill Cipher is susceptible to known plaintext attacks, but suppose the Hill Cipher is modified into the Iterated Hill Cipher. For a plaintext $x_0=m_0$ and an initialization vector $x_{-1}=u_0$ we have,

$$x_{i+1}=Ax_{i}-x_{i-1}$$

for $0\leq i< k$. So our private key consist of the triplet $(A,\,u_0,\,k)$ where $A$ is an invertible matrix. The ciphertext will be the tuple, $c=(x_{k},\,x_{k-1})$. This is the idea behind the Iterated Hill Cipher given in Symmetric-Key Homomorphic Encryption for Encrypted Data Processing (paywall).

Then there are lots of research papers which try to employ Latin Squares and Magic Squares for $A$. Here are some:

Strengthened Iterated Hill Cipher for encrypted processing (paywall)
Successful Implementation of the Hill and Magic
Square Ciphers: A New Direction (pdf)

So my question is: why do people try to use Quasi-groups (Latin Squares) and Magic squares for the Hill Cipher? Does it improve the security?


texts: Getting the encryption method and key from the encrypted data and the raw data

texts:
I have some pairs of plaintext and ciphertext data, from which I need to be able to decrypt the other passwords stored in the database.

The password field typically contains something like

ENC:LCznyFywN+3J+AD330rqHg==
ENC:D3H2ODVCAzkzQzRr8ZbJdw==

The raw data for the first is 1234, and the second 62369. ENC: denotes that it is an encrypted field, and the == at the end is always the same (no matter what the password).

If this can be done, then any prods in the right direction would be greatly received.


texts: Can I use MAC as CTR mode nonce, if my messages are non-repeating?

texts:
I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 bytes is not acceptable and I must come up with a solution which adds smaller overhead.

The protocol messages do not repeat between re-keying, because they contain large enough sequence number (I can specify how often to re-key).

Question: Can I use the packet MAC as the nonce for the CTR mode encryption?

AFAIK the only requirement for the "counter" value is that it does not repeat for the same key, and that is guaranteed by message uniqueness (assuming MACs would not collide). Such "reuse" would save me 16 nonce bytes in each packet.


texts: What if OT breaks in Yao's garbled circuit?

texts: Two semi-honest parties are computing F with Yao's garbled circuit. Sender garbles it with his inputs baked in then sends it to the receiver. At this point the receiver must use OT to get his keys. What happens if OT breaks and the receiver gets both keys for every wire? It's not clear to me that this would break the sender's input privacy.


texts: Are SSL modes with forward secrecy vulnerable to the BEAST attack?

texts:
From the original BEAST paper, it seems to me that you need the same session key when encrypting data, so you can check if the original plaintext block is the same as your chosen plaintext (which is impossible with different keys). However, in modes with PFS, the keys are different in each session, so doesn't this foil the BEAST attack as well?

I appear to be wrong somewhere, but I can't see where. Can someone enlighten me?


texts: Is there a multiplicative group of integers modulo p in which the discrete logarithm is easy?

texts: The complexity of computing discrete logarithms in a multiplicative group modulo a prime $p$ is assumed to be sub-exponential time. The complexity is determined by $q$, the biggest factor of the group order $p-1$. Is there any group $\mathbb{Z}_p^*$ such that discrete logarithms are easier than subexponential in $q$?


texts: Is every point on an elliptic curve of a prime order group a generator?

texts:
If the order of elliptic group is prime then every point is a generator of that group.
I tested the above statement on some elliptic curves and found it true.
Does that really work on all curves?

Is there any lemma or theorem which states that?


texts: Is every pseudorandom generator a one way function?

texts:
$$\{G:\{0,1\}^n\rightarrow\{0,1\}^{2n+1}\}^\infty_{n=1}$$

If above function is a pseudorandom generator then is the same $G$ a one way function. I tried to prove this but failed a lot of time. Would be helpful if someone could provide some insight on this.


texts:
I am looking for cryptographic algorithm or combination of them.

Basically I need an algorithm, which can generate private key and for this key can be computed multiple keys based on some seed. So a different seed would generate a different line of keys and so on. Does such an algorithm (or set of algorithms) exist?

I think something like this is used for in PS3 games, where consoles have some master key and games are encrypted with various public keys.

Does something like this really exists or I am completely wrong and this isn’t possible at all?

EDIT:

I will try to explain scenario I need to solve.

I have a data-file I need to protect against unauthorized reading attempts. I considered using the RSA public/private concept for that, but I need something  where I can have one single public key for reading.

I need to change that key every time and that’s where I want to create some key derivations from, which are dynamically generated.

It looks similar like RSA tokens, which generate new pin code each time. I need something like this. Just $1 * PrivateKey \rightarrow N * PublicKeys$.

Additionally, it would be great if I could sign it with a certificate, but that’s not so important to me as having the ability to hide the data from curious eyes… that’s definitely more important to me.

I hope this description helps…


texts: Why must s be kept secret in pedersen commitments?

texts:
I was reading up on Pedersen commitment over at this website: https://asecuritysite.com/encryption/ped, where they calculate $h=g^s \bmod p$, and they say that $s$ must be a secret.
I wonder why this is a requirement? Since verifiers will know the value of both $h$ and $g$ anyways, and a random value $r$ is used for creating the commitment, I don't see why $s$ must be kept secret?


texts: How to Distribute the Shares using Secret Sharing for arbitrary Monotone Access Structures

texts:
Consider 4 people, $A$,$B$,$C$,$D$, & a secret $s\in\{0,1\}^k$. Construct a scheme
which enables the following subsets of people to retrieve the secret $\{A,B\}$, $\{A,C\}$, $\{B,C,D\}$.

I know that we can use Shamir's secret sharing scheme to do so, and A should be allocated more shares than the others. But how do we do the allocation when given an arbitrary monotone access structure?


texts: Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?

texts:
As I understand length extension attacks, they depend on the coincidental property of most cryptographic hash functions that the hash value is exactly the hash function state after hashing the last block of data. This enables an attacker to initialize their own hash function with the state as it "left off".

This being the case, why are hash functions simply not defined as outputting the n-byte prefix of their state (i.e. for a 256-bit hash, maintain 512 bits of state)? I'm assuming there's a fundamental reason this isn't done, but I haven't been able to find any literature specifically addressing it.


texts: How to devise cryptographic system with data-sharing ability and password reset

texts:
I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question.
I am writing a C# .NET application. For my application the following requirements should be met:

The data of the users should be stored encrypted in the database
Users can share data with other users
I, as the developer, should be unable to decrypt any user data
If the user resets their password, previously encrypted data should still be possible to decrypt
The private key should not be stored anywhere on disk. Ideally, I want the client application to be able to derive the private key, for example from the password, every time the user logs in.

I cannot seem to find a solution that meets all five requirements. So far, I have come up with the following cryptographic system using asymmetric encryption: When a user registers, a public-private key pair is derived based on the user password (Is that even possible/practical?). The public key is stored in the database. When the user shares data with another user, it is encrypted with that other user's public key and stored in the database. But now req. 4 is not met, since the key pair is based on the current password a reset will render all previously encrypted data undecryptable.
If instead I use symmetric encryption to encrypt the data, then I can encrypt the encryption key using some password based key, which solves req. 4. However, then I am unable to meet req. 2 i.e. share data with other users. This is, of course, because the user would need the other user's symmetric data encryption key which is encrypted with the private key.
So I am finding myself stuck and unable to come up with a solution that fixes all issues simultaneously.


texts: What primitives are needed to generically implement public-key cryptography?

texts:
Public-key cryptographic systems are often implemented on top of an existing problem. For example, RSA is built on top of integers and the difficulty of factoring. ECDSA/ECIES are built on top of elliptic curves and the difficulty of the discrete logarithm.

My question is, what are, mathematically speaking, the exact primitives needed to implement public-key based signature and encryption cryptography in a generic way?


texts: Concept of "guessed ID" in Authenticated Identity-Based Encryption

texts:
In Authenticated Identity-Based Encryption by Ben Lynn, in Proof of Integrity (section 4.3) and Proof of Security (section 4.4), I cannot grab the concept of "guessed ID" . Because encryption differs according to "guessed ID", I am unable to know how it works.

Is there anyone who can help explain this term and how it affects the proof?


texts: Is it possible to build a CPA-secure encryption scheme which remains secure even when the encryption of secret key is given?

texts: How can I design a CPA-secure encryption scheme which is secure even after the encryption of secret key is given in the training phase?  I.e., in the training phase, $\mathit{Enc}_{\mathit{pk}}(\mathit{sk})$ is given to the attacker, where $(\mathit{sk},\mathit{pk})$ is the key pair.


texts: How to calculate Enc(-m) from Enc(m) in Paillier cryptosystem?

texts:
The encryption in Paillier cryptosystem is like this according to Wikipedia:

Let $m$ be a message to be encrypted where $m \in \mathbb{Z}_n$
Select random $r$ where $r \in \mathbb{Z}_n^*$
Compute ciphertext as: $c = g^m \cdot r^n \bmod n^2 $

So just calculating the inverse of ciphertext $c$ (i.e enc($m$)) will not work, because enc($m$)*enc($-m$) is equal to $r^{2n} \bmod n^2$, not $1 \bmod n^2$.


texts: Blowfish encryption with different keys produces same ciphertext

texts: I have set up a test app with Blowfish encryption taken from someone else's library. I have been astonished to find that password "Test" gives the same encrypted text as password "TestTestTestTest". Is this normal behavior of the algorithm or is it a bug?


texts: I am trying to figure out how to evaluate the security of a hash function. If I have defined a candidate hash function: $$H(x) = α^x\text{ mod }p$$ how do I then evaluate it with respect to collision attacks, second preimage attacks, and preimage attacks? Hope someone can help


texts: Google Timeline: is it encrypted and if so who has the key?

texts:
Google Timeline claims (e.g. here) that "Your Timeline is private, so only you can see it."

What does that mean? As a cryptographer I would take that to mean that the Timeline data is encrypted using a key that only I have access to.

But based on some of the features, that doesn't seem likely. For instance it can be accessed from any device provided I log in to my Google account, which would make key management hard. It seems that the recommendations it sends are based on it doing some ML on the data, which would be very hard to do if it were encrypted. And it now sends an email with a customized summary of annual activity. (I don't actually have Timeline enabled; this information is based on what I've heard from friends and seen online.)

Is Google actually doing some fancy FHE or MPC thing to analyze Timeline data while it's encrypted? Is the data being processed by your local devices? Or by "only you" does Google mean "only you and Google"?


texts: Cipher that interleaves rounds from other ciphers?

texts: Is there a cipher that interleaves rounds from other ciphers (with the same block size)? For example, interleaving the rounds of AES/Twofish/Serpent/RC6?


texts: What algorithm could/should be used to encrypt files for storage on untrusted servers?

texts:
I need an encryption algorithm that works fast on large files and doesn't increase the file size. It should use a key to encrypt/decrypt data. The files will be sent using REST and over HTTPS, but a good encryption/decryption method with a key is mandatory (to be used in a website).

The files will be saved on a 3rd party servers, and although the files are sent through HTTPS, they must be stored encrypted on the remote servers and decrypted when retrieved. The key will not be distributed. The key will be stored on my trusted server, as it is also the receiver! I want to encrypt the file, put it on the 3rd party server, then when I need it I can retrieve it and decrypt it.


texts:
I know that there are cases when RSA will not work like when the number to feed into the system is greater than the modulus. I was wondering if there were any other cases when RSA won't work

I looked all over and tried rephrasing the question in google many times

Edit: I am looking for what cases exist with a valid n, e and d used properly will not encrypt and decrypt correctly eg: message <= n


texts: Are there any hash outputs not produced by the MD5 hash function? I need to use it as a placeholder for an empty hash while comparing two hashes.


texts:
I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a keygen and I can generate as many keys as I like then anyone else can do that too, but solving this by requiring a long "private key" there occurs another problem.

Usually serial codes are supposed to be short and easy to type but even the shortest Elliptical curve signature algorithm has a signature size of 160-bits which could not possibly fit into the 100 bits I have. Is it possible to use a threshold approach?

I have seen many similar questions (please do not mark as duplicate) but none have answered my main question as to how can you treat the serial code as a signed document if the length of signature is at least 60 bits more than the maximum allowable size of a serial code?

Could you please give a deeper insight on my question and bare with my lack of knowledge in many areas? Thank you.


texts: What is the best algorithm for compressing a hash?

texts:
What is the best way to transform a hash with a longer length into one with a smaller length, preventing as many collisions as possible? (Hashing the hash)

For example: Some versions of Git use SHA-1 for hashing commits. Of course, 15ce7ff90976b3e43738be403f5c985377646bb3 is rather large to display on a screen. Because of that, Github usually only shows the most significant 4 bytes (15ce7ff9) to refer to a specific commit.

But is this the best strategy or is there a better way? If SHA-256 was used instead of SHA-1, would the resulting "minified" hash be as secure and as colision-avoiding as possible within 4 bytes, regardless of the "minification" algorithm used?


texts: What are the implications of an encrypted private key being released?

texts:
An application owner at my organization requested a java keystore to be built around specific parameters and provide them with both the JKS and pkcs12 versions of the keystore.  Weeks later and after many changes they were troubleshooting some issues.  The application admin, not thinking of the security implications, blasts an email with the output of the OpenSSL command: pkcs12 -info -in .

In the output of that command the first key listed shows.

-----BEGIN ENCRYPTED PRIVATE KEY-----
blahblahblahblahblah
-----END ENCRYPTED PRIVATE KEY-----

To me this looks nuclear and appears to expose the private key.  My recommendation initially is to burn the entire keystore and start over rekeying everything.  As this is a significant amount of work I wanted to be sure my reaction was accurate.  It does say Encrypted so perhaps as long as the password is still secure maybe we're okay?  I'm pretty solid on OpenSSL and keytool but this slips past my expertise.  Can anyone here help me define the exposure for my mangement?


texts:
Could you confirm whether my understanding of the SHA-1 collision issue is correct?

If for certificate $A$, the message digest equals to $X$ and a Root CA signs it with its private key everyone can verify its authenticity by decrypting the signature with the public key that is pre-loaded in to the browser in form of a X.509 certificate, correct?

So given the hash value of $X$ over the certificate and while not knowing the private key that signed the hash,  I know that the final result (signature) = $Y$.

I compute another certificate (with the Issuer filed set to the Root CA that signed the real certificate) so that it’s hash value will as well = $X$. So with two different certificates (data input) we were able to get the same hash (collision occurred).

I still don't know the signers (Root CA that signed the original certificate) private key, but I know that the hash value of $X$ signed with his private certificate = $Y$.

I take my fake certificate and try to impersonate the legit  website. I "steal" e.g. copy the signature (bytes) from the original certificate and send them along with the fake cert to the user/browser when the connection is set up.

Now, the browser will run few checks. It will, try to decrypt the signature with the public key that is wrapped in the X.509 certificate that is pre-loaded in to the browser.

Because we assume (we hope) that our hashing algorithm is collision resistant, the public key decrypts the signature and the browser is able to calculate the same hash value, hence proving the authenticity of the certificate and that it was not changed during transit.


texts: Is the following key stretching algorithm as memory hard as I think it is?

texts:
I'm having some fun designing a key stretching algorithm that can be implemented in pure Python. It's built entirely out of the standard library's hash functions in an attempt to at least wrest some speed out of this particular language.

I came up with the following construct for mutating memory. Given a hasher initialized with a key, and a zero initialized array of hash-digest sized memory cells:

Pick a random location in the memory cell based on the low bits of the current hash digest.
Update the hash with the data at the picked location.
Update the memory cell with the new hash digest.

Ignoring the memory cells, at the very least this stretching algorithm ends up feeding the hash function with N values (zeros or previous digests). My question is in regards to the amount of memory required by a brute force attack on the key. Intuitively, it seems to me that any algorithm that wishes to find the digest after the last iteration of the above loop needs to invest in at least enough storage to hold all cells that have been modified. The reasoning is that the last cell that is fed into the hasher is not known until the second to last cell is processed, and so on. Does this logic hold up?

I'm also assuming the low bits of the hash functions (specifically sha256/512) are of sufficient quality to be used as shown. Is this a fair assumption?

Edit: Regarding initialization and number of iterations

It should be obvious that if the number of total iterations is so low that there is a substantial amount of empty cells, an attacker can easily conserve memory by storing modified values only.

At first I did consider initializing the memory array, as suggested by Thomas, for example with a series of digests or cheap random data. But it occurred to me that this doesn't actually thwart an attacker with an excessively high rate of calculation vs memory. Since the array is predictably constructed, the attacker can simply store the current state of initialization av various stages, for example for every 100 kb of data. Then, whenever access is required to a cell that has not been modified since initialization, at most 100kb of data needs to be re-calculated.

So, the way I see it, there is no point in using anything but the fastest possible way to initialize the array as it must be assumed an attacker can get away without storing any initial values anyway.

The entire point of the algorithm is to do continual mutations and nothing else, hopefully leaving less and less room for shortcuts as the array fills up with values that forcibly must be stored. As very clearly pointed out by Thomas below, this establishes a strong correlation between the amount of memory that can be used and number of iterations.

So, given the condition that the number of iterations must be large enough to properly seed the array, does the algorithm hold up?


texts: Choosing between additive or multiplicative group for Diffie-Hellman

texts: I am trying to construct a theoretical Diffie-Hellman key exchange protocol. However, i cannot understand the difference between choosing an additive group or a multiplicative group. I believe an additive would make it much more simple, but would a multiplicative group make it more difficult to break? What would be the difference between the use of those 2 kinds of number groups?


texts:
I'm developing an application to run elections. A voting system. I would like to give the ability to the voters to check later if their vote were correct computed/casted.

assumptions:

each user has its own and unique voter id (64 bytes id)
we have the birthyear of an user (i.e 1977, 1982, etc)
the user must vote in N candidates (each candidate is represented by a number. candidate_1, candidate_2, candidate_N stands for numbers like 10,33,N)
in an election you must vote in N candidates, where N is >= 2.
votes are inserted in random order (they are not sequential)

As soon as the user has voted in his N candidates, it will be stored in a DB in the following format:

sha256(sha256(voter_id | birthyear) | candidate_1 | candidate_2 | candidate_n)
the chosen candidates (a list of candidate_1, candidate_2, candidate_N)

for example

the user 12345678, borned in 1980, in a 3 candidates election voted in the candidates 10,11,33.

we would compute his signature hash as:

Digest::SHA256.hexdigest(Digest::SHA256.hexdigest("12345678|1980")+"10|11|33")

in the db it would looks like:

64d2dc73485ca4d26b6dfcd517849e9654c6b8f2b7ef386dc2055fcbec2f034b,"10|11|33"

The hash signature would be printed after his votes were casted. So he could then:

a) compute it locally and see if its matches

b) via an user gui, entering his voter_id, birthyear, candidate_1, candidate_2, candidate_n, calculate his hash and look up the DB and see if his votes were rightly computed.

Important: its not the same as Approach towards anonymous e-voting. I'm not trying to provide anonymity, but a way to the user validate if his votes were casted right.

the questions are:

a) Is that a good approach to garantee the integrity of the casted votes? is that enough?

b) why wouldnt it be enough to garantee anonymity? please assume that the votes are shuffled and inserted in random order.

c) is the birthyear an strong enough salt oder would be better the whole birthday dd-mm-yyyyy to increase the numbers of possibilites? I cannot let it up to the user decide, otherwise it would introduce a complexity/time in the human interaction with the system (think about which string, ask for help and etc).


texts: RSA generation of private key using public key

texts:
In RSA private key generation

e*d ≡ 1 mod φ

e is public, also n is public. How to prove mathematically, generation of private key d is not possible using the same equation and public key e


texts: What's the best block cipher mode of operation for RSA?

texts:
I know that you should never use RSA with any block cipher mode of operation, but theoretically, what's the best block cipher mode (safest) we can use with RSA encryption - without adding any kind of padding?

I already know that CTR is not the best choice and that ECB with RSA and without padding is a really bad idea cause we can see the repeated blocks, but between CBC, CTR, and OFB, I can't understand what would be the best choice.


texts: What is the NTRU parameter equivalent to security level 112, 128 and 192?

texts:
I came across this paper which mentions this table, which states that NTRU 347 is equivalent to 112 bit security level

However, in this paper, Choosing parameters for NTRU mentions that NTRU-401 is equivalent to 112 bit security

Thus, I would like to ask what parameter of NTRU is equivalent to 112, 128, 192 bit security level


texts: Why do we use multilinear maps for obfuscation?

texts: I have recently developed interest about obfuscation, and I see that (all?) the proposals use multilinear maps. What's the reason to this? As I also that many of the multilinear map proposals get broken too. Are there any other approaches to achieve obfuscation, that use other mathematical structures?


texts: I was wondering what will happen if I use the Shamir Secret Sharing scheme with $P$ not being a prime, let's say it is $255$. An adversary which holds $k'$ shares ($k'<$ threshold $k$  ) can attack the scheme and find the secret $S$? If he can attack the scheme, how the attack works?


texts: What does a "cycle" mean in cryptography benchmarks?

texts:
In this table of the "Crypto++ 5.6.0 Benchmarks", for example, cryptographic algorithm performance is measured in cycles per byte for symmetric ciphers, and in cycles per operation for asymmetric ciphers.

What does "cycle" here mean, exactly? And does one AES or RSA decryption always need the same amount of cycles, or can it be different every time?  (If it's always the same number of cycles for a cipher, then the time needed to decrypt must always be the same for different ciphertexts.)


texts: Is modular Barrett reduction usable for Ed25519?

texts:
I currently try to implement Ed25519 following this draft. I have implemented every field operation except the reduction by the group order $q$ (in chapter 5). I looked for a reduction algorithm and found montgomery reduction and barrett reduction. Because Barrett reduction seems to be more fitting I tried to understand how to implement it (mainly using this).

What I don't understand is how I can reduce a SHA512 hash by $q$, as the maximum possible value to reduce is ca. $2^{504}$ ($q$ is $2^{252}$, meaning $q^{2} = 2^{504}$). Is there a trick to reduce it in a step before that (like in curve25519 with $2^{256-38}$) or is Barrett reduction simply not usable here? (I don't necessarily need the fastest method available, a simple working one would be enough.)


texts: IPSec like strongSwan can be configured to do rekeying after time or bytes transferred or packets transmitted. Is there any recommendations to set those settings? Maybe according to algorithms used?


texts: How do applications set up secure communications through an untrusted middleman?

texts:
I recently discovered Tox whilst looking for alternatives to Skype, and while the Tech FAQ goes into some details about algorithms used, etc. I don't understand how keys are securely exchanged.

I understand that at least the following takes place:

Asymmetric keys are used to exchange a symmetric key.
Symmetric keys are used for exchange of chat messages.

From reading this question, it seems that it's not possible to establish such a communication with no prior shared information. With that being the case, it seems that the user id (which is quite long) is the only piece of information shared between clients before establishing communication through the interim untrusted server. I assume this is used in some way to prove the identity.

My question, therefore, is how are symmetric keys exchanged in such a way that the interim server can't perform a MITM attack (by presenting itself to Client A as Client B, and by presenting itself to Client B as Client A)?

If my question has been asked before, please feel free to flag it as a duplicate.


texts:
Let's assume that we have a secure PRNG. Is it "safe" to initialize it with password, or seed based on a password like SHA256(password)?

If yes, is it "safe" to generate an RSA or DSA key from it?

The idea behind this is to initialize a PRNG with a password, then use it to generate RSA or DSA keys. So, the scheme will always generate the same prime numbers when generating private keys, meaning that you would not need to store your private key anywhere but would instead regenerate it each time it was needed. Only the password would need to be stored (or remembered).

UPDATE: Obviously this scheme would inherit the general risks of bad password choices, but how about a password requiring a reasonable range of characters. Alternatively, one could use 2 passwords, where the system uses the 2nd password as the salt of an PBKDF2 calculation.


texts: Determining the Shamir's secret sharing scheme for the following problem

texts:
I'm having trouble solving the Shamir's Secret Sharing scheme for the following problem that states:

  Problem: A certain military office, which is in control of a powerful missile, consists of six generals, five colonels, and four desk clerks. Describe how they would set up a Shamir scheme so that any five generals or any set of four colonels and three desk clerks or any three generals and three desk clerks can launch the missile.

I was thinking that this looks like the Shamir's scheme definition where the secret S was divided among the three groups( $n=3$? ), and so I need to describe the process of obtaining the threshold scheme $(k, n)$, the $k$ shares from the given problem? Or am just confusing myself further. Any help of approaching this problem would be helpful.


texts:
I have a simple calculation. Its inputs should be very hard to discover, but I want to be certain, hence the question.
Start with value $A$, a known 1024-bit number.
Input $I_1$ and $I_2$ are 512-bit numbers, and their hashes are known as $h_1 =Hash(I_1),  h_2=Hash(I_2)$.
Output $O$ is the result of $O=(A\cdot I_1)+I_2$.
Given $A,O,h_1$, and $h_2$, is it feasible to brute force $I_1$ and $I_2$?


texts:
Suppose we have a RSA-type Modulus $n = pq$ with $p,q$ prime. We also pick a random public exponent $e$ with $\gcd(e,\varphi(n)) = 1$ and compute the private exponent $d$ with $de \equiv 1 \pmod{\varphi(n)}$. $(n,e)$ is the public key, $(n,d)$ is the private key. Just like RSA, so far.

Now we encrypt a message representative $m$ with $0 \leq m < n$ by applying the following steps:

Choose a random $r$ with $1 \leq r < n$
Compute $y = (r^e)^e \pmod{n}$
Compute $z = (r \cdot m)^e \pmod{n}$
$(y,z)$ is the Ciphertext

How is it possible to decrypt this cipher using just the ciphertext $(y,z)$ and the private key $(n,d)$?

Here's what i have so far for the decryption algorithm:

Compute $r = (y^d)^d$
Compute $rm = z^d$
Find the multiplicative inverse $r^{-1}$ of $r$ modulo $n$
Compute $m = rm \cdot r^{-1}$

The problem with this is, that $r^{-1}$ only exists, when $\gcd(r,n) = 1$ and thus the decryption fails, when this is not the case. Is there a better way to do this?


texts: How does the Blowfish algorithm key initialization work

texts:
I'm having some trouble understanding the Blowfish encryption algorithm.  From the Wikipedia article...

  The secret key is then, byte by byte, cycling the key if necessary, XORed with all the P-entries in order

Can someone explain this in more detail?  For example, the first few P entries are 0x243f6a88, 0x85a308d3, 0x13198a2e, 0x03707344,...

Supposing the secret key is abcd, how would I implement this part of the algorithm?


texts:
Can you think of any solution to this problem? suppose we have three parties, A, B and C:

A has some data signed by C, a small part of which (not the signature) it wants to hide from B.
A wants to prove to B that the data (including the hidden part) has been signed by C. (B can't just verify the signature normally since some data is hidden).
B knows most of the data and the signature but not the hidden part. B doesn't want to know the hidden part, for him it's enough to know that the rest of the data is what it expects and that all of it was signed by C.
C won't cooperate for this in any way (other than originally signing the data including the hidden part); A and B are on their own.


texts: Relation between encryption algorithms and (password) hash functions

texts:
This is a really basic question.
Blowfish is not seen as a secure cipher.
but bcrypt is one of the most secure hash functions.
So first: How can a hash function be based on an encryption algorithm, after all these two things have little to do with each other?
Second: If blowfish is insecure and bcrypt is based on it, how can it be secure ?
And just a little question regarding bcrypt: In Linux-based operating systems the code for hashes is

 $1 – MD5
$2 – blowfish
$2a – eksblowfish
$5 – SHA-256
$6 – SHA-512

With "blowfish" they actually mean bcrypt, right?


texts: I am implementing a security protocol based on discrete log. I came across the equation $p = kq + 1$. Understand that based on number theories that both $p$ and $q$ should be large enough to be "safe". However, how does it justifies safe? Say I chose $p = 7$, $k = 2$ and $q = 3$, will my implementation be screwed up?


texts: Intuition behind the asymmetry between invertibility of key and ciphertext in block ciphers

texts:
I have studied the design of block ciphers like DES and AES.

I know the actual algorithms, but I don't intuitively "grok" the most important property of them:

The most important property, is that if you have the key and the ciphertext, you can calculate easily the plaintext, but if you have the plaintext and ciphertext, you cannot easily calculate the key.

That is, the block cipher is a function $$f(P,K)= C$$ and the essential property is that the inverse w.r.t. P is very easily caclulated, but the inverse w.r.t. K is not.

I don't intuitively understand why this assymmetry is true, even though I know how to actually do the decryption algorithm. Is there an intuitive explanation of this asymmetry?


texts: Symmetric encryption with compression for MySQL DB data

texts:
I would like to compress data before encrypting and storing it in a MySQL DB to reduce especially bandwith requirements (compression reduces bandwith by 70-80%). At present, all is handled by a server-based script. In the future, the DB may also be accessible via a web interface.

Various comments on the insecurity of compression plaintext prior to encryption, related to security breaches such as CRIME or BREACH, make me unsure of how to do this. Also, some argue that compression prior to encryption is actually good security practice. I realize that attacks such as CRIME or BREACH are specific scenarios, but I am concerned that my application might be too close (or eventually come too close) to a similar scenario where compression may pose a security risk (DB contents can be stolen, server compromised etc). I am also not enough of an expert to fully understand all the aspects, details and nuances of CRIME or BREACH.

After reading this discussion on the topic, with the recommendation to pad the plaintext with a random nonce before compression, I wonder if the following implementation (in PHP) will safely do the job:

    $plaintext = gzcompress ($plaintext . openssl_random_pseudo_bytes (64));
    $cipher_text = openssl_encrypt ($plaintext, 'aes-256-cbc', $key, 0, $iv);

Data integrity is ensured through an HMAC signing / verification procedure on the cipher text and key.

Am I understanding the issue correctly?

Is this a safe implementation?

Would there be any benefit in the nonce being of random length, and then adding the length information to the end of the padding in order to remove the padding after decryption? Or should the length of the nonce be in relation to the length of the plaintext (which would typically be at least 512 bytes)?


texts: How should I interpret this note on diffusion of the internal state of a PRNG?

texts:
This question is about Tyche, a non-cryptographic PRNG. While the PRNG is not cryptographic the analysis and this question surely is heavily involved with cryptography, so I think it's on-topic here.

In short, Tyche is a nonlinear PRNG based on the ChaCha quarter-round function. The state (4 words $a, b, c, d$) gets mixed using the $MIX$ function (which is basically the ChaCha quarter-round), and then a part of the state gets returned. This is the $MIX$ function in pseudocode:

MIX(a, b, c, d):
    a = a + b
    d = (d ^ a) <<< 16
    c = c + d
    b = (b ^ c) <<< 12
    a = a + b
    d = (d ^ a) <<< 8
    c = c + d
    b = (b ^ c) <<< 7

Later the authors propose a faster variant (due to instruction level parallelism), where the inverse of $MIX$ is used, $\textit{MIX-i}$:

MIX-i(a, b, c, d):
    b = (b >>>  7) ^ c; c = c - d
    d = (d >>>  8) ^ a; a = a - b
    b = (b >>> 12) ^ c; c = c - d
    d = (d >>> 16) ^ a; a = a - b

Then the authors note the following (emphasis mine):

  The downside, however, is that $\textit{MIX-i}$ diffuses bits slower than $MIX$
  does: for 1-bit differences in the internal state, 1 $MIX$ call averages
  26 bit flipped bits, while $\textit{MIX-i}$ averages 8.

I don't exactly know how to interpret this note.

Why is this a downside?
Does this mean the quality of the PRNG is less?
By default the initial constant state (in $c$ and $d$) gets mixed with the seed (in $a$ and $b$) using 20 calls to $MIX$. Does it need more iterations to initialize the PRNG when using $\textit{MIX-i}$?
It surely can't affect period length since it's the inverse, right?


texts: What schemes support atomic decryption+reencryption

texts:
What encryption schemes support this workflow?
Vendor encrypts and publishes information for the client

Client generates public and private key
Vendor encrypts private information
Vendor publishes that

ENCRYPT(PRIVATE_INFORMATION, CLIENT_PUBLIC_KEY) --> Publish

Client re-encrypts for benefit of a third party

Client generates re-encryptor using its own private key and third party's public key
Client publishes that

CREATE_REENCRYPTOR(CLIENT_PRIVATE_KEY, THIRD_PARTY_PUBLIC_KEY) --> Publish

Third-party decrypts data

The third-party decrypts the data

Other people

Nobody can decrypt PRIVATE_INFORMATION unless they have the THIRD_PARTY_PRIVATE_KEY or CLIENT_PUBLIC_KEY.

I know that the asymmetric scheme supports most of this workflow. However, it violates requirement 7. Is there another scheme that fully supports this workflow?


texts: Symmetric encryption construction (meet-in-the-middle attack)

texts:
This is a question I had from an exercise session.

First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$.
Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC decryption mode with a secret $IV_2$ and key $K_2$.

Is this construction safe against meet-in-the-middle attack?

Wouldn't the first two operations negate themselves because $C_1$ would decrypt into $P_1$?


texts: Generating RSA keys with plain and ciphertext

texts:
I have plaintext and ciphertext. Is it possible to generate an RSA key pair that encrypts the plaintext to ciphertext and decrypts ciphertext to plaintext.
I don't need to find the original key pair used, but any key pair.


texts: Checksum for bailing early on first corrupt byte in stream?

texts:
Suppose you want to transmit bytes of a file from computer a to b, but you want to bail early if any of the bytes are wrong.

It’s easy to prescribe a hash/checksum implementation for the entire file. For example, sha-256 is probably sufficient and only requires 256 extra bits to be transmitted, and for any file of significant size, 256 extra bits are negligible.

But if you want checks at multiple points during the transfer, so you can bail early, I assume the cost of transmitting hashes grows as the interval of checking approaches checking every single byte... unless I am missing something clever, I think that it becomes hard to justify.

Do you know how others have dealt with this issue or have any advice? Maybe there is no clever way around it and you must just choose a reasonable compromise, like one hash per every megabyte?

(My application is that I want to build a small/safe virtual machine + language that implements arbitrary compression/decompression algorithms to produce files. For decompression, I would like the machine to halt early if any unexpected bytes are emitted. )


texts: Secure and deterministic MACs which are not strongly secure?

texts:
One of the practice problems I was given for an exam that I'm preparing for is as follows:

  Let $\Pi$ be a secure, deterministic MAC that uses canonical
  verification. Show how to construct a MAC $\Pi'$ that is secure and
  deterministic but is not strongly secure.

In my book, it says that if a MAC uses canonical verification, then it is a strong MAC. This seems to suggest that $\Pi'$ should not use canonical verification.

By the definition of a strongly secure MAC, for our construction, an adversary should be able to generate a new valid tag on an existing message-tag-pair that it has seen before. However, if the MAC is deterministic, doesn't that mean that each unique message only has one valid tag?

How do I approach such a construction? If all deterministic secure MACs can use canonical verification, and all secure MACs that use canonical verification are strongly secure, then doesn't that mean that all deterministic MACs are strongly secure?


texts: Clarify EC point addition and multiplication

texts:
Please clarify the below doubt regarding EC point addition and multiplication:

$P$-Generator Point; $a$ and $b$ are integers; $X$ and $Y$ are EC points, defined as follows:

$X = (a*P) + (b*P)$
$Y = (a+b)*P$

Questions:

Are the points $X$ and $Y$ equal?
Does computing $X$ take 1 scalar point multiplication (i.e. 0.5 + 0.5), whereas computing $Y$ takes 0.5 scalar point multiplikations?
Does $(a*b)*P$ take 1 scalar point multiplication?
How can an EC-point computation be (equal to?) 1 or 0.5 scalar point multiplications?


texts: I understand DH and ElGamal and RSA encryption/signatures.  But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air.  I can verify that the algebra used in the verification formula does in fact work out, but I have no clue why forgeries are hard, why these formulas were used, why something simpler wouldn't work, and where the inventor(s) got all this stuff.  Can someone explain the intuition behind ECDSA?


texts: What is the advantage of a probabilistic PKC over a traditional PKC?

texts: While reading through a textbook, I came across the idea of a probabilistic public key cryptosystem, which uses a probabilistic TM to generate the public encryption and private decryption algorithm; it is possible the encryption algorithm is probabilistic. If the encryption algorithm were not probabilistic, would the PPKC have an advantage of a traditional, non-probabilistic PKC? Can a traditional PKC offer a probabilistic encryption algorithm?


texts: Why is data signed with SHA256-RSA-PKCS and digest signed with RSA-PKCS different?

texts:
I need to sign some data using RSA. I have the digest that I can sign but the signature turns out different from the signing source data.
There is data in data.bin and its sha256 digest in digest.bin
$ xxd -p -c32 digest.bin
19d512fc649e1668eb84741284ad95ec03f3225719a83e40389dbade4eabe5ed
$ sha256sum data.bin
19d512fc649e1668eb84741284ad95ec03f3225719a83e40389dbade4eabe5ed  data.bin

Why is the signature different when signing data using SHA256-RSA-PKCS and when signing a digest with RSA-PKCS? In both cases, the same sha256 digest should be created and then signed.
$ pkcs11-tool --module /usr/lib/libIDPrimePKCS11.so --pin=$PIN --slot 0x11 --sign --input-file data.bin --mechanism SHA256-RSA-PKCS |base64 -w0
Using signature algorithm SHA256-RSA-PKCS
N4XkgBhyu5fAFTSraEj4RlKeyKy2fyUD4kv9QgBVmRl/u0jDYuPdQ/Gr0Hf2wRD8B3AWe98Y3WWtv5/c2NILosG5VzqrQEKVFKLCLkdpV7cQoSDkzAv0YjRRWKMJPr1Y9Vwi15yua17W8JqnqAc0D/Mda68qgugxgCzfwC+BkWnjsN3EaxixIzwZ9aMbfuBbA8R/+uRZMdPHc6w/aFIhSM9sS3jyeb2ZYy7semPlFMAx1BQx4C2uGlEW5GI7BCq1sTCchuB0baR4WX+yoHp+bRsJHWjEcXmgFloxfb6k0n3rvZOZboO0h9UPbxlxFxHou1v6UqymNgnt+oC1KkclRQ==

$ pkcs11-tool --module /usr/lib/libIDPrimePKCS11.so --pin=$PIN --slot 0x11 --sign --input-file digest.bin --mechanism RSA-PKCS |base64 -w0
Using signature algorithm RSA-PKCS
RseZYWjkyNRcU1lI1KR+I+0C1jC+FVp2kTAhyOUsE2x6UGf+UMSf3kqD4KGBb+eIryXDFTzNsdo8XroUtWvYQvHgPLPaRQ8xfPtTOZS/crQY168S2lk4buAeDZWat/xiGeXgU4rL7hdbjojdkfbeGWHfIERcese6wv521t9x9w5K3XGz50Ec9Y/C4cPPo4xuQMSQlCrx1iIlfeGbkElxGIdIkZvt2nTrhl/ico5YCbTJfuDqZaaaJxPkXcfgAcvFVU/kILi7U3XQCvz7zohZoRj4vkeTutanW6I7qGyWvIcxXGJx29MInF3pohT0+KUzegN4A1GfkW5hfk5HyCP2Gw==

public key is
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwzz8XZ5iDjWlLZOfXgzh
VsyFcx85QEhgrcJJXkFV2k+vmVUA1R4oZPuvE+cF13ymh05+GLM0OHHzrohSrbv9
3AUmkWLPY04jF0NXSEAd180ImJ84Y2lSaqo4op+l3cPjIWeeBN0DPX78GdLGJnIr
Fq51TwKcdtjgQMvfWDuxZbjo2C20QQIIzp0cWGTsWOBFamjOJGhfRcQ/TT4MDA2h
//813N2HqXnlAtEgvlLH1Jv+VNROd/WIN+CMo0NLDQGS0AhVZPctatNqH5mXwklZ
goyv62WY284EIZLC1nTgMWxdQQIR6yRyJmQwp7zLs/Fk9rYZDHEOTuILEHd/7dPB
7wIDAQAB
-----END PUBLIC KEY-----


texts:
Is it possible to implement blind signatures with purely hash-based signature algorithms?

Any whitepapers, code samples, etc on the subject would be helpful.


texts: Key management and derivation - Allow changing of the passphrase

texts:
I'm working on a program, which allows encrypting files before storing it on a cloud service. Currently I'm trying to figure out how to derive and store the keys.

First, I wanted to use a simple passphrase from which the file encryption keys are derived using PBKDF2HMAC and a file specific random salt. This helps providing unique nonce/key pairs, which is required for GCM mode.

Now one additional feature would allow changing the passphrase without re-encrypting and re-uploading all files. The new key derivation would look like this: The passphrase is used to generate a decryption key, again using PBKDF2HMAC with salt. This key can be used to unwrap a master key file, which is encrypted and authenticated using AES-KW. This master key is randomly generated and matches the key size used for file encryption. To generate unique keys for every file the master key is then XORed with a file specific random salt, which acts as a one-time-pad. To change the passphrase one would unwrap the master key and wrap it again using a different passphrase. I know that this technique does not allow revoking passphrases. Any previously used passphrase and master key file can still be used to decrypt the data.

While I am quite sure, that this method is secure (given that all random generated keys and salts are truly random) it seems a bit complex. Is there a reason to avoid the obvious extension to the first method? That is: Changable passphrase decrypts random master passphrase (using GCM mode), which again decrypts the files.


texts:
This is for a distributed system: we don't want to have
to maintain synchronization of random streams neither
enforce uniqueness of pads because this would require some synchronization.

Alice and Bob met once.
They agreed on a secret (S) and a symmetric cipher (C).
Let's assume S is 128 bits in length.

Then, they want to communicate in the following way.

Alice want to send a message (M) to bob.
Alice generate a random number (R).
Let's assume R is also 128 bits in length.
She symmetrically encrypt R using S and C.
This become the message header (H), also 128 bits long.
Then, she use R to generate the pad for M, using
a cryptographically strong random number generator.
The generator she uses must be non repeating: it will
never produce the same output twice.
She obtain (M'), the encrypted message.

Then, Alice send to Bob the concatenation of H and M'.

On his side, Bob will first decipher H to generate the pad to decipher M'.

I think the risk of reusing a pad is only 1/(2^256),
which looks terribly small.

Let's say that if Alice and BOB want a MAC, then they
agree on a second secret and a MAC scheme and will
encrypt concatenate(MAC(M),M) instead of just M.


texts: Why is this functionality chosen for UC-NIZK?

texts:
A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness.

And, let's say P is a party which has does not have a witness, it can send an arbitrary string. And this proof might get accepted if the adversary has knowledge of the witness.

This functionality according to me does not capture completeness and soundness! Am I missing something?


texts: How does the Rijndael 192/256 bits block size mix column works?

texts:
I am quite comfortable about the 128 bits block size mix column operation, the maths behind it and how to implement it.

However, what about the 192 and 256 bits block size? I can't find any paper describing it.

Do you simply do two times the operation? For 192 one full time and one with half the bits being set to 0 as place holders, and two full time for the 256 bits block size?


texts:
For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol.
Unfortunatly it doesn't exist in nist sp800-56a standard (while c (1e, 2s) ka protocol is defined)

So i have a double question:
- what may be the reason for this specific miss in nist standard where all other combinations c (xe, ys)  for ka protocols (with x&y <=2) are specified ?
- does it have a sense to derive a c (2e, 1s) ka protocol from nist existing c (1e, 2s) ka protocol ?


texts: Example of an attack on a message exchange which uses the homomorphic property

texts:
Can someone give me an example of an attack on a message exchange using this encryption scheme, that uses the homomorphic property?

In my opinion, Existential forgery under directed message attack uses malleability. Can someone explain it in more detail?


texts: Unclear about the importance of Initialization Vectors

texts:
I was reading about Ruby ciphers and found this:

  Although the key is generally a random value, too, it is a bad choice
  as an IV. There are elaborate ways how an attacker can take advantage
  of such an IV. As a general rule of thumb, exposing the key directly
  or indirectly should be avoided at all cost and exceptions only be
  made with good reason.

What does this mean?


texts: Adding the same noise to all element of a vector is Differential privacy

texts: In Differential privacy, if we add a $N$-dimension private vector with $N$-dimension Laplace or Gauss noise, we obtain differential privacy. However, if we only generate a 1-dimension noise to add it to all element of private vector, can we obtain differential privacy?


texts: Can a LFSR has more than one repeat cycle?

texts: It's clear that an LFSR has finite states and eventually will end up with repeating cycle. However, is it possible for an LFSR to have more than one repeating cycle? For example, with initial state $A$, its goes to cycle $C_a$, and for initial state $B$, it ends up with cycle $C_b$.


texts: Proving HMAC collision probability bounds?

texts:
Could someone point to results or proofs about the probability of $$HMAC(k, m_1) = HMAC (k, m_2)$$ assuming the underlying hash function is SHA-256? Would those probabilities be higher/lower if $m_1$ and $m_2$ are not independent?

Please don't point to birthday attack results. I am only interested in the probability that the tags are equal given two messages (random or not) and a single key.


texts: Point addition equation in projective co ordinates

texts:
How can I get point addition equation for elliptic curves in projective co ordinate system? Can I get it by changing $$ x = X/Z $$ and $$ y =Y/Z $$ in the equation for affine co ordinates' group law?

I have done it using the above narrated step and made the denominator as $ Z $ in equation for binary super-singular curves. Unfortunately I am not able to get the correct output. I have used the equation $$x_3 = (y_1 +y_2/x_1 +x_2)^2 + x_1 + x_2$$
$$y_3 = (y_1 +y_2/x_1 +x_2)(x_1 +x_2) + y_1 + c$$ for the curve $y^2 + cy = x^3 + ax+b$.


texts: Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

texts:
I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it.

The attack in question uses a custom-developed decryption oracle on an external system that uses the same parameters as the ones used to create the encrypted message. For example, if the message had been generated using an open source library such as Libsodium, which the adversary utilizes to create an automated oracle on their own hardware.

Scenario

Two encrypted messages sent by Alice to Bob are intercepted by Susan. The first was encrypted an AEAD mode of operation (say AES GCM), whereas the second utilized an encrypt-then-MAC flow (say AES CBC + SHA3).

Susan is fully aware of the cryptographic implementation (i.e. algorithm and mode of operation, MAC, open source library and version used).

Question

Is it possible for Susan to create her own decryption oracle to decipher the plaintext messages with her knowledge and access to both the message payload and implementation library?

Would this oracle be successful against an AEAD algorithm?

Would this oracle be successful against an encrypt-then-MAC implementation? In my mind, the adversary could simply ignore the MAC. I am especially curious of how one would protect AES CBC against a padding oracle attack in this scenario (if it is a valid one).


texts: Is including the key as AAD actually dangerous?

texts:
In a recent answer, Maarten mentioned

  including the key is a bad idea as well.

This got my curious. Is there any scientific / cryptographic analysis whether including the key in the authentication actually allows for (easier) attacks in the standard model(s) for authenticated encryption?

Obviously this means that both sides include the key in the AAD but don't send it in clear.

I also see that it's kinda pointless to include it, but is it actually dangerous? (less formal than above)

If no generic answer is possible, please assume AES-GCM as the scheme in question


texts: Implementation of Leighton-Micali Hash-Based Signatures

texts:
I am trying to follow the RFC instructions but am not sure if I understand it. In the RFC there are also some test cases given, although my implementation yields different results.
Test Cases: https://tools.ietf.org/html/rfc8554#appendix-E
How is the SEED for private key generation used? It is stated, that LMOTS private key generation creates a 32B SEED at the start of the process, although does it create a new SEED for every new key from 0 to q=2^h-1?
The I value seems to be a constant 16B value generated only once for a given keypair.
In the test case 2, for
I=d08fabd4a2091ff0a8cb4ed834e74534
SEED=558b8966c48ae9cb898b423c83443aae 014a72f1b1ab5cc85cf1d892903b5439
the resulting public key is
K= 32a58885cd9ba0431235466bff9651c6 c92124404d45fa53cf161c28f1ad5a8e
although it is not stated for what q the LMOTS public key is generated, or does it mean, that this public key is the LMS public key, which is the root of the tree created by leaves of LMOTS public keys K? In this case this "K" is the "T[1]" value?
I have a slight problem using the reference implementation, as it is created for HSS. Do you know how can I force it to use only LMS?


texts:
from Can I clone a LUKS container?

  You can, but it breaks security, because the cloned container has the
  same header and hence the same master key.  You cannot change the
  master key on a LUKS container, even if you change the passphrase(s),
  the master key stays the same.  That means whoever has access to one
  of the clones can decrypt them all, completely bypassing the
  passphrases.

From What users should know about
Full Disk Encryption based on LUKS

  If  we  set  a  new  secret user key, the encrypted master key stored
  on disk changes but the master key does not. Hence, users can change
  password frequently without re-encrypting all the data.

My questions:

If we can have up to 8 slots for decryption does that mean we have 8
corresponding Master Keys split in anti-forensic stripes or is it
still ONE MK ?
If it is ONE MK how the passphrase from slot 2 decrypt it when it is already encrypted with the passphrase from slot 1 (yes I know it
is not the passphrase itself, but I keep it like that for
simplicity).
Regarding the second quotation. So per my understanding while changing the LUKS passphrase we first provide the current
passphrase, we then provide a new one and that changes the encrypted
representation of the MK but after decryption it is still the same
that was randomly generated during first initialization, correct?
Then regarding the first quotation. I simply don't get it, at least notthe last sentence

  That means whoever has access to one of the clones can decrypt them
  all, completely bypassing the passphrases

Does that mean that if a have server A with LUKS encryption protected by a high-entrophy passphrase and clone that drive I would be able to decrypt that drive without even knowing or having to provide that passphrase ? If yes how would I do that ? Dump the MK from memory on server A, or how ?


texts: Authenticated encryption and file data integrity

texts:
I've got a task to provide the integrity and an authenticated encryption for files in our application. I need an assurance if my way of thinking is correct.

I can't use AES GCM, I have to stay with CBC mode.

File is logicly divided in 5MiB chunks that are going to be encrypted using same key. IV of first block is randomly generated and the IVs of next blocks are going to be extracted from previous block ciphertext.

Here, below I choosed two possible scenarios how to provide an authenticated encryption and data integrity for file:

First option

At first I encrypt first chunk of file with key and recive ciphertext.

Next I calculate hmac(key, ciphertext) and store it to verify during decryption. For each next encrypted chunk of file I create mac with below formula:

hmac(key, previous_hmac || ciphertext)

And store it to verify during decryption.

Is it proper to do it this way? Is it appropriate to store only last computed hmac in this chained hmac version alongside encrypted file, if it's not important which block was violated, for veryfication purposes?

Second option

The second solution I consider, is to calculate:

hmac(key, block_number || ciphertext)

for each chunk of file and store computed MAC alongside each ciphertext for veryfication during decryption attempt.

ciphertext is encrypted file fragment and block_number is constant bit width integer, which value is fragment offset in file.

Is this an acceptable solution? I know it allows to find violated block among unimpaired ones.

I'm not quite sure, which one of given above solutions is better. I would be thankful if someone could give me an advice which one should I chose or propose a better solution. Any links to lectures also would be appreciated. Thanks.


texts: Does the size of data to be encrypted influence the security of Gmac?

texts:
In this link: Has GMAC mode a future outside GCM?, the last comment given by the user Demi, indicates that the larger the size of the text to be encrypted, the lower the security of the gmac.

Why is this happening?