texts: Groth-Sahai Proof of multi-exponentiation

texts:
I want to create a NIZK proof of a multi-exponentiation via Groth-Sahai proofs. In the lectures of Jens Groth in a winter school of Bar-Ilan University, he shows a way to transform multi-exponentiations to paring product equations.

My problem is as follows. Let me take a pairing in the first form ($e(A_j,h^{y_j})$) I need to commit to $h^{y_j}$ as I understand. But I don't know how to prove that I commit the right exponentiation. I think that I just have another exponentiation to prove, since $y_j$ is also a variable -not a constant. Is there a different way to create proofs for multi-exponentiation equations or am I missing something?


texts: Can you hash an ssh key to generate a symmetric password?

texts: Let's say you need a 256 bit password but all you have is an SSH key.  Can you securely transform the SSH key into a symmetric password via a hashing function?  What would be a good choice for a hash function?


texts: Get the parameters of an elliptic curve's equation

texts:
I have a binary signed with ECDSA384 and I need to verify it using a particular cryptography library.
The first thing that needs to be done is to initialize the EC public key, which involves setting several parameters 'manually'. These parameters are the ones that make the following EC equation:
Elliptic Curve equation over $\operatorname{GF}(p): y^2=x^3+ax+b \pmod{p}.$
I need the parameters $a$, $b$, $p$ and $n$. (no idea what $n$ is)
The key I'm using is in PEM format. I'm aware that the EC parameters can be extracted by doing:
openssl ec -in ec384.pem -noout -text

and I get
read EC key
Private-Key: (384 bit)
priv:
    5d:b1:ef:88:fe:7b:f2:af:d8:cc:3a:04:89:09:34:
    15:c4:17:7b:41:72:ee:32:7b:54:9a:e2:aa:fa:1d:
    d1:47:1a:ef:fe:dc:d3:6b:51:fa:bd:c2:5e:66:c4:
    42:d0:16
pub:
    04:5e:ff:47:19:80:be:93:5f:8f:51:14:45:d5:40:
    41:79:ca:48:be:85:97:bd:e2:0f:2b:a0:b2:7d:6c:
    37:74:39:44:ff:50:67:74:30:a8:10:ac:89:a6:6a:
    80:5a:1a:c9:82:ff:2a:51:84:38:c8:f6:af:e0:46:
    e7:9f:d5:66:1b:20:75:7f:87:42:46:d9:6e:12:4f:
    74:38:4d:f4:9f:b1:13:27:9a:10:a8:0c:6b:4b:1f:
    f6:6c:bf:32:ee:a3:10
ASN1 OID: secp384r1
NIST CURVE: P-384

Still, I don't get the parameters I need from that output. It's not very clear to me if these parameters change from key to key or they are inherent to the curve being used, in my case, P-384.
How can I get the parameters I need?
EDIT - might help
Apart from the fantastic answers, I have found this that might help:
The python library ecpy contains this information, e.g:
pip3 install ecpy
python3
>>> import ecpy.curves as ec
>>> ec.Curve.get_curve_names()
['stark256', 'frp256v1', 'secp521r1', 'secp384r1', ...]
>>> p384 = ec.Curve.get_curve('secp384r1')
>>> hex(p384.a)
'0xffff...ffc'
>>> hex(p384.b)
'0xb3312f...3ec2aef'
>>> hex(p384.order)
'0xfffffff...cc52973'
>>> hex(p384.field)  # This is the modulus
'0xfffffff...00ffffffff'


texts: How to generate public key for ATV-FHE scheme?

texts:
I want to implement the ATV-FHE scheme as it is described here https://eprint.iacr.org/2014/039.pdf. How to generate the public key?

Should I compute it as indicated in section 2 :

  $h(i) = 2g(i)*[ ( f(i) )^{(-1)} ]$

or should I sample the public key as indicated in section 3 Parameter selection in NTRU_FHE :

  Recall that for the NTRU-FHE scheme, the public key is of the form $h = 2gf^{(-1)}$  where $g$; $f$ chosen from
  a Gaussian distribution $D$ where $f$ is kept secret. The DSPR problem is to distinguish polynomials
  of the form $h = 2gf^{(-1)}$  from samples $h_0$ picked uniformly at random from the ring $Rq$. If the DSPR
  problem is hard, we can replace $h = 2gf^{(-1)}$ by some uniformly sampled $h_0$.


texts: autocorrelation of non-linear shift register with the period of $2^n$ (full period)

texts:
throughout the question I will talk about sequences in bipolar alphabet, meaning, over {1,-1}.

I have read in the book Shift Register Sequences by Solomon W. Golomb that sequences with the period of $2^n$ can be created by pure cycling register of order n ($PCR_n $). Moreover, it gives some properties about the autocorrelation (that I also read in some papers):
$$C(\tau)= \ \begin{cases}
      2^n & \tau =0 \\
      0 & 0< \tau \le n-1 \\
      \ne0 & \tau =n
   \end{cases}$$

Another statement (and that is where my question) is that $C(n)$ can bound by the number of cycles of the $PCR_n$ (we can denote the number of cycles as $Z(n)$)

Where this come from I don't really understand.


texts: Why is elliptic curve parameter $a=-3$ somehow special

texts:
Considering the equation of the elliptic curves over $GF(p)$

$y^3 = x^2+ax+b$ ,

why is there some magic in using $a=-3$ ? In some well known curves (e.g. P-256) only $b$ is specified, while $a$ ist taken as $-3$. In a software library I use, $-3$ is the default value, what means, that is assumes $a=-3$ if not otherwise specified.

Why is $a=-3$ special?


texts: Is one big file as secure as X small files with the same password?

texts:
Hello people of StackExchange.

It's my first time asking and I know little about Cryptography, so be gentle.
My problem can be simplified to this:

I can create a 2GB Volume that contains 1GB of text files and 1GB of photos. It has the password 123.

Or I can create a 1GB Volume with 1GB of text files with the password 123 and a 1GB Volume with 1GB of photos, again password 123.

It seems to me that it makes no difference in security. If the attacker gets the password he gets all the files. But I may have oversimplified the issue. What's your take on it?


texts:
I am trying to estimate parameters for LWR $(n,q,p)$ instance using the LWE estimator. My $q,p$ are $283,256$-bit prime numbers and I am trying to find required $n$ for 128 bit security.
For this, I need to know the $\alpha$ to be used in the estimator.
In the paper introducing LWR, the authors mention the analogous error rate is of the order of $\frac{1}{p}$.
What is the $\alpha$ I may need to use, is it $\alpha = \frac{1}{p}$ or is there more to that?


texts: Is the following s-box more linear or more non-linear?

texts:
I am trying to figure out whether the following simple s-box configuration I created is more linear than non-linear or vice versa more non-linear than linear?

The parameters for this 16*4 table of 64 values, is it takes any arbitrary 6-bit binary string, and uses the left-most column for the outer-bits (first and last) and top-row for the inner 4-bits as lookup values, to output a 4 bit final value.

Example: a binary value of 101010, starts with 1 and ends with 0 so the third row would be used for part of the coordinate lookup value, and the inner bits of 0101 correspond to the sixth column and point to the coordinate 1111. So an binary value of 101010 would transform to 1111.

This s-box was created using a deterministic process involving XOR and one of the conditions it meets for non-linearity is that each output has 4 pre-images, but I am otherwise not sure if it is totally linear or to what degree, if any, it has non-linearity and other desired s-box properties such as discussed here: Desirable S-box properties

Sidenote: It also has a balanced hamming distance of all values, not sure if that is applicable either helping or hurting it one way or another.

P.S. There have been other questions about s-box linearity but those used AES-'s s-box How are the AES S-Boxes calculated? or the one from DES S-box basic question.


texts: How to modify the Socialist Millionaire Protocol to be symmetric.

texts:
In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step.

In the final step, both parties check a value like $R_{ab} == P_{alice} / P_{bob}$. So the parties have to agree who's the numerator (alice), and who's the denominator (bob) (reference).

But I noticed I can avoid this asymmetry by just checking for both $P_{alice} / P_{bob} $ and $P_{both} / P_{alice}$. Or more explicitly, with the roles removed.

$$
(R_{ab} == P_{self} / P_{other}) \text{  or  } (R_{ab} == P_{other} / P_{self})
$$

My question is: is this safe? Is there some way an attacker could use this extra check to interfere with the final result?

If it is the case that both parties do have the same secret value, this should always work. But if the parties don't have the same value, could the adversary make my extra check return true somehow?

Here is my code for reference:
https://github.com/cowlicks/socialist-millionaire-go/blob/master/smp.go#L129-L138


texts: what does the m parameter in XML Signatures for gnBasis characteristic-two curves represent?

texts:
https://www.w3.org/TR/xmldsig-core/#sec-ECParameters defines the same three characters two-field basis's that http://www.secg.org/sec1-v2.pdf#page=107 defines:

GN (Gaussian Normal, I guess)
TP (Trinomial Basis)
PP (Pentanomial Basis)

In http://www.secg.org/sec1-v2.pdf#page=107 just Trinomial basis and pentanomial basis have parameters and they have 1 and 3 respectively. Gaussian Normal has "NULL parameters". eg. no parameters. But in https://www.w3.org/TR/xmldsig-core/#sec-ECParameters it does have a parameter:

<element name="GnB" type="dsig11:CharTwoFieldParamsType" />

<complexType name="CharTwoFieldParamsType">
  <sequence>
    <element name="M" type="positiveInteger" />
  </sequence>
</complexType>

My question is...  what does this parameter represent?


texts: Commutative Hash Function for Password Challenge?

texts:
I had an idea. Could anyone tell me if this is a thing, if they see any problems with it, and if they know of a commutative hash function that would make it work?

Suppose you had a pair of cryptographic hash functions, one of which could take an a key in addition to its regular input, and that these functions were commutative. So:

hash1(hash2(key, input)) = hash2(key, hash1(input))

I think this could be used to implement a very effective challenge-response password system:

Server stores storedHash = hash1(password)
User requests login
Server generates random key, sends to user. (Alternatively: User and hub use trust-less protocol to agree on random key.)
User returns sentHash = hash2(key, password)
Server compares hash1(sentHash) == hash2(key, storedHash)

The upside to this system is that even if the communications are intercepted, the users password remains safe, even for future use on the same server. Even if the user were tricked into trying to log in to a malicious fake server, the credentials they sent would be useless for impersonating them to the true server.

So... anyone see a problem with this? Anyone know a hash function that would make it work? (Or is there a reason any hash functions that's key-able and commutative would not be secure?)


texts:
I'm studying mathematical cryptography and have been asked to find the encryption function for the Atbash cipher I know that it means a=z, b=y, c=x and so on but putting it into a formula has me a bit stuck. I already know affine ciphers version of the atbash is $ -(x+1) mod m $

Any help would be greatly appreciated!
Thanks


texts: Are PBKDF2 derived keys related if only the number of iterations is changed?

texts:
I'd like to encrypt my disk with a password.
To generate a nice key from a password, I used PBKDF2, which applies a hash function $k$ times to a cleartext and outputs the final result.
When I modify that encrypted data, I decrypt it, modify it, and re-encrypt it.
When I re-encrypt, I plan to use a different key by increasing the number of PBKDF2 iterations during the key derivation (described soon), i.e., $k$ in the previous description, so that the encryption key differs from those in previous encryptions.
I derive the keys as follows.

$\mathsf{K}_\mathsf{derived} = \mathsf{PBKDF2}(\mathsf{password}, \mathsf{random\_salt})$, which constructs a key from the user-input password.
$\mathsf{K}_\mathsf{master} = \mathsf{HKDF\text{-}Extract}(\mathsf{K}_\mathsf{derived},\texttt{''no salt''})$, which derives a master key with an empty salt.
$\mathsf{K}_\mathsf{data} = \mathsf{HKDF\text{-}Expand}(\mathsf{K}_\mathsf{master}, \texttt{''AES-KEY''})$, which derives a symmetric key for AES encrypting the disk data. The derivation uses the salt $\texttt{''AES-KEY''}$.

where the PBKDF2 uses SHA-256, HKDF-HMAC function is HMAC-SHA256.
I set the parameter of PBKDF2 such that the following two conditions are satisfied:

The initial number of PBKDF2 iterations is large enough, such that the key derivation takes at least 1 second.

The number of PBKDF2 iterations is increased by at least 1 each time the message is re-encrypted.

My question is:

Are keys derived from the same password, but with different numbers of rounds in PBKDF2, computationally related?

If it matters, I use AES-CBC to encrypt, the data is not longer than 1 GB, and I'm only interested in keeping the data confidential.
P.S. I'm not serious about rolling my own crypto, I'm just looking to see if my hunch that this is safe is right or not.


texts: Can you explain the counter in the Key derivation function of PACE?

texts:
I try to understand the PACE-Protocol, especially the Key Derivation Function in ECDH on page 33.

Can someone explain me, what the Counter is good for? Often there are iteration counters in KDF - but here are usual Hash-Functions (like SHA-256) are used as KDF. So there is no iteration. Is this something like a message counter so that we create a new Hash for every new message?


texts:
On my exam, we had to solve this problem:

  message matrix is: [20, 19, 14; 17, 0 10]
  and the ciphertext matrix is: [18, 15, 16; 3, 24, 24].
  Find key matrix.

I couldn't solve this problem, because I tried to find key matrix by multiplying
[20, 19, 14; 17, 0 10]^-1 and [18, 15, 16; 3, 24, 24], but I wasn't able to calculate [20, 19, 14; 17, 0 10]^-1, because it's not a square matrix.

How can I decode a Hill Cipher without a key?


texts: What is the difference between Paillier additive homomorphic property and addition of two paillier ciphers

texts:
Paillier has additive homomorphic property that states:

if two ciphers c1 and c2, are multiplied, and the result is decrypted, it is equal to addition of the  two plaintexts.

D(c1*c2)= m1+m2

Paillier also allows two ciphers to be added. If the addition result is decrypted, we get the addition of the two plaintexts also.

D(c1+c2) = m1+m2
The two operations lead to the same result i.e., m1+m2.
However the second operation is only mentioned in Paillier python  libraries and not in the formal definition of Paillier.
What is the difference between the two and if both are valid, is it true that Paillier has many-to-one homomorphic property.
The second property is mentioned in the python library pdf as follows:
Once this party has received some EncryptedNumber instances (e.g. see Serialisation), it can perform basic mathematical operations supported by the Paillier encryption:

Addition of an EncryptedNumber to a scalar
Addition of two EncryptedNumber instances
Multiplication of an EncryptedNumber by a scalar


texts: When is public-key crypto used / when is symmetric crypto used?

texts:
I read in the book "Cryptography & Network Security" that it has almost been universally accepted that public-key cryptography is restricted to only being used for key management (Does this mean sending symmetric keys securely using a public-key crypto system?) and signature applications.

Can someone explain me if these really are the only cases where we use public-key cryptography?
Also, does this mean that public-key cryptography can't be be used alone for sending messages and that for such an example we use both a public-key cryptosystem and a symmetric cryptosystem for sending for example an e-mail?
Furthermore, can someone give me some examples of where we use public-key cryptography and where we use symmetric cryptography?

I know it is a lot of questions, but i have done a lot of searches online and in books and cannot seem to find the exact answer to my question.


texts: what is the motivation behind quantum key distribution with Continuous variable?

texts: Quantum Key Distribution protocol is a technique that allow two parties to share common secret key for cryptographic purpose and defined as being secure, by definition. But I am still wondering what is the motivation behind quantum key distribution with Continuous variable ?


texts:
I am looking for a perfect OTP design, so let's see if this design is good.

There are 2 issues when it comes to a good OTP system, the key and the plaintext, we will use XOR as cypher:

If the plaintext is like a message, then it should be long enough, otherwise it's pointless. What is the point in encrypting "Hello world", or something like that. So it should be a long message, so that it can't be guessed. If the plaintext is a private key itself, then it should be truly random and long as well, otherwise this scheme is pointless. This has nothing to do with the OTP I will talk about, it's just a caveat.
The key is the important part. It has to be truly random, the same size as the message or longer, and used only once, hence an OTP (onetime pad). So if we XOR the plaintext with the key, we get an unbreakable OTP.

The weakest link is probably the randomness of the key. However there is a solution:

Multi-Embedded Xor

What if we XOR it multiple times with different keys, like this:

$$Cyphertext = ( ( ( ( ( (Plaintext \oplus K1 ) \oplus K2) \oplus K3) \oplus K4) \oplus K5 ) .... \oplus K_n$$

So we would just Xor the plaintext n times with n different one time keys. Even if the key is biased or contains low entropy, the Xor function is known for it's de-biasing features, so Xor-ing multiple keys togeter would decrease the bias, and even for a very low quality random key, I think 5-6 rounds are enough, the bias will definitely shrink after 6 rounds to insignificance. But it also adds entropy into the system. By having 1 weak key with unknown entropy, we can have more keys mixed into the system thus increasing the overall entropy of the keys.

Would this be a perfect OTP design?


texts: What are unified addition and differential addition in elliptic curve point arithmetic?

texts: A lot of papers use these terms but I do not find a proper explanation of them. Can somebody tell the meaning / difference / intuition / application and if possible with an example.


texts:
I don't quite get the algorithm yet. Sometimes it works and other times it doesn't,so clearly I am overseeing or misunderstanding something.

I will just write what I did.
My $N=143$ and has factors $p=11$, and $q=13$.
To determine my second public number:
$R=(p-1)(q-1)= 10 \cdot12=120$. So the second number can not be a factor of $120$. I figured $e=7$ would be fine.

I simply want to message $'7'$. So $\mod\frac{7^7}{143}= 6$ will be my message.

My friend wants to decode it and needs to exponentiate this number by $d$.
$d=\frac{R+1}{e}=121/7$ But this should be natural number right?

I noticed it doesn't work for $e=9$ as well. Even though it is not a factor of $120$. It does work for $e=11$.

Should $e$ be chosen so that it is a factor of $R+1$?


texts:
I'm studing Shor's algorithm, and I have a question regarding the following step:
$$a^r -1 = (a^{r/2}+1)(a^{r/2}-1)=0 \pmod n$$
What would be the result if ${r/2}$ was -1? This will mean it's going to be like this: $(1/a+1)(1/a-1)$.
Will it also be $= 0 \pmod n$?


texts: How to find the inverse of a 3x3 MDS matrix

texts:
I implemented a block cipher similar to AES.
But the reason I can't decrypt is that I can't get the inverse MDS matrix.
The MDS matrix I used is a 3x3 MDS matrix on $GF(2^8) \implies GF(2^8)$ like AES

\begin{bmatrix}
1 & 2 &2 \\
2 & 2 & 1\\
2 & 1 & 2\\
\end{bmatrix}

The encryption process is the same as that of AES mixcolumns, and the MDS matrix used is as above.

I need the MDS inverse matrix required for decryption.
What is the inverse of this MDS matrix on $GF(2^8)$?

I searched for Euclid-Wallis Algorithm or extended euclidean algorithm but I did not understand it well.

How can I find the inverse of a 3x3 MDS matrix?


texts: Cutting down the size of a long blowfish key

texts:
I am reverse engineering a software that uses blowfish for encryption. The target uses an implementation of blowfish that allows arbitrary positive key length with a key size larger than 56 bytes.

I am looking for a way to cut the key size down to 56 bytes so that I can use a standard library to take care of the encryption instead of using a custom implementation like what the target did.

I started by cutting the key size to 72 bytes as I read here that key bytes beyond the 72th have no effect. This 72-byte worked as a substitute for the original longer key.

Is there a way to cut the key further to 56 bytes?


texts:
In the context of a new largest (mersenne) prime number being found this week -

The largest known prime number is now 2^57,885,161 − 1, and it took 5 years to find it since the last largest prime was found.

But we know that various asymmetric encryption algorithms require ridiculously large primes which are used as the infamous p and q factors. For example, 1024-bit RSA would require two 512-bit primes.

But this article, if correct, claims we are able to enumerate no more than ~1.7M prime numbers.

How does this settle with cryptographic prime number generation?


texts:
I'm struggling to understand the intuition of the zero knowledge-ness of this proof from the following paper.
The proof is a 2 round where the verifier asks the prover to extract square roots of quadratic residues.
I've read the HVZK proof (shown in the picture below) and I agree that you can produce a transcript that distributes like a normal proof, however I still can't get over the simple fact that:

Without the witness (factorization) you can't extract a square root modulo $N$.
When the proof is turned into a NIZK via the Fiat-Shamir transformation, the prover records square roots in their raw form inside the proof, so the verifier learns square roots of numbers in the group which it could not compute on its own before.

Isn't that a "knowledge" leak? Why can this proof be turned into a NIZK?
Many thanks in advance.


texts: Given a sequence of integers, would applying AES encryption to the sequence produce a unique set of strings?

texts:
Let us say that we take a sequence of the integers from a to a+n-1: (a, a+1, a+2, a+n-1), where a and n are picked arbitrarily and have no lower or upper bounds on either, except that a < n, and we apply AES encryption to that sequence, one element at a time, utilizing the same key for each element in the sequence.

Assumption is that we encode the resulting ciphered values as Base64 or some other encoding to produce strings.

Would the resulting set of encrypted strings have any, irrespective of how infinitesimally small, chance for collisions?


texts: Is the HMAC of a broken hash such as MD2, MD5, SHA1 etc, also broken?

texts:
As we know, MD5 and SHA1 (to some extent) are broken, and older algorithms like SHA0 or MD4 and MD2 are very broken.
Does this also imply that the corresponding HMACs are also broken?
Obviously nobody should use e.g. HMAC_MD4 anymore. But I'm just trying to understand the underlying security risk from a theoretical point of view.
Is it feasible to generate a collision for something like HMAC_MD2 or HMAC_MD5?


texts:
In the the paper "Efficient Methods for Conversion and Solution of Sparse Systems of Low-Degree Multivariate Polynomials over GF(2) via
SAT-Solvers" there is a Figure that I can not understand and I need help to understand it. The authors plot the running time of the probability distribution of the SAT solver applied to a certain problem. My question is about the X axis. Why there are numbers in this Figure 1, that are placed in vertical form? How to interpret this axis X?

I imagine that are interval times but I do not understand why they are in vertical form. Moreover, on the same axis there are twice the number 180.


texts: Fast string hash function for a specific table size?

texts:
I tried writing two hashing function and compared it to MurmurHash64A. To my disappointment one was better but maybe 1.5x slower and the other was slightly faster but had more collisions when I truncated the bits to put in my hash table ((Hash64bit^(Hash64bit>>32)) & 0x9FFFFF). Apparently it didn't distribute well.
From memory there was a random number algorithm where I could pick a prime and coprime to get a uniform distribution (it may have been a type of linear feedback shift register algorithm). I was wondering if something exist for hash tables where if I know how many slots I have I can pick numbers for better distribution.
I'm expecting 200K unique words for one table (I'm hoping I can use 1M slots for a 8MB table)  and I have another table that expects around 1K unique words or less (I'm hoping I can use 32K for that). Am I out of luck or is there something I can read or an algorithm I can use to help get a good distribution?


texts:
The following suggest that it's possible to test 32 bytes mathematically to determine if they might constitute a Curve25519 public key:  Bernstein, Hamburg, Krasnova and Lange 2013 https://safecurves.cr.yp.to/ind.html and also https://elligator.cr.yp.to/elligator-20130828.pdf
Q: can you please give a simplified overview of how this test can be performed programmatically?
I recovered five (quite possibly base64) encoded strings from a system log, two of which I suspect would constitute a public key, as they were isolated from the other three (but still distinctly part of the group). Unfortunately, the server software logged the error as lower case. I believe it is likely to be base64, because the range is 35 char, 0-9, a-i, k-z, with only 'j' missing, no '+' or '/'. (The inclusion of numbers [0,1,8,9] eliminates b32, while chars h+ eliminate a hex-string. I rejected base85 as being highly unlikely.)
I counted all possible capitalisations in the five 20-char chunks, but the total number is 2^80, which is infeasible. In the key alone, I count 2^30 possibilities, which is within the realms of realistic on ol'grindy (my four-year old i5), but only with a test for valid public key that didn't involve an attempt to decrypt.
I b64-decoded each ~2^15 candidate chunk, and retained only possibilities with printable char (reduced the number to ~tens of 1,000's), and scanned it with two separate meatware-based pattern analysers, both under normal operating conditions, as well as in the chemically enhanced mode of operation: nothing jumped out as being decipherable English.
I then pushed every ~16byte candidate b64-decoding (as well as every possible reduced partial range of bytes, from the left, and from the right) through Gary Kessler's file binary-signature list (BytesIO is your friend) Kessler 2020 https://www.garykessler.net/software/index.html#filesigs - this yielded no sensible results, ie. byte-counts >= 4. I'm holding off studying crypt-analysis at this time, on the assumption that admin actually wants to have a chat some time in the next decade!
ps. exhaustive search I estimate to take somewhere within (2^30 * 2^50) tests (ie. every possible pk, and every possible cipher), so this is out of the question: it would be nice if admin coming in from ec2 switched to hex-strings, or set me this puzzle using a 404 GET off the HTTP/s root directory, so it hits the webserver logs instead!


texts: Does RSA operate over a Finite Field (Galois Field)?

texts:
Is it correct to say that RSA operates over a Finite Field (Galois Field)? In this case GF(p)?
I do understant that the modulo in RSA is not itself a prime number, but all the operations (multiplication, inversion) occur as if it is a GF(p).


texts: How many iterations for Pollard's $p-1$ with $p = r^k + 1$ for prime $r$?

texts:
$p$ and $q$ are large primes.
What is the lowest upper bound for the number of iterations for Pollard's $p-1$ algorithm for factoring $N = pq$, provided that $p = r^k + 1$, for a prime $r$, and $r^k + 1 < q < r^{k+1}$?


texts: CPA-security proof of "l-padded RSA" encryption scheme

texts:
The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for all $n$:

The padded RSA experiment $PAD_{A,GenRSA,l}(n)$:

$(N,e,d) \leftarrow GenRSA(1^n)$.
Give $N$, $e$ to $A$, who outputs a string $m \in \{0,1\}^{l(n)}$.
Choose random $y_0 \leftarrow \mathbb{Z}^*_N$ and $r \leftarrow \{0,1\}^{||N||-l(n)-1}$, then set $y_1=[(r||m)^e \mod N]$.
Choose a random bit $b \leftarrow \{0,1\}$. Adversary $A$ is given $y_b$, and outputs a bit $b'$.
The output of the experiment is $1$ if $b'=b$, and $0$ otherwise.

The exercise asks to prove that if this $l-padded$ $RSA$ is hard relative to $GenRSA$, then this $PAD$ construction using $l$ is CPA-secure. Unfortunately my crypto teacher stated that "if $l(n) \leq 2n-2$ then this construction is conjectured secure but there is no formal proof based on standard RSA", which is precisely what the exercise is asking (if my understanding is correct). Please don't mark this question as a duplicate of this one, because it's not, note that I'm expliciting when $l(n) \leq 2n-2$ and not when $l(n)=O(\log n)$.

So, my question is: how should I procede, as the exercise task apparently contradicts the teacher's statement?


texts: PKCS12 password of container and private key

texts:
As I understand pkcs12 defines a container structure that can hold both a certificate and one or more private keys.

openssl pkcs12 -export -inkey test-key.pem -out test.p12 -name 'Test name' -in test.crt
Enter pass phrase for test-key.pem: KEYPW
Enter Export Password: EXPPW
Verifying - Enter Export Password: EXPPW

Read the p12 file:

openssl pkcs12  -info -in test.p12
Enter Import Password: EXPPW
<outputs certificate, followed by>
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Bag Attributes
    friendlyName: Test name
    localKeyID: 92 C7 F8 7A 23 F4 03 21 0A 3B D6 CE 29 C6 45 C8 1E E0 D2 DD
Key Attributes: <No Attributes>
Enter PEM pass phrase: KEYPW
Verifying - Enter PEM pass phrase: KEYPW
-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----

For the PEM pass phrase I use the one when the private key was created. But why does the output show encrypted private key instead of private key? That's why I entered the pass phrase isn't it?

What makes it even more confusing: passing option -nodes to the openssl command doesn't ask the pass phrase anymore (as expected) but still shows the private key, this time not encrypted anymore. I would expect the opposite: without pass phrase show the encrypted private key, with pass phrase show the unencrypted private key. After all, I can only use the private key when it is not encrypted.

EDIT: hopefully it's easier if I ask smaller questions. Given the created test.p12 as shown above:

Is it correct that EXPPW is the p12 container password and KEYPW is the pass phrase to protect the private key?
Is it possible to get the unencrypted private key with only EXPPW? In other words, is KEYPW not used inside the p12 container?
If the private key is stored encrypted inside the p12 using EXPPW, why does openssl pkcs12  -info -in test.p12 not accept a new pass phrase for outputting the new encrypted private key? If you don't use the original KEYPW it fails with Error outputting keys and certificates.
Is it possible to protect the whole p12 container with password X and the private key with password Y? So that if you know X, you can still get the public certificate yet you can't get the private key?


texts: Does limiting the sales market to U.S. only, releive my application of Export Admin Regs?

texts:
I have a steganography application that uses one-time-pad encryption. Obviously, key lengths can be very long.

If I were to limit the sales market on the Microsoft Store to U.S. only, would that be sufficient action to relieve the application of any Export Admin Regulation? Or, would it still be subject to other forms of regulation?

Any direction or feedback is appreciated as I find the BIS regulations rather confusing. I'm bureaucratically challenged :)


texts: Computation complexity of modified Euclidean algorithm

texts: The computational complexity of the extended Euclidean algorithm is $O(log(b)^2)$ ($b$ being the second integer) as referenced by Wikipedia. How to compute the complexity of the modified extended Euclidean algorithm for basis reduction? I know that complexity is equal to the number of iterations multiplied by the cost of iterations. I can compute the cost of iteration but I am not sure how to deal with the number of iterations?


texts: Changing the IV of the AES key wrap algorithm

texts:
The first 64-bit block to be encrypted is defined by the spec to be

A6A6A6A6A6A6A6A6

Is their any merit in changing this to another value eg. B0B0B0B0B0B0B0B0?

You retain the strong integrity check although maybe at the cost of interoperability, but does changing the value make the wrapping more secure as potential attackers will not have the knowledge of the unencrypted value of the first block?


texts: "Dave Check" for a tweakable P-256 ECDH KDF

texts:
I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation function, which deterministically allows both sides to generate the same key given their partner's P-256 public key and a tweak value. The construction must have the property that computing the key for a new tweak value requires an operation on the hardware token, even if token outputs for many other tweak values are known.

I've come up with the following pseudocode:

// NIST recommended way to generate a private key
l = 2^256 − 432420386565659656852420866394968145599
P256Priv(ikm): (HKDF_expand(40, ikm) % (l - 1)) + 1

// point multiplication with g as the P-256 generator
P256Pub(p): g * p

// different function instances for different tokens
tokenECDH(inPub): ECDH(tokenPriv, inPub)

// Using XOR because it makes both sides symmetrical
TweakableKDF(tokenECDH, peerPub, tweak, numBytes):
    Epriv = P256Priv(tweak)
    Epub = P256Pub(Epriv)
    HKDF_expand(numBytes, tokenECDH(Epub) ^ ECDH(Epriv, peerPub))

It looks to me like this would be secure, but I don't want to be a Dave. (Also, I can't help but wonder if there's something standard out there that does this already; I looked briefly and was surprised I didn't find much.)

Any Questions? Comments? Snide remarks?


texts: Is storing original file size in an encrypted file header a bad idea?

texts:
I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the encrypted file over a socket, I won't know when the encrypted file has been finished, as I'm reading it in chunks. Because of this, I won't know when to trim the PKCS#7 padding from the decrypted file chunks. (I won't know the size of the decrypted data in advance, so I won't know where to look for padded bytes and to trim them.)

One solution I've thought of would be to include the unencrypted file size in the header of the encrypted file, but I'm not sure if this is a security threat or not. Is this a bad idea?

Edit

I have kind of a strange setup. Encrypted data is stored like so:

$$s \longrightarrow e_{m} \longrightarrow d$$

The source data $s$ is passed to $e_{m}$, the encryption method, over a socket. As $e$ encrypts the data, it simultaneously writes the data over another socket to the destination $d$.

Retrieval works in the inverse:

$$d \longleftarrow d_{m} \longleftarrow s$$

The encrypted source $s$ is passed through the decryption method $d_{m}$, which decrypts it and passes the decrypted data to destination $d$.

With this in mind, how can I maintain padding with AES? The contents being transferred are files, so they are inherently and usually larger than 50 bytes of data. The problem seems to be $e_{m}$ and $d_{m}$ not knowing the size of the input data and simply encrypting block-by-block.

How can I create a decryption method which, not knowing the size of $s$, will still be able to decrypt the data and send it to $d$?


texts: How many hashes for high probability of finding a collision (specific case)?

texts:
Suppose Bob managed to obtain 220 different digests that were generated
by a hash function employed by a target system. The hash function outputs 8-byte
digest of a message. Bob now wants to find a message that hashes into 1 (one) of the
obtained digests. How many different messages should Bob approximately hash until
there is a good probability that a generated digest will match 1 of the obtained
digests?

My answer is $\sqrt{2^{64}}$ ($= 2^{32}$) messages for a probability of 0.5. Is this correct?


texts: ASCII input to HMAC weaker than raw bytes?

texts:
In various cryptographic programs I've written (most have been toy problems, but this current one is not) I have taken a slothful approach to performing a message digest (hash) of numerical input. I have been casting the numbers to strings, concatenating them, and then performing the hash. (Actually, this is a keyed hash, or HMAC, as described in RFC_2104.)

Example:

# I desire to hash a single bit with a sequence number.
# bit is either 0 or 1
# sequence_number is some 64-bit number.
# key is some 32-bit number/value used to create an HMAC.
make_HMAC(key, str(bit) + str(sequence_number))

# make_HMAC works on longs as well, but would become ambiguous because:
# make_HMAC(key, 0 + sequence_number) == make_HMAC(key, 1 + (sequence_number - 1))

I've been avoiding ambiguity, but I worry that I've weakened the strength of my hashing functionality in a subtle way.

Does casting these values to a string cause the HMAC to become less secure in any way?

If it matters, I'm using python 2.7 and the pycrypto library.


texts: Bulletproofs range proof of value provided from trusted third party

texts:
I'm really interested in range proofs, and bulletproof seems to be the most effective range proof.

I saw an example of usage of bulletproofs range proof: You can generate a proof that your age is greater than 18 without revealing your exact age.

That sounds cool, but what I don't understand is how I can prove that my age is verified. Say I'm 12, but while I generate a proof, I pretend that I'm 20 and generate a proof for 20 years. Clearly, I need a third trusted party to verify that my age is really greater than 18. How it can be done?

Maybe I should generate a proof, and then a trusted third party - for example my government - signs that it to make it a valid proof? Is there a better approach?


texts: How many bits can be safely extracted from the BBS generator at each step?

texts:
The Blum-Blum-Shub generator is a deterministic Pseudo-Random Bit Generator with security reducible to that of integer factorization.

Setup: Secretly chose random primes $P$, $Q$, with $P\equiv Q\equiv 3\pmod4$, and compute $N=P\cdot Q$. Secretly chose a random seed $x_0$ in $[1\dots n-1]$ with $\gcd(x_0,N)=1$.

Use: To generate the $i$-th bit, compute $x_i=x_{i-1}^2\bmod N$, and output the low-order bit of $x_i$.

In that definition, BBS produce 1 bit per iteration. For a given $N$, how much can this be improved while maintaining security demonstrably reducible to factorization of $N$ (or determining quadratic residuosity $\bmod N$)?

This is discussed in Vazirani & Vazirani: Efficient and Secure Pseudo-Random Number Generation, with proof that the low 2 bits can be safely extracted, and even (if I get it correctly) $\log n$ bits where $n=\lg_2 N$. However the authors "notice that in all the proofs, $\log n$ can be replaced by $c\cdot\log n$, for any constant $c$". Note 5.41 in the HAC gives it as $c\cdot\lg_2n$ bits and warns that "for a modulus $N$ of a fixed bitlength (eg. $n=$1024 bits), an explicit range of values of $c$ for which the resulting generator is cryptographically secure under the intractability assumption of the integer factorization problem has not been determined".


texts: Is Attribute based encryption sub-class of Identity based encryption

texts:
I have a basic question related to Identity and Attribute based encryption.

Construction of IBE scheme was first shown by Boneh et al. in 2001 and I think in 2004 Sahai and Waters introduced  Attribute based encryption in 2004 for multiple attributes. ABE extended to CPABE or KPABE schemes.

Can ABE schemes be considered as child of IBE schemes or ABE can be considered as subclass of IBE schemes. Or ABE schemes cannot be categorized as a variant of IBE scheme at all.

Is there a generic name under which I can group the IBE and ABE schemes? Please suggest.


texts: Determine AES key given encrypted and unencrypted files

texts:
Given an encrypted file, the original unencrypted (cleartext) file, and knowledge of which AES encryption algorithm was used, is it possible to determine the key that was used to encrypt the data in a reasonable period of time?

I am not looking for details on how AES works, just a simple answer.


texts: Future Secrecy/ Break-in Recovery of group chat messages in Whatsapp?

texts: Whatsapp does not use double ratchet for group messages rather it uses  “hash ratchet” of the message sender’s Chain Key to provide forward secrecy. Thus, does it mean that it does not provide future secrecy for group messages?


texts: Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

texts:
When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and the confused deputy problem doesn't apply either. To be clear, the plaintext the DEK ultimately encrypts should be protected with AEAD. But, if you would argue the DEK itself needs AEAD please tell me why.

Here are some resources to use as a reference for how major cloud platforms recommend using their key managements systems to encrypt data.

https://cloud.google.com/kms/docs/additional-authenticated-data
https://cloud.google.com/kms/docs/envelope-encryption


texts: Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)

texts:
Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size here).

These are standard implementations in Mcrypt.  I'm vaguely aware that a larger block size can help to mitigate some kinds of attacks... is that true?  Which ones?  Could a larger block size also introduce weaknesses?  I'm just curious to know why the 128-bit version become the standard, and whether there's any good reason to use the 256-bit version.


texts: Family of hash functions which are epsilon-almost universal

texts:
Let $R, S,$ and $T$ be finite, non-empty sets. Suppose that for each $r \in R,$ we have a function $h_r: S \rightarrow T.$ In other words $\{h_r\}_{r \in R}$ is a family of keyed hash functions from $S$ to $T$.
We say that a family of hash functions $\{h_r\}_{r \in R}$ is pairwise independent, if for all $s, s' \in S, s \neq s'$ and for all $t, t' \in T$
$$
Pr[r\stackrel{$}{\leftarrow}R: h_r(s)=t\wedge h_r(s')=t']=\frac{1}{|T|^2}.
$$
We say that the family of hash functions $\{h_r\}_{r \in R}$ is $\epsilon-$almost universal, if for all $s, s' \in S, s \neq s',$
$$
Pr[r\stackrel{$}{\leftarrow}R: h_r(s)=h_r(s')] \leq \epsilon
$$
(a) Show that if a function family is pairwise independent then it is $\frac{1}{|T|}$-almost universal.
(b) Let $p$ be an odd prime. For $a,b \in \mathbb{Z_p}$ define $h_{a,b}: \mathbb{Z_p} \to \mathbb{Z_p}$ by the rule
$$
h_{a,b}(x)= (x+a)^2 +b \hspace{0.2cm}(\mbox{ mod } p)
$$
Prove that the family $\{h_{a,b}\}$ is $\frac{1}{p}$-almost universal.
Let me write down what I have tried.
(a) $\forall s, s' \in S, S \neq S'$ and for all $t, t' \in T$
$Pr[r \stackrel{$}{\leftarrow}R: h_r(s)=t \oplus h_r(s')=t']=\frac{1}{|T|^2}$
$Pr[r \stackrel{$}{\leftarrow}R: h_r(s)=t^{'} , h_r(s')=t' \oplus t=t'']=\frac{1}{|T|^2}$
Now consider $t^{'}=t^{''}$, then we have $|T|$ choices for $t^{'}$.
Then,
$Pr[r \stackrel{$}{\leftarrow}R: h_r(s)= h_r(s')]=\frac{1}{|T|}$
Hence $h$ is $\frac{1}{|T|}$-almost universal.
(b) Let $x_1, x_2 \in \mathbb{Z_p},$ where $x_1 \neq x_2$
$h_{(a,b)}(x_1)= h_{(a,b)}(x_2) (\mbox{ mod } $p$)$
$\implies (x_1-x_2)(x_1+x_2+2a)=0 (\mbox{ mod } $p$)$
$\implies x_1+x_2+2a=0 (\mbox{ mod } $p$)$
Since there will be $p$ choices for $x_1$ and $x_2$ will be calculated according to $x_1$. So there are $p$ possibilities.
Hence, Pr[$h_{(a,b)}(x_1)= h_{(a,b)}(x_2)]=$\frac{1}{p}$.
The family $\{h_{a,b}\}$ is $\frac{1}{p}$-almost universal.
Please let me know if I am wrong.


texts: FIPS 140-2, Level 1 validation vs. compilation

texts:
I'm working on a system that needs to use cryptographic functions that must be FIPS 140-2, Level 1 validated. The challenging part is that some of this system needs to run in the browser. For maintainability reasons and ease of use, I would really like to avoid having to resort to applets or browser plugins or Active-X controls or something of that sort, and would much rather build this part of the system in JavaScript.

So, I've been searching for validated JavaScript modules, but this website:

https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search

which lists all (?) currently validated modules if you click on "Show All", does not give me much hope to find one.

So, here's what I'm thinking:

Can I take one of the Java modules (like Bouncy Castle) and cross-compile them to JavaScript using something like GWT?

Or can I take one of the C or C++ modules and compile it into asm.js?

Or, to ask the question even more generally: How does (cross-)compilation or translation of validated code affect the validation?


texts: Encrypting 8 times with 8-bit key beneficial?

texts:
I was trying to understand cryptography from the book Information Security by Mark Stamp and I am confused by something.

  Suppose that Alice has a secure block cipher, but the cipher only uses
  an 8-bit key. To make this cipher "more secure," Alice generates a
  random 64-bit key K, and iterates the cipher eight times, that is, she
  encrypts the plaintext P according to the rule

  $$C = E(E(E(E(E(E(E(E(P, K_0), K_1), K_2), K_3), K_4), K_5), K_6), K_7)$$

  where $K_0,...,K_7$  are the bytes of the 64-bit key $K$.

  Assuming known plaintext is available, how much work is required
  to determine the key $K_1$?
  Assuming a ciphertext-only attack, how much work is required to
  break this encryption scheme?

Here I believe that the author is trying to explain the meet in the middle attack, but how does this attribute to it? As far as I have understood things, by using a MIM attack, the answer will be $2^7$ for each block do is $2^7*8$, and ciphertext I believe there are no ciphertext shortcuts so is should be $2^{64}$?

Am I right or I am thinking in the wrong direction?

Is encrypting 8 times with 8-bit key beneficial?


texts: If I compute the SHA-1 of all possible 40 digits hexadecimal strings, will I get all possible sha1 hashes?

texts: Wikipedia says sha1 produces a 160-bit (20-byte) hash value. So if I compute the SHA-1 of all possible SHA-1 values, which as far as I understand is at current time impossible both to calculate and store, will I get all possible SHA-1 values? Would I be able to collide anything?


texts: What is the difference between OTR and Signal protocols?

texts:
The Signal Protocol is a relatively new secure messaging protocol that was recently implemented in Signal, WhatsApp, and several other messenging apps.  According to Wikipedia, the Signal protocol is an evolution of the OTR protocol (https://otr.cypherpunks.ca/otr-wpes.pdf).

One of the major new features of Signal is that it allows for asynchronous messaging (i.e. both participants need not be online at the same time).

What are the other important differences between these protocols? Are there any instances in which OTR would be better suited than Signal?


texts: In general,  we consider the output of s-box in AES as a “sensitive value” in order to perform a side channel attack. I would be very grateful if you could explain to me the reason of that consideration. Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?


texts: Computational feasible to reverse MD5SUM?

texts:
This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size $N$ whose MD5SUM is $X$?

For example,

ls -l wczasp.rb
-rwxrwxrwx  1 master master     7273877 2011-01-30 17:13 wczasp.rb

md5sum wczasp.rb
acf3602b5eb9a2db3e365d3043682faf  wczasp.rb

So, how computationally hard might be to generate any 7273877-byte file whose 128-bit checksum is also acf3602b5eb9a2db3e365d3043682faf? In a sense, I am asking for a hash collision. My intuition says next to trivial, and nearly as useless too, but I would like to know for sure.


texts: AES-128 or AES-256 with 18 bytes of key storage?

texts:
I have only 18 bytes in which to store a (randomly generated) key.
Is it more secure to:

use AES-128 and a 16 byte key,
use AES-256 and a 18 byte key padded with 14 zero bytes to make a 32 byte key, or
use AES-256 using a KDF to turn 18 bytes into a 32 byte key, each time it is needed?


texts: Can Paillier Encryption has independent decryption key?

texts:
As Pailliear cryptosystem secret key $\lambda$, depends on primes $p$ and $q$. As $\lambda = \operatorname{lcm}(p-1,q-1)$.

I want decryption key to independent from $p$ and $q$.

It can be possible to generate decryption key independently?


texts: How did G.H. Hardy's work contribute to today's public-key cryptography?

texts: I know that Hardy's work in number theory was used by Clifford Cocks in 1973 to develop the basis for public-key cryptography.  What specifically was this work, and how is it used today in cryptography?


texts:
I need to generate secure pseudorandom numbers in an embedded system. Instead of having to port some RNG library, could I just use an existing SHA2 function as a random number generator (n-th random number is SHA2(seed + n))?
I'm worried that SHA2 hashes might not be evenly distributed (have bias towards certain sequences of bits).


texts:
What are the disadvantages of using random s-boxes?
In AES, the s-boxes had to obey certain mathematical rules, which? And why?
What security does using hidden s-boxes (GOST) or generating them from the key (Khufu) add?, and how do these secret and generated s-boxes defend against differential and linear cryptanalysis or other unknown attacks?


texts: How to formalize a partial preimage task?

texts:
Part of the bitcoin mining proof of work is associated with solving a partial
  preimage problem. For example, output a preimage message $M′$ which computes
  to a hash value $Y$ with $|Y| = n$ bits where half of the output bits are fixed to 0, $Y =0^{n/2} ∥ Z$ for any $Z$ with $|Z| = n/2$ bits.

  • Formalize this partial preimage task for an adversary A (as an advantage
  probability function).

This is the answer I landed at:
$Adv(A) = Pr(z \leftarrow Z,\ |Z|=n/2,\ Y=0^{n/2} || Z,\ H(M') = Y)$

Am I correct? If not, how can I improve my answer?


texts: How to find multiplicative inverse of a hexadecimal number in the finite field GF(2^8)?

texts: I am new to cryptography. As I was reading a note regarding S-box construction, I found a step mentioning multiplicative inverse of a number in the finite field GF(2^8). I couldn't understand it!! Can anybody help me by explaining the procedure(step by step) to find multiplicative inverse of a number(say 95 in hex) in the finite field GF(2^8) ?


texts: How does an oblivious test of plaintext equality work?

texts:
Assume an ElGamal Cryptosystem. Assume a set of three players, $P_1$, $P_2$ and $P_3$. The private key $x$ is shared among the players. The player $P_1$ has a piece of the private key $x_1$, $P_2$ has the piece $x_2$ and $P_3$ has $x_3$.

Assume the following messages, $m_1$ and $m_2$.

Let $E(m_1)$ and $E(m_2)$ be two ElGamal ciphertexts.

The elements $r_1$ and $r_2$ are random numbers, and $y = g ^ x$, where $g$ is a generator of the group.

Encrypted message m1: $E(m_1) = (g ^ {r_{1}},   m_1 \cdot y ^ {r_{1}}) = (a_1, b_1)$

Encrypted message m2: $E (m_2) = (g ^ {r_{2}},   m_2 \cdot y ^ {r_{2}}) = (a_2, b_2)$

The question is: how can the holders (players) of the private key execute the oblivious test of plaintext equality proposed by Schnorr and Jakobsson? Specifically, how can the three players can determine if $m_1 = m_2$ without revealing the messages?

PS: The protocol oblivious test of plaintext equality proposed by Schnorr and Jakobsson is in the article entitled "Efficient Oblivious Proofs of Correct Exponentiation".


texts:
I am working on this question and I am wondering I have figured out the secret key, but my problem is I don't know how to use the secret key to decrypt the ciphertext.

Thanks for the help!


texts: Is the Discrete logarithm problem suitable for this pairing scheme?

texts:
Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$

If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows two values. In this scheme, the user only know one value.

Is the discrete logarithm problem suitable for this scheme or not?


texts: Are there cryptographic schemes that mask as unencrypted traffic?

texts: Are there cryptographic schemes that make encrypted traffic look like unencrypted traffic?


texts: The answer to this question at Crypto.SE is clear about what a trapdoor function is, but what makes a trapdoor function "injective"?


texts: Why does ROT13 provide no cryptographic security?

texts:
I can understand that ROT13 is not secure for obvious reasons, but I'm looking for the theoretical answer.  Wikipedia says "The algorithm provides no cryptographic security.."  What does it mean to provide cryptographic security? Why does it provide no security as opposed to, say, very little security?

What would make ROT13 easy to crack from an automated program (e.g. one that had no knowledge at all of what the encryption cipher was)?  How is a cipher measurably "weak?"


texts: What is the difference between implausibility vs impossibility in the context of Crypto? I came to know that differing input indistinguishability Obfuscation (diO) implausibile but not impossible. Can I know the difference between the two terminologies?


texts: Is there a cryptographic primitive that allows "signature chaining"?

texts:
Let's assume that a digital signature scheme $S$, which is secure against existential forgery under adaptive chosen message attack, can only be used with fairly short signature inputs, i.e. $S(sk, m)$ has a constraint of $len(m) < n$.

Is there a way to use this scheme in a way that gives stronger protection against forged signatures than the naive solution of signing the first $n$ bit of the output of a hash function over a message, i.e.

$S'(sk, m) = H(m)[0..n]$?

The security of $S'$ seems to be limited by the relatively short output of the hash function: Finding a hash that collides only in the first $n$ bits of a message pair $(m, m')$ allows for a forged signature, even though the asymmetric primitive itself might not allow for a forgery.

One way I can think of is to apply the signature function over slices of the hash output and concatenate the results, i.e.

$S''(sk, m) = S(sk, H(m)[0..n]) || S(sk, H(m)[n..2n]) ...)$,

but that would allow for the rearranging of the signed parts, which does not seem good.

When driven to the logical extreme, setting $n = 1$, it becomes obvious that any such scheme will fall apart, given that there are only two possible signature outputs that can be interpreted as logical zeroes and ones, and rearranged to form any desired hash output.

The scheme could be further improved by encoding the "block number" in the signature input, or by somehow chaining the hash output and the signature output with some feedback mechanism similar to some hash function or block cipher modes of operations, but I'm going to stop here since I'm assuming that what I'm trying to do is generally impossible:

Assuming that the number $i$ of signature operations that an attacker can perform is bounded to $i<\sqrt(n)$ (i.e. the birthday bound), is there a way to construct any signature scheme $S'$ that makes an existential forgery harder than $O(n)$ for an attacker, given the constraints on the atomic input into the asymmetric signature function?

And does the situation change if the adversary does not have access to $S$, but only to $S'$ (i.e., can $S'$ then be possibly made secure even for $i > n$)?

(I'm aware that the assumptions in my question might be a logical contradiction with the chosen security properties of the "atomic" signature scheme. In this case, let's assume that it is as secure as possible given the constraints, i.e. an input of only $n$ bit and no other user-controllable randomness, even though it might internally use a random padding scheme etc.9


texts: Derive a shared secret between different curves

texts:
Is it possible to derive a shared secret between different curves?
An explanation would be nice.
How can I decide which curve I should use in my software?
Highest amount of bits has in my case the brainpoolP320r1 curve, but on this site https://safecurves.cr.yp.to/ the brainpool curves are rated as not safe.
The German Federal Office for Information Security recommend amongst others the brainpoolP320r1.

These curves can I use with my HSM (hardware security module):

secp192r1 (aka prime192v1)
secp256r1 (aka prime256v1)
brainpoolP192r1
brainpoolP224r1
brainpoolP256r1
brainpoolP320r1
secp192k1
secp256k1 (the Bitcoin curve)

Additional Question:
If I want to perform signing and generating a shared secret, should I always use different instances of a curve? Because if not, I would perform different actions one the sone instance. Which is bad?


texts:
Regarding the question  Provable Encryption,
I'm trying to understand how a 'proof of encryption' might actually work.

What I can deduce from the answers is this: we need a cryptographic scheme that is somewhat homomorphic, in the sense that some algebraic structure on the set of plaintext is respected by the encryption transformation (like RSA and Rabin (plain $x^2$ version) respect multiplication in the underlying finite rings).

Can someone explain this in more detail? How can it be used to decide whether or not a given string is actually the ciphertext of something w.r.t. to a given public key?

I mean, in a sense all elements of the underlying finite field (or lattice or whatever algebraic structure the scheme is based on) are ciphertexts of something, right?


texts: Canonical inclusion map in subfield attack on overstretched NTRU

texts: I'm trying to understand subfield attacks on overstretched NTRU. In the paper https://eprint.iacr.org/2016/127.pdf  authors used "canonical inclusion map" to lift  vector to full lattice. What does the canonical inclusion map relative to finite fields mean? And where can I read more about this construction?


texts: All fully homomorphic encryptions (FHE) are converted into homomorphic commitments?

texts:
The GSW one of the FHE scheme is widely used as a homomorphic commitment scheme to build lattice based ABE, homomorphic signatures and NIZK and so on. But I cannot find other FHE schemes to be considered as a commitment scheme such like that.
Is there a special reason why GSW is only one scheme regarded as a commitment scheme? or all known FHE schemes such as BGV are also commitment schemes?


texts: How is a ciphertext encrypted using random numbers decrypted using a symmetric key algorithm

texts:
We use true random number generators as a source of keys for encryption. What I can not wrap my head around is: How is this cipher text decrypted in case of symmetric key algorithm as we need the same random number to decrypt the cipher text.

What I could guess is:

Is this random number used as a session key and transmitted using any asymmetric key algorithm?
Are PRNGs and true random number generators used as a seed?


texts:
I need some basic guideline on Password Based Key Derivation Function. PBKDF1 generates a key from password and salt using Hashing algorithm (like SHA1, SHA256, MD5).

What is the step behind this?


texts:
I have an application where I want to be able to send an encrypted file, and then mete out "keys" that allow the receipient to decrypt the file from a certain point to the end of the file. Actually, it's from a certain point to the beginning, and I'm doing the above by reversing the file.

Looking at AES (and thus Rijandel) and all of the available block modes, it needs the key to decrypt every block, and so releasing this would allow the receipient to decrypt the entire file. Not useable.

However, if I was to make the Key public, much like the IV or a Salt is usually public, and instead mete out the IV necessary to decrypt block N through the end, then that would give me the functionality I need, since theoretically the IV in a mid-stream block does not let you derive the IV for previous blocks, but only subsequent blocks.

So, the question is, how less secure is AES if I switch the Key and IV around as inputs to the block cipher?


texts: Is a deterministic PRNG seeded by with cryptographic hash a secure basis for generating one-time passwords?

texts:
I am building a passwordless auth scheme, and would like to avoid storing temp passwords in memory, so I wanted to derive them rather than store them. A valid password looks something like 'amendable-goofiness-ahead' (a warning which could also be appropriate for this question).
I was thinking we could generate a seed from a combination of a secret salt, username and the current time, then use that to seed a deterministic PRNG (such as PCG64) which is used to select words at random from the EFF 'large word list'.
$$
seed = sha256(username || salt || timestamp)
$$
This password is sent to the user (say, over email), then when the server receives it again, it simply generates all the valid passwords for the past 20 minutes or so and checks the password it received against each of the passwords it generated.
Does this sound like a valid solution? It depends on the salt remaining hidden (this would be stored long term in the database with the rest of the user record), is there a solution that could avoid this?


texts: Choice of delta-neighbors in Balloon Hash algorithm

texts:
Reference Document: https://eprint.iacr.org/2016/027.pdf

According to appendix D section 4 definition 27

  each vertex in V has predecessors sampled independently and uniformly at random from the set U

It appears from the pseudo-code in section 3.1 step 2b, and the reference code given on GitHub hash_state_mix(), that this has been implemented by the authors as some form of squeezing bits out of the hash function; however my question is could it just as easily have been done with Mersenne Twister or is there another reason why the hash is required?


texts: What if an AES GCM nonce overflows and collides with the GHASH nonce (0^128)?

texts:
When using AES in GCM mode, the GHASH function uses E(0^128) as the initial value for H, the authentication key. The IV, for the underlaying CTR mode, is initialized with:

[prefix (application nonce)] [initial_counter (4 byte counter)]

This initial counter starts at ...02, like explained here. I'm guessing this is done to prevent a collision with the GHASH function.

It's known that letting a nonce overflow is very, very bad, because repeating a nonce completely breaks GCM mode. But what if the prefix is all zeroes, and the counter overflows only to 0xffffff+1 (0^128)? You'd have one block that's xor'ed with the same value as the authentication key. Would this break GCM?


texts:
Imagine two persons: Alice and Bob. We have a generated secret value that is valuable and has to be encrypted in a way that both can't reveal the value on their own but only when they both confirm.

My first approach would have been to double encrypt the secret value. One time with Alice keyset and one time with Bobs keyset. The problem: They both don't trust each other. So we can't send Bobs public key to Alice in order to double-encrypt, because Bob can't trust Alice that she stores the generated secret value before encryption.

My second approach is to write a software tool that generates the secret value and immediately encrypts it with Alices and Bobs' public key. But if Alice runs this software, how can Bob be sure that the encrypted hash he got was generated from this software tool and not from a compromised tool from Alice?

I hope the idea is understandable. Which approaches could solve this problem? Do I need a third person that does the encryption for them - and what if there is no such person, that Alice and Bob both trust.


texts:
Alice has bought a brand new hard disk, $K$ (with $K \sim 10^{12}$) bytes in size. She is very happy about her purchase, and tells Bob about it. Bob claims he also bought a $K$ bytes hard disk. Alice doesn't really trust Bob on this, so she asks him to prove his claim:

Alice sends Bob an $O(\ln(K))$ sized problem she has generated.
The problem can only be solved if one has $K$ bytes of memory.
Bob sends back an $O(\ln(K))$ sized solution.
Alice verifies the solution.

In particular, there can be two distinct cases:

Alice verifies the solution without having to carry out the same operations as Bob (in this case, she doesn't even need to have a $K$-bytes hard disk herself)
Alice computes the same solution as Bob on her side, using her own hard disk.

What problem could we use? It is perfectly okay if the nature of the communication between Alice and Bob changes a bit (for example requiring more than a two-way communication is okay), but the communication should never grow in size to something like $\Theta(K)$.

Solutions I tried

(Feel free to skip this section if you don't need inspiration!)

Using $\Theta(K)$ communication, Alice could obviously generate $K$ random bytes, send them to Bob and ask him to compute the hash of some subset of them that she will send only after sending the whole payload. (We need the hash of a subset of the data otherwise Bob can compute the hash on the go as he receives the bytes). But this solution is obviously discarded because it requires too much communication.
Alice sends a seed, Bob generates random numbers with the seed to fill the $K$ bytes, then he sorts the bytes and computes the hash. However, an $O(K^2)$ (in time) solution exists that will allow Bob to compute the hash by extracting the first, second, third... item by repeatedly re-generating the random numbers. So this doesn't actually prove that Bob has a $K$-bytes hard disk.
Alice sends a seed, Bob generates random numbers with the seed to fill the $K$ bytes, then a shuffling procedure is put in place to randomly take small blocks and hash them together, or XOR them, or anything in that fashion, so that after a few iterations each byte depends on every other and it is impossible to compute a partial solution on the go. Alice then asks the hash of a subset of the total result (or even the total hash). This could work, but it has the issue of producing an huge amount of random I/O on the disk, which could actually damage a real-life, non-SSD hard disk.
Bob generates a sequence of proofs of work (as in bitcoin mining). Bob then generates a Merkle tree on the sequence and sends the root to Alice. Alice asks for $N$ random proofs of work, and Bob sends back the whole navigation on the Merkle tree from the root to the leaf, Alice verifies everything. However, Bob could just save the first $L$ layers of the Merkle tree, and re-compute on the go all the leafs under the last node memorized. If he stores $10^9$ values, for example, he will just have to recompute $10^3$ leafs, which is feasible on the go.


texts: Starting stream cypher, first block (Salsa20)

texts:
I'm implementing Salsa20 in Rust for fun.

I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm confused on how to encrypt the first block. QR is applied on the 4x4 matrix, but how do I "mix in" the input? Is there a better reference for this algorithm (or stream ciphers in general) I could use to understand the implementation?


texts: When to use Argon2i vs Argon2d vs Argon2id?

texts:
I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case.

I want to securely encrypt passwords in a database in an unshared environment.
After first pass of the docs (pun-intended) it sounded like Argon2i is recommended in this case, but I feel like it's more likely for someone to gain access to the database directly and try to execute a GPU/ASIC/FPGA based attack to decrypt the data than someone gaining access to the network and attempting a side-channel attack.

I would like to prevent side-channel attacks if possible too, so that sounds like Argon2id is the way to go, but my understanding is the i-portion of the implementation only does one pass. Does the one pass really offer much protection against side-channel attacks (I read 3+ or even 10+ passes are needed to really secure Argon2i) and is there a way to increase the number of passes for the i-portion before the d-portion kicks in?

If Argon2id is the implementation for my use-case, but I can't increase the number of passes for the i-portion, would it make sense to effectively create my own "Argon2id" by implementing the Argon2i algorithm first, and then running the output through the Argon2d algorithm after?


texts: Has any crypto hash function been proven to be surjective?

texts: This answer claims that "it is not proven that all outputs of SHA-1 are possible." Has any crypto hash function been proven to produce all possible outputs (i.e., to be surjective over the codomain of all possible numbers $[0, 2^n]$, where $n$ is the number of bits of the hash)?


texts: RSA encryption input range - plaintexts that map to ciphertexts?

texts:
According to the wiki article on the RSA encryption function, the valid range of input $m$ is $0 \leq m \lt n$. However I have found that the following values of $m$ always return themselves when encrypted:

$0$
$1$
$n - 1$
$n - 2$

Have I implemented the algorithm incorrectly or am I misreading the wiki article?


texts: How to generate a non periodical, theoretically infinite, sequence of numbers from a secret alphanumeric key

texts: Are there algorithms that enable the creation of a non periodical, theoretically unlimited, sequence of numbers based on an alphanumeric secret key? The idea is to produce always the same unique sequence from a secret alphanumeric key, where the sequence doesn't leak information about the used key, and looks random enough from a cryptographic stance. If the key changes just one bit, the pattern is completely different. Is there a known secure way to produce this?


texts: How to exchange keys despite a MITM, using some short known password?

texts:
The simple scenario is two devices on one WiFi network sitting side by side. The user can copy a short code from one device to the other to be the "password" however this code can't be too long. Let's assume it's at most 12 decimal digits. The devices will only allow one attempt so any MITM attacker will have to take a chance with only 1 in a trillion for success, which will also alert the user that he (the attacker) is there, so that would be secure "enough" for me. This is all there is, that is, there is no server which both devices have its public keys.
But how would this work? I thought of something like the following but ran into a problem. If there's a standard solution for this key-exchange scenario, please feel free to ignore the following:

I thought device d1 can create a random number in the above mentioned
range and use it as the key for Rijndael encryption of its public
encryption key but without a need for padding so that all ciphertexts
can be "decrypted" so that the MITM won't be able to brute force which is correct
by being alerted that a wrong one is wrong. The second device d2 then uses that password to
decrypt the ciphertext (which is transmitted over wifi). It then uses it
to encrypt and send d1 its (d2's) keys. The idea is that the MITM
won't know which of the trillion possible deciphered texts is correct.
And even when he (the MITM) sees the message back from d2, won't be
able to brute force it, because the plaintext of the sent ciphertext
will be random-like (because it's a public key of an unknown key pair)
and will be encrypted like the first one, where there is no padding and
therefore an attacker can't see whether they got the correct plaintext
or an error.
Unfortunately this might not work because the MITM might be able to
preemptively craft a set of keys (- a trillion decipherings of some
key) where the key used can be detected from the ciphertext, and send that key to d2 and then discover the "password" from d2's response. Can this
be done?
Also, the usual rule of not rolling out my own encryption scheme.

So, is there a safe way to exchange keys despite a MITM, using some short known password? (Preferably with forward secrecy such that brute forcing, if it takes a month, won't give the attacker the ability to start impersonating one of the devices from then on.)


texts:
Why does AES file encryption not ensure perfect secrecy?

I understand that $\Pr[E(K,M_1)=C_1] = \Pr[E(K,M_2)=C_2]$ given $M1\neq M2$ holds for perfect secrecy of a scheme.
However, this seems to hold for any message with AES.


texts:
'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.

To summarise, we generate a symmetric key and encrypt it using RSA. We would encrypt our data using the symmetric, and prefix it with the IV and encrypted key. You therefore need the private key from the RSA keypair to be able to decrypt the symmetric key and then decrypt the data using the symmetric key.

My question is about combining RSA with autheticated encryption, specifically AES in GCM mode. Are there any pitfalls, or any reasons this might be a bad idea?

Is it a good idea to include the IV and RSA-encrypted symmetric key in the additional data (to provide integrity for them), or should they simply be prefixed to the encrypted data?


texts: How to decrypt a substitution cipher using a Base64 alphabet

texts:
Let us consider a cipher that works like the following:

Plaintext is encoded to Base64.
The characters in the encoded plaintext are substituted with a randomly shuffled character set (a-z, 0-9, A-Z, /, +).

The shuffled alphabet are the key. How do I decipher it to get the base64 encoded string without knowing the shuffled character set?


texts: Voting scheme where the votes become public when a threshold is reached

texts:
Does there exist a voting scheme where voters cast private encrypted votes that automatically become public only after the threshold number of votes is cast?

It needs to be done without a central authority that is trusted to hold keys. I don't need it to be receipt-free, I just want it to be authority free and automatic.

The reason why I need this is, that seeing other people's votes before the threshold is reached could bias the final outcome.


texts: Partially Homomorphic Cryptographic Schemes - Deterministic vs Probabilistic

texts:
While reading this paper I realized that textbook RSA was the only deterministic PHE scheme mentioned. I did cross-check the ones listed in the Wikipedia article also and, quite on the opposite direction to this question, I could not find any of them to be deterministic. Now, I am aware that, as drLecter points out in the answer to the question previously linked, the deterministic ones are weaker and are to be avoided. However, I would be very interested in knowing whether any other PHE scheme exists aside from RSA. I think it might be the reason why it is the only one I've seen where the operation is the same (modular multiplication) in the Plaintext and Ciphertext space.
Also, trying to respect the original notation on RSA's homomorphism but emulating the figure 2.1* of the paper which of these 3 diagrams would be more correct?

*I linked a cached version of the paper 'cause the only pdf I found gets directly downloaded when clicking the link. Unfortunately the figure 2.1 cannot be seen on the cached version, here is the link  for the actual pdf.


texts: Why using AES in ECB (Electronic Code Book) mode a bad idea? is CTR mode better? Given only these two can be used for parallelization.


texts: Attribute-based encryption for cloud storage

texts:
I'm trying to understand attribute-based encryption schemes. Almost all articles describe that they are designed for cloud storage, but as I understand, almost all computing (encryption & decryption) is performed client-side and not in the cloud.

In this regard, I have a question: How are these schemes related to cloud storage?


texts: Is it more secure to use Diffie-Hellman to generate a symmetric AES key for use with CBC, rather than use CBC directly atop RSA encryption?

texts:
Short question:
If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security disadvantage to encrypting the blocks directly with the RSA asymmetric key rather than deriving a symmetric AES key using DH and using that?
I understand that hybrid encryption using an AES symmetric key is faster than encrypting every block with RSA.  And I understand that using hybrid encryption with a DH-derived AES key might be more secure than pure RSA is if you also hash-ratchet the AES key to provide forward secrecy.
But if we ignore hash ratcheting and forward secrecy, for a given stream is DH-AES actually more secure than just encrypting every message with RSA?  I don't think it is, but I want to confirm.
Longer question:
If we assume:

A symmetric (such as AES) encryption function symEncrypt(K,M) that can encrypt M-byte blocks with key K, with a matching symDecrypt(K,M) function that decrypts the results, such that M = symDecrypt(K, symEncrypt(K, M))

An asymmetric (such as RSA) encryption function asymEncrypt(K.pub,M) that can can also encrypt M-byte blocks with a public key K.pub, with a matching asymDecrypt(K.priv,M) function that decrypts the result with the private key K.priv, such that M = asymDecrypt(K.priv, asymEncrypt(K.pub, M))

Two parties, Alice and Bob, each of whom have generated one-session-use asymmetric keypairs Alice.pub/priv and Bob.pub/priv respectively, and have exchanged those public keys with each other

A plaintext message split up into a series of M-byte sized blocks, P[0]...P[n], that Alice wants to send Bob in a secure fashion, over an insecure network

Is there any security difference between:
Hybrid Encryption:
A ciphertext message constructed using CBC atop AES symmetric encryption using a Diffie-Hellman derived key:

Alice derives a secret key from her private key and Bob's public key: K = Diffie-Hellman(Alice.priv,Bob.pub)
Alice encrypts the first block using a predetermined IV, and sends it to Bob: C[0] = symEncrypt(K, P[0] ^ IV)
Alice encrypts the second block using the first cihperblock, and sends it to Bob: C[1] = symEncrypt(K, P[1] ^ C[0])
... and so on for all n blocks
Bob derives the same secret key that Alice did, using Bob's private key and Alice's public key: K = Diffie-Hellman(Bob.priv,Alice.pub)
Bob decrypts the first block using the predetermined IV: P[0] = symDecrypt(K, C[0]) ^ IV
Bob decrypts the second block using the first cipherblock: P[1] = symDecrypt(K, C[1]) ^ C[0]
... and so on for all n blocks

Pure Asymmetric Encryption:
A ciphertext message constructed using CBC atop RSA asymmetric encryption:

Alice encrypts the first block using a predetermined IV, and sends it to Bob: C[0] = asymEncrypt(Bob.pub, P[0] ^ IV)
Alice encrypts the second block using the first cihperblock, and sends it to Bob: C[1] = asymEncrypt(Bob.pub, P[1] ^ C[0])
... and so on for all n blocks
Bob decrypts the first block using the predetermined IV: P[0] = asymDecrypt(Bob.priv, C[0]) ^ IV
Bob decrypts the second block using the first cipherblock: P[1] = asymDecrypt(Bob.priv, C[1]) ^ C[0]
... and so on for all n blocks

I think in every practical sense they will be equivalently secure.  (Sure, maybe one will take a thousand years to crack, and the other two thousand years, but both are effectively secure for real world use.)
It's not more secure to derive a shared AES symmetric session key using
Diffie-Hellman and encrypt a message with that, than to just encrypt a message with a RSA public key and decrypt it with the corresponding private key, is it?


texts: How is an epsilon of 1/1000 non-negligible?

texts: Lately I've been studying cryptography and in the current course I'm taking we're reviewing statistical tests and how they can be used to determine if a pseudo-random generator is secure or not. Essentially, one of the requirements for a Pseudo-random generator to be secure is that the probability of guessing the next bit in the string is less than 1/2 + a non-negligible epsilon (epsilon being any statistical advantage the computer has of guessing the next bit of the string due to insecurity in the PRG). In an example the professor uses, he states that the probability of guessing the next bit of output from the PRG is 1/2 + 1/1000 (the non negligible epsilon). How is 1/1000 non-negligible? I understand we're using computers with thousands of times faster processing power than a normal human brain, but that still means that a computer only has a 50.1% chance of guessing the correct bit. How can a computer leverage that tiny extra probability to crack a secret key?


texts: How do revocation certificates work in PGP?

texts:
I've already read how to build and upload them, but I'm wondering how revocation certificates work, what informations they hold and so on.

Suppose my private key is compromised, but I have a revocation certificate hidden somewhere.
How the keyserver matches the revocation certificate to the compromised key? Is it possible to distinguish my revocation certificate from one generated by an attacker with the stolen private key?


texts: Best suitable column type for openssl $tag,$iv,$key,$encrypted?

texts:
Which column type is best for storing  $tag, $iv, $key, $encryptedData  generated by openssl_encryption, and in which format I should save these values?
I am using "aes-128-gcm" cipher method.


texts: Hashing a password with SHA256 on the client then bcrypt on the server

texts:
I'm trying to implement a cryptographically secured storage site (not Mega, or anything similar) and am trying to prevent the user's password from ever touching the server. The password is used to both log in and generate a PBKDF2 key for AES in Javascript, so the plaintext password should never leave the client machine.

What I'm thinking of doing is getting the client to generate a SHA256 hash of the password and send it to the server, which will then use bcrypt on that hash to create final hash to be stored on the server. My concern is that after hashing the user's password client-side and server-side with two different algorithms, I might either a) be losing entropy in the password or b) opening myself up to attacks due to the mixed hashing methods. Are my concerns based in reality?

Thanks

[edit] all communication will be secured over 2048bit SSL so MITM or sniffing are not a primary concern.


texts: Energy consumption by mobile or sensor node when executing xor / encryption / decryption

texts:
I try to estimate the energy consumption by a sensor node when executing an authentication algorithm witch contains operations (hashing, XOR, Encryption / decryption by public/private key, addition,...).

The algorithm is named MDA (Message Digest Based Authentication). It contains:

(SN:sensor node; CH: cluster head; Th: hash operation ; Tx: transmit;
 Touex: XOR; Trec: reception; Tenc: encryption; Tdec: decryption)
**-Registration Phase :**
*SN-->CH:
2Th+Tx+Touex
*CH-->SN:
Trec+Touex+3Th+Tenc+Tx
**- Authentication Phase :**
*SN-->Ch
Th+2Tenc+Tx
*CH-->SN
Trec+Touex+2Tdec+Th
**- Numeric Certif**
*CH-->SN
Th+Tenc+Tx
*SN:
Trec+Tdec

So I ask if there are measurements that I can use to calculate energy.


texts: Creating ECC Signature - Is "R" necessary in calculating "S"

texts:
After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature.

In other words, what's the problem with using the following equation to calculate "S", $S = \frac{z + dA}{k}$

Let me explain in more detail... a few of the proofs I've found online use the following logic:

In creating the signature, the following equation is used to calculate S.

1) $S = \frac{z + dA(R)}{k}$ where k is random number, z is hash digest, dA is private key, R is x1 of P(x1,y1) = k (G), & G is base point.

In confirming the signature the following equation is used:

2) $P(x_1,y_1) = \frac{(z)(G) + R(Qa)}{S}$ where Qa is public key and R is x1 of P(x1,y1)

The proof that I found states the following. Since we are interested in using eq #2 to calculate D which equals (k)(G) where D is x1 and Qa = (dA)(G) then we can re-write equation #2 as the following:

$(k)(G) = \frac{(z)(G) + (R)(dA)(G)}{S}$ which can be reduced to the following:

$(S)(G) = \frac{(z + (R)(dA))*G}{k}$which is the same as

$S = \frac{z + (R)(dA)}{k}$ which is the same equation as equation #1.

In calculating S to create the signature, couldn't we also just use the following equation:
$S = \frac{z + dA}{k}$ where the "R" is omitted? If you re-do the above proof it works without multiplying dA by "R" assuming you also omit "R" form Equation #2 to confirm the signature.
The benefit or necessity of multiplying dA by "R" to calculate "S" is not apparent to me.

Thank you!


texts: Reverse Encryption Algorithm from Decryption code

texts:
I have the code for a decryption algorithm but I'm struggling to figure out how to reverse it into the original encryption code.

function write(x) {
    return x >= "0" && "9" >= x ? (x.charCodeAt(0) - 48) : (x >= "a") && "f" >= x ? (x.charCodeAt(0) - 87) : 0;
}

function ondata(input) {
    var DATA = "";
    var i = 0;
    for (; i < input.length; i += 2) {
        var diff = write(input[i]);
        var firstNum = write(input[i + 1]);
        val = 16 * diff + firstNum ^ [31, 126, 188, 168, 210, 3, 208, 219, 229, 149, 187, 222, 17, 31, 59, 100, 131, 62, 163, 81, 115, 154, 2, 220, 166, 30, 112, 192, 48, 172, 174, 119, 249, 5, 251, 41, 46, 148, 43, 210, 35, 42, 231, 145, 16, 6, 10, 28, 228, 49, 103, 248, 151, 109, 19, 20, 151, 243, 12, 193, 152, 126, 83, 235, 27, 109, 66, 96, 179, 88, 11, 189, 30, 187, 23, 172, 93, 109, 239, 247, 123, 105, 55, 98, 117, 175, 114, 212, 146, 136, 38, 115, 124, 39][i / 2];
        DATA += String.fromCharCode(val);
    }
    return DATA;
}

ondata("6c0adddaa66abebc"); // 'starting' (javascript)

As shown, the string 6c0adddaa66abebc produces the output starting. My initial thought was to take the character code of each input character, but I wasn't sure what do to then. I'm sure it's just simple algebra but an explanation or a point in the right direction would be great, I'd like to learn from this.

UPDATE:

Ilmari Karonen's post gave me the help I needed to understand this. The problem I had was that I didn't actually understand what the long val = 16 * ... line was doing. His refactored code and explanation helped me to understand the process. Here's how I came up with the solution if anybody's interested in the thought process:

I knew I had to reverse the function, like in algebra. So logically, I started with finding the character code of each letter in the starting string:

var x = value.charCodeAt(i);

Now, I had to "undo" the xor applied, which obviously (not to me) was just the xor function with the same key:

x ^= key[i];

Then, I had to undo the conversion of the hex string to a decimal number, which was just converting the decimal to a hex number:

var hex = x.toString(16);

I also had to add padded zero's to the hex number, because the decoder worked in pairs of two.

if (hex.length < 2) hex = '0' + hex;

Final solution:

function parse(value)
{
    var result = "";

    for (var i = 0; i < value.length; i++)
    {
        var x = value.charCodeAt(i);
        x ^= key[i];

        var hex = x.toString(16);
        if(hex.length < 2)
          hex = '0' + hex;
        result += hex;
    }
    return result;
}


texts: Is there any benefit to *really* strong passwords?

texts:
Suppose you had these two passwords:

password_one = "Z;$]bnNvY3I-Ww]R4qm7PpiE/@y9Qz$cNk{d3"
password_two = "4tjDqq])G-^u:PT~X]QBTa,XqUk[o9`(p?iC`w8*)*T9t\@l+^+U04m@_8CXV:E7L\R]\>N6M.0E|%Ud_f*]bN*rn^;FX7\M%5t?"

It seems to me that they are both strong. Is password_two harder to crack than password_one?

I guess this depends on what sort of hashing is involved. What if Bcrypt or sha512 are used, would there be any benefit for using password_two?


texts: Number of terms in Balanced boolean functions?

texts:
I know that balanced boolean functions are required for creating S-boxes. I want to create four balanced Boolean functions for 4X4 Sbox and as far as I’ve understood, the maximum order of the balanced Boolean function should be <= (number of var)/2.

But… how many terms should there be in my boolean functions?


texts: Finding Private key in RSA with public key, cipher text and plain text

texts:
Is there a known 'non-brute force' method of determining a private key in an RSA system when all other parameters are know?

I found the values of a ciphertext ($C$), its corresponding plaintext ($P$) and the values of the public key ($e$,$N$) are known.

We know that:
$$P = C^d \mod N$$

Here, the value of $P$ is known (the cipher text has been decrypted) and the values of $C$ and $N$. Given these parameters, is it possible to find $d$?

Also, how do I find an integer $k$ such that $(k\cdot N - P) = C^d$ ?

Any suggestions/discussions are welcome.


texts: How Multiplication Table is generated for GF(2^2) field

texts:
I was unable to solve the multiplication table given in the book for $\mathrm{GF}(2^2)$.However, I have managed to solve the addition table.

Acoording to the Book multiplication is the AND operation, but when I applied this I did not get the answer given in the book.

This is the Table given in the book:

I couldn't replicate the same answers for 10x10 or 11x11.


texts:
In the SHA-2 family, specifically SHA-256, there are functions called Sigma0 and Sigma1, which look like this:

Sigma0(b, c, d)
{
    Return (b & c) ^ (~b & d);
}

I don't really understand the logic or idea behind this. I looked on the internet a lot, but I couldn't find an answer to my question.

So does anybody know why they chose this specific function? Is it part of some secure block cipher or permutation algorithm? I couldn't find anything about the Ch and Maj online, nor what I'm asking now.


texts: Can several run of a semi-honest protocol be used to infer malicious security?

texts:
In the ideal world, $A$ sends several inputs $x_1,...,x_\lambda$ to the functionality and $B$ sends input $y$. Functionality sends $f(x_1,y),...,f(x_\lambda,y)$ to $A$ and nothing to $B$.

Suppose that we have a protocol which is secure against semi-honest adversaries to realize this functionality.

In this protocol, $A$ sends encrypted values of $x_i$s to $B$. $B$ computes the encrypted result of each $f(x_i,y)$ and sends them back to $A$. $A$ decrypts these values to know each $f(x_i,y)$.

Is it possible for $A$ to choose $x_i$s in a way that this protocol is also secure against malicious $B$? For example, $A$ can choose some $x_i$s equal or with some specific relation in such a way that any deviation from the protocol is detected?

What I am intended to say is something like cut-and-choose but for outputs instead of inputs.

More generally, is it necessary to force the malicious party to act honestly at each intermediate step or it is sufficient to force him to output correctly?


texts: Elliptic Curve based blind signature implementation

texts:
I want to use Elliptic Curve based blind signature scheme for my research.

There is no proper implementation of ECC-based blind signatures.

Can someone describe to me which things I need to follow when implementing this?


texts:
Probably the simplest cipher is the xor cipher with a single integer. One can extend this to use more than one integer by several means. I'm wondering if there is any benefit to doing more than this:

Let $x_n$ be the $n$th data byte to encrypt and $p_k$ be the data stream (password or whatever) to encrypt with and $p_k$ is cylical.

Then the "standard" way of doing the encryption is

$$\large y_n = x_n \small\oplus\large\; p_k$$

But for certain functions $f,g,h$

$$\large y_n = x_{h(n)} \small\oplus\large\; f(p_{g(k,n)},n)$$

is invertible.

My question is:

  Without knowing what formula and functions are used, would such a method make it much more difficult to "crack" an encryption? (Basically is there any real benefit to using a more complex formula. Ofcourse, if anyone has any theoretical insight in how these modifications "enhance" the encryption then by all means ;) My guess is that it is too difficult, mathematically, to understand in general. For example, if invertibility exists and f,g, and h have certain properties, do we end up with a more secure encryption than the standard xor cipher(which is easily attacked using frequency analysis)?)

Assume $f,g$ and $h$ are the best possible functions in whatever way is needed.

What I have noticed is that such complex formula seem to increase the "randomness" of the output over the standard method.

It would seem that if $f,g$ and $h$ are completely known to the cracker then it is equivalent to simply using a different $p_k$ and $x_n$ and equivalent to the standard method.


texts: What is the difference between a HMAC and a hash of data?

texts:
On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data.

What exactly is the difference between an HMAC and a hash of a span of input data?


texts:
We are given an arbitrary number $n$ and a sequence of primes $p_1=2$, $p_2=3$, ..., $p_k$. I am interested in the following question: Are the events "Prime $p_i$ is a factor of $n$" independent for distinct primes $p_i$?

It seems that the answer is no but I think this depends on the size of $n$. If $n$ is slightly greater than $p_k$ or lower than $p_k$, the answer is no. But what about the case where $n \geq \prod_{i=1}^k p_i$?

This is an intuition but I am not able to give a argument.

Thank you


texts:
I'm working on a P2P communications and chat framework, and am looking for a quantum-secure asymmetric key exchange algorithm which I can use to perform a key exchange of an AES-256 bit key. This is an open-source project which will be licensed under GPL-3.0, and I have considered using NTRU. However; I have discovered that NTRU is a patented cryptosystem, and is therefore not compliant with the licensing constraints that apply to my application. Are there any asymmetric key exchange systems other than NTRU which are not patent encumbered, and secure against quantum attacks?
UPDATE in response to NTRU answer
Turns out that the patent grant may not be in fact in compliance with the GPL. The patent grant document the answer refers to (PATENTS.md) states that

  Businesses and enterprises that wish to incorporate NTRU cryptography into proprietary appliances or other commercial software products for re-distribution must have a commercial license

In contrast to the GPL, which permits commercial usage of a work if the commercial product is also licensed under the GPL. See the official FAQ on the matter of commercial use. This same FAQ page also clarifies, under a different section that the licensor cannot ban commercial/military use of a GPLd work as doing so is contradictory to the GPL.

UPDATE 2 -- Response from Security Innovation
The issue regarding GPL compliance has been sorted out. Below is an e-mail I have received clarifying the issue. I have decided to use NTRU under the GPL in my solution, and will be marking this answer as accepted.

  Thanks for getting in touch. You're absolutely right, our patents.md file isn't correct: it specifies GPL but then contrasts GPLed use with commercial use of the patents, even though as you point out commercial use isn't precluded by GPL. So our patents.md file is not in fact consistent with GPL 2.0. This was an oversight on our part. The intent was to have language identical to what's in our licence.md file at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/LICENSE.md, specifically: "Parties who wish to distribute ntru-crypto, or components thereof, under licenses other than the GPL or the FOSS Exception must obtain a commercial license." This wording makes it clear, I hope, that in this context we use "commercial license" to mean "license for non-GPLed use". The intent is to be fully GPL compliant, including supporting commercial use under GPL. I'll work to get this language clarified on the site. Thanks for your eagle eyes, this is a good one to get sorted out.
  Hope this helps and let me know if you have any more questions.
  Cheers,
  William


texts: How to responds to server in order to prevent replay attack?

texts:
I am trying to solve the next question:

A client needs authenticate to a server. The client and a system share
the server public-key. Denoted here as K. The client sends to the
system a message requiring an authentication, and the server responds
with a nonce. What does the client send to the server as respost in
order to prevent replay attack

The result of encrypt a nonce with symmetric cryptography and a key K.
The result of sum K to the nonce.
A OK message
The result of encrypt a nonce with asymmetric cryptography and a key K.
The digest of the nonce

Could you help me with this question please?.
For me this question is strange because (1) and (2). Specifically, I think that I do not need to send any key K to the server because this key is a public key. Thus, I think the respost is or (2) or (5). Could you help me, please?


texts: In the mix column stage when multiplying the byte  value by 2 the following gives the correct answer. If the MSB of the byte value is 1, then left shift the byte value by 1 bit and then XOR the resultant with 27. What is the logic behind this number 27. How was it arrived at.