texts: "Work factor" and "iteration count" nomenclature in adaptive functions

texts:
In adaptive functions like PBKDF2 / bcrypt I often read people refer to "iteration count" and others refer to "work factor", and they seem to be used interchangeably (even though they're not - the latter is used to calculate the former).

I also see this (commodity hardware circa 2019):

iteration count: e.g. 100,000
work factor: e.g. 16 or 17, i.e. 2^16..2^17 (65536..131072)

I like the idea of work factor as it's simpler to reason with when coding, e.g. I can "increase the work factor" every year, which means go from 16 to 17, etc. So it's a base-2 "order of magnitude".

However, what is the "correct" nomenclature?


texts: Concrete Example of AND Gate Using Garbled Circuit

texts:
Most of the resources online like the wiki presents the beautiful idea of Garbled circuit in a rather unnecessarily abstract manner. This is the screenshot of Wiki's protocol:

What would be an example of step 2? How does Alice garbles the circuit? Using any public-key crypto or private? Could anyone please give me a concrete example of any gate, say AND using this primitive? Like, at the bitstring level. For example, let's say Alice has bit $0$, Bob has bit $1$. They would like to compute the AND. Thanks!


texts: Is EC integrated encryption scheme used in practice?

texts: I know ECDSA and ECDH are used a lot but what about the ECIES? Is it used or specified as an option in any protocol?


texts: How to calculate initial RC5 encryption parameters?

texts:
I learn from a minithesis to understand RC5.
As we can see at the formula, the round 0 must be using A=A+S[0], because the loop is starting at r(round) 1.

I tried addition and OR(bitwise) to get the answer DA679BFB but keep missing, Here is my result of calculating.

A = A + S[0]

  = 4B726970 + BF0A8B1D

  = 10A7CF48D

A = A OR S[0]

  = 4B726970 OR BF0A8B1D

  = FF7AEB7D

The S Data is the result of 3rd phase key expanding on RC5. I really need help because I have been stuck here for 2 days and thank you in advance.

Plaintext : 4B726970 746F2053 74656761 6E6F
key       : 4B726970 746F6772 616669
w(blocksize) = 32, r(round) = 12, b(key lenght) = 16


texts:
I'm studying the Lamport's Hash one-time password scheme.

This is the scheme:

Alice wants to authenticate herself to Bob from a workstation that knows nothing about her. Alice only knows her password.
Bob knows

Alice types her name and her password into her Workstation
The Workstation sends "Alice" to Bob
Bob sends n to the Workstation
The workstation computes x = hash^(n-1) (pwd) and sends it to Bob
Bob hashes it once and compares it with database. If it matches, Bob considers the response valid, replaces the stored quantity with the received quantity, and replace n by n-1.

This scheme has a security weakness called small n attack.

This is the explanation given in "Network Security: Private Communications in a Public World":

  Suppose an intruder, Trudy, were to impersonate Bob's network address and wait for Alice to attempt to log in. When Alice attempts to log into Bob, Trudy sends back a small value for n, say 50. When Alice responds with hash^(50) (pwd), Trudy will have enough information to impersonate Alice for some time, assuming that the actual n at Bob is greater than 50.

I don't understand this. I would need a different explanation.


texts: Is there a key exchange protocol that requires only one message?

texts:
Say I want to exchange a secret with someone, but I only get to send one message to the other person, and then we encrypt with that secret. Diffie-Hellman and ECDH require multiple messages to be sent back and forth to get a shared secret.
Is there a key exchange that requires just one message to be sent from one party securely? (I know that sending the key over plaintext works, but that isn't secure.)
(Define message as a packet over the internet or one SMS for example)


texts: How can you derive a P-256 public key from the X and Y points

texts:
Deriving a secp256k1 public key is also possible.  For whatever reason, I'm only being provided X and Y, not the public portion.

I just need to get the binary representation of the public key given that I am provided X and Y.


texts: How secure is a lagged fibonacci sequence for encrypting brief messages?

texts:
Say I start with a 26-letter keyword and convert the letters into 26 integers (A=0, B=1...Z=25) nr[0] to nr[25]. Then I create a stream, nr[26] onwards, with a lagged fibonacci sequence where  nr[n]= (sum of nr[n-26] to nr[n-1] )mod 26. And I use the stream to encipher a brief message (no longer than 200 letters) in such a way that the stream is hidden.  How secure is that encipherment?

example of cipher:

ciphertext letter[n] = plaintext letter[n] + key letter[n mod 26] + nr[n+26]


texts: Hiding the metadata of a one time pad message by encrypting the next key

texts:
here is an idea that I feel has some big flaw I can't put my finger on.

The scenario is: Alice will go overseas for 5 days and will hopefully retrieve some information and send it back to Bob. She does not want to let anyone listening to know what day she got the information. She is taking with her a one time pad the size of the information, and a hardware random number generator.

The solution I thought of was:

Alice and Bob at home
Alice creates new key(key1) > Bob (key1)

Alice travels to Elbonia
Alice creates new key (key2) XOR key1 > Bob (key2)
Alice creates new key (key3) XOR key2 > Bob (key3)
Alice creates msg + padding (msg) XOR key3 > Bob (msg)
Alice creates new (rand) > Bob (rand)
Alice creates new (rand) > Bob (rand)
Alice travels home

Is this system any better or worse than just sending the encrypted message the day she receives the information, and pure random data on the other days?


texts: Problem with this authentication protocol

texts:
Consider such authentication protocol:

Alice and Bob share a key.

Bob sends alice a nonce.
Alice encrypts it with shared key and sends to bob.

Now assume Alice was successfully authenticated.

But there is such attack mentioned

  Trudy can hijack connection after authentication, if she can send
  packets with Alice’s source address

This seems to be a general problem with authentication protocols. Even if steps 1 and 2 are secure and authentication protocol is secure, trudy can always mount above mentioned attack after the authentication protocol is finished, isn't it?
How are such problems dealt with?


texts: Generate hash value using public key along with message

texts:
I was trying to understand one way signature chaining on message by Saxena and Soh. As the message is passed from one user to other, every user can combine their signature to create one single signature for a message m. This aggregated signature when passed along with public key of all users who have signed the message can be used to prove that message has been seen by every user.

The chain signature protocol defined under it has 3 steps:

What i do not understand is that in "Chainsign" step, how for a message m, we get different hash values H(i) for different values of L(i). I know that Hash function only takes message as input to yield hash value. How is sequence of public keys Y1,Y2,Y3....Yi is fed along with 'm' to get different hash values? can we practically add key along with message to hash function to get new digest, if so how this mapping is happening?


texts: Why is the market for cryptographic primitives non-commercialized?

texts:
There are not many successful companies in cryptographic primitives market. Certicom holds many patents attached to the ECC. RSA Security probably made some profits from the patent. Are there more examples?
Why do people, scientists not try to commercialize their achievements, despite the fact that they could do so, especially under patent protection? I know it's harder to sell a product when most solutions are free. I know that a patent can makes it difficult to adopt technology in this market.
Nevertheless, it is still not clear to me why such powerful and universally useful technologies are being developed and made available in a charitable way.


texts: Are ZKPPs possible with server-side hashed passwords?

texts:
A basic ZKPP (Zero Knowledge Password Proof) is based on the server being able to challenge the client, and the client can then prove it knows the password (in such a way that is verifiable to the server) without transmitting the password itself.

However, in order for the server to issue the challenge and verify the response, it seems like the server would need to have the password in plaintext. Anybody gaining access to the server would be able to simply retrieve the password.

Is it possible to create a ZKPP such that the server only maintains a hashed version of the password, and yet is still able to issue the challenge and verification?


texts: Is there any way to mapping point between 2 elliptic curves?


texts: modular reduction algorithm over $F_{2^m}$ doesn't seem to work when order of polynomial being reduced is small

texts:
I was considering algorithm 2.40 (arbitrary reduction polynomials) in the Guide to Elliptic Curve Cryptography and...  it doesn't appear to work when the order of the polynomial you're trying to reduce is less than the order of the reduction polynomial.

Say you have a reduction polynomial of $x^{128}+x^7+x^2+x^1+1$ (the GCM reduction polynomial) and are trying to reduce $x^{127}$.

With polynomial division the quotient is $0$ and the remainder is $x^{127}$ but algorithm 2.40 in the ... seems to give $0$ as the answer.

In the for loop $i$ is going from the $2m - 2$'th bit (more specifically, the coefficient of $x^i$) downto the $m$'th, where $m$ is the order of the reduction polynomial ($128$). So you never actually get to $x^{127}$ and so nothing is ever added to $C\{j\}$ and thus the return value is $0$.

Is my analysis correct? If so that would seem to imply that the algorithm given n the Guide to Elliptic Curve Cryptography is insufficient and it's inclusion probably ought to be considered errata?


texts: Can we design a block cipher based on SP-network without loss of E/D similarity theoretically?

texts:
I understand what SP-network (Substitution-Permutation Network) and Feistel Network look like. And those ciphers based on Feistel (e.g. DES) often achieve so called E/D similarity, which indicates that the cipher itself follows the same pattern during either encryption or decryption.
SPN, comparing with Feistel Network, can bring more "confusion" into the cipher indeed. But the ciphers deriving from SPN (e.g. AES) may not be able to realize this E/D similarity. For instance, we have to put the inverse SBOX into the AES decryption process.
Thus, can we design a block cipher based on SP-network without loss of E/D similarity theoretically? Thanks!


texts:
Let $(x,y) \in E'_{\mathbb{F}_{p^2}}$ be a point of the sextic twist.

I am currently trying to compute:

$\psi : (x, y) \leftarrow (\mu^2x,\mu^3y)$ with $\mu \in \mathbb{F}_{p^{12}}$ the root of $(Y^2 - \xi)$ with $\xi = 1+i \in \mathbb{F}_{p^{2}}$.

From the original curve over $\mathbb{F}_{p^{12}}$ (that is $y² = x³ + 2$) I found the twisted curve over $\mathbb{F}_{p^{2}}$ (that is $y² = x³ + (1-i)$) so I am currently able to easily find points in the twisted curve. However I don't really understand how I am supposed to compute $\mu$ in order to compute $\psi$ and get my point in $\mathbb{F}_{p^{12}}$.

Does anyone have any idea of how I can find $\mu$? I mean is there an algorithm that computes $\mu$? I know that $\mu^6=1+i$ but how do I compute $\mu$?

Thank you very much!


texts:
Why is RSA safe, using this algorithm to calculate $d$ as the private key?
$$e\cdot d \equiv 1 \pmod{\varphi(n)},$$
where $e$ is part of the public key and $n$ is also part of the public key, so there is only one variable the attacker doesn't know, and that is $d$?  Why can't they can use the extended Euclidean algorithm to calculate it?  Even if they can't, why is it considered safe?


texts:
This exercise comes from Coursera's "Cryptography" course.

  Let $F$ be a PRF, is the following $G(x)=F_{0…0}(x)∥F_{0…1}(x)|| ... ||F_{1…1}(x)$ a PRG?

$F$ is a PRF with $n$ bit key, input, and output length. I know the answer is “NO it isn't!”, but I can't understand why.

Is that because on any input $x$, the keys for every $F$ in the concatenation sequence are fixed, which implies that the $F$ functions are not randomly chosen over $2^{-n}$? Could this be a possible answer?


texts:
I was wondering whether plain RSA encryption can be cracked given:

The public key
A plaintext of a known cipher text(s).
In other words the decrypted message from an encrypted one (but without knowing the private key)

I.E.: you have managed to find the plaintext of an already encrypted message using the public key, however, you DO NOT know the private key.

With maybe some form of adaptive-chosen-ciphertext attack?

edit: maybe also take advantage of plain-RSA malleability?


texts: Which answer is true regarding birthday attack on digital signatures?

texts:
The actual question is:

A sender $S$ sends a message $m$ to receiver $R$, which is digitally
signed by $S$ with its private key. In this scenario, one or more of
the following security violations can take place.
(I) $S$ can launch a birthday attack to replace mm with a fraudulent
message.
(II) A third party attacker can launch a birthday attack to replace
$m$ with a fraudulent message.
(III) $R$ can launch a birthday attack to replace $m$ with a
fraudulent message.
Which of the following are possible security violations?
A. (I) and (II) only
B. (I) only
C. (II) only
D. (II) and (III) only

so if a sender sends a message m to reciever.. I know that an attacker can perform a  birthday attack and send fraudulent message to receiver
But these statements confuse me!

Sender can perform birthday attack and send fraudulent message to Receiver

Receiver can perform birthday attack and create fraudulent message.

I searched upon this but this is too confusing can someone explain? They both seem to be true but the answer i saw states only one is? Can someone explain birthday attack! Thanks


texts:
Is it safe to use the hash of the data as the key to encrypt them?

That is, if I give one some encrypted data and tell them that the key that was used to encrypt them was the hash digest of the data before encrypting, will it be easier for them to decrypt them?

Edit as I can not reply to comments: The recipient will have the keys, that is no problem.


texts:
I want to understand more about substitution-permutation network, if we modify it
instead of carrying out the key-mixing, substitution, and permutation steps in alternating order for r rounds, the cipher instead first applies r rounds of key-mixing, then carries out r rounds of substitution, and finally applies r permutations.
How this could affect the security, and what is the security of this construction?


texts: Consequences of AES without any one of its operations

texts:
Suppose AES-$128$. There are $4$ operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey.

Question: If I remove one of the following opearations, what will happen to the AES?
SubByte, Shift Row, MixColumns

If Shift Row is removed, then attacker can treat input block ($128$ bits) as $4$ independent $32$ bits block. Hence, attacker can attack these $4$ blocks one by one to recover key.

If MixColumn is removed, then attacker can treat input block ($128$ bits) as $16$ independent $8$ bits block. Hence, attacker can attack these $16$ blocks separately.

If SubByte is removed, then the non-linearity of AES is gone. But I don't know how an attacker can attack the AES?

Can anyone give some hint?


texts: Sigma protocol for AND-composition involving the same secret

texts:
Say we have two public cyclic groups $G_1$, $G_2$ of corresponding prime orders $p_1$, $p_2$, and known generators $g_1$, $g_2$.
Say $g_3$ is also a generator of $G_2$.
For publicly known $C_1$ and $C_2$, and secret $r$ and $m$, I want to prove:
$POK\{(r, m): C_1 = g_1^r \land C_2 = g_2^rg_3^m\}$
Note here that $C_2$ is a Pedersen commitment using the same $r$. How can I prove this statmement?

I know proving Discrete-Log is easy using Schnorr's identification protocol [1], proving knowledge of both factors in Pedersen commitment is also possible using Sigma protocols [2], and using a common challenge we can build AND-composition [3].
The challenge here is to prove for the same $r$.

Bonus: how can I prove it in zero-knowledge (instead of with honest-verifier-zero-knowledge)?

[1] https://pdfs.semanticscholar.org/8d69/c06d48b618a090dd19185aea7a13def894a5.pdf
[2] https://courses.cs.ut.ee/MTAT.07.003/2017_fall/uploads/Main/0907-sigma-protocol-for-pedersen-commitment.pdf
[3] https://www.math.leidenuniv.nl/~edix/oww/mathofcrypt/schoenmakers/sigma-Leiden2003.pdf


texts: Is AES + RSA Encryption of individual log entries with the same key but different IVs secure?

texts:
I have sensitive logs that needs to be encrypted using AES-256 and RSA. Due to the nature of the logging system, the entries (rows) need to be encrypted one-by-one.

My approach was to reuse the same AES-256 key and IV (and also the same RSA pubkey) per run of the application. I would save the unencrypted IV and the RSA encrypted AES key together with each log entry. I figured out that this is not secure as two identical log entries in the same application run would yield the same cipher text, making inference possible (please correct me if this is not true).

What I'm thinking of now is encrypting each log entry using the same AES key but with different IVs . This will remove the need to perform the expensive RSA encryption for each log entry, while not allowing inference weakness. Is this approach secure?


texts:
The python library secrets gives a title as;

  "Secrets - Generate secure random numbers for managing secrets"

and makes a distinction from "random module" by

  In particularly, secrets should be used in preference to the default
  pseudo-random number generator in the random module, which is designed
  for modelling and simulation, not security or cryptography.

What are the methods the secret use?

And, are there any security evaluation of python's secret library?


texts: Standard deviation of gaussian noise in FHEW scheme

texts:
I've got two questions regarding the paper FHEW: Bootstrapping Homomorphic Encryption
in less than a second.

First, the final error of a ciphertext after the refresh procedure is stated as following a gaussian of standard deviation:

$\beta = \sqrt{\dfrac{q^2}{Q^2}\left( \zeta^2 \cdot \dfrac{B_{r}^2}{12} \cdot nd_r\cdot \dfrac{q}{2} \cdot 2Nd' + \sigma^2Nd_{ks}\right) + \dfrac{\|\mathbf{s}\|^2+1}{12}}$

Then, after giving their chosen parameters they conclude that $\beta = 6.94$. I don't understand where this result comes from. Even if we ignore the (positive) first term in the square root, as $\|s\| \leq n/2$ (with $n=500$ in the parameters), the standard deviation $\beta$ should be way bigger than $6.94$... Where does this result come from?

Second, they then say that the probability of error per homomorphic NAND is $p = 1 - erf(r/\sqrt{2})$ where $r = \dfrac{q/8}{\sqrt{2}\beta}$. I know that $p$ is the probability to get a sample outside of the interval $[-r;r]$, but I don't get why they set $r$ that way. What does it represent?


texts:
Suppose I have the following hash function:
$\newcommand{\md}[1]{\text{md#1}}
 \newcommand{\H}{\text{H}}$

$$\H(x, y) = \md{5}(x) \oplus \md{4}(y)$$

How can I prove it's collision proof?

I tried to say "lets assume we have an oracle which know how to find a collision/pre image of $\H$" and find an algorithm to find $\md5$ collision. I didn't manage to find such algorithm.

How can it be proved?


texts: Block cipher mode with diffusion on ciphertext

texts:
As I understand, diffusion property in AES-CBC ensures that one-bit change in plaintext will yield changes in all following blocks in ciphertext upon encryption.

I'm looking for algorithm that will have this property on ciphertext. I.e. when I change one bit in ciphertext, then plaintext after decryption will be changed in all following blocks. As far as I know, AES-CBC changes only two blocks upon decryption.

Does such a mode of operation exist? Or do I have false assumptions?


texts: Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?

texts:
The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed value of 160 bits. For this reason a page of DJB's website calls them

  Manipulatable: The curve-generation process has a large unexplained
  input, giving the curve generator a large space of curves to choose
  from. Consider, for example, a curve-generation process that takes
  $y^2=x^3-3x+H(s)$ meeting various security criteria, where $s$ is a large
  random "seed" and $H$ is a hash function. No matter how strong $H$ is, a
  malicious curve generator can search through many choices of $s$,
  checking each $y^2=x^3-3x+H(s)$ for vulnerability to a secret attack;
  this works if the secret attack applies to (e.g.) one curve in a
  billion.

Is that feasible? More precisely, is there an openly known method making that feasible? If not (as I suspect), is there additional rational argument (or even informed opinion) about the feasibility, or in-feasibility, of such intentional rigging, and the associated effort? Or perhaps, some more info on how the seeds have been chosen?

Note: I have not found a deep study of that precise point in the answers to these related questions.


texts: Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case

texts:
I need to know:

1- What does exactly correctness mean in this context?

2- How is correctness implied in malicious model?

3- If the correctness means " the adversary cannot cause the output to be incorrectly distributed"[1] then it can change the computation result with the correct distribution.

[1].Carmit Hazay · Yehuda Lindell,Efficient Secure Two-Party
Protocols,Techniques and Constructions.


texts: Which QKD schemes don’t utilize an authenticated classical channel?

texts:
This Wikipedia article discusses one drawback of quantum key-distribution:

The main drawback of Quantum Key Distribution is that it usually relies on having an authenticated classical channel of communications. In modern cryptography, having an authenticated classical channel means that one has either already exchanged a symmetric key of sufficient length or public keys of sufficient security level. With such information already available, one can achieve authenticated and secure communications without using QKD, such as by using the Galois/Counter Mode of the Advanced Encryption Standard. Thus QKD does the work of a Stream Cipher at many times the cost. Noted security expert Bruce Schneier remarked that quantum key distribution is "as useless as it is expensive".

My question is, how universal is this drawback?  Wikipedia says “usually”, so are there some quantum key distribution schemes which do not rely on an authenticated classical channel of communication?
And if so has any such scheme been practically implemented?


texts:
I am newbie to the crypto world, but my question is, If block cipher BLOCK satisfies the following relation (where ENC is encrypt and "+" means XOR): For ever pair of blocks of input A and B, ENC(A+B) = ENC(A) + ENC(B).

I was wondering what would be the security of BLOCK? Assuming the key is of fixed size and that you have unfetterd access to the ENC function. In other words, how hard is it to decrypt a given ciphertext without knowing the details of BLOCK.


texts: Oblivious transfer where neither party learns the index of the message

texts:
In a traditional oblivious transfer setting, the sender has a list $(x_1, x_2, ... , x_n) \in G$ where $G$ is the chosen group. The receiver has $b \in \mathbb{N}$, such that engaging in the protocol the receiver is given $x_b$ and the sender does not learn $b$.
Presume I want a slightly different procedure, where the receiver gets a random $x_i$ and neither the sender nor receiver learns $i$.
Is there a name for protocols with this behavior?


texts: Using RSA keys for Broadcast Encryption?

texts:
What is the best way of using both broadcast encryption and RSA private keys? I'm particularly interested in Broadcast Encryption as implemented by BGW 1, but I guess that the question stands for any broadcast encryption system.

My confusion comes from the fact that the initial phase of Broadcast Encryption takes in the number of users and creates one global Public Key and a Private Key for each user. But suppose that the users in the system already had RSA private keys assigned. Is there a way to mitigate the fact that we need to maintain two private keys per each user (one from RSA and one from Broadcast Encryption) ?

1 Boneh, Dan, Craig Gentry, and Brent Waters. "Collusion resistant broadcast encryption with short ciphertexts and private keys." Annual International Cryptology Conference. Springer Berlin Heidelberg, 2005.


texts: Security Strength of Double Substitution Ciphers

texts:
I am wondering why people are using RSA keys when some types of double substitution ciphers seem to be just as secure if not better off.

By some types of double substitution ciphers I mean one Which expands the plaintext message like so:

A: aaa
B: aab
C: aac
D: aba
E: abb
F: abc
G: aca
H: acb
ect.

(And if there is an odd length the add a d to the ciphertext.)

Then collapses the newly made ciphertext into a new ciphertext like so:

aa: A
ab: B
ac: C
ad: D
ba: E
bb: F
bc: G
bd: H
ca: I
cb: J
cc: K
cd: L

This method would render any method I know for deciphering codes useless, and I was wondering if there is a method I am missing or if this is actually a very strong method of encryption.


texts: What is the signifcance of inside threat in "How to Construct Multicast Cryptosystems ... Secure Against CCA2"

texts:
In How to Construct Multicast Cryptosystems Provably Secure Against Adaptive Chosen Ciphertext Attack, the paper states under preliminaries:

  We consider the scenario where a single party, called the center,
  sends messages, over insecure channels, to a group U of n parties
  who are denoted members of the group. In such a setting, the center
  often has a special role. Since it is often distributing information
  of its own choice, it is assumed to have control over the group
  membership, i.e., the center is allowed to make decisions about who
  can join the group and whose membership should be revoked. This is in
  line with almost all multicast schemes such as [25, 4, 26, 27, 22, 23,
  24].

  We assume a computationally bounded adversary who is allowed to attack
  the system from both outside and inside the group. The insider’s
  attack is modelled by allowing the adversary to corrupt and gain total
  control of up to t group members where t is a predefined
  threshold. We only consider non-adaptive adversary who chooses what
  members to corrupt before the key generation.

Since the center U authorized the inside attacker, it seems disingenuous to claim that an inside attacker can ultimately access the message.

What is the significance of inside attacker or threat? Why should we care about it in this case?


texts: What do I use as the encryption key and initialization vector in AES cfb128

texts:
I'm writing a program that can encrypt a file using AES cfb128 (using Openssl and C++).

The scenario of the program is this:

Person A visits computer, encrypts a file they make, takes away a key (on USB stick?)
Person B visits computer and is unable to decrypt encrypted file
Person A comes back and decrypts the file using their key

My question is I have an encryption key and initialization vector that I must set for the AES encryption. I plan on randomly generating numbers for one and using a hardware ID for the other. Also the person could choose to encrypt multiple files.

So how would I do this?
Can I make the encryption key the hardwareID and the init vector a sequence of random bits?

If the same hardwareID and init vector are used to encrypt multiple files per machine, is this unsecure given that an attacker will not have the init vector but may have the encryption key? Should the encryption key be the random bit instead and the hardware key be the init vector?

Or should both the encryption key and init vector be random and unknown to the attacker? And if so, is it secure to encrypt multiple files using the same 2 unknown keys?


texts: Is it more weak to encrypt with the private key RSA?

texts:
I have a simple question.

Is it more weak to encrypt with the private key against the public key with RSA ?

Like is it easier to "crack", "brake", "solve", "decrypt" when I encrypt with the private key against the public key. Is it really the same process of encryption?

(In both cases we assume that the "breaker" doesn't know any of the keys)

Edit:

To be more precise, is there something that differs in the process of encryption with any of these two keys.

Is the only difference between the public and private is that the private can generate public keys but the public key can not generate private? If I want to encrypt with the private or the public key the result is the same, the encryption is passing by the same steps and then results in a difficult breakable encrypted output?

RSA key generated with puttygen
PGP encryption / decryption


texts: Could PAKE via smooth projective hash function protect agaist replay attacks?

texts: I came across some password-based authenticated key exchange (PAKE) protocols that are based on the smooth projective hash function (SPHF) in the standard model. And I checked some related works, and most of them only considered the dictionary attack and forward security. I am wondering if this kind of PAKE via SPHF could prevent replay attacks? If it can prevent, why? Otherwise, how to fix this problem?


texts: Comparison of SNARK-friendly hash algorithms MiMC7, Poseidon, Pederson?

texts:
There are some cryptographically secure hash algorithms designed to be efficient for SNARKs, STARKs and FHE. Some of them already implemented in Zcash, Zokrates and circom. The ones that I know of are:

MiMC7 hash
Poseidon (website here)
Pederson
Rescue Prime

Is there any security and performance comparison available for these hash algorithms? (There have been attacks published on some other hash functions designed for SNARKs. But, I didn't manage to find a proper comparison for these ones.)


texts: I recently created a program that hashes a password using SHA256 and potentially using salt. How can I crack that if I know that the password only contains lowercase letters?


texts: How to calculate kinv from the given k value

texts:
I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09.

One of the test vectors is given below:

P-192 SHA1

Msg = 608079423f12421de616b7493ebe551cf4d65b92
d = e14f37b3d1374ff8b03f41b9b3fdd2f0ebccf275d660d7f3
Qx = 07008ea40b08dbe76432096e80a2494c94982d2d5bcf98e6
Qy = 76fab681d00b414ea636ba215de26d98c41bd7f2e4d65477
k = cb0abc7043a10783684556fb12c4154d57bc31a289685f25
R = 6994d962bdd0d793ffddf855ec5bf2f91a9698b46258a63e
S = 02ba6465a234903744ab02bc8521405b73cf5fc00e1a9f41

I am trying to calculate $k_{inv}$ from given $k$ value and I am using curve “NID_X9_62_prime192v1”.

Can anyone tell me how to calculate $k_{inv}$?


texts: If RSA is limited to 117-200 bytes or so, is that a very limited use case?

texts:
Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size?

I have read that you can only encrypt a message of around 117 to 200 bytes in size (depending on your key size: 1024 or 2048 bits). Is this correct?

If so, I think I have read people suggesting on using it for larger files. I guess they are just repeating the process many times over and over in blocks of 117 bytes?


texts: Decrypting only message product - is it possible?

texts:
Ok, I'm looking for a way to be able to decrypt ONLY message product and not individual messages. The message product can contain an arbitrary number of messages as long as it's greater than some margin. Probably it's impossible, but I need to make sure.

Suppose it's some weird inverse DKG: you have 5 shares of a public key and can encrypt messages (numbers) using any share. However, you can decrypt only product of messages, that contains at least one message encrypted with each share. However, there is NO escrow key and no possibility to decrypt just one message.

I've been thinking about id-based encryption schemes, but it always seems to have escrow key and allows to decrypt individual messages. Commitments do not work with an arbitrary number  (>=5) of messages in a product. Any ideas?

Is it even possible in theory to design such scheme?

I know, the problem is kind of weird, but it bugs me that I can't find a solution or prove that there is no solution at all.


texts: Is MD5 second-preimage resistant when used only on FIXED length messages?

texts:
I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient.
I have read a lot about MD5 security for this project, and I know it is broken in several ways: extending a file while having the same MD5 hash, and generating two different files with the same MD5 hash, for instance.

In my particular instance, I have a Merkle tree. The root is validated with SHA256, but for performance reasons the internal nodes use MD5. The key point  is that in my application the MD5 hashing is done over fixed length blocks.
For instance, leaf nodes are MD5 over a 4096 bytes block. Internal nodes are MD5 over a 16384 bytes block.

So, my question is: Given a known block and its MD5 hash, is there an attack to generate a different block of the same length with the same MD5 hash?

I don't want to generate two 4096 bytes blocks with the same hash. I want to know if, when given a 4096 bytes block, can one replace it with a different 4096 bytes block with the same MD5.


texts: Should I use the first or last bits from a SHA-256 hash?

texts:
I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash.

Should I take the first bits or the last bits? Which of them contain the most entropy?


texts: What is the probability of $\gcd(e,\varphi(n))=1$, where $e$ is an odd number and $\varphi(n)$ is an even number with $ e<\varphi(n)$?

texts: This is needed because I use a random function to generate the encryption key in RSA setting to generate random numbers and check if $\gcd$ is $1$.


texts: In use of AES CBC, can a cipher text signature be replaced with appending a known string to the plain text?

texts: Would appending a known string to the end of plain text then validating the string after decrypting adequately verify the authenticity of the cipher text?


texts: What are some use cases for white-box digital signatures?

texts:
There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes:

White-Box Implementation of the Identity-Based Signature Scheme in the IEEE P1363 Standard for Public Key Cryptography. IACR ePrint
White-Box Implementation of Shamir's Identity-Based Signature Scheme. DOI, ResearchGate

I understand how the described algorithms work, but I don't know where white-box signatures could be useful.
In (1), they write:

While there are numerous identity-based signature schemes, they are
generally not white-box attack resilience, and we are not aware of any
white-box implementation for identity-based signature scheme. Hence,
our research has filled the gap in white-box cryptography.
...
According to the performance evaluation, our proposed method showed
that it is potentially useful in the industrial area and the real
world applications.

So is it possible that there are no use cases for this yet, but the crypto schemes are implemented just in case someone came up with a use case in the future?
Or is this purely academic prototype showing that it's possible to implement white-box signatures, without necessarily having any real world usage?
P.S. Here is some discussion about asymmetric white-box: Any white-box cryptography for asymmetric-key? What is the latest status of white-box cryptography?


texts:
Quark says u-Quark has 64 or 128 security (bits). But u-Quark width is 17 bytes means 136 bits.

Why this difference? If the hash produced is 136 bits then why do we call them as 128-bit hash value and not 136-bit hash value? If I wish to use the hash value generated, then should I use just the 128 bits or all 136 bits must be used?


texts: Evaluate similarity between two "encrypted" time series

texts:
Can you think of any way to evaluate the similarity between two time series without revealing any information on the time series ?

More precisely, considering two time series $x$ and $y$ of length 130 each, is there a way to get the minimum distance (using DTW for example) without reveling x or y ?

Recent work has been done on this topic using Homomorphic encryption but it performs very poorly (around 10 seconds to build and compute the minimum path on a $10*10$ DTW matrix)


texts: Why do two Argon hashes with the same password differ?

texts:
Can someone explain to me what the ArgonHashString function in libsodium returns (i'm using the .net port).

For example i called it twice with the same string:

var foo1 = PasswordHash.ArgonHashString("f");
var foo2 = PasswordHash.ArgonHashString("f");

and i got entirely different answers:

"$argon2i$v=19$m=32768,t=4,p=1$rKEPCGqfhm7zQt8c2QBhRA$7oZHFjWhHdVg/31SottxDyVM5KA9+4IBc5qD5m9DNFI\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
"$argon2i$v=19$m=32768,t=4,p=1$o8MmGW+GoaVcQvBfmPDE8A$3mHVQbZz3JuLI++MIBC4JOI+/G2oVtq75Jbqml8lbEM\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"


texts: Security strength EC signature for variable message size

texts:
I am implementing a system using some sort of 32bytes OTC (One-Time Code) and signing it with ECDSA to get verification of a public key owner.

The key I'm using is secp256r1.

Since the nature of this mechanism is very short-lived (say I will refresh the OTC within 1 minute), I doubt whether I can shorten the OTC in some sense that it still gives acceptable security.

Therefore I would like to know the following as a direction to measure the security strength:

The probability of best attack known to secp256r1 key per trial, with variable "length of the message-to-be-signed"
The expected number of trials to make expected value of success = 1

I'm okay if you just refer some papers or guidance and not doing the calculation here; or any other direction of such measurement.


texts:
Excuse me in advance for the generality of the question I am about to ask, I am not even sure if this is the place to ask... but here I go!

Let me start by mentioning a little about my academic background:

I recently finished my Mathematics BSc and I am starting an MSc in Mathematics on September. I did my Final degree thesis on Tannakian Categories and I have a good background in topics such as algebraic number theory, algebraic geometry (I have a good knowledge of scheme theory) and algebraic topology. When it comes to programming, I know C, C++, Python and R.

And here's the question:

I would like to find a good book/online course in order to learn a bit about Cryptography, most preferably following a deep mathematical approach, but combining it with programming in any of the latter languages, so that I can see an application. I don't mind learning another language, by the way :)

Thanks in advance!


texts: I was reading about how a one time pad output can be changed by a third party without the receiving person realising.  Surely the output at the other end would be garbage?  Also, could you not generate a crc for the output, encrypt it with the same random sequence so at the other end it could be decrypted and checked to make sure nothing has changed?


texts:
I have a 4 bit S Box

byte[] S = new byte[16] { 0x9, 0xE, 0x5, 0x6, 0xA, 0x2, 0x3, 0xC, 0xF, 0x0, 0x4, 0xD, 0x7, 0xB, 0x1, 0x8 };

How can i calculate Correlation Immunity of this S Box


texts: How to know if a point on a discrete elliptic curve be represented uniquely using its y-coordinate?

texts:
Let's say we have a point on an elliptic curve $p=(x, y)$ which is not the point-at-infinity.

Can there be some other point $\hat{p} = (\hat{x}, y)$ that is also on the curve and that has the same y-coordinate, but a different x-coordinate (i.e. $x \neq \hat{x}$)?

Clearly, if the elliptic curve is over the real numbers, this is not the case (as can be seen by drawing a horizontal line between two saddle points). An example of a particular finite-field elliptic curve shows this can be the case for finite-field elliptic curves too.

Are there any finite-field elliptic curves for which points can be represented uniquely by their y-coordinate?
If so, how can you determine whether, for a particular finite-field elliptic curve, a point can be represented uniquely by its y-coordinate. For instance, can this be done for secp256k1?


texts: I am trying to solve the following question with an example/proof. The question is from Introduction to Modern Cryptography by Katz and Lindell. Any help would be appreciated.


texts: Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?

texts:
I take the definition of safe prime as: a prime $p$ is safe when $(p-1)/2$ is prime.

Safe primes of appropriate size are the standard choice for the modulus of cryptosystems related to the discrete logarithm problem, such as Diffie-Hellman.

A modulus $p=2^k \pm s$ with $s$ small makes exponentiation $\bmod p$ appreciably simpler (the problem of quotient estimation in classical Euclidean division all but vanishes, and the cost of modular reductions becomes negligible compared to multiplications). This, and the desire to use a non-arbitrary, compactly stored modulus, makes it tempting to prefer such choice of $p$. Like "the modulus shall be the biggest 2048-bit safe prime, which is $p=2^{2048}-1942289$".

Are there any major reason not to do that, like a much faster algorithm for the discrete logarithm problem?


texts: Can a PRNG with a fixed amount of entropy always be detected?

texts:
Given a fixed seed (i.e. no ongoing source on entropy), is there (practically or theoretically) any PRNG algorithm that can generate an infinite sequence of random numbers such that an observer cannot detect that it is a PRNG rather than a genuinely random source ?

All widely adopted cryptographically secure PRNGs seem to use entropy collectors to supplement, but it's not clear if that's actually a required for any CSPRNG.

The reasoning behind this question is: If a hardware or software RNG has been compromised such that it's seeded with a known key and the RNG doesn't use any additional real entropy source, will there always be an external method of detecting that it's not a real random source.


texts: Initialization vector length insufficient in AES

texts:
I use AES with AES/CBC/PKCS5Padding with the following encryption and decryption code sections in Java:

cipher.init(Cipher.ENCRYPT_MODE, keySpec, new IvParameterSpec(IV1));
cipher.init(Cipher.DECRYPT_MODE, keySpec, new IvParameterSpec(IV2));

where IV1 and IV2 are randomly generated 16-byte initialization vectors. As you can see, the initialization vectors in encryption and decryption processes are different. This leads the bytes of the decrypted message to be right after the first 16 bytes such as the message:

Enter your message here...

becomes

*****************ge here...

after enc/dec where * denotes a wrongly decrypted byte as it should be as IV1 and IV2 are different.

My question is: What to do to encrypt and decrypt text with length greater than 16 bytes using AES with initialization vector?


texts: In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

texts:
In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security?

My hypothesis is "yes" because:

The block cipher's only use is in CTR mode (i.e. as a stream cipher).  ChaCha20 is a PRF used in CTR mode.  In fact, I think this should increase security.
Blake2b is considered at least as strong as SHA256 and is immune to length-extension attacks, so the double hashing is not required.

The main advantage is performance.


texts:
So the Davies-Meyer Hash Function is: Hi = Hi−1 ⊕ exi (Hi−1)

Say I pick H0 = 1110 0011

And the message x1 = "5" or "0000 0101"

Is this the correct way to compute H1?

H1 = 1110 0011 ⊕ (0000 0101 ⊕ 1110 0011)

H1 = 1110 0011 ⊕ (1110 0110)

H1 = 0000 0101

I must be doing something wrong because the hash function always comes out the same as the message.


texts: Lehmer random generator cipher - related key attacks

texts:
I'm looking for related key attacks in my kind of toy encryption scheme which has already been broken here several times. It is not secure against differential attakcs and possibly vulnerable to many other attacks. But I want to focus on attacking it by the related keys.
Let's consider linear congruential generator:
$X_{k+1} = a \cdot X_{k} \mod 2^{128}$
Such that $a$ is some number which for every 128-bit input $X_{k}$ from $0$ to $2^{128}-1$ will give us different output $X_{k+1}$ from $0$ to $2^{128}-1$. So we got bijection here (we can find many such odd $a$). Now let's say we will choose such 128-bit $a_{1},a_{2}, ..., a_{10}$ as a keys, randomly. We make $10$ rounds of encryption like that:

$a_{1} \cdot INPUT \mod 2^{128}$
Reverse $128$-bit block.
$a_{2} \cdot (2^{128}-INPUT) \mod 2^{128}$
$a_{3} \cdot INPUT \mod 2^{128}$
Reverse $128$-bit block.
$a_{4} \cdot (2^{128}-INPUT) \mod 2^{128}$

and so on...
Let's skip the encryption problems with zero-block - it can be solve easily, for example if we will use xoring before every round. Of course it is just keyed Lehmer random number generator with a modulus which is a power of two - and such generators have problems with low bits. What's more - the keys have very simple relationships. Every round key $a_{i}$ gives the same first $n$ bits as $a_{i} \mod 2^{n}$. Can this or other properties be used somehow in practical related key attacks?


texts: Creating SHA256 constant values on the fly without memory usuage

texts: Is it possible to create the constants used in SHA256 on the fly? Meaning I dont have to reserve 64 32-bit words of space? It would result in a slower implementation, but at the profit of using less memory. I know it is possible to do it with AES Sboxes, but how about the SHA256 constants?


texts: Can compression + encryption sometimes be beneficial?

texts:
I hope this question hasn't been asked before: I searched and couldn't directly find it.  It is known that in specific applications, compression followed by encryption leaks information of the length of the compressed message, which, combined with the possibility to inject known plain text in the message, can leak sufficient information as to break the encryption entirely.  There are real-world examples where such plain text injection is a possibility, and there, compression+encryption is a bad idea.  There are other applications, like VoIP, where data packets have comparable length before compression, but compression will change these lengths in ways that betray sufficient aspects of the data to allow, again, for a leakage of plain text information.

In all these cases, the vector is the variable length of the compressed plain text that is leaked.

This counter-intuitive result is opposite to the old cryptographic idea that "pre-whitening" which is also an effect of compression, is beneficial.

So, my question is: are there cryptographic applications where compression + encryption is beneficial over simply encryption (as old wisdom would have had it), or is compression in several cases dangerous, and at best, sometimes harmless, but never beneficial to encryption ?  In other words, is "pre-whitening" still sometimes an advantage, or not ?  I'm not talking about the gain in room or bandwidth.  I'm talking on the cryptographic side only.


texts: Using a single key pair for man-in-the-middle attack on Diffie-Hellman

texts:
Assume that a man-in-the-middle attack on the Diffie-Hellman key exchange protocol is possible, for which the adversary generates two public–private key pairs for the attack.

Could the same attack be accomplished with one pair?


texts: Tell where messages begin and end in a series of ciphertext blocks?

texts:
With block ciphers, I understand that the plaintext is first broken down into the right-sized blocks, padded, and then encrypted into the same number of cipher blocks.

Once these blocks are sent over to the receiver, does this mean that (after decryption) the receiver would have to parse each block looking for the padding in order to be able to tell that the current message has ended and that the next cipherblock belongs to the next message?

Is there a way to mark somewhere how many cipher blocks a given message is, so the receiver would not have to do this parsing on every single cipher block that it receives?

Thanks.


texts: Differential Privacy and appropriate noise distribution

texts: In differential privacy solutions and more specifically for queries that they do entail counting the proposed solutions define the Laplace distribution that is best calibrated for low error. Other solutions for non-numerical queries propose exponential distribution. However, it is not clear why noise from a Laplace distribution is chosen for numerical? What is the special property that best suits the Laplace distributrion?


texts:
How can we find the key used with a Vigenère  cipher in small number of steps?

If we have text like:

Peit Wokm! Mhfa fepatgb ets bvvrvxmea ebte bae twkd qiqi

and we have key information like Key =  ‘ ? a ? i ’, then how I can understand this and solve this to make the complete key?


texts:
Let $f$ be a length preserving one way function. Show that $g(x)=f(x)|x_{[1:\log n]}$, where $|$ indicates concatenation and $x_{[1:\log n]}$ indicates the first $\log n$ bits of x, is also a one way function.

Can someone please give a starting hint for this problem?

I know I have to use a reduction to show that if $g$ can be inverted easily, then so can be $f$. In other words, when I am only given $f(x)$, I have to construct $g(x')$ for some $x'$, use the assumed inverter, get $x'$ and construct $x$ from $x'$. But due to the definition of $g$, I can't think of anything to start my approach.


texts:
I want to know how EXACTLY the WPA password gets encrypted

I have been searching through and I was able to catch:

The actual password is converted to some hash
Salting is applied to the hash
The operation is not reversible
The hash comes with the 4-way handshake

So what kind of hash is it converted? like, SHA1? MD5? and how the salting process is done? like, is the SSID appended to the password before the hashing operation?

Or maybe I have some misunderstanding here?


texts: Fully Homomorphic Encryption over the Integers - Runtime Question

texts:
I have a question regarding the paper "Fully Homomorphic Encryption over the Integers"
(http://eprint.iacr.org/2009/616.pdf): On page 6 after they set their parameters, it says

"This setting results in a scheme with complexity $\overset{\sim}{\mathcal{O}}(λ^{10}).$"

What exactly do they mean by this? That the runtime is $\overset{\sim}{\mathcal{O}}(λ^{10})$? If yes, the runtime of what exactly - performing a multiplication on encrypted data? After all, the overall runtime of the scheme depends on the depth of the circuit that is being evaluated, so such a generic bound on runtime of the whole scheme would not make much sense, would it?

My second question (which assumes that "complexity" refers to runtime) is the following: In section 5 (page 13), the authors present an attack which has running time $2^{2\rho}$, where $\rho = \omega(\log(\lambda))$. Wouldn't that make the attack in general much faster than the runtime of the scheme? On page 6, it says that "A convenient parameter set to keep in mind is $\rho = \lambda,$ [...]", in which case I understand why we do not need to worry about the attack, as it runs exponential in $\lambda$. But is it really enough to require $\rho = \omega(\log(\lambda))$ in general, or wouldn't values of $\rho$ that are very close to $\log(\lambda)$ make this scheme extremely unsafe? Also, does $\overset{\sim}{\mathcal{O}}(λ)$ mean linear in the bitlength of $\lambda$, whereas $2^{2\rho}$ refers to the actual numerical value of $\rho$?

I looked at runtime tables here: http://eprint.iacr.org/2011/440.pdf (where both the scheme and the attack have been slightly modified) and the scheme is way faster than the attack, even though they chose $\rho$ smaller than $\lambda$. Although not logarithmically smaller, I actually have no idea how they derived $\rho$ from $\lambda$.

So am I missing something, or is everyone just using $\rho \approx \lambda$ and the bound $\rho = \omega(\log(\lambda))$ is not safe?


texts: Different padding rules for Merkle–Damgård and Keccak/sponge function

texts:
We learned that length padding was used in Merkle–Damgård  where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash values for the different inputs $x \ne x0..0$.

Then again for Keccak we learned it is possible to use simple padding (e.g. add $10..0$). Why is that possible for sponge functions? Isn't it still possible to find two different inputs that will be padded to the same value and then deliver the same hash?

Please be quick with your answers - I'm preparing for my exam tomorrow. (And this is a question that could be asked and that I cannot answer...)


texts: When encrypting twice with two separate keys, can a single key decrypt both steps?

texts:
Is it possible that if a plaintext is encrypted first with a key, $n_1$, and then this ciphertext is again encrypted using the same algorithm but a different key, $n_2$ that the resulting ciphertext could be converted back to the original plaintext with a single key?

For example:
keys $n_1$, $n_2$, and $n_3$

$p_1$ = "plaintext"

$p_2 = C(n_1, p_1)$

$p_3 = C(n_2, p_2)$

Is  this possible:  $Dec(n_3, p_3) = p_1$?   (where $C$ is an encryption algorithm taking the key and plaintext)

An example I can think of is the Caesar Cipher (the key can be seen as the shift). Where first a shift of 4 is used, and then a shift of 6. A shift of 16 would reveal the plaintext in a single operation (a single key).

Obviously this is a trivial example. Are there any cases where this could happen with a stronger algorithm, such as AES?


texts: How many bits should I use for bearer tokens?

texts:
I'm in the process of developing a service that can be accessed with bearer tokens. Currently I'm using a random UUID converted into a URL safe format. That is 128 bits. Users will be authenticated through a custom oauth2 server, client services (e.g. when the API is called on behalf of the client app) are going to login with HMAC-SHA digest auth.

Some questions:

Is it enough to use HMAC-SHA256? Or should I use HMAC-SHA512 or maybe even SHA-3 for a brand new project? I don't think that the extra overhead would be a problem, but I'm not sure that it would provide significantly more security. I know that it is a bit opinion based, but still.
What should be the length of the client secret for my HMAC algorithm? I'm not sure if it should be equal to the output block size, or the internal state size, or the input block size? (E.g. for SHA256, input block size is 512 bits, output block size is 256 bits.)
Should I increase the number of bits in the bearer tokens too? I'm not sure that using SHA256 or SHA512 makes sense when the bearer token only has 128 bits.

Maybe using 160 token with HMAC-SHA1? I do not exactly see how the number of bits in hmac and/or bearer tokens affect security, or of it worth increasing one without the other.

UPDATE - although not stricly related to the question, I have changed the code to use SecureRandom instead of UUID:

public class UrlSafeTokenGenerator {
    private static SecureRandom random = new SecureRandom();
    private static final int BITS = 128;
    private static final int BYTES = BITS/8;

  /**
   * Generates a new URL safe token.
   *
   * @return the newly generated token.
   */
  public String generate() {
    byte[] buff = new byte[BYTES];
    random.nextBytes(buff);
    String generatedToken = BaseEncoding.base64Url().encode(buff);
    return trimRight(generatedToken, '=');
  }

  /**
   * Trim returns string with all leading and trailing Unicode code points contained in cutset removed.
   */
  private String trimRight(String text, char cutset) {
    int i = text.length() - 1;
    while (i >= 0 && cutset == text.charAt(i)) {
      i--;
    }
    return text.substring(0, i + 1);
  }
}


texts: Traditional DES scheme in Unix crypt function

texts:
In a security context course, we need to reproduce the old DES hashing scheme in the crypt program, on an old unix system.

I am actually reading the crypt page on wikipedia:

  The traditional implementation uses a modified form of the DES
  algorithm. The user's password is truncated to eight characters, and
  those are coerced down to only 7-bits each; this forms the 56-bit DES
  key. That key is then used to encrypt an all-bits-zero block, and then
  the ciphertext is encrypted again with the same key, and so on for a
  total of 25 DES encryptions. A 12-bit salt is used to perturb the
  encryption algorithm, so standard DES implementations can't be used to
  implement crypt(). The salt and the final ciphertext are encoded into
  a printable string in a form of base64.

I am not sure to well completely understand the above definition, and I would like to use an example to show you my questions.

So, considering I use the password: foobar12345678.

I will work in hexadecimal, so the password is: 66 6f 6f 62 61 72 31 32
1.The password will be truncated to foobar12.

2.I remove the first bit (not sure?) of every password byte, so my new password will be:

01100110 01101111 01101111 01100010 01100001 01110010 00110001 00110010
==>
11001101 10111111 01111110 00101100 00111100 10011000 10110010

The password in hexadecimal is cd bf 7e 2c 3c 98 b2 and is the 56 bits DES key.

3.The key above is used to encrypt an all-bits-zero block. I imagine the zero block is 56 bits also?

so, using an hypothetical DES scheme encryption function function_DES(hex_message, hex_key), our hash here would be the output of function_DES(00 00 00 00 00 00 00, cd bf 7e 2c 3c 98 b2). imagine that the output is hashOutput1

4.We crypt 25 hashOutput1 with the key cd bf 7e 2c 3c 98 b2 using DES scheme.

  A 12-bit salt is used to perturb the encryption algorithm, so standard
  DES implementations can't be used to implement crypt()

5.What's the 12-bit salt? I imagine it's predefined in linux system? Where can I find it? Imagine the salt is 101010101010 I place it in front of the 25th encrypted DES output?

6.Both hash and salt are comverted to base64 and placed in the /etc/shadow as:

$clearSalt$DEShash

So, during the 56 bits key creation, when we coerce down bits in 64 bits password, is it the first bit of each byte that we need to remove?

Are all-zeros blocks 56 bits (the exact same size than the 56 bits key) ?

What's the salt? Is it predefined in Unix system? Is it the same in all distro?

So, using this technique bruteforce tools should never go over 8 characters?

References:

http://en.wikipedia.org/wiki/Crypt_%28Unix%29 and http://www.kernel.org/doc/man-pages/online/pages/man3/crypt.3.html

edit:

for my salt question, I think I found my answer:

  When you change your password, the /bin/passwd program selects a salt
  based on the time of day. The salt is converted into a two-character
  string and is stored in the /etc/passwd file along with the encrypted
  "password."[10] In this manner, when you type your password at login
  time, the same salt is used again. UNIX stores the salt as the first
  two characters of the encrypted password.

(From: http://www.diablotin.com/librairie/networking/puis/ch08_06.htm)


texts:
Let’s say there’s a language that has all the letters of the alphabet evenly distributed.

Is this language then secure against frequency-analysis or could there still be some soft of weakness, i.e. by using too short keys?


texts:
I am doing a project using ECDH with Curve25519. I use mbedtls library, in the implement, I realize that the private key of Curve25519 is clear 3 last bit, or it is divide by 8 and the cofactor of Curve25519 is 8 too. I looked to another curve (Curve448) it cofactor is 4 and the private key is divide by 4 too.
I tried choosing a non-divisible key for 8 and the algorithm still works. So does cofactor affects private key on ECC.

Does ECC's cofactor affects ECC's private key selection?
If I intentionally choose a key that is not divisible by 8, is there a problem?


texts: Is there any restriction in using lossless compression algorithms for huge key sizes?

texts:
I'm studying McEliece and Multivariate Public Key cryptographic systems. The main problem here is the huge key size.

Is there any restriction in using lossless compression algorithms to fix this problem?


texts: How should I implement a secure recovery of encryption?

texts:
I want to create a system to host as securely as possible encrypted data in a way that not even the system can know the content of the data, but that it could be recovered.

I would like to know how is it that other systems implement the use of a multiword recovery passphrase, like some bitcoin wallets for example, where the user defines its password, but also gets a set of words to be written and saved securely in case the password is forgotten.

Is this an additional key so that they are 2 possible keys to decrypt the data? or just another form of the same key? What algorithms support this?

I would appreciate any hint or link so I can research deeper.

Thanks


texts: Digital Certificates genereted from Hardware Security Module

texts: Software library without hardware based source of entropy will provide enough security to generate digital certificates. However Hardware security Modules provide hardware based source of entropy and apis to generate certificates along with other crypto operations. But buying HSM just for making certificates will be kind of spending much for just one feature. Is there any other way or device to make strong digital certificates?


texts: 128 bit 3DES Key and AES Key: what's the difference?

texts:
Apologies if this is really basic but I couldn't find the answer to this.

I have heard some Info Sec colleagues talking about creating an AES key in preference to a DES or 3DES key but I don't know the difference; I thought a key was just a random string of bits? Is there a difference? Can you use the same key with different algorithms? i.e. a 128 bit key with 3DES and also with AES?


texts: Use cases for “online” authenticated encryption?

texts:
What is the the point of an "online" mode for an authenticated cipher?

I understand what "online" means in this context. However, I have trouble coming up with applications that would benefit from such a feature.

Usually, the "messages" that are encrypted and authenticated are not too long and I think that this is due to people not wanting to decrypt "big messages" completely only to throw them away if the tag is finally invalid. So, at least for network protocols, it seems like a very good idea to insert authentication tags more frequently.

But this strategy makes the "online" feature of some AE implementation seem irrelevant especially since support for online modes makes the implementation more complicated.


texts: What will browser show when a user access website and website present certificate of some other domain with same top level domain

texts:
For example, User tries to access a.example.com and server presents abc.example.com with a.example.com not in SANs list.
Will it be just a warning or an error?


texts:
I was trying to understand RSA when I encountered the Euler Function. I do understand this: $\phi(P)$, where $P$ is a prime is $P-1$.

However it seems that for a number $N$ such at $N=P\cdot Q$ where $P$ and $Q$ are non-equal primes:

\begin{equation}
    \phi(P\cdot Q) = (P-1)\cdot(Q-1)
\end{equation}

I'm having trouble understanding why that is so. Could someone point me toward the proof of the same?


texts: How to determine r' in pederson commitment?

texts: Can someone help me with that question? Assuming that someone knows $log_g(h)$ so that he can calculate any message $m'$ for commitment $c$, how to determine $r'$ in?


texts:
Hy i just saw this Question: How does a rolling code work?

And I just wondered how it is possible that my Vehicle (A 2013 Mazda 6) has two key fobs? As i understand this shuld not be possible. Because there shuldbe only one key that stores n+1.

Are these Vehicle using another form of a Rolling Key Algorithm or are there Keyfobs that do full handshake?(Rx+Tx)


texts: Does the double-hash H(H(x)) have greater collision probability than H(x)?

texts:
Let $H$ be a collision resistant hash function and $P_c[H](S)$ the collision probability about a sample set $S$ of input elements (eg. random numbers). It increases with double hash?  That is, $P_c[H\circ H](S) \ge  P_c[H](S)$   ?

Well... we need a precise $P_c$ definition.  Perhaps the problem here is also the choice of a good probability definition (see notes below).

NOTES

Answer's application: the answer is important in the context of checksums used for digital preservation integrity of public files.

Imagine the checksum (the hash digest $H(x)$) of a PDF article of PubMed Central or arxiv.org... And that we need to ensure the   integrity, with no "PDF atack" or minimizing it, in nowadays and in a far future, ~20 years.

If the answer is "YES there are a little increase", the recommendation will be "please don't use double-hashing as standard for checksum for PMC or  arxivOrg".

General probaility

The general collision probability is defined as

  Given $k$ randomly generated $x$ values, where each $x$ is a non-negative integer less than $N$, what is the probability that at least two of them are equal?

and depends only of the $|S|$, so $P_c[H\circ H] = P_c[H]$... There are a hypothesis of "perfect hash function", but I want to metric the imperfections.

If there are no error on my interpretations, I need other probability definition.

Counting the collisions

Suppose a kind of "collision tax", $\frac{N_c}{|S|}$, based on the number of collisions $N_c$ occured with a specific sample. So, for many different sample sets $S_i$ with same number of elements, $k=|S_1|=|S_2|=... =|S_i|$. Suppose a set $K$ of all sets $S_i$ and  $P_c[H](K)$ as an average of this collision rate.

This kind of probability seems better to express the problem.

... Bloom filter efficiency

Another metric, instead a probability. Perhaps using
Bloom filter theory as reference. A kind of efficiency-benchmark of two Bloom filters, one with $H$ other with $H\circ H$.


texts: Can cryptography help create tamper proof voting systems?

texts:
After hearing about what happened with the election in Kenya and the related discussion about a “tamper proof voting system”, I was wondering how the use of cryptography could be used to make a tamper proof voting system?

I have had a basic look at zero knowledge proofs, but I do not know how these and other protocols could be used to achieve a tamper proof voting system – hence the question.


texts: Concrete evidence for the asymptotics of $\lambda_1(\Lambda^\perp(A))$?

texts:
A recent eprint paper claims to bound $\lambda_1(\Lambda^\perp(\mathbf{A}))$ for $\mathbf{A}\in\mathbb{Z}^{n\times m}$, a uniformly random matrix, by $O(1)$, specifically by $4$. This has applications to solving $\mathsf{SIS}_{n,m,q,4}$ in $\mathsf{P}$.

I'm no expert in this area, but it seems to me this contradicts the common thought that $\lambda_1(\Lambda^\perp(\mathbf{A})) = \Omega(\sqrt{n\log q})$ (see, for example, section 2.4.2 of this paper).

As getting into the details of the recent paper is likely off topic for this forum, I'm interested instead in another question --- what concrete/experimental evidence has been collected for the asymptotics of $\lambda_1(\Lambda^\perp(\mathbf{A}))$? Looking into data such as this would be an easy way to gain intuition for whether we're in an $O(1)$ regime or $\Omega(\sqrt{n\log q})$ one, and I had assumed that someone had papers along these lines, but don't actually recall seeing any of it myself.


texts: Yao's Millionaires' Problem without knowledge of plaintext

texts:
I have two integers $x,y$ which are encrypted using a homomorphic cryptosystem, probably Paillier.
I am looking for a (one-party) protocol that, given $enc(x)$ and $enc(y)$, returns a bit $b = 1 \iff x \geq y$ (b plaintext) without knowledge of the private key.
I found several solutions for Yao's Millionaires' Problem, however most of them are for two parties and require that each party knows the plaintext value of their input.
Is this possible with the constraint that both integer values are positive and small ($0 \leq x,y \leq 1000$) and complexity is not the main issue?
Right now I have something like this: Create a set containing the numbers $0,1,2,...,1000$. For each entry $i$ calculate $(enc(x) - enc(y) - enc(i)) * r$ then shuffle the results and check if one entry equals zero. (Lets assume there is an algorithm available that answers "equals zero" requests).


texts: we don't want change standard just after every attack, now for AES 128bit blocks i think 16 round is secure, but what is best round amount ? we had attack for 7 round then 10 round and it going so on i think so is better we use a better standard. how many round you think we use is better for a long time ?


texts: Would SHA-1 be safe for certificates with short validity?

texts:
There are articles floating around the topic of SHA-1 deprecation. The gist of it is that in (mostly) developing countries, people are still using mobile/computing devices that are 5 years old (or older) and do not support SHA-2. As a consequence, the deprecation of SHA-1 would result in their being "cut off from the Internet as we know it."

Yeah, there are many problems with this oversimplification, but here's some questions:

There are estimates that it would cost something in the ballpark of several hundred thousand US dollars to create a SHA-1 collision. But how much time does that take?
Depending on the answer to the first question, why not extend client and CA support for SHA-1, provided that certificate validity periods are simply shortened to 6 months?  3 months?  One?  This seems especially more feasible with the kind of automation LetsEncrypt offers.

In my view, there's nothing wrong with the SHA-1 algorithm. No one has "broken" or is coming close to "breaking" the algorithm per se.  It is just becoming computationally more feasible to overcome its cryptographic strength over the typical course of a certificate's validity period. So long as that's the case, although it may be no longer well suited for year-long (or multi-year) certificate validity periods, it's still technically safe to use in more limited applications. After all... all forms of encryption are about time, not about impenetrability.

Would this proposal sufficiently eliminate known risks to make SHA-1 safe to use on older devices?


texts: Breaking a modified version of Diffie Hellmann Protocol

texts:
I'm modifying the Diffie Hellman protocol as follows: We are given a large prime number $p$ and exponent $x$ such that $0 \lt x \lt p-1$ and $\mathrm{gcd}(x, p-1) = 1$. Also we pick $g$ such as $1 \lt g \lt p-1$.

We are also given $y = (g^x) \bmod{p}$. Essentially, we know about the prime $p$, the exponent $x$ and the result $y$. But $g$ is kept secret.

This is similar to Diffie Hellman protocol except that exponent $x$ is made public while $g$ is kept secret. So I'm trying to find if there's an efficient way to determine the secret $g$ or is this also a discrete logarithm problem?


texts:
I'm reading “Efficient Identity-Based Encryption Without Random Oracles” by Brent Waters.

In Page 9, I don't know how $$\mathcal{P}_{BDH}=\Pr[\beta'=1]=\Pr[\beta'=1|\textbf{abort}]\Pr[\textbf{abort}]+\Pr[\beta'=1|\overline{\textbf{abort}}]\Pr[\overline{\textbf{abort}}]$$

becomes
$$\mathcal{P}_{BDH}=\frac{1}{2}+\frac{1}{2}(\Pr[\overline{\textbf{abort}}|\gamma'=\gamma]\Pr[\gamma'=\gamma]-\Pr[\overline{\textbf{abort}}|\gamma'\neq\gamma]\Pr[\gamma'\neq\gamma])$$
$$$$$$$$
Since

$$\Pr[\beta'=1|\textbf{abort}]=\frac{1}{2},$$

$$\mathcal{P}_{BDH}=\frac{1}{2}\Pr[\textbf{abort}]+\Pr[\beta'=1|\overline{\textbf{abort}}]\Pr[\overline{\textbf{abort}}]$$
I can't not follow after that.$$$$
Please help me to understand what Waters said.


texts:
I just encountered the term "zero-knowledge" and wanted to know more about it.

I understood that there is a zero knowledge protocol between two parties to determine whether $x$ is greater than, equal to, or smaller than $y$, given that one side knows $x$ and the other knows $y$, but I couldn't find anything about it.

I searched in google, but couldn't find an answer (maybe I'm just bad at searching).

Hopefully you guys can give me a simple answer.


texts: Mersenne Twister's vulnerabilty with small-size distributions

texts:
C++ rookie here, trying to wrap his head around (CS)PRNGs.

I (assume that I) already understand the concept of the Mersenne Twister being "broken" (i.e. not cryptographically secure) due to its linear recurrence; so an attacker may figure out its internal state by knowing a sufficient amount of outputs and could then predict future outputs.

My question: Does this also apply to MT engines whose output values are distributed over a very small range? Like

std::mt19937 mt_rand(/* assuming secure seeding here */);
std::uniform_int_distribution<int> dist(0,127);
uint8_t rand7bit = dist(mr_rand);

, where the 32 bit output of the std::mt19937 template is effectively "reduced" to 7bit of actual information?

Would an attacker still be able to break this, even if he/she could ONLY access the distributed 7-bit values? (which are -theoretically- lacking 25 bits of the "full size" information?)

Or am I getting something wrong here?


texts: Converting Ciphertext to a Number in RSA

texts:
I've been looking into RSA and the attacks against weak implementations of it, such as when $e$ is small and there's no padding. On Wikipedia, the following attack is outlined for small $e$ values:

  When encrypting with low encryption exponents (e.g., $e = 3$) and small values of the $m$, (i.e., $m < n^{1/e}$) the result of $m^e$ is strictly less than the modulus $n$. In this case, ciphertexts can be easily decrypted by taking the $e^\text{th}$ root of the ciphertext over the integers.

What I'm confused about here though is how do you carry out mathematical operations on ciphertext? I'm aware that all characters have numerical values, but what I'm unsure on is do you construct a single number from a whole ciphertext as you would for plain text to be encrypted (ie, convert each character to an integer then construct the number with the rightmost digit being most significant) and then carry out the operation on this number, or do you act on each individual number in the ciphertext? If it's the former, how do you determine to reconstruct the single number into a sequence of numbers that create the original plain text?


texts: Fermat's factorization method on weak RSA modulus

texts:
Given a public key for RSA, I have extracted the modulus which looks like this:

Public-Key: (2049 bit)
Modulus:
    01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:02:19:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:fe:
    f8:45
Exponent: 65537 (0x10001)

I have successfully factorized the modulus using Fermat's factorization method. This method is fast when the prime factors are close to the square root of the modulus.

My question is, how can you tell that this modulus has its prime factors close to its square root?

Thank you


texts: The enigma machine had a serious flaw: the letters could not be encrypted as themselves. Is there an online enigma simulator I can try that does not have this flaw, which would likely make it secure?


texts: In this question I asked about a subset sum hash. Would it be possible to adapt that into a commitment scheme by keeping M private and revealing it at a later time? Would this be secure for some size of M?


texts: Is it possible to extract the decryption key from a locked android device

texts:
Is it possible to extract the decryption key from a FDE android device while the screen is locked but the phone is powered on.

Is the data only safe when the phone is off ?


texts: Dedekind sum is a product of sawtooth function

texts:
"The Dedekind sum is a product of a sawtooth function." This sentence does not make sense to me. A sawtooth is a kind of wave for sound generation. But in the realms of cryptography, the Dedekind sum seems to use these sawtooth functions.

Could anyone please explain how the sawtooth function are used for the Dedekind sum?


texts: Is this mentally computable password system, cryptographically secure? And anything like this out there I can find?

texts:
Please bear with me on this, I'm not learnt in this field, just trying to ask questions about the security of my encryption method.
I'm trying to create a mentally computable human password manager method that can generate strong passwords using a set of operations and a master password, so that you only have to really remember one password to have strong passwords for all your accounts. And also to never have to change the system in your life so you can have backwards compatibility. The system will work even when everything has been exposed to a public. My desire is to have the system be intuitive and user friendly (instead of having to put effort into memorizing 1pad charts, etc.) yet secure.
I had some feedback elsewhere that my system outputs strong passwords against normal attacks but is vulnerable to a determined adversary, so now I made some changes.
For the sake of simplicity, I will be using weak passwords, but bear in mind it doesn't take that much to obfuscate the final output with scrambling, numbers and symbols.
So, I have a string of 34 letters, each letter representing a word that starts with said letter. That is my master password.
Let's begin with making a Google account:
1. Google
First, I take the word Google to apply the seed
G = 7th letter of the alphabet (position)
Google = 6 letters (length)
2. GoogleLydngr
Then, I add the 6 (length) letters after the 7th (position) letter of the master password
3. GoogleLydAroundngr
At this point, the last letter "r", represents a word which has 3 letters
I move back 3 spaces and add the word "Around", which is the next letter/word after the "r"
GoogleLydAroundngr
So that will be my password for Google. This example is easily bruteforced but my question isn't about the password strength but more of the concept.
Now I create a Facebook account, using the same system:
FacebookGlAndydngra (6 position, 8 length)
You will notice the difference is the letters and number of letters, and that I moved back 6 spaces instead of 3, and has added "And" instead of "Around".
I create 3 more for Instagram, Twitter and Microsoft:
InstagramDngrNeveraadyn (9 position, 9 length)
TwitterNgraNeverady (20 position = 0 = 10 position, 7 length)
MicrosoftYungRunlydng (13 position = 3, 9 length)
So, you hacked my accounts through a keylogger, and got a hold of all my passwords. Also, you discover my order of operations. And finally, I wrote down my master password in a text file, so you know that too. I lose everything.
But I go ahead and create new accounts using the same system. However, I change the master password.
How easy is it to crack my new accounts just based on the fact you know everything now... except for my new master password?
For anyone who's curious, the master password is Nggyunglydngraadyngmycngsgngtalahy

Never gonna give you up
Never gonna let you down
Never gonna run around and desert you
Never gonna make you cry
Never gonna say goodbye
Never gonna tell a lie and hurt you

But seriously, this is a serious question. I'm trying to use the chaos of language and musical timing to generate more variety in place of complex calculations. But I'm not smart or educated in this field to know how flawed my system is.
And just another tidbit, one song alone can generate several passwords for when I need to change a single password exclusively, all I have to do is use a different verse of the song or use syllables instead, or something.
Thanks and appreciate any help or comment given.


texts: Linear secret-sharing scheme for four players

texts:
I got stuck on this question during my exam revision.

Consider the linear secret-sharing scheme for four players $P_1, P_2, P_3$ and $P_4$ based on the matrix
$$
M=
  \begin{bmatrix}
    1 & 0 & 0 & 0  \\
    1 & 2 & 3 & 3 \\
    0 & 1 & 5 & 5 \\
    1 & 4 & 3 & 6 \\
    0 & 5 & 2 & 4 \\
  \end{bmatrix}$$
whose entries are elements of $GF(7)$. The dealer shares a secret $s \in GF(7)$ using random elements $r_1, r_2, r_3 \in GF(7)$ by computing $M(s,r_1,r_2,r_3)^T$ and letting the share of player $P_i$ be the $(i+1)^{th}$ coordinate of the resulting 5-tuple.

How do I show that $\{P_1,P_2\}$ and $\{P_3,P_4\}$ are the only pairs of players who can recover the secret?

How do I show that any set of three players can recover the secret?


texts: Is order of Correlation Immunity of AES S_box Zero?

texts:
I am working on AES S_box and trying to find out its properties like Correlation Immunity, Balancedness, Algebraic Degree, ANF form etc.

These Papers 1, 2 give a nice definitions to above said terms.

Also this very famous paper by T. Siegenthaler proved a fundamental relation between the number of variables 'n', algebraic  degree 'd' and order of correlation immunity 'm' of a Boolean
function : $$m+d <= n$$

Moreover, if the function is balanced then $$m+ d <= n − 1$$

I used this python script to find the ANF form and the Algebraic Degree comes out to be 7 i.e d=7 and we know for AES S_box n equals to 8 and its balanced function.

So putting all this data in that formula gives m=0 i.e. order of correlation immunity be zero.

Is this the right Correlation Immunity? or I am doing something wrong. Those who have  worked in this field kindly help.


texts:
AES-CTR is nice for its parallelizability and simplicity but if you duplicate an IV you reveal plaintext.

Chaining modes like CFB and CBC don't have that problem per se but they are not parallelizable. (CBC-type modes have padding issues too but that's a separate problem.)

Naive ECB mode is not secure because it reveals structure in the plaintext as shown clearly here.

However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem.

The advantage over CTR as I see it is that duplicating a nonce/IV (or having no nonce/IV) would not allow actual plaintext recovery. It may reveal duplication, but that's it. In the no-IV case duplicate messages would have duplicate ciphertext, but that again only reveals message duplication but does not compromise secrecy.

Obviously you'd need some kind of padding but again that's a separate issue.

Why is this kind of mode not a thing? Would a mode like that have some problem I don't see or is it simply deemed unnecessary?


texts: On an EKE (Encrypted Key Exchange) what would happen if asymmetric key would be symmetric?

texts: On EKE where the user sends a password encrypted public key and receives a password encrypted and public key encrypted secret key. What would happen if these asymmetrical keys would become symmetrical?


texts: Why is ciphertext from low entropy plaintext not compressible?

texts:
This comes following a discussion with a colleague.

My plaintext file plain consists of a about 100,000 lines of "all work and
no play...". It's size is: 2.2 MB.
Compressed it is: 5.4kB
I encrypt the original:

openssl aes-128-cbc -in plain -out plain.ENC

plain.ENC is marginally bigger than the original, which I would expect.
I compress the encrypted copy: gzip plain.ENC. But I observe that the
compressed copy is now marginally larger than plain.ENC.

Assuming the entropy of the original file is on the order of ~1000-10000 bits, why is the corresponding ciphertext incompressable? My intuitive notion of the entropy of a string is the minimal number of bits required to produce that string. If the string is the 3 MB long cipher text, it was generated with a 1000-bit entropy string encrypted with an AES implementation (probably no more than a few thousand bits), as well as a few-hundred bit key. Intuitively, to me, the entropy of the cipher text should be no more than the sum of the entropies of the strings and procedures that generate it.

So, my question is: Is my intuitive notion completely wrong? If we extended the low-entropy file to be orders of magnitude larger, would we begin to observe compressibility in the ciphertext?


texts: What are the values of $w$ such that the corresponding $\text{Keccak-}f[25w]$ function is invertible (bijective)?

texts:
From this answer, I see that from a mathematical point of view, one could define the $\text{Keccak-}f[25w]$ permutation for an arbitrary value of $w$.

I am interested in the following question: disregarding all properties of the resulting function except the invertibility (because $\text{Keccak-}f[25w]$ is required to be a permutation), is it true that if the value of $w$ is a multiple of $8$ and not a multiple of $5$, the corresponding $\text{Keccak-}f[25w]$ function is invertible (and bijective)? If the answer is “No”, then how to determine whether a particular $w$ is suitable (assuming that $w$ is required to be a multiple of $8$)?


texts:
I'm looking to use group signature that is scalable in terms of the size of the signature is independent of the number of the group members.

Two question-

1- Is [1] considered an up to date, efficient and secure scheme?

2- In case of new joining member, does the signature needs to be changed? (to also to reflect the new member's membership).

[1] - https://link.springer.com/content/pdf/10.1007/BFb0052252.pdf


texts: Check the validity of a rsa key pair with only the public key?

texts: I am currently developing a messaging application that uses rsa end to end encryption. The client generates permanent rsa keys, and sends the public key to my server for account management. As it currently is, my program will take any keys, without validation. This is a big security risk, so I need to validate the keys in some way, without knowlege of the private keys. How would I go about doing this?


texts: How to break AES CBC with PKCS#5 padding?

texts: If I have a string encoded with AES CBC with PKCS#5 padding, how can one possibly decrypt/crack it? What are the approaches that one can take to break its security?


texts: If I can crack the AES, how do I crack the wifi

texts:
I am a student major in math.
My teacher said that AES (Advanced Encryption Standard) has many applications.
For example, the WPA2 in wifi.
Then he taught the theory of the AES and never says how to apply it.

So, my question is,
if I can crack the AES,
how do I crack the wifi and steal others' data (just for learning purpose).

Please give me the concrete steps.
If it is too complicate to explain at here,
you can give me the reference which I should read.

Edit: the point of my question is not "how to crack AES".
My question is "how to crack wifi if I can crack AES".
I can choose the key by myself in a private newwork.
Then I don't need to crack the AES.
The thing I want to do is crack and learn how to crack the wifi.


texts: SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)

texts: The hashing scheme SHA-256 (for instance) is based on Merkle-Damgård construction with the underlying compression function based on the block cipher SHACAL-2 configured in Davies Meyer mode. SHACAL-2 has 80 rounds, per 512 bit block of data (which is inserted in the key input of the block cipher). As an alternative, one could use AES with 256 bit key (so the hashed data should be divided to 256 bit blocks, inserted as a key) and using Davies Meyer principle in the same way. Seemingly, this would be much more efficient, because AES-256 requires 14 rounds, or total 28 rounds in order to process 512 bit of data, while theSHACAL-2 requires 80 rounds. Is there any standard that does this?


texts: Ignoring the TAG of the AEAD-SIV encryption

texts:
I am working with personal data that contain Identifying attributes such as a player ID and i need to prepare the data for analysis purposes, therefore i need to pseudoanonymize the data beforehand. However, the data should be pseudo-anonymized in a deterministic way in order to always have the same pseudo-anonym for the same player ID.
While searching through different sources, i ended up working with the encryption AEAD-SIV method mode implemented https://pycryptodome.readthedocs.io/en/latest/src/cipher/modern.html?highlight=siv#siv-mode where i specify a fixed nonce.
AEAD by definition creates a ciphertxt and a tag for each plaintext message and no one can decrypt the ciphertext except when providing the tag.  Therefore, from my side because i dont need to decrypt the ciphertext after encryption , i am only storing the ciphertext and completely ignoring the tag upon creation.
Therefore my questions:
1- Does it decrease the level of security of the encryption if we do not store the tag?
2- Also, In some cases am specifying a fixed padding in order to not have ciphertexts with different lengh. Does this process affect the level of security of the encryption?
3- Is AEAD-SIV still considered a standard for deterministic encryption? (I read about AEAD-GSM-SIV but there doesnt seem to be any available implementation yet).
Thanks in advance


texts: PBKDF2 uses HMAC-SHA1 to generate keys, but what is the key for the HMAC?

texts:
I was reading up on PBKDF2 and noted the following:

DK = PBKDF2(PRF, Password, Salt, c, dkLen)

PRF is a keyed HMAC, but I can't seem to find out what they use as key for the HMAC?


texts: Conditions for Perfect Secrecy with the Vigenere Cipher

texts:
Please forgive my ignorance here as I'm far from a math major and I've never looked into cryptography before so if this seems stupid - it probably is. There is a question in a quiz I'm attempting that is just doing my head in. If you are wondering - I'm not doing this course for credit or receiving any certification for passing it, just for my own interest.

I've attempted this question multiple times now and I'm still getting it wrong and I don't understand why. Here is the question:

  Consider the Vigenere cipher over the lowercase English alphabet, where the key has length 6. For which of the following message spaces will this scheme be perfectly secret? (Check all that apply.)

  The set of all 7-character strings of lowercase English letters.
  The set of all strings of lowercase English letters containing at most 6 characters.
  The set of all 6-character strings of lowercase English letters.
  The set of all 5-character strings of lowercase English letters.

I know I'm getting punished by the combinations that are available due to the 'check all that apply' criteria, but I'm now at the point of blind guessing - which just isn't learning.

I'm particularly annoyed with this because further down in the same quiz the following is considered to be a correct answer for an aspect of another question:

  'The Vigenere cipher is perfectly secret if the length of the key is equal to the length of the messages in the message space.'

To me then, it seems that the answer would be:
2 and 3 and 4 - Wrong

Perhaps this is wrong because 'the key' is only as long as one individual member of 'the strings' in the message space, not the length of 'all the messages in the message' space combined?
(i.e. which would effectively be turning it into a One Time Pad where the key is the same length as the total message space?)

How should I go about breaking down this question to arrive at the answer with some sort of mathematical reasoning, rather than taking blind shots at it (which is where I'm at now)?

Description of the Vigenere Cipher

  Now when we introduced the Vigenère cipher, we presented it in the
  following way. We said that the key was a string of letters. From the
  English alphabet and the plaintext will also consist of letters from
  the English alphabet. To encrypt a given plaintext with a key, what
  you do is simply shift every character in the plaintext by the amount
  dictated by the next character of the key. You can view this simple as
  addition modular 26, because there are 26 letters in the English
  alphabet. And if the key is shorter then the plaintext you simply wrap
  around in the key as needed, and decryption just reverses the process.


texts:
When studying cyclic groups I stumbled upon the following sentence:

The ∗ in $Z_n^*$ stresses that we are only considering mulitplication and forgetting about addition on this site of stanford.

I don't really understand this definition, as I was learned that $Z_n^*$ just consists out of all elements of the elements of a cyclic group, minus the 0. Where does this the multiplication and addition come in?


texts: Why does curve25519 use a cofactor of 8?

texts:
This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field.

Why would one wish to reduce the number of possible private keys, it seems to reduce security.

What is the reasoning behind using a cofactor of 8?


texts:
I have some questions from previous years exams, I hope you could help me with them. :)

Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. Consider an instance of the 3SAT problem for Boolean variables $v_1, \ldots , v_l$, given by a Boolean formula $\Phi$ consisting of $m$ clauses, which each consist of $3$ literals:

$ \Phi = (l_{1,1} \vee l_{1,2} \vee l_{1,3}) \wedge \ldots \wedge (l_{m,1} \vee l_{m,2} \vee l_{m,3})$.

Each literal is of the form $l_{i,j}=v_k$ or $l_{i,j}=\overline{v_k}=1-v_k$ (negation of $v_k$), $1 \le k \le l$. Construct a $\Sigma$-protocol for the following relation:

$R_{\Phi}=\{ (B_1, \ldots, B_l;x_1,y_1,\ldots,x_l,y_l)\colon \Phi(x_1,\ldots,x_l), \forall_{k=1}^l B_k=g^{x_k}h^{y_k}, x_k \in \{ 0,1 \} \}$.

Thanks, Peter.


texts: Encrypting messages without revealing length?

texts:
In various messengers, we have end-to-end encryption, making it hard to know what the message said.
But do these messengers have to pad the message to some maximum length every time, in order to hide the length of the message?
In a block cipher, there is a minimum length that you have to pad to, right?
My question is how do WhatsApp, Telegram, and Signal actually do this? How effective are they are hiding the length of the message?
And are there good ways to hide this type of metadata (length of the message and how often it is being sent) by doing some sort of steganography (eg posting message chunks to different endpoints depending on a hash of some variables available only to the participants, and sometimes also posting decoy garbage prefixed with “disregard:” in order to obfuscate patterns, etc.)


texts: Algorithms to securely derive symmetric keys

texts:
I need to  derive symmetric keys between two communication endpoints on an embedded device with 800MHz ARM core. What algorithms are available to have this secure key derivation mechanism?

I know Diffie-Hellman is one of them, but I am unable to make the right choice while considering computational requirement vs security. It seems there are many variants available, and parameters involved. Any pointers are appreciated.


texts: How many qubits are required to break classical Diffie-Hellman?

texts:
There have been comparisons between RSA and ECDH with regards to the number of qubits  required to break the algorithm with a specific key size. But how many qubits are required to break "classical" Diffie-Hellman (DH) over a multiplicative (finite, cyclic) group?
This would for instance be interesting for stored DHE TLS sessions that used for key agreement. Would it do better or worse than RSA with a similar key size (and therefore, approximately the same classical cryptographic strength)?


texts: Diffie Hellman: Why is $(\mathbb{Z}_{8191}^*, \times)$ an insecure group?

texts: I noticed that all the binary bits of $8191$ are $1$'s. Could this have something to do with it?