texts:
This question is rather simple.

I've recently read the paper

"Automated Analysis and Synthesis of
Authenticated Encryption Schemes".

On page 17 of this paper the authors provide three figures of encryption modes for

tweakable block ciphers. However all I can see is that the box representing the block cipher

only has one input and one output, as opposed to two for tweakable block ciphers.

Question: How can I translate the figures into the standard description of modes?

Standard description means something like $C_1=E_K(M_1\oplus C_0)$ for CBC.

For everyone not sure which figure is meant, here are the figures in question:


texts: Which encodings have |encoding key| >> |decoding key|?

texts:
I'm looking for an encoding scheme that requires a very large encoding key E (>10MB)  and suffices with a relatively small decoding key D (<4kB). One should be able to prove some lower bound on |E| using only knowledge about the scheme, the encoded message and D.

It would be great if the proposed scheme has computationally efficient primitives.

EDIT: A use case for this can be to encourage voluntary disposal of E after encoding a smallish (~1MB) file.
EDIT 2: Ideally, it should not be possible to infer E from D.


texts: Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?

texts:
First of all, the Guillou-Quisquater digital signature scheme is:

Note everything is $\bmod n$. Message is denoted by $m$.
Private key: $s$
Public key: Hash function $H$, $e$, $L=s^e\bmod n$
To sign: Alice chooses random $r$. Computes $c=H(m||x)$ with $x=r^e\bmod n$; $y=r\cdot s^c\bmod n$;  send Bob $x$ and $y$.
To verify: Bob computes $c=H(m||x)$ and accept if $y^e \equiv x\cdot L^c\pmod n$.

I'm wondering what the strongest known security of this is, in particular the question in the title. If not, what's the best research that's been done on this scheme?
I've scoured the internet for such a proof, but I can't find anything. I was also told by my supervisor that if I could find such a proof for El Gamal it might be easily adaptable, so that would also be much appreciated. Thanks!


texts: generate hash of all handshake messages for verify data (DTLS)

texts:
I am trying to create a DTLS client finished packet, where I need to generate verify data for handshake hash is need. And here I want to know how to generate handshake hash. As of now I am doing like this:

memcpy(hs_msg, client_hello_with_cookie+13, client_hello_with_cookie_len-13);
len = client_hello_with_cookie_len-13;
memcpy(hs_msg+len, server_hello+13, server_hello_len-13);
len += (server_hello_len-13);
memcpy(hs_msg+len, server_hello_done+13, server_hello_done_len-13);
len += (server_hello_done_len-13);
memcpy(hs_msg+len, client_key_exchange+13, client_key_exchange_len-13);

But the hash of handshakes seems to be wrong while comparing with openssl. (I am using sha1).

Need help to solve this...

Thank you very much.


texts: Discrete log problem, when we have many examples

texts:
Suppose I have many instances of the discrete log problem, all using the same unknown exponent.  Is this problem easier than the standard discrete log problem?

Oh, heck, I should be more precise.  Let $p$ be a large prime, chosen to be large enough that the discrete log problem modulo $p$ is (presumably) hard.  Everything from here on will be in the multiplicative group of integers modulo $p$.  Suppose we are given $a=(a_1,\dots,a_n)$ and $b=(b_1,\dots,b_n)$, where $b=a^k$, and we want to find $k$. In other words, $b_i = a_i^k$ for all $i$ (the same integer exponent for each of the $n$ instances), and we want to find the exponent $k$.

What is the hardness of finding $k$?  Is it significantly easier to find $k$, given these $n$ instances, than it would be given only one instance?  (say, is a greater than $n$-fold speedup available?)

$\newcommand{\Z}{\mathbb{Z}}$
I suspect it makes sense to focus in particular on three cases, depending upon how the $a$'s are chosen:

Random choice. In this variation, the $a_i$'s are uniformly and independently distributed on $(\Z/p\Z)^*$.
Non-adaptive adversarial choice. In this variation, the adversary chooses all of the $a_i$'s in advance, before seeing any of the $b_i$'s.
Adaptive adversarial choice. Finally, we can consider an adaptive variant, where the attacker chooses $a_1$, gets to see $b_1=a_1^k$, then the attacker can choose $a_2$, see $b_2=a_2^k$, and so on.

Does it help the adversary significantly to see $n>1$ pairs $(a_i,b_i)$?  Of course, when $n=1$ this just reduces to the standard discrete log problem.  When $n>1$, is this problem ever significantly easier than the basic discrete log problem?


texts: How much processing power should you assume an attacker has?

texts:
The answer to this question says that you should assume an attacker can do one billion operations per second: Key Size for Symmetric Homomorphic Encryption Over the Integers

Is that a single attacker with a simple desktop computer, or is that someone with a bot net or super computer?


texts:
I don't have much knowledge about cryptography beyond using libraries for it. So just wanted to understand if the following two cases differ sufficiently in security or is it just psychological:

Say I have a plain text T and I use the following scheme to encrypt:

Take SHA512(T) = H(T)
Use any good symmetric encryption scheme to encrypt T with H(T).
Result cipher text = C
Keep H(T) safely secret.

How secure is cipher text C in the wild now ? (I can do (1) a few times if it adds anything - so instead of H(T) use H(H(H(T))) etc. - you get the idea).

How would this compare with using an encryption key unrelated to T ? Since H(T) shouldn't be reversible how much more does an unrelated key  add to the security ?


texts:
Sophie Chen at Wired Magazine;

  quantum mechanics could solve cryptography's random number problem

Such machine already exist, but it's too huge and not so fast in order to use it all the time.

Anyway, can it solve the problems connected to randomization and security or it will be still vulnerable?


texts: Rotor that divides binary number by mod 3

texts:
Let's say we have transformer(?) A = $\{0;1 \}$, B = $\{0;1\}$, $Q = \{q_0,q_1,q_2\}$, where A - plaintext alphabet, B - encryption alphabet, Q - the set of states. The functions of the rotor are described as:
$$q0 ◦ 0 → q0 \ \ \ q0 ∗ 0 → 0 \\
q0 ◦ 1 → q1 \ \ \  q0 ∗ 1 → 1 \\
q1 ◦ 0 → q2  \ \ \ q1 ∗ 0 → 2 \\
q1 ◦ 1 → q0  \ \ \ q1 ∗ 1 → 0 \\
q2 ◦ 0 → q1  \ \ \ q2 ∗ 0 → 1 \\
q2 ◦ 1 → q2  \ \ \ q2 ∗ 1 → 2$$
And the function which it executes is mod 3. Does it only work for determined length of plaintext? What algorithm is behind this scheme?


texts: From 2-round key-exchange protocol to a public-key encryption scheme CPA-secure

texts:
I have to solve this exercise and I really could use some help:

Show that any 2-round key-exchange protocol (that is, where each party
sends a single message) satisfying $Definition$ $9.1$ can be converted into
a public-key encryption scheme that is CPA-secure.

$Definition$ $9.1$:
A key-exchange protocol II is secure in the presence of
an eavesdropper if for every probabilistic polynomial-time adversary $A$ there exists a negligible function negl such that

$Pr [KE^{eav}_{A,\pi} (n) = 1] \le \frac{1}{2}+ negl(n)$


texts: How to design a cryptographically secure file hosting service

texts:
How would one go about designing something like Google Drive/Dropbox providing the following features:

files are encrypted and decrypted on the client
files can be synced between devices
the service provider shouldn't be store private keys/passwords on servers
if the user can have only one password to remember that'd be great (we want to design something user friendly)
ideally one could share files with other users

So I thought about a couple of things which don't quite solve the problems.

Using AES to encrypt files

So the first idea is that each user has one password. Now to encrypt a file we derive a long enough AES key from this password (by hashing it and taking the first N bits of the hash) and we encrypt the file. Decryption can only be done if we have the original password.

This fulfills requirements #1, #2, #3, #4.

But I see several potential drawbacks: first files cannot be shared (unless we decrypt them...). Also how bad would that be to derive the AES key from a hashed password? And how bad would that be to reuse the same AES key again and again?

Using a public/private key encryption scheme

To encrypt a file: generate a key pair, encrypt with the public key, save this to the servers. To decrypt use the private key.

This fulfills requirements #1, #2*, #3.

[*] while files can be synced between devices we don't have a user friendly way to pass private keys around (because the user would have to store them 'offline' and carry them with him 24/7)

Sharing is also an issue. Let's consider that Alice stores a file foo.bar and wants to share it with Bob. The only way to do that would be for Alice to decrypt the file locally and reencrypt it with Bob's public key and then send this to Bob. This is cumbersome because it means that sharing takes time and needs Alice to be 'online' to be able to send the new encrypted file.

tl;dr

Is there a way to design such a system without any of the aforementioned drawbacks/flaws?


texts: How can a hash function be suitable for hashing passwords, but not for deriving enctyption keys, and vice versa?

texts:
Not being a specialist in this field, I am nevertheless constantly trying to keep up with which methods are being considered secure for storing passwords and for encrypting data.

During my research and desperate tries to extract the key points which are important for practice :-), I am reading often that certain hashing functions are suitable for password hashing, but not for deriving encryption keys, and vice versa. Since I absolutely can't get this, but have read it too often, I have to seek help.

For the following, let's forget about all complicated things (rainbow tables, salting, side channel attacks and so on). Furthermore, I am over-simplifying things in the following sections. But the question is so basic that I think that the over-simplification does not hurt in this case.

My understanding problem is this:

An OS should not save a password in clear text for obvious reasons. So a hashing function (MD4 (yes, Windows still uses it), SHA-2, scrypt, ...) is  applied to the password, and the hash is stored on disk instead of the password.

If an attacker wants to crack the password, he has to get the hash, and then has to take every possible input string, apply the hashing function to it, and see if the hash of the input string is the same as the hash of the password the OS had stored.

This means that the hashing function should be slow (in terms of cycles), should be hard to parallelize, and should be memory intensive to make brute force cracking (even with specialized hardware) as expensive and time consuming as possible.

On the other hand, as far as I have understood, when deriving an encryption key from a password, nearly the same method is applied. The difference is that the hash of the password is not stored on disk, but is used directly as encryption key for some symmetric encryption method (like AES) (over-simplified, but shows the general idea, right?).

Now, if an attacker would like to break the encryption, he also would have to test every possible password, apply the hashing function to it, and then decrypt the encrypted data with the hash and test if the result contains something meaningful. Thus, as with password hashing, the hashing function should be very hard to parallelize, memory and cycle intensive so that the attacker could test only a few encryption keys (= hashes) per second.

So the requirements to a hashing function for hashing passwords seem to be the same as the requirements to a hashing function whose output is used as encryption key. For the life of me, I don't get why some hashing functions are considered suitable for the one, but not the other, and vice versa.

Could somebody please explain this in simple words, taking into account that I have a mathematical background in general (if urgently needed :-)), but no background in cryptography's mathematics?


texts: Can I attack a PRNG using a differential or linear cryptanalysis?

texts: I modified the generation key function of XTEA using a PRNG with 128 bits. I have to attack it using both differential and linear cryptanalysis but I don't see how, it's possible to attack a PRNG?


texts: Small values with non-uniform distribution encoded as large values with uniform distribution

texts:
Given a non-uniformly distributed set of 32-bit values (for example), is there a way to reversibly encode each one as a 128-bit value (for example) where they'd be approximately uniformly distributed in that larger 128-bit space?
Block ciphers do this as I understand it but they require a key and are computationally expensive due to security concerns. If I didn't want security, just the property of approximate uniform distribution and increased size, is there a more efficient way?


texts: Is it possible to prove the time a message was produced?

texts:
Say Bob wants to tell Alice a secret message, then they start some message exchanges protocol. At the end, Alice will receive the secret message and can be convinced that the message was not produced earlier (and obviously not later) than the time they communicated.

An attacker (Bob included) will try to win by forging the secret message before they start the message exchanges.

As for a real world scenario, consider the secret message a picture, showing something of Alice's interest. Bob sends this picture to Alice, Alice however, doubt the picture was taken a long time ago, so she challenges Bob to send as well some random angles of the things showing in the picture as she requested until she is convinced that the things showing in the picture are there at the time they communicate. Note that the things in the picture can be there a long time ago (e.g. an old house) , but the secret message (the picture showing the old house) was only produced at that moment.

The security of the above scenario is only based on Bob not knowing the random choice of the angles Alice will pick and the infeasibility of Bob quickly creating a fake picture at the said angle. Can cryptography provide something better than these?

Somehow I believe the "infeasibility to create variants of the secret message" is a must assumption to guarantee the proofs. So may be in real world this cannot be a simple plaintext message, but sound, picture, video, 3D model, etc., which are difficult to edit?


texts: using elliptic curve point multiplication as a key stretching method

texts:
My friend came up with the following idea: assuming we agreed on curve parameters, use the following algorithm for key stretching/derivation from user-entered password.

Pad the ascii representation of the password to n bits or use any simple hash function, e.g. MD5 to allow passwords of arbitrary length
Compute the resulting key as a multiplication of the curve generator point by the number we got at step #1.

In other words, we consider the user-entered password to be the private key of ECDSA and use the public key derivation algorithm as a key stretching function.

Now this looks pretty simple and effective (my CPU only manages to do less than a couple thousand multiplications per second and it seems there is no way to get significant speedups using GPUs). Is this algorithm actually used anywhere? If not, what are some obvious flaws that I can point to for my friend and make fun of him?

EDIT: Thanks for answers! Can't upvote yet due to low rep. The idea was to use this method as a slow hash function for password hashing (as a replacement for bcrypt for example). IMPROVED VERSION: Assuming we use SHA256 in the first step to hash the entered password, then multiply with the generator point in the p256 curve and use the X coordinate of the resulting point as a 256-bit hash of the password. Is this hash good enough for this purpose?

This is a purely theoretical question of course, we are not going to actually use any homebrew cryptography in our app!


texts: What is the public key and signature sizes for XMSS?

texts:
This is a follow-up to a recent question of mine.

I am looking to find the public key and signature sizes for the XMSS signature scheme, in terms of the XMSS parameters (length $\ell$, height $h$ and security parameter $n$). I found the following 2 papers that have contradictory answers and I'm confused.

The original XMSS paper on pg.5 says:

  The bit length of the XMSS public key is $(2(h+ \left \lceil log \ell \right \rceil) + 1)n$, an XMSS
  signature has length $(\ell+h)n$ (...)

and a more recent paper on pg.6 says that the public key has length of $4 + 2n$ and the signature size is $4+n(\ell+h+1)$

Can someone explain me which of the two is true and why?


texts: Public Key generation for Ed25519 vs X25519

texts:
It is my understanding that EdDSA uses a slight variant of Curve25519 (typically used for ECDH), called Ed25519.

Given the same private key, are the differences between the two algorithms enough to make the resulting public keys different between X25519 and Ed25519?

In other words, if I'm writing code to generate private/public key pairs, do I need separate implementations for EdDSA/Ed25519 and ECDH/X25519?

Clarification: I realize that EdDSA mandates a SHA-512 step which ECDH/X25519 does not specify. I'm curious if the public keys are the same for the given input to the scalar multiplication step.


texts: In FHE over integers is each bit of the cyphertext encrypted under the new key?

texts:
In the paper Fully Homomorphic Encryption over the Integers, a method is shown for doing homomorphic encryption using only integers. The basic idea is that a bit m is encoded as a large integer c.

The principle behind homomorphic encryption through bootstrapping is that after some calculations, the cyphertext is recrypted by encrypting it under a new key and then performing the decryption on the first key homomorphically. This is explained in section 1.2 of Fully Homomorphic Encryption Using Ideal Lattices.

My question: since the scheme in the first paper encrypts a bit as an integer, how is this integer encrypted under the new key? Is each bit of c encrypted using the new key?


texts: Definition of one-way functions: randomly-chosen point vs every point

texts:
Notation: $\Sigma^k$ is the set of $k$-strings on the alphabet $\Sigma$; $\Sigma^\ast$ is the set of all finite dimensional strings on the alphabet $\Sigma$.

In the context of computer-science a strong one-way function is generally defined as follows:

A function $f:\Sigma^{\ast}\longrightarrow\Sigma^\ast$ where $\Sigma=\{0,1\}$is a strong one-way function if the following conditions holds:

$f$ can be calculated in polynomial time.
If $M$ is a probabilistic Turing machine that inverts $f$, then for every polynomial $q:\mathbb N\longrightarrow\mathbb N$ there is a $k_q\in\mathbb N$ such that  for every $k>k_q$ we have that
$$\textrm{Pr}\bigg(M\left(f(x)1^k\right)\in f^{-1}(f(x))\bigg)\le \frac{1}{q(k)}$$
for $x$ randomly chosen in $\Sigma^k$.

Many book emphasize the fact that $x$ is randomly chosen amongst all strings of length $k$. But what is the difference between the condition 2) stated as above and a condition $2)'$ where the phrase "for $x$ randomly chosen in $\Sigma^k$" is replaced by "for every $x\in\Sigma^k$"? Generally if a property is true for a generic element of some set, then we conclude that the same property holds for all the elements of the set. Why this importante on the random choice of the string $x$? To be more precise, when I read "for $x$ randomly chosen in..." can I interpret this sentence as "for any $x$ in..."? It seems that the answer is NO, but I don't understand the reason.

(This is the Wiki definition ).


texts: Decrypting an Affine Cipher with known characters

texts:
I am trying to cryptanalyse multiple cipher–texts that I know are encrypted by different Affine ciphers. I have already analysed the frequency that each character occurs, and compared it to a frequency table of the languages the plain-texts could be in and as a result have a pretty decent idea of what a few characters could correspond to. For example I know in one cipher-text:

  X = e, S = t, V = s

Converting those into their numerical correspondences yields

  23 = 4, 18 = 19, 21 = 18

I have therefore deduced that:

$4a+b=23 \pmod{26}$

$19a+b=18 \pmod{26}$

$18a+b=21 \pmod{26}$

I figure I could probably calculate the values of a and b by manually trying every iteration of a (which wouldn't be terrible since I can rule out all even values) and hoping once they all match with the same b it works for all characters, but I was just wondering if there was a faster/more reliable way of doing it Mathematically. Is there some way I can solve for $a$ and $b$ that I am unaware of?


texts: Is a PRG concatenation using the same input still a PRG?

texts:
Suppose we have a secure PRG $G: \{0,1\}^s→ \{0,1\}^n$ and we define a $G'(k)$ as:

$$
G'(k) = G(k) \| G(k)
$$

So if $G(k)=\mathbf{i}$, $G'(k) = \mathbf{i} \| \mathbf{i}$

Is $G'$ still a secure PRG?

Based on my own understanding it should be, because the statistical distinguishers will produce the same analogy of zeros and ones, therefore $G'$ should be a secure PRG too.

Is there any other principle about PRGs that $G'$ does not satisfy?


texts: Secure hashing when the input comes from a small space

texts:
I have a problem that I'll simplify here. Let's say I want to store a table of {person, fav color}. Only, I don't want anyone to ever be able to look up a person't favorite color; the only thing someone should be able to do is group people if their favorite color is exactly the same (not just merely similar). The obvious solution would be to not store the favorite color, but {person, hash(fav color)} using a good crypto hash(). Only, turns out that there is a very small list of color names, and anyone can easily enumerate all the colors, and compute the hash thereby reversing the hash and extracting the fav color for a person. I can stretch, but that makes computing hash() slow -- it needs to be a fast operation.

Basically, I have input x chosen from a small, easily enumerated space. I want a fast-to-compute function H that will guarantee x==y <=> H(x)==H(y) (with high probability). But knowing H(x) does not allow one to easily compute x.

I'm creating a secret key, and using H(x) as Hmac-Sha256(x, key).

Does this work? Is there a better, more accepted way of doing this?


texts: Difference between known-plaintext attack and forward search attack

texts:
I am looking at the different attacks on RSA. I came across known-plaintext attack where the public key can be used to encrypt all possible messages until it finds a match on the sent encrypted message. However, on the book I found in the library it seems this form of attack is also called "Forward search attack".

  If the message space is small or predictable, an adversary can decrypt a ciphertext c by simply encrypting all possible plaintext messages until c is obtained. Salting the message as described above is one simple method of preventing such an attack. -Handbook of Applied Cryptography

So are these attacks the same with different names or have I misunderstood it?


texts:
I came across some code in our project that encrypts usernames (limited to 50 chars, most are less than 10) using the following parameters:

IV size is 16 bytes

Key size is 32 bytes

Algorithm is CBC-AES (256bits)

Is there a security issue because of these parameters? Why would you use CBC and not ECB with a key size larger than 50 chars? Is it dangerous to use an IV smaller than the key size? What is the proper way to encrypt usernames in a database?

EDIT:
The IV is being reused for every username. This is not good apparently. I can write a migration script and change the algorithm etc, as long as the usernames are encrypted in the end. If anyone has any suggestions on how to best do this securely that would be very helpful.


texts: How to select parameters based on some condition

texts: I am implementing a protocol for authentication where parameters need to be selected with $gcd(\mu,\phi)=1$ where $\phi=(p−1)(q−1)$. What is the best way to select the parameters while implementing


texts: Difference between Hardware implemented algorithm and software implemented one?

texts:
In the articles about cryptography I see the words Hardware implemented and Software implemented. I'm curious to know what is the difference between them?

In the other words, even in the computer when I write a program to do a crypto algorithm, I finally run it on CPU. So why I couldn't call it hardware implemented?

What is the difference between a simple processor and a crypto processor(coprocessor?)?


texts: Is a function defined as PRF with a given key a PRG?

texts:
Let $G(s)=F_{0^n}(s)$ ($ 0^n $ is a fixed key given to the PRF F) for any $n∈\mathbb{N}$ and $s∈\{0,1\}^n$.

Is G, defined via PRF as above, necessarily a pseudorandom generator?

I presume that it is a PRG, since we don't really know what is the seed s. But the fact that $ F_{0^n}() $ is known, makes me doubt myself.

I don't seek for a proof, just an intuition or a hint (i do understand how to prove such claims, i just don't get the "catch" in this specific case).


texts: Clarification on the TLS verification process

texts:
I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand.
In the simplified description of how the browser validates a certificate you have this:

The client, which is a browser for ease of explanation here, has two processes that it must complete to validate the signature. The first process is to take the signature on the bottom of the certificate and decrypt it with the CA's public key. This public key comes from the CA's intermediate certificate which should be delivered by the server during the connection at the start of the TLS handshake. This tells us that if the CA's public key can decrypt it, the CA's private key must have encrypted it. This means it definitely came from the CA in question because only they posses the private key. The second process is for the browser to calculate its own hash of the Pre-Certificate to compare to the hash stored in the signature and determine if they are identical

But not sure if this portion is correct:

The first process is to take the signature on the bottom of the certificate and decrypt it with the CA's public key. This public key comes from the CA's intermediate certificate which should be delivered by the server during the connection at the start of the TLS handshake.

Is the portion that says the public key is delivered by the server correct? I would have assumed that the browser uses the pre-installed public key of the CA in this step.
Is the article wrong? Or am I the one who has got things wrong?


texts: PKCS #11 – Deriving a Key where MSB perform encryption and LSB perform CMAC operation?

texts:
I am using Thales HSM, a PKCS #11 Compliant device. I have an 32 byte AES key and derivation input.

I want to use AES-ECB encryption Mode to derive a 32 byte key where 16 MSB should be considered as one key, and 16 LSB should be considered as an another key. How do I achieve this?

I know that CKM_AES_ECB_ENCRYPT_DATA mechanism and C_DeriveKey PKCS #11 functions allow for derivation of keys using the result of an encryption operation as the key value. But my problem is how do I get 2 separated Keys (16 MSB and 16 LSB)?

This is very much needed for me to implement a System where 16 MSB perform Encryption operation, and 16 LSB perform CMAC operation.

EDIT

I am adding some more inputs to my query here.

Derived_Key = encrypt_Aes_Ecb(Master_Aes_Key, Derivation_Input)

where Master_Aes_Key is a 32byte Key and

Derivation_input = Concatenate(Input1 , Input2)

Both Input1 and Input2 are 16bytes.

My understanding is, if

Derivation_input = Concatenate(Input1, 16B of Zeros)

gives 16MSB of derived Key, and if

Derivation_input = Concatenate(16B of Zeros, Input2)

gives 16LSB of derived_key. Am I correct?

EDIT 2

Sample Input1:

00 00 00 F0 00 00 00 00 00 00 00 00 WW XX YY ZZ

Sample Input2:

00 00 00 0F 00 00 00 00 00 00 00 00 ww xx yy zz

where WW, XX, YY, ZZ , ww, xx, yy, zz would be keep changing always.

Derivation Input: Concatenate(Input1, Input2)
Derived_Key = encrypt_Aes_Ecb(Master_Aes_Key, Derivation_Input)

Now How do I get 16MSB of derived_key as one key used for encryption/decryption, and 16LSB of derived_key as another key used for CMAC operation?


texts: Where do the constants for SHA-1/2/3 come from?

texts:
My request is:
I need to know the source of constants (shift constants, IV, or S-Box) for the following algorithms:

SHA-1
SHA-2 (all sizes)
SHA-3

Examples:

BLOWFISH uses the hexadecimal values of PI.
SKEIN uses chosen constants from the output of running RJINDAEL in CTR mode on all zeros nonce and all zeros key and counter starting from 0 to one million.
CHACHA uses statements "expand 32-byte k" and "expand 16-byte k".


texts: Choosing a Random Number Generator algorithm to encrypt a message

texts:
What are the best cryptographically secure pseudo-random number generator algorithms, and what are their strengths/weaknesses?  I can't seem to come up with a list of them (or maybe I do, but they have such weird names that I don't recognize them).

I'm trying to write a simple program that takes a message and a key and encrypts or decrypts the message by using the key as the seed to a psuedo-random number generator that then generates the key to be used to encrypt/decrypt the message.  However, I keep getting frustrated at how hard it is to find a good, safe random function no matter what language I try, so I decided to try to make one myself.


texts: How are the PC-1 & PC-2 calculated for the DES block cipher?

texts: How  are the permuted choice tables - PC-1 and PC-2 - calculated for the DES block cipher algorithm?


texts: Securely derive AES and ED25519 keys from a ED25519 seed

texts:
Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed.

See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed

The reason I want to use this is because this is only 32 bytes, hence easy to copy and pass around.

I assume if I use a cryptograpically secure source of random for the seed, I should be ok in terms of security for the ed25519 key.

(Ideally I'd go even smaller if I could, without compromising on security).

Now I'd like to derive an AES key for encryption from those 32 bytes I already have (or the pub/priv key generated by the seed).

I would like anyone with the seed (or the private key) to be able to do the same.

Now there might be three types of clients:

Clients that have the seed/private key, who are able to derive the AES key, encrypt and sign the encrypted data. (needs 32 bytes for privkey or seed)
Clients that have the public key, and are able to verify the data has not been tampered with, but not be able to decrypt the data. (needs 32 bytes for pubkey)
Clients that have the public key and AES key, who area able to verify and decrypt data, but not able to sign it themselves (needs 64 bytes, 32 for pubkey, 32 for aes key)

How could I derive an AES key securely for this matter?

My gut says to use pbkdf2 on the private part of the ed25519 key to generate a AES key, but I am not sure if it somehow weakens the security.

Using pbkdf2 on the seed feels like it would compromise the security even more?


texts:
In Handbook of applied cryptography, Golomb's randomness postulates are given:
Let $s$ be a periodic sequence of period $N$. Golomb’s randomness postulates
are the following.

R1: In the cycle $s_N$ of $s$, the number of $1$s differs from the number of $0$s by at most $1$.

R2: In the cycle $s_N$, at least half the runs have length $1$, at least one-fourth have length $2$, at least one-eighth have length $3$, etc., as long as the number of runs so indicated exceeds $1$. Moreover, for each of these lengths, there are (almost) equally many gaps
and blocks.6

R3: The autocorrelation function $C(t)$ is two-valued. That is for some integer $K$, $C(t)=K$ for $t\neq 0 \pmod N$ while $C(0)=N.$

But why do those postulates make sense?


texts: Invalidate a hash of a sequence of values given only the first N elements of a sequence?

texts:
I want to develop a system where before some activity is performed, the user is sent a hash of a sequence of values which will be an inputs to the activity.
The number of possible values is fixed and values are not repeated in the sequence.
This I can do:
After the activity, the actual full sequence is sent to the user, so that the user can validate that the sequence of inputs was the sequence promised by computing the hash themselves.
Caveat:
During the activity, not all of the data from the sequence is consumed. Ideally, I don't want to send ALL of the original sequence to the user. I want to only to send first N elements that were used. Of course I cannot have the values in the sequence somehow discoverable using the hash.
Is this possible?
I see there is something called a Merkle Tree which seems to be able to prove set membership but it is not clear to me if this can prove order as well. Also this seems to be potentially leaky if there is only a limited set of values.


texts: Why is multiplication uncommon in cryptographic primitives?

texts:
Modern computers (which crypto programs are usually run on) have a 64-bit multiply, and it only takes one cycle. It's pretty decent mixing at next to no cost.

For block ciphers:

  Multiplication by a constant is nonlinear (when combined with other mixing operations), provides diffusion in one direction (easily amended with a rotate), is bijective (necessarily), and is as fast in both directions (with precomputed inverse).

For hashes:

  With no need to efficiently reverse the permutation, it is safe to use polynomials (ones that aren't linear). They provide even better mixing and can mix more than one value at a time. If bijectivity is not important, the full 128-bit multiply result can be used, for example by xor-ing the low and high words. Otherwise, rotates should be in there somewhere so the high bits can affect the low bits. It is somewhat costly, but still less costly than what would provide equivalently good mixing with only "lower level" operations. Simple example: a^=(b&~c)<<<7 can be replaced with a+=(b*~c)<<<7, which imposes no extra cost and mixes better most of the time.

I'm sure there's other potential uses for multiply, but those are the first two I came up with.

So, why is multiplication uncommon in cryptographic primitives? Sure, AES and SHA3 are designed to be hardware friendly, but what about all the others? Especially the ones designed for software implementations.

RC6 uses a multiply, though not for the usual purposes, "usual" meaning "like every other block cipher".


texts: Avoid decrypting every password in a password manager

texts:
The Setup

I'm making a password manager for fun. It stores a random encryption key, encrypted with a key derived from the master password, and then it stores the data, which is a list of (site, username, password) triples, encrypted with the encryption key. Here, encryption means calling libsodium's secretbox, which is authenticated encryption.

The Problem

I wanted to avoid decrypting every single password just to get a single one. Since the database still needs to be searchable, all the metadata still needs to be unencrypted in one go. So I came up with two different strategies:

Keep the passwords in a separate dictionary, indexed by hash(encryption_key ++ data).
Encrypt the password before storing it in the triple, which is then encrypted again. This idea sounds terrible, because double encryption scares me.

My questions are:

Is my setup secure?
Is it reasonable to avoid decrypting every password?
Which of the two aforementioned strategies are secure, and is there a simpler way to encrypt passwords only as necessary?

Sorry if this question is too specific, I'd be happy to try to make it more general.


texts:
I'm trying to find a good algorithm for generating authorization codes, access tokens and refresh tokens in an API.

Currently, I am looking into the following setup:

Tokens are generated using the RNGCryptoServiceProvider class in C#. (I have limited the allowed chars to the following set:  abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNOPQRSTUVWXYZ0123456789!@$?_-)

Authorization codes are generated with 256-bit length and have a lifetime of 5 minutes.
Access tokens are generated with 512-bit length and have a lifetime of 1 hour.
Refresh tokens are generated with 2048-bit length and have a lifetime of 60 days.

Those codes and tokens are then salted with a random 64-bit salt, and then hashed using SHA-256 before being stored in the database.

Considering the token lifetime, salt and hashing algorithm used, would this be a reasonable secure setup?


texts: How are Predicate Encryption algorithms implemented?

texts:
After a lot of reading on the internet, i can't seem to figure out how Predicate Encryption works.

As i read, it consists of 4 algorithms:

Setup() - (outputs MSK - Master Secret Key and PK - Public Key)

Encrypt(PK, text) - (outputs CT - ciphertext)

GenKey(MSK, predicate) - (outputs a Token)

Query(Token, CT) - 0 if false, 1 if true

I don't understand how the GenKey algorithm works, how u generate a token based on MSK and predicate, and of course, how you query the ciphertext using the generated token.

Can someone point me in the right direction ? Maybe some pseudo-code or very detailed explanation.

Thanks!


texts: Definition of support in the context of an encryption scheme and usage of P = NP assumption in lemma 9.2 (Arora, Barak)

texts:
EDIT: I've migrated the question by deleting the same question I asked on mathematics stackexchange.

2 questions: (1) I am confused about the definition of support used in the proof given in the textbook Computational Complexity: A Modern Approach lemma 9.2 by Arora and Barak (2) The usage of the assumption that $\boldsymbol{\mathbf{P}} = \boldsymbol{\mathbf{NP}}$

Lemma 9.2 states that

  if $\boldsymbol{\mathbf{P}} = \boldsymbol{\mathbf{NP}}$, then given
  any polynomial-time computable encryption scheme $(E, D)$ with key
  length $n$ shorter than the message length $m$ and where $E$ and $D$
  are each poly-time computable functions satisfying $D_k(E_k(x)) = x$
  for plaintext $x$, we can construct a polynomial-time algorithm $A$
  such that for every input length $m$ we can construct a pair of
  messages $x_0, x_1 \in \{0, 1\}^m$ satisfying that the algorithm $A$
  distinguishes any given encryption of either $x_0$ or $x_1$ with
  probability greater than $\frac{3}{4}$.

(1) In the proof, they write:

  Let $S \subseteq \{0, 1\}^*$ denote the support of $E_{U_n}(0^m)$

where $U_n$ is the uniform distribution on  $\{0, 1\}^n$ and then they state:

  Note that $y \in S$ if and only if $y = E_k(0^m)$; hence if
  $\boldsymbol{\mathbf{P}} = \boldsymbol{\mathbf{NP}}$
  then membership in $S$ can be efficiently verified.

But the definition of a support as I have known is that the support of a function is the smallest closed set of inputs where the function does not vanish. But $y$ is the output of the encryption function so how can it be in defined to be in the support of the function in the definition I'm using? How is the support defined properly in this case?

(2) My second confusion is on the statement

  Note that $y \in S$ if and only if $y = E_k(0^m)$; hence if
  $\boldsymbol{\mathbf{P}} = \boldsymbol{\mathbf{NP}}$ then membership
  in $S$ can be efficiently verified.

It seems that verification is efficient since in this case given a witness, a key $k$, one can encrypt $0^m$ with key $k$ and compare the output with $y$ and encryption is a poly-time computable function. Where does the assumption $\boldsymbol{\mathbf{P}} = \boldsymbol{\mathbf{NP}}$ come into play?


texts: Is SHA-1 collision free on data up to 20 bytes long?

texts:
Is SHA-1 collision free on data up to 20 bytes long (lenght of hash / internal state)? That means that every input produce unique output, but you surely know that, i just write it in order my question to be accepted by the site :)

If yes - which other hash functions does it apply to and what is the corresponding maximal length?


texts: Why shouldn't cryptocurrency hash algorythms, resist side channel attack?

texts:
2015's Argon2 publication suggests that cryptocurrency hashing like password hashing on backend servers should not be subject to side-channel attack:

Argon2d is optimized for settings where the adversary does not get
regular access to system memory or CPU, i.e. he can not run
side-channel attacks based on the timing information, nor can he
recover the password much faster using garbage collection [17]. These
settings are more typical for backend servers and cryptocurrency
minings.

Why ?


texts: Is the private key of a private/public key pair also a symmetric key?

texts:
I think I've got a fairly good (practical, not mathematical) understanding of symmetric versus asymmetric cryptorgraphy, so the difference between those is not the question.

In a local discussion someone said the private key (of a private/public key pair) would also be a symmetric key.

It was my understanding that this is not true, but I've not been able to find an authoritative answer to that question.

I found places that document "what has been encrypted using one key of the private/public key pair can only be decrypted with the other key of the pair."

Since the private key must be kept private with no exception for the concept to work, it would not hurt if it also was a symmetric key.

Thanks
Peter


texts:
I need some example values for the message schedule stage of SHA256 to test this part of my implementation.

If possible in binary, for the string 'abc'.


texts: Proof of RSA security dependent on public key exponent

texts:
I am writing a (high-school) paper on the public key exponent's (in textbook RSA - no padding is discussed!) significance in terms of time and security. The time part is done; as for the security part, so far I have shown example of various attacks that can take place when the public key is low (e.g. $e$ root attack, Håstad Broadcast Attacks etc).

My question is: Is there a way to mathematically justify that there is no way to prove that the security of the system lies in the value of the public key exponent?

I have also done some readings on the integer factorization problem whose intractability cannot be proven - can I relate this to the link between security and the public key?


texts: Pailler encryption of small integers to 32-bit integers

texts:
I want to encrypt very small integers in the range 0-44 using the Paillier cryptosystem. Is there a way to select p, q (g=n+1 anyway) and mostly r in such a way that I can guarantee that the encrypted values are still 32-bit integers?

Also, I have trouble understanding how to select r. According to wikipedia, the random $r \in Z^{*}_{n} $. How can I implement this in a programming language e.g. Java when I will have to select random values of r for more than 100,000 such integers?


texts:
In the Identity-based cryptography, the user's private key in the systems is delivered by the key generation center(KGC). My question is : Is it meaningful to consider the leakage of master key of KGC? And further, if this happens, then can I think that all the user's private keys disclose?
supplementary part (below)
Actually, in the papers(ID-based key-exchange) that I've read, I rarely encounter the scenarios where the leakage of master key is considered. Maybe(I'm not sure) it's because that since the adversary has the competence to get the master key, then what keys(including user's private keys) it cannot get?
But if we consider from another aspect, if the master key of KGC compromises, then it depends.If the KGC generates the user's private key only as a function of master key and user's identity without adding some additional ephemeral information(e.g. $sk_A=H(ID_A)^{msk}$), then the compromise of master key means the leakage of user's private key. But, if the KGC generates the user's private key also adding some additional ephemeral information(e.g.$sk_A=k+msk*H(ID_A,r)$, where $r=g^k$ is the ephemeral information ), then it's the other way around.Unless the adversary obtains the master key and the ephemeral value, then it can get a user's private key.
So many times, I don't know if the leakage of master key should be considered.


texts: factorization of an integer $N$ that is in special format

texts:
Suppose $p_0$ and $q_0$ are known prime numbers and define $p_i$ and $q_i$ as follows:

$$p_{i+1} = next\_prime(p_i^2 + q_i^2), \qquad i \ge 0$$ and

$$q_{i+1} = next\_prime(2p_iq_i), \qquad i \ge 0$$ and
$$N_{i+1} = p_{i+1}q_{i+1}, \qquad i \ge 0$$

I want to know is there efficient algorithm to factor $N_{i}$? What happen when the $p_0$ and $q_0$ be unknown? So can we factor an integer $N_1$ for example for unknown $p_0$ and $q_0$?


texts: Is there some way to generate a non-predictable random number in a decentralised network?

texts:
Is there a way to generate a random number with given restrictions:

It will be used in a decentralised network with a big number of peers (no central authority to generate it)
Its generation should not rely on any third-party service (for example, going to a specific website)
Its generation is triggered by a semi-random data being sent through the network, and it should relate to the data
The computer sending the data should not have an advantage in determining the random number (for example, computing some number that would have a really high chance of becoming the seeked number)

I was thinking of using a random number like that to counter a 51% attack against the Bitcoin network. The main problem there is that an attacker with a lot of computation power can compute a couple "blocks" in advance and only release them to counter "blocks" generated by legitimate users. I figured a way to counter that would be by requiring generation of some random number that couldn't be pre-computed in advance, but only when a block is sent through the network. Required use of that number would then invalidate blocks that are precomputed beforehand, preventing the attack.

So, is there a way to generate a random number like that described above?


texts:
I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC.

Can someone explain to me how CFB works. Such as how Initialization Vector(IV) work inside the Encryption Algorithm process together with the Key, and also how does the ciphertext message working to the next block cipher encryption.

And also my other question, is it okay to to use CFB with AES? I am confused because the plaintext message should enter AES algorithm to encrypt the plaintext message, but here in CFB, only Initialization Vector and Secret key will permuted by the block cipher.

Here is my another issue with CFB:

  "To use CFB to make a self-synchronizing stream cipher that will synchronize for any multiple of $x$ bits lost, start by initializing a shift register the size of the block size with the initialization vector. This is encrypted with the block cipher, and the highest $x$ bits of the result are XOR'ed with $x$ bits of the plaintext to produce $x$ bits of ciphertext. These $x$ bits of output are shifted into the shift register, and the process repeats with the next $x$ bits of plaintext. Decryption is similar, start with the initialization vector, encrypt, and XOR the high bits of the result with $x$ bits of the ciphertext to produce $x$ bits of plaintext. Then shift the $x$ bits of the ciphertext into the shift register. This way of proceeding is known as CFB-8 or CFB-1 (according to the size of the shifting).

  In notation, where $S_i$ is the $i$-th state of the shift register, $a \ll x$ is $a$ shifted up $x$ bits, $\operatorname{head}(a, x)$ is the $x$ highest bits of $a$ and $n$ is number of bits of IV:

  $$ \begin{aligned}
C_i &= \operatorname{head}(E_K (S_{i-1}), x) \oplus P_i \\
P_i &= \operatorname{head}(E_K (S_{i-1}), x) \oplus C_i \\
S_i &= ((S_{i-1} \ll x) + C_i) \bmod 2^n \\
S_{0} &= \operatorname{IV} \\
\end{aligned} $$

  If $x$ bits are lost from the ciphertext, the cipher will output incorrect plaintext until the shift register once again equals a state it held while encrypting, at which point the cipher has resynchronized. This will result in at most one blocksize of output being garbled."

I can't understand the formula and also what is the use of shift register. Can someone help me?


texts: Security of the shared secret key for a smart meter (Linky)

texts:
Reading the specs of a new electricity smart meter (called Linky in France), I was surprised about the chosen encryption method (128 bits symmetric key AES), based on a single secret key (called CCC in the specs), that is shared between the meter and the central system, used to generate session keys to encrypt data.

Some context from the documentation:

  5. PLC COMMUNICATION SECURITY - Each meter must have a CCC secret key, a unique CC_LAN  key, a unique  CC_LOCALE key and two session keys for the LAN interface and a session key for the Local interface, transmitted when the application association with the Client concerned was created

  5.1 Encryption method - 128-bit AES symmetrical key algorithm, GCM operation mode. It is used to ensure data confidentiality and authentication.

  5.2 "CCC" secret key - The CCC key is used to reprogram the "CC_LAN" key or the "CC_LOCALE" key in a meter. This key is never used to encrypt the communications between the concentrator and the meter. It is known only
  to the meter and the IS (Central server). When the CC_LAN (and the CC_LOCALE respectively) is generated, the IS encrypts it with the CCC and transfers it to the meter via the concentrator. This transfer is completely transparent for the concentrator which sends the encrypted data to the meter. The meter that knows the CCC is responsible for decryption the data in order to retrieve the CC_LAN (and the CC_LOCALE respectively).
  The CCC key is not accessible in read mode.

  5.3 Unique "CC_LAN" and "CC_LOCALE" keys - The CC_LAN and CC_LOCALE keys are only used during the application association phase between the  concentrator and the meter, and the TSP and the meter respectively. They are used to crypt the service allowing this application association. This service transfers the session key that will then be used, in the context defined by t
  his application association, to crypt the communications between the concentrator/TSP and the meter.
  The CC_LAN and CC_LOCALE keys cannot be accessed in read mode.

A quick note on the architecture: the meter communicates with the local transformer using PLC on open power lines, the transformer communicates with the central system with GPRS. The local transformer, apart from local network management, only forward data packets "as-is" to the central system.

(More information on the architecture is available here. Security is chapter 5, pages 39-40).

What is the security implication of having a central repository of secret keys?
If the central key database is hacked, would the attacker be able to decrypt the communication of any meter? (For example, to tamper with it?)
Is there any reason why not to choose an asymmetric public key mechanism instead, where the central system does not have to know the secret key of all meters? Does this has to do with the complexity of securely communicating the public key once generated? (since the central system has to ensure the authenticity of the public key maybe a manual intervention would be needed?)
Is there any potential security risks of the chosen architecture?

Note: This question has been also asked on security.stackexchange.com.


texts: Breaking ZIP 2.0 encryption without password

texts:
I have an old sourcecode backup from my DOS days stored in a ZIP 2.0 encrypted archive, but I lost the password.

The password was written on a paper slip, but I remember that it consisted of 30+ completely random alphanumeric characters with some special symbols in between.

I have read that a GPU cluster will crack old ZIP 2.0 archives almost instantly, and that there is a vulnerability in the ZIP 2.0  encryption allowing an attacker to recover the password instantly if there are multiple files in the archive.

But what if there is only one file in the archive, and the password consists  of 30  completely random characters?

Can I expect fast recovery if I can run the process on a GPU cluster?

Addition: The archive was created with PKZIP 2.04C and there is nothing known about the filename extension and nothing known about the plaintext.

Does it change the calculus that the archiver was 2.04C and not 2.04G?


texts:
I am reading specifications from my client that focuses on the topic of security. In these specs, the term key material has appeared many times.

I used Google to look for what the term means. Unfortunately few posts explain what it means.

What is the difference between key and key material, if any?


texts: Is there any security advantage to using a pre-determined IV in CBC mode over a null IV? I'm implementing a license key system similar to this article on CodeProject, but I'm confused by the authors use of a pre-determined IV embedded in the client code alongside the key. Presumably a properly randomized IV wasn't used because the resulting license key would be too long, but wouldn't a null IV be just as (in)secure?


texts: In RSA, why is it important to choose e so that it is coprime to φ(n)?

texts:
When choosing the public exponent e, it is stressed that $e$ must be coprime to $\phi(n)$, i.e. $\gcd(\phi(n), e) = 1$.

I know that a common choice is to have $e = 3$ (which requires a good padding scheme) or $e=65537$, which is slower but safer.

I also know that for two primes $p,q$, we have $\phi(pq) = (p - 1) (q - 1)$

Now, let me give a (simple) example:

Say I choose $e = 3$, and two random primes $p = 5$ and $q = 13$.

I can now compute $\gcd(3, \phi(5 \cdot 13)) = 3$.

This reveals that $3$ and $\phi(n)$ are not coprime. I assume this could also happen for large values of $p$ and $q$, and likewise for another $e$. I therefore assume that the RSA algorithm must check that $\gcd(e, \phi(pq)) = 1$. But let's assume it doesn't.

How does RSA become vulnerable if $\gcd(e, \phi(pq)) \neq 1$?


texts: Can you help me understand ECC Cryptography and it's algorithm?

texts: I want to know the basic understanding of ECC algorithm for cryptography. But I am not aware of the algorithm. Can anyone provide me with a basic explanation of the algorithm?


texts: Calculate share for a specific value of $x$ in Shamir's Secret Sharing scheme

texts:
I am currently reading the book Cryptography: Theory and Practice (4th edition) by Stinson and Paterson and going through the exercises. I have reached the Threshold schemes section and am currently doing the exercises related to Shamir's secret sharing scheme.
The first exercise (11.8 in the 4th edition of the book) asks to write a computer program to compute a key starting from a list of shares, which I have done, and then test that the program computes the same key with different combinations of $x$ and $y$ values (which are provided in the exercise instructions), which I have also done.
Exercise 11.8 (b) then proceeds to ask the following:

Having determined the key, compute the share that would be given to a participant with x-coordinate equal to 10000. (Note that this can be done without computing the whole secret polynomial a(x).)

Perhaps I am misunderstanding the question, but my understanding is that the resulting $y = a(x)$ share does not depend on the $x$ value alone. Indeed, looking at the formula for computing a share:
$$a(x) = K + \sum_{j=1}^{t-1} a_jx_j \pmod p$$
(with $t$ the minimum number of shares required to reconstruct the key $K$)
we see that the final value of $a(x)$ will not only depend on the chosen $x$ values, but also from the chosen $a$ values. The values $a_1,...,a_n$ are also chosen by the dealer at the beginning of the key distribution process.
In light of all this, am I misunderstanding the exercise question or is it not possible to have a unique answer, unless you know all the $a_1,...,a_n$ values, which the exercise does not provide?
Or in other more concise words: am I supposed to have one and only one value for $a(10000)$?


texts: Can we design a public-key infrastructure without certificate authorities?

texts:
In a recent essay, Bruce Schneier tasks the engineering community with redesigning and rebuilding the vulnerable parts of the Internet's backbone.

  We need to figure out how to re-engineer the Internet to prevent this kind of wholesale spying. We need new techniques to prevent communications intermediaries from leaking private information.

In my mind, one of the most glaringly vulnerable parts of the Internet's security infrastructure is the certificate authorities. They're big, private companies, vulnerable to legal and extralegal attacks from governments and hackers alike. They nevertheless hold the keys (no pun intended) to the kingdom, cryptographically speaking.

Are these kinds of central trust authorities the sine qua non of a practical public-key infrastructure? If so, why?

If not, what alternatives exist? What would it take to use one of these alternatives in a new, less vulnerable public-key infrastructure? What is the cryptography community's role in this discussion?


texts: anonymous signature implementation and usage?

texts:
This is one of the question asked in my class. Implement a anonymous digital signature. So it means hiding signers information. i could not find any article in anonymous digital signing. Also another confusion made me think about blind signature. blind signature used to hide senders information before sign by a third party. This scheme is not going to hide sender identity. For my knowledge group signature can be used hide the identity of sender. My question is

what is anonymous digital signature
How it different from blind signature
How can we use this to hide identity of sender


texts: SSL handshake - what is the purpose of the finishedClient message?

texts:
I am having some difficulties in understanding why is the finishedClient needed.
In case an attacker attempts an attack like a replay attack, it will show immediately that the attacker wasn't able to derive the correct set of keys.
However, this would be evident even without this message as the attacker wouldn't be able to encrypt and decrypt messages.
Is that the reason for this message, or is there another reason? What can we learn from this message that we wouldn't have learned without it?


texts: How can a collision be generated in this hash function by inverting the encryption?

texts:
This is from Joan Daeman's Doctoral thesis
Per page 64 (or PDF page 79)

4.7.1 Our approach
Our goal is the design of simple and portable unkeyed and keyed
cryptographic hash functions that are hermetic.The basic principle of
our approach is derived from the compression function of an early
version of MD4.  The operation of this compression function can be
described as encrypting in an invertible way the 128-bit chaining
state $d^{i−1}$ to $d^i$ with $m^i$ as a key,or
(4.4): $d^i = f_{MD4}(d^{i−1}, m^i)$
In a later version this compression function was modified by adding
$d^{i−1}$ to the "encryption result" :

(4.5): $d^i = d^{i−1} + f_{MD4}(d^{i−1}, m^i) \bmod 2^{128}$
It can be seen that for the compression function (4.4) collisions can
be generated by simply inverting the encryption

2 Questions

What does hermetic mean in this context?

How exactly can you generate a collision by inverting the encryption?


texts:
In RSA, suppose we know that $e=N$ and we are given the value of $e$.
($N =  p\cdot q$ for some large primes $p$ and $q$; $\gcd(e, \varphi(N) = 1)$

Can we calculate $d$ ($d = e^{-1} \mod \varphi(N)$) without factoring $N$?


texts: What EC curve is used by Apple iOS platform?

texts:
I can't find information about EC curve used by Apple's iOS platform. The algorithm name that I could see in their docs is:
eciesEncryptionCofactorVariableIVX963SHA256AESGCM

However, there is no any explanation what it refers to. I've tried to find info about cofactor IVX963 with n/a so far. I read somewhere that Apple has adopted DJB's Curve25519. Is this the one that iOS uses as well?
If not, probably you can provide some pointers like NIST refs or anything else in public domain explaining what this is exactly.
Answer below is good (I've accepted it) and it does provide a lot of information, but clarification is still required.
The only ref that links curve in question with p256r1 is from a private blogger who primarily talks about generating curves of different types. While p256r1 has been generated in the demo, he doesn't know what other curves can be generated this way, nor it's clear how his curve generating scripts are related to the curve in this post.

This rough demo script isn’t set up to handle curves other than P256v1

More information is needed

A more official link that explains what this curve is
Equation type, domain parameters, etc.

I hope, it's not P256r1/v1
Please also note that the recommended curve is not even available in iOS 14.1, which is very recent

Type 'SecKeyAlgorithm' has no member 'kSecKeyAlgorithmECIESEncryptionCofactorVariableIVX963SHA256AESGCM

UPDATE I found the new link provided by @kelalaka very useful and practical, especially this part of it:

import Sodium

let sodium = Sodium()
let curve25519KeyPair = sodium.box.keyPair()
let privateKey = curve25519KeyPair!.secretKey
let publicKey = curve25519KeyPair!.publicKey

This is what everyone should use in EC domain, not the old and obscure Apple's CommonCrypto


texts:
Are there any public key encryption algorithms that allows for arbitrary ordering of crypto operations (commutative). That is, given a plaintext $\text{message}_1$, the following operations work to doubly encrypt it:

$$\text{message}_2 = \operatorname{encrypt}(\text{message}_1, \text{pub}\_\text{key}_1)$$
$$\text{message}_3 = \operatorname{encrypt}(\text{message}_2, \text{pub}\_\text{key}_2)$$

Then to decrypt one would need to remove the encryption in LIFO order:

$$\text{message}_2 = \operatorname{decrypt}(\text{message}_3, \text{priv_key}_2)$$
$$\text{message}_1 = \operatorname{decrypt}(\text{message}_2, \text{priv_key}_1)$$

Is there a crypto method that allows me to also (implying commutativity) reverse the order in which the keys are applied in the decrypt operations to recover the original plaintext $\text{message}_1$? That is, I would need the following to work as well:

$$\text{message}_4 = decrypt(\text{message}_3, \text{priv_key}_1)$$
$$\text{message}_1 = decrypt(\text{message}_4, \text{priv_key}_2)$$


texts: Could time lock encryption be implemented through indistinguishable obfuscation?

texts:
In the paper "How to build time-lock encryption", the authors give a theoretical solution to build time-lock encryption using multi-linear based witness encryption and blockchain. However, an instantiation of the construction is unfeasible to build because of the inefficiency of multi-linear maps.

So, if witness encryption based on multi-linear maps can't provide the efficiency required for the time-lock encryption, what alternatives are there? There are witness encryption schemes built from indistinguishable obfuscation, could time-lock encryption also be implemented using that?


texts: variant of Diffie–Hellman key exchange protocol

texts:
Motivation

Consider the following variant of Diffie-Hellman key exchange protocol for two parties:

Assume Alice and Bob share $\mathbb{G}$ of order $q$ generated by $g$
Alice samples $a$ uniformly from $\mathbb{Z}^q$, and sends $h := g^a$ to Bob
Bob samples $b$ uniformly from $\mathbb{Z}^q$, and sends $h^b = g^{ab}$ to Alice
The shared key is $g^b$

Alice can calculate $g^b$ by raising $h^b$ that he received from Bob by $a^{-1}$ so he will get: $(h^b)^{a^{-1}} = (g^{ab})^{a^{-1}} = g^b$

My question is how to prove that the above protocol is secure (assuming DDH assumption holds?

I tried to prove it by reduction:

upon receiving $(\mathbb{G},q,g,g_1=g^x,g_2=g^y,g_3)$
run the above protocol s.t. Alex sends $g_1$ to Bob, then Bob returns $g_3$, and both will agree on key $g_2$. i.e. we simulate the case where: $a=x$ and $b=y$.

In case $g_3=g^{xy}$, then $(Transcript, Key) = (g^x,g^{xy},g^y)$

In case $g_3=g^z$ for $z$ sampled uniformly from $\mathbb{Z}^q$, then: $(Transcript, Key) = (g^x,g^z,g^y)$

The problem with my solution is that the difference between the two cases is in the distribution of $Transcript$ while $Key$ is the same, and this is different from what required in the definition.

In another try, I simulated the protocol s.t. Alice sends $g_1$, Bob sends $g_2$ and they agree on $g_3$, i.e. simulate the case: $a=x$ and $b=x^{-1}y$, but this will not work because the key the agree on will be $g^y\neq g^b=g^{x^{-1}y}$

Edit: General case

We have $A_1,...,A_T$ parties (where $T$ is polynomial) and $B$. the protocol is:

each $A_i$ sample some $a_i$ uniformly and send $h_i := g^{a_i}$ to $B$
upon receiving $h_1,...,h_T$, $B$ samples $b$ uniformly and sends $h_i^b$ to $A_i$
The key is $g^b$.

Any idea of how to prove the general protocol's security?


texts: Is authentication length always a subset of encryption length?

texts: Do in all the use cases, if I have to encrypt and authenticate, encrypt-then-authenticate or authenticate-then-encrypt, like in IPSEC, SSL or SSH or others, if I were to do these operations to a packet, do I always know that the cipher offset will be greater than authentication offset i.e that authentication length will always be greater or equal to cipher length. For example in IPSEC, we add an esp header and trailer, we need to start encrypting after ESP but need to authenticate starting from ESP.


texts:
Why not rank-2 constraint system or rank-3 constraint system?

How do rank-1 constraint systems link to circuits?


texts: What are the risks of using CTR mode with 64 bit blocks?

texts:
On DJB's blog he writes:

  I was one of about 40 people sitting in a meeting where the speaker, NSA's Louis Wingers (one of the Simon and Speck authors), falsely claimed that counter mode is safe for 64-bit blocks, since counter mode doesn't have block collisions. NSA's continuing promotion of these dangerous ciphers includes perfect sentences to quote in the introductions of "provable security" papers studying small block sizes.

I can think of the following problems with 64 bit CTR mode (either used with HMAC or without the need for message authentication)

The keystream can be distinguished from random if the length is close to (or greater than) $2^{32}$ blocks. No two blocks will have equal values assuming no counter overflow. The birthday effect means repeat block values are expected after around this many blocks.
There is a potential plaintext information leak. For ciphertext $C$ and plaintext $P$ (for any length), only if  $P_i \neq P_j$ may $C_i = C_j$ where $i \neq j$. This is true for CTR mode with any block size but is more of a problem for 64 bit blocks than for 128 bit blocks because the birthday limit for 64 bit blocks is smaller.
Random IV collisions are too common because the maximum length of the IV is less than 64 bits.

Are there other problems for CTR mode associated with 64 bit block sizes? (Perhaps associated with different message authentication algorithms.) If not, then what is Bernstein referring to? The problems I identified seem like they would be minor if keys can be regenerated to avoid encryption of too many blocks with the same key.

I hope my list is not exhaustive just so I don't need to post an answer to my own question. Besides mathematical problems I suspect there are a lot of human problems. Those alone I think are serious enough to justify completely discouraging 64 bit block sizes. Plus I believe the IV problem is especially serious.


texts: ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

texts:
I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal.

I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$


texts: show that key recovery is not possible in a computationally secure system

texts:
(G, E, D) is a computationally secure encryption scheme over the message space $\{0,1\}^n$. Show that the probability that a PPT adversary can recover the key after seeing the encryption of a random (uniform distribution) message is negligible.

I want to show that if the attacker A has the ability to recover the key with non-negligible probability, e.g. 20%, it breaks semantic security, as A can guess much better $f(M)$ than a blind attacker A' that does not see the cipher.
BUT I'm stumped, as suppose $f(M)$ distribution is very skewed and the most frequent value occurs 30% of the time, the blind attacker A' can simply always guess that and beat A, thus not breaking semantic security...

Reminder - semantic security definition I'm using: $Pr_K[A(E_K(M))=f(M)]\leq Pr_K[A'(1^n)=f(M)]+neg(n)$


texts: DES algorithm exhaustive key search 2^55 instead of 2^56

texts:
How is it possible to do an exhaustive key search (DES algorithm) and only search for 2^55 instead of 2^56 keys ?

This is a slide from my course if this helps you. I don't understand it.


texts:
Given the affine form of coordinates $(x,y)$ such as $(5,3)$, if I want to convert $(5,3)$ to projective coordinates $(x,y,z)$, should the form of point be $(5,3,1)$? It is triplet not a point, right?

So, is the true form from affine to projective $(x,y) \rightarrow (x/z),(y/z) \in Z_p$. For example: $(5,3) \rightarrow (5/1,3/1)$? But $1$ is BigInteger?

Then, I am coding in Java with BouncyCastle API:

public pointMultiplication (BigInteger x, BigInteger y, BigInteger z)
{
    this.X = x;
    this.Y = y;
    // Jika z = null atau z = 0 maka nilai Z menjadi 1
    if (z == null) {
        this.Z = BigInteger.ONE;
    }
    else {
        this.Z = z;
    }
    this.zinv = null;
}

What the meaning of z = null?


texts: Looking for feedback on the cryptographic design of my open source project: Bloom

texts:
I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption.

I've published the cryptographic details online and I am looking for feedback by the community before launching it:

https://gitlab.com/bloom42/bloom/-/wikis/security

Any feedback is welcome.


texts:
If there are two people Alice and Bob, and each has one set. They want to know whether their sets have intersect or not.
Is there any Private Set Intersection scheme that only leak whether intersect or not without the real intersection value?
Thank you!


texts: Homomorphic Multiplication Operation in BFV Scheme

texts:
I am working on BFV scheme and trying to create a very simple Python implementation. I am following the paper by Fan and Vercauteren. Most of the operations are easy to implement but I am having difficulty implementing homomorphic multiplication operation.

In the page 10 of the paper, the computation of $c_0$, $c_1$ and $c_2$ are defined as:

[round(t*(Some Polynomial Arithmetic)/q)]_q

where [*]_q is applying modulo q to each coefficient of the resulting polynomial.

Here, I think that I should use a carrier modulus ($Q$) besides regular modulus ($q$) where size of $Q$ is at least $\log(n) + 2 \cdot \log(q)$.

In other words, I should follow the steps:

all inputs should be converted to based $Q$ from base $q$ first (no cost since I am investigating the case with single $q$ and single $Q$).
Then polynomial multiplication (utilizing NTT) and addition should be performed in base $Q$.
After that, $(t/q)$ should be multiplied with the coefficients of the result and rounding operation should be applied.
Finally, the resulting polynomial should be reduced to base $q$.

After multiplication operation, I apply relinearization and decryption operations. However, I cannot obtain the original plaintext. Is there something wrong in the steps I defined above?


texts: Decrypting messages crypted with one time pad (used more than once)

texts:
I have a stream cipher with a key (that is unknown to me) that is used more than once. Messages are ciphered in this way:

ciphered_message = message XOR key

Let's assume that I have 23 messages (all ciphered with same key) and
the original messages contain only upper and lower case letters and spaces.

I've understood that if you xor a space with a space the result is zero, and if you do Letter uppercase xor Space = Letter lowercase (and vice-versa).

I have to get the original messages (at least a part...). How can I do that?
I have to use frequency analysis, right?
I'm trying to write some code but I'm stuck!

import binascii

def xor(a, b):
    return bytes(x ^ y for (x, y) in zip(a, b))

def read_msgs(input_filename):
    try:
        with open(input_filename) as f:
            rawmsgs = f.read().splitlines()
    except Exception as e:
        raise Exception("Cannot read {}, error={}".format(input_filename, e))

    return [ binascii.unhexlify(m) for m in rawmsgs ] # each message is an array of byte

def xor_all_msgs( messages ): # return a matrix, first row is the first message xored with the others
    ret= []

    for current_msg in messages: # xor message "current_msg" with the others
        xor_with_current= [ xor(current_msg, other_msg) for other_msg in messages if current_msg is not other_msg ]
        ret.append(xor_with_current)

    return ret

def xor_is_space( c ):
    return (ord('a') <= c <= ord('z')) or (ord('A') <= c <= ord('Z'))

def main():
    msgs= read_msgs("ciphertexts.txt")
    xor_all_msgs(msgs)

if __name__ == "__main__":
    main()


texts:
This describes a way of proving CDH <=> and Square-DH. The thing I don't get - how to efficiently compute $\operatorname{CDH}(U,V)$ from $\operatorname{CDH}(U,V)^2$. Isn't square root problem is hard in general? (In case of composite order fields for example). As far as I understand computing square root is as hard as factorization of $N$, where $|G| = N$ which can be hard in non prime order group.

So what am I missing here?


texts: Is it a variant of Strong RSA assumption?

texts:
Informally, the hardness of RSA/Strong RSA assumption lies in the hardness of factoring a large composite number $N$ having two large primes as its factors. If RSA modulus $N$ is a prime number, then the system is trivially breakable.

But, what about this variant of the Strong RSA problem presented in Ben Lynn's PhD dissertation? Here it says, given $c$, it's hard to find a pair $(g,a)$ such that $c = g^a$. RSA modulus $N$ hasn't been talked about here.

Are the above two notions synonymous?


texts: How do Hash functions work under the hood?

texts:
Using and benefiting from hash functions on a daily basis, I keep wondering how hash functions actually work down in their core.
Most of the available resources I found, only explained hash functions on a very high level, usually referring to their awesome properties and some of them mentioning something like reducing inputs.
But HOW do functions like SHA actually work on a very concrete level?
How do they actually implement something like collision resistance?


texts:
AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits.

XTS-AES-128 as described in IEEE 1619-2007 doubles key length to 256 bits by using distinct 128-bit keys for block and tweak encryption, which is sometimes remarked as unnecessary change to the original XEX construction.

https://csrc.nist.gov/csrc/media/projects/block-cipher-techniques/documents/bcm/comments/xts/xts_comments-liskov_minematsu.pdf

Grover's algorithm applied to XTS-AES-128 would attack the double-length 256 bit key, reducing it to 128 bits. Does it mean that the decision to use two keys for XTS-AES-128 made it reasonably resistant against quantum computers?


texts: How to determine required number of rounds for RC6 cipher given custom W and B parameters?

texts:
The RC6 symmetric block cipher is parameterized with three parameters :

W : The number of bits in a machine word (8 , 16 , 32 , 64)
B : The number of bytes specifying key length (0 to 255)
R : The number of rounds to execute (1 to 255)

A data block is specified as 'uint_t data [4]' where 'uint_t' can be 8, 16, 32, or 64 bits resulting in a 32, 64, 128, or 256 bit data block size respectively.

These parameters allow the end user to select block size, key size, and to trade off performance for security.

The question I have is : Given parameters W and B, along with a desired security strength (not sure how to specify this exactly, but it depends on R), how does one determine the minimum value of R to ensure this minimum security bound?

ie: I desire to parameterize an instance of RC6 for a 256 bit data block (W = 64) and a 256 bit key (B = 32).  I would like the cipher to have 256 bits of security (that of the key B) which clearly depends on the value of R. Assuming a full 256-bit key is used, what is the minimum number of rounds (R) required to ensure full diffusion and security equivalent to a brute-force search of the 256 key?

I have researched the original RC6 specification, alternative research papers that I could find which discuss various attacks on RC6, etc. but I have not yet seen any summary, equation, or guidelines on how to select values of R for tailored instances of RC6.

It seems to me that without an equation or clear instructions on how to select R, the specification is not 100% complete and layman implementing the cipher for a practical application will be left guessing, which will cause bad things to happen.

Note : I am not an expert cryptographer, but I do know enough not to "roll my own" and follow a standard to-the-letter.  This standard, while awesome, seems to be missing a letter... :)


texts: are anonymous credentials a type of zero knowledge proof?

texts:
Are anonymous credentials (such as IBM Idemix) a type of zero knowledge proofs (ZKP)? if so what type of ZKP are they?

The papers such “Security without identification: transaction systems to make big brother obsolete” don not reference ZKP.

My understanding is they both refer to similar topics.


texts: Proving that the least significant bit of an elliptic curve discrete logarithm is $0$

texts:
Suppose I have a secret value $a$ which maps to a public point on an elliptic curve $A = a \cdot G$, where $G$ is a generator of the elliptic curve of prime order $q$.

Can I prove to someone that the least significant bit of $a$ is $0$ using a non-interactive proof that does not expose the value of $a$? If I can, what would be the most efficient (in terms of proof size) way to do it?

Edit: this can probably be done using bit commitments (something similar to Confidential Transactions), but in this case, proof sizes are likely to be close to 10KB. Is there a way to do this more efficiently? Maybe somehow relying on the fact that $a$ is even?

Edit2: I've been reading a bit about Division Polynomials and I'm wondering if it is possible to use them somehow to prove that $a$ is even.


texts: If $n = p_1 p_2$ for primes $p_1 \ne p_2$, $\phi(n)$ is $\phi(p_1)\cdot\phi(p_2)$. Does that mean that the possible range of $\phi(n)$ is somewhat narrow, that $(p_1-1) \cdot (p_2-1)$ (that is, $\phi(n)$) is close to $p_1\cdot p_2$ (that is, $n$)?


texts: Encryption and decryption using multiple different keys

texts:
I want to encrypt files, wich can be decrypted and encrypted by multiple different keys. Is there any algorithm which can accomplish this?

Example (Each user has a different key):

User 1 encrypts a file with his key
User 2 decrypts the file, adds information and encrypts it with his key
User 3 decrypts the file with his key


texts: How are security proofs performed for Certificateless PEKS schemes?

texts:
I have been studying several CLPEKS (CertificateLess Public-key Encryption scheme with Keyword Search) schemes and I understand the security assumptions and the several types of security models used for the security game between the Challenger and the Adversary.
The paper I'm reading is titled "Certificateless searchable public key authenticated encryption with designated tester for cloud-assisted medical Internet of Things"
Below you can see picture of the lemma I'm trying to understand. How do they write the probability to solve the CBDH problem?

My question is what is the concept behind that security proof? What is their aim and what are the rules that guide the process?
I need to understand that to apply it to the scheme I am working on.


texts: Is there a way to prove that a ciphertext $c$ was encrypted under a given public key, $Pk$, without revealing the plain text message $m$?


texts: Specification of the Megamos crypto algorithm

texts:
It has recently emerged that a paper that was scheduled to appear at Usenix Security 2013, titled "Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobiliser", has been censored according to a newspaper article in the "Guardian".

A court in the UK issued a temporary injunction barring the scientists from publishing their paper.  Based upon the newspaper article, it sounds like the paper describes how to break Megamos, a crypto algorithm that is used in several luxury cars — "including Porsche, Audi, Bentley and Lamborghini".

That same newspaper article indicates that software for Megamos has been available on the Internet since 2009.

Does anyone know what the Megamos algorithm is?
Is there a specification of the algorithm that is publicly available, or any publicly available code that implements it?


texts: What does the normalizing coefficient do in the Index of Coincidence?

texts:
In school we only learned the formula without the normalizing coefficient:

But Wikipedia has one that says:

I am using IC in a cryptography class to find the key length and am checking various key lengths to see which one results in an IC closest to 0.066. I have to automate the key length finding process but I don't know which formula I should use. What does the normalizing coefficient change about the value? Does it make it better for finding the key length? Which formula should I use for my case?
from freq_analysis import freqs
import string

def ioc(fname, normalize: bool = False):
    frq = list(freqs(string.ascii_uppercase, fname).values())
    n = sum(frq)
    for x in range(0, len(frq)):
        frq[x] = frq[x] * (frq[x] - 1)
    frq = sum(frq)
    if normalize:
        return frq*26 / (n*(n-1))
    else:
        return frq / (n*(n-1))

Full context for above code here: https://github.com/DarkFireGuy/cracking-vigenere (if you want to see context for freq_analysis and freqs())


texts: Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the support.


texts:
Some cryptosystems operate on the domain of the form $\mathbb{Z}_q[x]/\langle x^n-1\rangle$ and others operate on $\mathbb{Z}_q[x]/\langle x^n+1\rangle$.

What's the security impact of the two forms?


texts: Any good file format alternative to PGP for encrypting data at rest?

texts:
I'd like to create an encrypted file that:

Can be decrypted on a variety of platforms (mainly Windows, OS X, and Linux) with knowledge of the key.
Can be decrypted with existing tools (perhaps writing a shell script piping together common tools).
Is in such a simple file format such that it'd be relatively easy to write your own decryption function from scratch assuming you had a standard library that included primitives like AES and HMAC-SHA256 without spending days or weeks trying to understand the file format.

So far, I've come up with three alternatives:

PGP - This sounds like a no-brainer, but its file format is quite complex and would require using a library like BouncyCastle. I'd rather have something simpler and not need dependencies.
OpenSSL - It has a very simple file format. I was able to write my own reader and writer in a few lines of code after understanding its key and IV derivation function. However, the format doesn't have a MAC in its standard.
KeyCzar - The encrypted file format does have a MAC in it, but the tools to encrypt and decrypt files aren't nearly as popular as PGP or OpenSSL.

Given these options, OpenSSL sounds very compelling if I could incorporate the MAC in it in an intuitive way. I could run openssl dgst on the encrypted file and then concatenate it to the end of it, but that is a bit hacky and I'm worried that it might be easy to mess up the Encrypt-then-MAC characteristics of the file in custom implementations.

Am I missing an easy answer to this problem?

Thanks in advance.


texts:
MD5 has a digest size of 128 bits but has long been discouraged.

Is there an alternative algorithm with 128 bit digest size which is still considered secure?


texts: Is it safe to use fast/small hash for key identity?

texts:
I have to roll database access keys often, but it's important to know which key each system is using in order to avoid unavailability. I want the systems to report that without exposing the key itself, of course.

I'm using randomly-generated 512-bit keys, and from each key I'm planning to make a 32-bit hash. I only need to compare a handful of keys each time, so it's ok to have $1 - \frac{1}{2^{32}}$ of comparison confidence (which gives more than 99.99999%).

If the attacker sees the hash and knows the key size, he/she can filter out keys that produce a different hash. However, he/she will still have $2^{480}$ keys to brute-force access the database.

Does that make sense or is there a better solution? If this will work, which hash function should I use for the 32-bit hash? CRC/Checksum/something else?


texts: How do phenomena such as mouse movement or thermal noise are exploited as TRNG within a symmetric crypto-system  (e.g: Stream cipher)? I will really appreciate if anyone could provide me with a genuine use case in order to well understand the concept. Many thanks in advance.


texts:
I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003).

In this paper on page 4, Brumley specifies the following steps :

  Step 1. Calculate guess, $g$.

  Step 2. Calculate $U_g = g\cdot R^{-1}\bmod N$

  Step 3. Send $U_g$ to Server for decryption and note the time before and after.

My queries:

How should $g$ look like for a 3 bit combination of "101" when we are searching for peaks ?
The CLIENT_KEY_EXCHANGE message, which will be $g$ here, should be unencrypted. Am I right ?


texts: What is the "correct" way to authenticate hybrid encryption?

texts:
In hybrid encryption we use an asymmetric encryption scheme and the recipients public key to encrypt a symmetric encryption key $K$. I will denote the resulting ciphertext $C_A$. We then use a symmetric encryption scheme to encrypt a message $M$. I will denote the ciphertext of the symmetric encryption scheme $C_S$. Finally we send to the recipient both $C_A$ and $C_S$. The recipient then decrypts $C_A$ to extract $K$ and then decrypts $C_S$ to get $M$.

I am aware that sign-then-encrypt is recommended for authenticating asymmetric encryption. However, in the case of hybrid encryption there seems to be two options, either sign $M$ or sign $K$. It appears to me both options could work provided the symmetric encryption scheme is authenticated, e.g., using an authenticated mode, encrypt-then-mac or similar.

My question is, what is the "best practice" to authenticate in such an encryption scheme? I am guessing there could be some more or less subtle reasons to chose one over the other.


texts: Why 3 round Feistel cipher are not common

texts:
Luby and Rackoff showed that 3 rounds are sufficient to make the Feistel networks a pseudorandom permutation.

Question: why are 3 round Feistel Ciphers not common?

My thoughts about the round functions of Luby and Rackoff construction are

They are hard to find one
They are hard to analyze
They are complex to fit small devices.
3 rounds of Luby and Rackofd constructions are slower than 16 rounds non-Luby and Rackoff constructions. Assuming that they have the same security.


texts:
Let $G$ $PRG$ and $G'(s)$ equal to the first $n$-bits of $G(s)$, where $|s| = n$. Show that $F_k(x) = G'(k) ⊕ x$ is not a $PRF$.

My attempt:
Lets assume a $k$ and 2 messages $x_1$ and $x_2$. So, for $x_1$ I have $F_k(x_1) = G'(k) ⊕ x_1$, for $x_2$ we have $F_k(x_2) = G'(k) ⊕ x_2$. If the attacker does $F_k(x_1) ⊕ F_k(x_2)$ he gets $x_1 ⊕ x_2$. And then he can simply $XOR$ that by $x_1$ or $x_2$ and then get the message from that.

I have no idea if this is the correct way to prove this. Can you give my any hint if this is the correct way to show that a function is not $PRF$, maybe I have to do a proof by contradiction ?

EDIT:

I also know that a $PRG$ must not be predictable, if it is then that's not good, so for the function $F$ to use $G'$ as the $PRG$ which is always the first $n$-bits of $G$ it's not good because it violates the pseudorandomness property. I don't know if this is correct or helpful at all.


texts: How should I read these three-dimensional (pseudo)random-generated numbers representations?

texts:
Visiting this site: http://lcamtuf.coredump.cx/oldtcp/tcpseq.html#phase

I found graphical representations of random-generated sequence numbers, but I can't figure out how to interprete the plots.

Taking as example OpenBSD:

and the Windows NT4 SP3 distribution:

I can't understand why the ISN guessing attack feasibility is higher for the Windows NT4 SP3 one (attack feasibility: 97.00%) and lower for the "cube" of windows 2000 one.

I would expect to be the Windows NT4 the less easy to attack because in its distribution the points seems to be better distributed respect to the "cube" of Windows 2000 distribution.

Looking at the site I read that this a three-dimensional representation with these definitions for $x,y,z:$

$x[t] = seq[t]   - seq[t-1]\\
y[t] = seq[t-1] - seq[t-2]\\
z[t] = seq[t-2] - seq[t-3]$

Where $t$ seems to be the time at which we pick the sequence number

But, given this, I can not understand how points plotted are related: for example, what I should think about two near (respectively: far) points? are sequence numbers with low differences or high differences?


texts: How does TLS with PQC use key encapsulation?

texts:
As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ephmemeral key agreement during the handshake I think that it is not possible to directly replace DHE / ECDHE with key encapsulation.
Which changes have been made in the protocol for adjusting it for Post Quantum Cryptography during the testing phase, e.g. using liboqs? Does this alter the TLS specification significantly?


texts:
Let $F$ be a PRF with $n = l_{in}(n) = l_{out}(n)$.

  For any PPT-encoding $[\;\;]:\mathbb{Z}_{2^n} \to \{0,1\}^n$ and any
  polynomial $l(n)$, $G_l(x) = F_k([1])\|\ldots\|F_k([l(n)])$ is a PRG
  of stretch $nl(n)$.

  Conclude that $F$-sCTR is CPA-secure if $F$ is a PRF.

The way I went about this was reducing to $l(n) = 1$ which I think is unsound in the sense that one has to prove the property for every polynomial. Anyways, here is the reasoning.

If $l(n) = 1$, then assuming $\mathcal{B}$ is an attack to the PRG. We could let Alice and Bob choose a random $b \in \{0,1\}$, send the corresponding oracle to Eve which would query the oracle and sends the answer to the attack $\mathcal{B}$ to distinguish with  non-negligible probability between a random string $y$ and $F_k([1])$. Schematically:

How could I generalize this attack to any $l(n)$?

To conclude that $F$-sCTR is CPA-secure if $F$ is a PRF I would try to show that $G_l(x)$ is in fact a variable length PRG. But then, I'm unsure what values should I set $n$ and $l(n)$ to get such a machine. I would do something like this:

$G_l(x) \equiv G(x,1^s) = F_k([1]) || \ldots || F_k([s])$

where I set $l(n) = s$ and $n = 1$. However, if I look to the definition of $[\;\;]$ with $n = 1$, I have a function $[\;\;]:\mathbb{Z}_{2} \to \{0,1\}$ and that means I cannot input $s > 2$ to $[\;\;]$.

How can I show that $G_l$ is a variable length PRF?


texts:
I'm implementing a Hash based signature algorithm and this paper recommends the use of $F(X,\mathit{salt})=\operatorname{AES}_\mathit{salt}(X)\oplus X$ as a hard one way function. The salt plays the same role here as it does in password hashing and is a fixed public value that varies across small groups of calculations.

The requirement is that $F$ be preimage resistant. (IE: given $F(X,\mathit{salt})$ attacker can't find $X$ faster than brute force)

Cryptanalysis has been done which rules out AES in contexts where the attacker gets to find approximate solutions to similar equations or gets control of key bits (EX:as hash compression function). In all these cases the attacker has degrees of freedom to work with. Here they don't.

Is $F$ preimage resistant? Can the attacker find $X$ with siginficantly less that $2^{128}$ work?


texts: I just read High performance physical random number generator by K.H. Tsoi, K.H. Leung and P.H.W. Leong. It proposes a physical RNG of speed 400 Mbps. Is this the fastest random number generator at this moment?


texts:
Two cryptographic schemes—RSA accumulators, and RSA-based Verifiable Delay Functions (VDFs) such as this one—require an RSA modulus to operate. These RSA constructions are secure if the trapdoor, namely the factorisation of the RSA modulus, is secret. In the context of a blockchain we do not want to trust anyone with the trapdoor.

The RSA public key of a dead (or presumed dead) cryptographer could be acceptable as a "trustless" RSA modulus. (Or at least, one of several moduli for an accumulator or a VDF built from multiple parallel sub-accumulators or sub-VDFs.) The idea is that the trapdoor, stored in the cryptographer's brain, disappears upon death. I tried to find an RSA key (e.g. from a PGP key) for Aaron Swartz and Satoshi Nakamoto, without success.

Are there famous dead cryptographers that have an RSA public key attached to their name?


texts: What is the advantage of using the socialist millionaire protocol to authenticate vs HMACing some random number?

texts:
Say Alice and Bob have a shared secret $s$.

Alice and Bob establish an encrypted channel and verify that it hasn't been MitM'ed by exchanging $r_1$ and $r_2$, where $r_1$ and $r_2$ are randomly generated by Bob and Alice respectively and sent over the channel. Alice computes $\operatorname{HMAC}(C \mathbin\| r_1, s)$ and Bob computes $\operatorname{HMAC}(C\mathbin\|r_2, s)$ where $C = \operatorname{HASH}(\text{Communication-channel})$ and they exchange values:

A & B: $C = \operatorname{HASH}(\text{Communication-channel})$
A → B: $r_1$, $\operatorname{HMAC}(C \mathbin\| r_1, s)$,
B → A: $r_2$, $\operatorname{HMAC}(C \mathbin\| r_2, s)$
A & B recalculate $\operatorname{HMAC}(C \mathbin\| r_2, s)$ and $\operatorname{HMAC}(C \mathbin\| r_1, s)$ and verify that they match the received values.

At this point Alice should trust that Bob knows $s$ and has the same value of $C$, and vice versa.  If Eve had carried out a MITM attack on the channel, the HMACs would fail, because $C$ would be different for Alice and Bob.

What differences would there be if the socialist millionaire protocol was used to establish that $s$ is shared?


texts: Mathematically/Theoretically calculating time to brute-force RSA encryption keys for a quantum computer vs a Classical computer?

texts:
Is there any way to theoretically, by the use of mathematics, to calculate the time taken to brute-force RSA keys?

I know there is a way to do so with a classical computer and time taken to brute-force RSA keys, but I'd like to specifically know how one calculates the time.

Furthermore, since the technology for brute-forcing RSA keys with a quantum computer differs from the one of a classical computer; How would one calculate the time to brute-force RSA keys using a quantum computer?

To do the calculation I'm guessing you have to take into consideration the amount of computing power. If possible use (or give me an example of) what equal (ish) computing powers in-between Classical and quantum computers would be. For example what scale classical computer is needed to compare (and be on the same level) as a 5-qubit quantum computer (only) in terms of brute-forcing RSA keys?


texts: Fiat-Shamir transform: reliance on hash input by interactive proof

texts:
Peggy would like to prove to Victor that she knows the discrete logarithm of $y$ based $g$; that is, she knows $x$ such that $y = g^x \bmod p$. One round of the interactive proof protocol consists of the following steps.

Peggy picks random $k \in \mathbb Z/(p−1)\mathbb Z$, computes $t = g^k \bmod p$, and sends $t$ to Victor.
Victor picks random $h \in \mathbb Z/(p−1)\mathbb Z$ and sends $h$ to Peggy.
Peggy computes $r = (k − hx) \bmod (p − 1)$ and sends $r$ to Victor.
Victor verifies that $t = g^r y^h \bmod p$.

The interactive protocol can be converted into a noninteractive zero-knowledge proof by choosing and making public a collision-resistant hash function $H$, and changing the second step of the interactive protocol to the following: Peggy computes $h = H(y, t)$. Then the noninteractive proof consists of $(t, h, r)$, which can be verified as follows: $$h = H(y, t), \qquad t \stackrel?= g^r y^h \bmod p.$$

What is the problem if in the non-interactive proof the hash $h$ depends only on $y$? That is, $h = H(y)$, and the proof consists of $(t, h, r)$, which can be verified as follows: $$h = H(y), \qquad t \stackrel?= g^r y^h \bmod p.$$
What is the problem if in the non-interactive proof the hash $h$ depends only on $t$? That is, $h = H(t)$, and the proof consists of $(t, h, r)$, which can be verified as follows: $$h = H(t), \qquad t \stackrel?= g^r y^h \bmod p.$$


texts: Will elliptic curve cryptography be weakened?

texts:
Today this post is going around on the internet and there someone wrote that it could perhaps mean that elliptic curve crypto will be weakened.

Here's the link: https://plus.google.com/+DavidRoberts/posts/KcjNn99tYaa

Can someone perhaps clarify this?