texts: Oblivious Encryption: Oblivious Transfer Based Encryption

texts:
I’m aware of a couple of OT protocols, most of which use Public Key Cryptography, Key Establishment (or similar constructs) as the base. I don’t really have specific knowledge on other OT protocols, however lately we’ve been discussing post-quantum OT, which actually inspired this approach on some “new(?)” type of asymmetric encryption. Which might potentially be useful, if an OT shows up which is not built on Public Key Cryptography or Key Establishment and proven to be post-quantum secure.

Here I would like to describe some form of encryption, humbly named “Oblivious Encryption”

Encryption:
For each bit $b_i$ in Alice’s message, Bob creates two random numbers $r_{i_0}$ and $r_{i_1}$. By means of OT, Alice chooses one of these random values as $r_i$, based on the bit value of $b_i$.
Alice sends all $r_i$ segments to Bob as the encrypted message.

Note: Bob is using a PRG with a seed (the seed acts as the key, and should not be reused)

Decryption:
Bob initiates the PRG with the same seed.
For each $r_i$ segment, Bob recreates the two random numbers $r_{i_0}$ and $r_{i_1}$ picks the value, that was associated with bit $0$ or $1$, constructing the $b_i$ values for message $m$

This, in essence, is a really silly symmetrical encryption scheme (probably akin to OTP); however with the touch of OT, it becomes somewhat asymmetrical, thus named Oblivious Encryption. First of all, does this make sense? Are there similar constructs, and what can you say about the security of this scheme?


texts: How can I show RSA-OAEP is not IND-CCA secure if G always outputs 0 (i.e. there is no hash function)?

texts:
Here is what I understand the algorithm to be:

Let $G, H$ be one-way functions, where G outputs the 0 string.

Select a random $$-bit integer $$.
Pad out $$ with $0$s to length $=||−.$
Compute $=()⊕_{}$ (i.e. $X = _{}$)
Compute $=⊕()$
Return $||$

Compute $r = Y \oplus H(X)$
Compute $m_{padded} = X \oplus G(r)$ (i.e. $m_{padded} = X$)
Strip off the $0$s from $X = _{}$ to recover $$

IND-CCA Game

The IND-CCA game in this case is as follows:

The adversary selects two messages $_0,_1$ and submits them to a decryption oracle $O$.
The decryption oracle samples $∈\{0,1\}$ and computes $*= \textrm{RSA-OAEP}(_)$.
The adversary is free to perform more decryptions, except for the one condition that $O(c∗)$ will return $⊥$.
To conclude, the adversary must guess $$ corresponding to the message that was encrypted.

Work towards showing that algorithm is not IND-CCA secure

The adversary need only recover $X$ from $c$, where $c = \textrm{RSA_OAEP}(m_b) = \textrm{RSA}(X||Y)$. Very basic question, but is $m_b \in \{b||m_1, b||m_2\}$? If so, then the adversary would know that $X||Y$ differs by $|X|$ significant digits depending on the value of $b$. However, $Y$ will always differ since $b$ is random, so $c = \textrm{RSA}(X||Y)$ will also always differ.

Unsure of where to go from here, any help would be much appreciated!

The adversary wants to output either the plaintext or $\bot$. For RSA-OAEP, $⊥$ is output when either the adversary tries to decrypt $c*$, or if the first half of the padding is not the 0 string then the decryption fails. Could we try multiplying $m_0 = 0...0$ and $m_1 =$ random with $2^e$ mod $N$?


texts: Clarification on Size of an Encryption Key

texts:
Given a key with a certain key size (e.g., 64bits). Would I be correct to interpret this as 8 characters (since each character would be 8 bits under ASCII encoding)?

Because the ASCII scheme is limited to just 127 characters, this would mean that characters not included in the English language are not considered. Could it be instead that 64 bits has to be interpreted based on an encoding scheme such as unicode that includes many more characters? -- This would mean that 64 bits contains a much smaller number of characters since a unicode character takes more bits.


texts:
I know there are XEX, XTS and other ways to add tweak to block cipher without modifying cipher itself. However they are quite slow and/or complex.

If we assume we have a secure block cipher round function (like AES) with pseudo-independent round keys (generated with stream cipher). Is it safe to add tweak with same size as block directly (and same value every round) into round function the same way as round keys?

$F()$ = round function
$b$ = block
$k_r$ = round key (same size as block)
$t$ = tweak (same size as block)

$b = F(b)$
$b = b \oplus k_r \oplus t$

How strong tweak schedule should be?


texts:
Say I want generate pair of public/private keys. First of all lets choose two prime numbers $q = 17, p = 11$. Now, lets choose public key $e=7$ and try to determine the matching private key $d$:
$$d\cdot e \mod (q-1)(p-1) = 1$$
$$d\cdot 7 \mod 16\cdot 10 = 1$$
$$7d \mod 160 = 1$$

So, there are many solutions for this equation, such $23$, $183$, $343$ and in general $d = 160k+23$ for every $k\in Z$.

But RSA should have single private key for public key, so why can I get many solutions/private keys? I tested them, and they can decrypt the encryption of the public key $e$.

I know that $q$ and $p$ should be destroyed and without them it is hard to calculate the private key. I just don't understand why there are many private keys for one public key...


texts: What is the probability equation of rotational cryptanalysis on modulo multiplication?

texts:
The answer in this question defined how to calculate the probability of rotational cryptanalysis on modulo multiplication $\odot$. This paper defined an algebraic equation of how to calculate the rotational probability of modular addition $\boxplus$ which is

$$
\textbf{P}(\overrightarrow{X\boxplus Y} = \overrightarrow{X}\boxplus\overrightarrow{Y}) = \frac{1}{4}(1+2^{-r} + 2^{r-n}+ 2^{-n})
$$
where $r$ is rotational value and smaller than modular value $n$

and experimental results of 8-bit ($n$) addition shows similar values of

$$
\begin{array}{c|c}
r & f \\
\hline
0 & 65536 \\
1 & 24768 \\
2 & 20800 \\
3 & 19008 \\
4 & 18496 \\
5 & 19008 \\
6 & 20800 \\
7 & 24768 \\
\end{array}
$$

where f is the frequency of
$
\overrightarrow{X\boxplus Y} = \overrightarrow{X}\boxplus\overrightarrow{Y}
$
for each $r$ . the probability of 1 bit rotation is $\frac{24768}{65536}$ is around $.378$ (nearly same as in the table in ). the other thing is you find reflection of frequency values , 1 bit rotation is equal to 7 bit rotation (2 and 6 so on). The following figure shows a flipped bell distribution of rotational modulo addition.

The next step

I conducted the same experiment (8 bit size) but with the following equation (double rotation).

$$
\overrightarrow{X} \odot \overrightarrow{Y} =
\overrightarrow{\overrightarrow{(X\odot Y)}}
$$
the following table shows the frequency:

$$
\begin{array}{c|c}
r & f \\
\hline
0 & 65536 \\
1 & 4730 \\
2 & 1082 \\
3 & 904 \\
4 & 1664 \\
5 & 904 \\
6 & 1082 \\
7 & 4730 \\
\end{array}
$$

from the table and figure, i see there is a reflection of frequency values (suggesting a similar equation of rotational cryptanalysis probability is applied as following:

$$
\textbf{P}(\overrightarrow{X} \odot \overrightarrow{Y} =
\overrightarrow{\overrightarrow{(X\odot Y)}}) = \frac{1}{t}(1+2^{-e_0} + 2^{e_0-e_1}+ 2^{-e_1})
$$

Question

if my guess is right , how to calculate the  $t , e_0 , e_1$ values?

NOTE
Iam happy to share the source code in the question.


texts:
What size of initialization vector (IV) is needed for AES encryption?
I am using either CBC or CFB modes.

Knowing that AES is a sysmmetrical block-cipher algorithm with a 128-bit block size, I think the answer for IV is still 16 bytes or 128 bits for AES 128, 192 and 256.

Reading this stackoverflow Q&A it seems as if the size of the IV is the size of the block which is always 128 bit (= 16 bytes) in AES, even if the keysize is larger than the block size. Is that correct?


texts:
Suppose that we want to develop a MAC scheme which is
as secure as Triple-DES CBC-MAC and at the same time as efficient as Single-DES
CBC-MAC. We come up with the following idea: Except the last plaintext block, we
apply Single-DES CBC with key K1 and for the last one, we apply 2-key Triple-DES
CBC-MAC using keys (K1, K2, K1). The result of the Triple-DES is output as the MAC.

a. Approximately how many (message, MAC) pairs would you need to observe in order
to ﬁnd two different messages with the same MAC value?

b. Describe how an attacker who has observed two different messages with the same
MAC value can break this MAC scheme completely by recovering the keys with a
time complexity about the same as that of breaking a Single DES encryption.


texts: Should I use XTS or GCM to encrypt my hard drives?

texts: I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS connection)? So my question is: should I use XTS or GCM, and why is one better than the other?


texts:
I understand that messages are encrypted using a symmetric algorithm such as AES, and the symmetric key is encrypted using an asymmetric algorithm such as RSA. In my particular implementation, the private key is encrypted using a key derived from a password.

Because this is a zero knowledge system, all encryption should take place client side. But I don't want people to be able to circumvent the javascript and directly POST cleartext. How should the server make sure that the message has been encrypted properly?


texts: Prove there is PRG that is not necessarily one-to-one

texts: We assume that there is at least one PRG .Now prove  there is a PRG like $G:\{0,1\}^{n} \rightarrow \{0,1\}^{l(n)} $ such that it is not necessarily one-to-one.


texts: If the input text and output text in DES are the same what is the value of the key?

texts: If some 64-bit message block (e.g. $M = \text{“12345678”}$) was encoded in DES using one key and the encoded message had the same value (i.e. $E_k(M) = \text{“12345678”}$), would it be possible to determine the DES key based on that?


texts:
According to this primer on elliptic curves by Ars Technica, when composite numbers get "too" big, they become easier to factorize with Quadratic Sieve and General Number Field Sieve.

While this is not explained in detail on the site, it is a common understanding that RSA encryption is in a squeeze trap where the RSA modulus is getting larger and larger as factorizing algorithms and equipment get more and more capable, at the same time getting closer to some sort of ceiling where, apparently the resulting security of the modulus drops.

Please enlighten me: Why is it not possible to increase the size of RSA keys indefinitely?


texts:
Consider the following setting: We have a sender $\textbf{A}$ and a receiver $\textbf{B}$. The sender $\textbf{A}$ a wants to send a message $M$ through a channel where each message to $\textbf{B}$ can be up to 8 bytes. Due to the limited size each message can have Truncated Timestamping (TTS) is used.

I am asking myself what possibilities $\textbf{B}$ has in order the check the correctness of the received TTS (this clearly depends on the way the TTS is build, so my question also includes how this is done in practice).

The trivial way would be the cut of the first m bits of the Timestamp and to compare this bits at the receiver end.


texts: Is PyCryptodome's export_key with passphrase secure?

texts:
When exporting a private key with PyCryptodome, DER format, PKCS#8 and a suitably strong passphrase, is the resulting exported key secure enough to place somewhere that you would not normally want sensitive information stored, such as a database or on a hard drive?
From PyCryptodome.readthedocs.io:

For ‘DER’, the PBKDF2WithHMAC-SHA1AndDES-EDE3-CBC scheme is used. The
following operations are performed:

A 16 byte Triple DES key is derived from the passphrase using
Crypto.Protocol.KDF.PBKDF2() with 8 bytes salt, and 1 000 iterations
of Crypto.Hash.HMAC.
The private key is encrypted using CBC.
The encrypted key is encoded according to PKCS#8.


texts:
According to Wikipedia LFSRs are used as PRGs but due to their linearity they are easy to cryptanalyze. Also, using Berlekamp-Massey consecutive output bits allow reconstruction of the internal LFSR state (I think the rule was something like $2n$ bits for state size $n$).

Now my question is a much more profane one. Given the following diagram for how an LFSR works doesn't it simply output its state and, therefore become trivially predictable?


texts: Cipher Block chaining but with encrypting the plain text first then xor with IV

texts:
I have just learned about the CBC mode of operation and that it gives the cipher by xoring the plaintext m0 with random IV and then encrypt it with random key and I found out that the CBC is not CPA-secure if the IV can be predictable.

I'm considering a new mode like what if CBC work by encrypting the plain text and then xored with the IV is it still CPA secure? and is still the IV can be predictable over CPA attack?

$C_0 = IV \oplus E(P_0)$ and $C_i = C_{i-1} \oplus E(P_i)$ for $i>0$

My guessing is that it is not secure because im not encrypting the IV im only xoring it with the E(m), an attacker can do a CPA attack on the E(m) and then xor it with the IV that he has guessed it  and then can compare it with the Cipher and guessed the key.


texts:
Let
$F:\{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n$ be a secure PRF (i.e. a PRF where the key space, input space, and output space are all $\{0,1\}^n$) and say $n=128$.
My assignment is to show that the function
$F'(k,x) = F(k,x)$ when $x \ne 0^n$ and $F'(k,x)=k$ when $x=0^n$ is
not a secure PRF, but the function $F''((k_1,k_2),x)) = F(k_1,x)$ when $x \ne 0$ and $F''((k_1,k_2,x)=k_2$ when $x=0^n$ is a secure PRF.
However, I think that both are secure PRFs. Because when the input is $0^n$, above $F'(k,x)$ and $F''((k1,k2),x)$ will return $k$ and $k_2$ which are randomly chosen from their keyspace. So, even though adversary inputs $0^n$ multiple times it can only find out some random $\{0,1\}^n$.
Can you tell me what's wrong with my reasoning?


texts:
Why is it foolish if you decide to use an RSA cipher to encode some message by first converting each letter of the message to an integer? So for exmaple Space=0, a=1, b=2,...

After the conversion I encrypt the integer $k$ as $k^e \mod N$.

I do not see why is there any difference?


texts:
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse of $d \bmod \varphi(n)$).  Given a plaintext message $m$, we obtain the ciphertext $c = m^e \bmod n$; we subsequently decrypt the ciphertext by calculating $c^d \bmod n$.

Suppose I'm trying to implement RSA on a device with low computational power, and these exponentiations take too long.  I decide to make my implementation run faster by choosing small values for $e$ and $d$ (e.g. in the tens or hundreds).

Are there efficient attacks against such an implementation?


texts:
A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9 (Pay-Walled)"

SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-bit Barreto-Naehrig Curve as its primary example.  This new paper suggests that because attacks against some Barreto-Naehrig curves have improved that the SM9 standard should adopt a 384-bit Barreto-Naehrig Curve.  The authors go on to suggest that this curve offers roughly 118 bits of security.

My question is whether there are more efficient curves (such as BLS or KSS curves) that offer the same security.  For instance, I have been told that the degree 12 BLS curve using a 381-bit prime modulus would be more efficient.   If there are more efficient curves what are the most efficient for security equivalent or greater than the 384-bit Barreto-Naehrig curve?


texts: Is there a hash function with 2048bit output?

texts:
Is there a publicly available cryptographic hashing algorithm with 2048 bit output?

The standard ones are "only" up to 512 bit (SHA-512, WHIRLPOOL).

(2048 bits are 256 bytes, so it would be useful for generating a full-length key for the ARC4 cipher)


texts:
i'm reading the article of Massey and Sain (here) and i cannot unserstand - what is "foreforward inversion"?

I mean

There is a description of circles in convolutional codes and a little bit description about catastrophic codes (i mean, codes that makes an infinite amount of errors on decoding if there was a couple of errors in channel).

Who can explain, what is "foreforward inversion", and which delay is meant?

Thanks in advance.

P.S. i interested in this theme because i want to understand the proof of Theorem 1 in that article, no more.


texts:
For curve secp256k1 prime modulus is $2^{256}-2^{32}-977$ and order is smaller number but has near half of starting bits set. If I draw number to be private key, it must be less than order. All field operations are modulo prime modulus and it means they must be smaller than modulus but can be  >= order? (or not?). Coordinates of public key point can exceeds order?
A very interesting case is in signing and verifying: in pseudocode: from nayuki library is modulo order.
 * if (nonce outside range [1, order-1]) return false
 * p = nonce * G
 * r = p.x % order
 * if (r == 0) return false
 * s = nonce^-1 * (msgHash + r * privateKey) % order
 * if (s == 0) return false
 * s = min(s, order - s)

This means, operations are done, first modulo modulus p, next modulo order?


texts: What's the difference between threshold signatures and multisignatures?

texts: I was wondering what's the difference between threshold signatures and multisignatures. In what respects do they differ? For example, is n-out-of-n threshold signature, just a multisignature?


texts: Why doesn't this operation reveal the voter's message?

texts:
I am working my way through this paper. I am trying to figure out the OR zero knowledge proof in figure 2. The prover is verifying that she has correctly voted, and that her input satisfies
$$\log_gx=\log_h{(y/m_0)} \wedge \log_gx=\log_h{(y/m_1)}$$
The authors' protocol for this makes sense except for one thing. After the prover receives the challenge $c$, she sets $d_2 \leftarrow c - d_1$ if her vote is 1, or $d_1 \leftarrow c - d_1$ if her vote is -1. Because $c \in_R \mathbb{Z}$ and the previously set $d$ is also $\in_R \mathbb{Z}$, the new $d$ could be negative.

However, in the final step, the verifier needs to compute two values to the power of each $d$. This means the prover can't simply send $d \mod p$, and must send $d$ even if it is negative. But the other $d$ value will never be negative.

Doesn't this mean that verifier can learn the prover's vote? If $d_2$ is negative then she voted 1, or if $d_1$ is negative then she voted -1.

What am I missing?


texts:
I want to use the improved sha1 hashing algorithm from the Intel blog described here Intel sha1 hashing. Currently I am using Openssl sha1 hashing in my application.

I wanted to know if anybody has used the Intel sha1 hashing and how does it compare against Openssl implementation as far as performance is concerned?
Also the source code provided there is in assembly and just defines 'update' function. What do I need to use it in place of Openssl sha1, which provides functions like 'init', 'final'? I can't use the Openssl implementation of these functions because they use some Openssl specific things.
Where can I find Openssl implementation of improved sha1 hashing based on 64 bit instruction set. It is an alternative implementation of this. I tried to find it in my /usr/inclusde and /usr/lib/ but could not get it. It seems it is an add-on to Openssl (openssl-addons/intel-accel/) but does not come with Openssl package. Also how to use it in place of Openssl's usual sha1?


texts: Lightweight cipher using only 8-bit operations

texts:
What is the most efficient (in cycles per byte) cryptographically secure symmetric cipher to implement using only 8-bit operations? Algorithms like TEA are great for embedded devices, but it is optimized for 32-bit operations. I am not looking for the most efficient implementation of an algorithm, but rather an algorithm which was designed with this in mind. The MCU in question is a 3.5 MHz Z80 with 16K RAM.

Looking this up, I found resources showing how to implement AES on 4-bit microcontrollers, and how to implement secure hashes on 8-bit microcontrollers, but neither of those answer my actual question.


texts: Proving one time pad is perfectly secret

texts:
I'm reading about one-time pad in "Introduction to Modern Cryptography" by Katz and Lindell. I can understand the definition of perfect secrecy. However, how is OTP proven to be perfectly secure ? I'm quite rusty on probability, so please explain the steps.

The proof in the book goes like this,

$M$ is the set of messages (all possible bit strings of length $\ell$), the message space. $K$ (the key space) is equal to the message space, and the cipher is computer as $c=k\oplus m$, where $k$ belongs to $K$ (chosen uniformly at random) and m belongs to $M$,
\begin{align*}
    \Pr&[C=c\mathrel|M=m] \\
    &= \Pr[M \oplus K = c \mathrel| M = m] \\&\quad\text{(How did the random variable $C$ become $M\oplus K$ here?)} \\
    &= \Pr[m \oplus K = c] \\&\quad\text{(where did the conditional probability go ? what rule should I apply here ?)} \\
    &= \Pr[K = m \oplus c] \\&\quad\text{(what is this ?)} \\
    &= 1/2^\ell \\&\quad\text{(how should I arrive at this finally ?)}
\end{align*}
I did not understand any of these four steps. Please explain the reasoning behind these steps. This result is being used to show that it satisfies the definition of perfect secrecy. Please help me understand this result.


texts:
I am trying to solve an RSA problem. In order to calculate $d$, I have to calculate $d$ with $e=3$ and
$$d\cdot e\equiv1 \pmod{40}$$
Obviously the answer is $d=27$, but I want to solve this with the extended Euclidean algorithm.
Though I know how this works, I am stuck because in the first step of the algorithm I get
$$40=3\cdot13+1$$

The remainder is 1 and the algorithm stops there.
How do I get $d=27$ by using the extended Euclidean algorithm?

I dont have a problem solving other similar examples that dont stop in the first step. But here, because it stops in the first step of the algorithm, I get confused.


texts: How do you perform the invert operation of Pm = kP on elliptic curve?

texts:
I'm stuck on this, may be due to the fact I'm missing something.
If I'm right, in order to reduce a Message to a point on an elliptic curve the operation is:
$\text{MsgPoint} = \text{msg}\cdot P$  with
  - $P$ being the Base point of the curve,
  - $\text{msg}$ being the message converted to an integer
  - and the operation $\cdot$ being the scalar multiplication

My question is: How do you perform the inverse operation?
formulated differently:
I know $\text{MsgPoint}$ and the Base Point $P$ and I want to find the $\text{msg}$?

In fact, I'm searching a way to retreive the Message from its elliptic point value:
$$P_m + kP_B - n_B(kG) = P_m + k(n_B)G - n_B(kG) = P_m  $$
I'm able to get back $P_m$ (decode), but $P_m$ is a Point on the elliptic curve, which is obtained by computing in the encode:
$P_m$ = scalar_mult(message_converted_to_integer, curve.G)
How to get the message_converted_to_integer value?


texts: Is it secure to encrypt random key with block cipher in ECB mode?

texts:
If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode?

This problem can be generalized to given a block cipher $C_0$ which has a block size of $k$-bit and a random bit string $S$ whose length is $n \cdot k$ where $n$ is a positive integer; in such settings, what would the security risks be to encrypt $S$ with $C_0$ in ECB mode?

I've read this thread Is it safe to encrypt random data using ECB mode?, which gives a good answer to a more generalized question. But in this case, $n$ is (assumedly) generally small, and the benefit to use a simple mode like ECB without op mode parameters (IVs, nonces, etc.) over more advanced modes like CTR is significant enough. Also although not mentioned in the link above, this specific setting doesn't involve padding, which makes the situation even simpler.


texts: Hill Cipher Plaintext Attack: Dealing with Non-uniqueness of Matrix Inverses?

texts:
I'm following along with my book. Here is an example of a plaintext attack from it:

It is known that:
plaintext = 'friday'
ciphertext= 'pqcfku'
$m$ = 2

We will use this to form the following matrix equation:

$$ C = PK $$
$$\pmatrix{5 & 16 \\ 2 & 5} = \pmatrix{5 & 17 \\ 8 & 3} K $$

Where $K$ is the key matrix. Note that $K = P^{-1} C$. To find that product, we must first find $P^{-1}$.
Now this is where I don't understand the book. The book says:

$$P^{-1} = \pmatrix{9 & 1 \\ 2 & 15}$$
First I tried verifying this in Mathematica. The command Inverse[{{15, 17}, {8, 3}}, Modulus -> 26] yields an error saying there is no such inverse... bizarre. I then found this online calculator to do it, and it returns the result:
$$P^{-1} = \pmatrix{13 & 5 \\ 10 & 23}$$

A quick check tells us that BOTH these matrices are correct inverses mod 26. But, only the inverse provided by the book works in correctly computing the key, and thereby being able to break the cipher.

So... how can I conduct a plaintext attack in this manner? There appear to be multiple inverses. How do I know which one is "right"? And if I must brute force, how can I find ALL possible inverses?


texts: How to get the same calculation result on an untrusted computer, while withholding some information?

texts:
Consider this command on a trusted computer:

result = function(public data, secret data)
or shorter: r = f(p,s).

How could a function on an untrusted computer produce the same result without the secret data being available to the untrusted computer?

Abstract example:

r = f(p, s) = f'(p1, p2, ... pn)
such that one or more of the public p variables are derived in some fashion from s.

Concrete example:

p is a database table, r is a record and s is a lookup criteria. The database server is untrusted.


texts: How to prove a symmetric encryption scheme provides perfect secrecy?

texts:
I learned in class that in order to achieve perfect secrecy, the source of the plaintext $\mathcal{P}$ needs to be independent from the source of the encryption key $\mathcal{K}$. We also learned that this is always the case for independent sources: $H(\mathcal{P}) \le H(\mathcal{K})$, but that it shouldn't be used as an exhaustive proof, because in the case where you have a high-entropy key but it is badly designed (such as having different lengths for each code word), you could still derive a lot of information from attempted decryption.

We saw an example where someone used a coin to determine a random key composed of 16 bits to mask a plaintext composed of 4 digits coded into 4 bits each (using xor logic). In this case, $H(\mathcal{P}) = 13.2877$ (there are 10000 possible combinations of digits), and $H(\mathcal{K}) = 16$, so the inequality holds.

Suppose now that 8 bits of the key are generated randomly, and then just copied over for the remaining 8 bits. The key source and the plaintext source now become dependent, however only if the "hacker" knows that the key was copied twice over (because it is technically a possible outcome). The inequality doesn't hold anymore either because $H(\mathcal{K}) = 8$. I'm assuming that this encryption scheme fails to provide perfect secrecy, but I remain unconvinced because of my previous argument of the conditional state of this "copied" key. In this case, is there a better way to provide a proof other than the two methods mentioned above?


texts: Allowing the user to choose the hashing formula at the registration

texts:
I was thinking of a potential new way to increase someone's account security.

The idea was allowing the user to choose one of the hash formulas available in the software (example: "MD5", "SHA512" and "Whirlpool"), decreasing the chances of any intruder to find out the hashing system used in case passwords are — for some reason — leaked increasing a potential required time of brute-force or dictionary attacks.

Would that be a good idea?


texts: What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?

texts:
I was reading this paper which has a lot of references to the terms MEDP and MELP. Even though i think i got the general meaning, I could not verify that it is indeed correct.

For the MEDP, I would say that it is the maximum bias that can be achieved over k rounds of encryption.

For the MELP, respectively, I would say that is the maximum probability of an equation that holds over k rounds of encryption.

And both are used in order to evaluate the resistance of an encryption scheme against differential and linear cryptanalysis, for example by setting the upper bounds on those metrics.
Is that right?

Also, I have noticed that those quantities are referred for 2 rounds of encryption in a lot of cases. (is various AES MEDP,MELP papers)
Is there a particular reason why they choose only 2 rounds, or it's just matter of computational complexity?


texts: The security effect caused by an MDS matrix in word-oriented designs

texts:
Considering a design where the MixColumns operation of AES is replaced by a lighter MDS matrix where by the term lighter we mean the number of required XOR to implement an MDS matrix.

As you know the most relevant property of an MDS matrix in an
AES-like design beyond its branch number is the so-called related differential.

My question:  Is there any security escalation or degeneration due to
the differences of the bit-level representations of the MDS matrices?
(For more details please see  Remark section of [1]).


texts: Difference between somewhat homomorphic encryption and leveled homomorphic encryption?

texts: Is there any difference between somewhat homomorphic encryption and leveled homomorphic encryption? I heard that leveled homomorphic encryption supports computing circuits of bounded depth on cipher text, and somewhat homomorphic encryption supports computing polynomials of low degree on cipher text. What's the difference? Which is stronger?


texts:
CPA attack means the attacker can send in his own plaintext to the oracle and receives some sort of ciphertext back.

CCA attack means the attacker can send in his own ciphertext to the oracle and return some sort of plaintext back.

When we talk about CPA and CCA secure, what exactly are we referring? All this time I just think of it as " if it's CPA secure, then the attacker cannot perform a CPA, which means when the attacker sends in his own plaintext he will not receive some sort of ciphertext back"

That makes logical sense to me, but I really don't feel like I am understanding CPA/CCA secure correctly.

I thought the whole point is so that the attacker can send in whatever ciphertext / plaintext he desires, the attacker will get something back, and the system will not leak information. Does that mean that I can also think of it as " the attacker can send in whatever cipher/plaintext he wants, but he will not receive informative outputs" ?


texts: CBC-MAC , fixed length, all blocks returned

texts:
CBC-MAC, with fixed length message.

Is it safe to return all ciphered blocks instead of the last?

My intuition says it is less secure, since is gives an attacker more information.
But how could one attack this scheme?


texts: Unique GCM/CCM initial counters without recipient side message counters

texts:
I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but not necessarily, performed by the sender in the same order the packets are sent over the network. This means two things:

Implicit packet counters can't be used to ensure that the initial counters are unique,
Explicit packet counters shouldn't be sent as plain text, due to implementation-specific side-channel attacks. (When packets are sent out of order, it is due to things happening sender side the attacker shouldn't be unnecessarily made aware of, and that would be significantly harder to spot using frequency analysis only.)

Packet counters are however sent encrypted and verified by the recipient using a sliding window technique.

Additionally, the following requirements should be met if possible:

No additional AES context should have to be maintained for each connection. i.e. if AES encryption is used in any way, it has to be done using the same key as for bulk encryption.
The size of the packets should be kept as small as possible. The overhead of the ciphertext should be equal to the 96-bit nonce, 128 bit MAC, plus optional padding that might be used to mask the length of the plain text.
I don't want to consider all possible security implications of letting the recipient simply try all possible implicit packet counter values in order (DOS-attacks, timing attacks, etc).

Thus, I am thinking a simple two-round unbalanced Luby-Rackoff cipher could be used for generating the nonces sender side, e.g.:

Let $T$ be the 32 bit encoding of the packet counter value.
Generate a 64 bit random bit string $S$.
Let $U = MSB_{32}(AES_k(0^{32}||S||0^{32})) \oplus T$
Let $V = MSB_{64}(AES_k(0^{32}||U||1^{64})) \oplus S$
If $MSB_{32}(V) = 0^{32}$ goto 2.
Let $Nonce = V||U$.

Since the transform is bijective, these nonces will be unique. Furthermore, the padding ensures that the plain text blocks passed to $AES_k$ do not collide with any counter values. Also, $AES_k$ is rekeyed at least once every $2^{32}$ packets, plus that the nonces aren't decrypted by the recipient since the packet counter value is also sent encrypted as part of the "regular" plain text.

The question is what the security level of the confidentiality of the packet counter values become?

Obviously, by the birthday paradox, there is a 0.5 probability that the same $S$ value will be generated at least twice before the cipher is rekeyed, and since the packets are sent in order most of the time, it should at least be easy to spot when such $S$ collisions do not happen, but is it possible to distinguish such occurrences caused by chance from those caused by $S$ collisions with non-negligible probability? Should a third-round be added?


texts: AES-256 will double the size of photo after encryption?

texts:
I am currently working on my JavaScript project where I am also trying to encrypt attachments with AES-256. Right now I am testing it and I am getting this results.

For photo file which has size about 2mb after encryption I get 3.7MB... Which is cca double that original size.

I want ask you guys if it is OK because what I have heard AES cypher is not like RSA and it is not adding any or not to much additional size. Am I right?

If this help I am using open source AES-JS...


texts: Password vs public key for authentication?

texts:
What's the difference password and key in terms of authentication?

I think that they are potentially same.
But, in practice, password involves some bias since it is created by human.

On the other hand, some key is produced by computer, which results in pseudo-randomness over some large bit space.

Can anyone explain when to and when not use password and key-based authentication?


texts: enhanced hash password in bcrypt for nuGet library

texts:
Why do we use EnhancedHashPassword in nuGet library and chose a SHA algorithm like this?

BCrypt.Net.BCrypt.EnhancedHashPassword(password,hashType:HashType.SHA512)

and when do we use the SHA algorithm after blowfish or before?


texts: Digital signatures using a partially public key

texts:
I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices.

To formalise it a bit, the signature is essentially $$MD5(msg, concat(pub, priv))$$

Since the entire key isn't (completely) known to the public, are such signatures considered secure? Should the merged key be hashed and/or derived from a KDF before applying it to MD5 (or HMAC for that matter)?

Perhaps, something like $MD5(msg, concat(KDF(pub, n), priv))$ where $n$, the number of rounds, is randomly derived from the public key? The rationale is that even if the attacker knows the public key, they won't be able to derive n, which protects the private key from some kind of text attack.


texts: Does Schnorr identification protocol using commitment scheme?

texts:
In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are using a commitment scheme?

if so, a commitment scheme needs to have binding and hiding properties. In this case I can get it is binding. But for hiding, it is not clear for me to see this property. Since the definition of hiding is adversary generate two messages $m_1,m_2$ and the adversary cannot distinguish their commitments.


texts:
The NIST (National institute of standards and technology) defines the HMAC standard as the following: $$\operatorname{MAC}(\text{text}) = \operatorname{HMAC}(K, \text{text}) = H((K_0 \oplus \text{opad} )|| H((K_0\oplus \text{ipad}) || \text{text}))$$ available in FIPS 198-1 (PDF).

I can see that the pre-shared key is XORed against internal padding and outer padding. I can also see that the results of which are not only hashed, but then concatenated together.

My question is how exactly is this used to ensure authentication/ integrity?

For example, If create a HMAC, how does my intended recipient use the HMAC sent with the message to ensure it is intact?

Also, given the inclusion of XORs, should I assume the inverse of these is calculated and somehow used in the process, as you can see I'm quite the novice, so some help would be very welcomed.


texts: Participant workflow in the Cryptography competitions

texts:
I learned about the NIST hash function competition which generated SHA3. It says it inspired a Password hashing competition too, which resulted in Argon2.

What I'm wondering is what people generally do to create these entries to the competition. Here is a piece about the SHA3 competition outlining the formal process, but doesn't really say anything about the people competing, what they did to create their functions. I get that they make the algorithm, but what goes into making it is what I'm wondering.

I would like to know how they work roughly, how long it takes them roughly, that kind of stuff. Nothing too involved if it's not possible, I would just like to get a sense of "it takes 2 people 3 years of 8-hour days doing pure math to submit something worthwhile", or "they can do this in a weekend". Or stuff about how they work, if they are just doing trial and error to get all the random magic values or if they have some methodology to the madness.

The coolest would be if one of the finalists or competitors could describe their experience developing the thing, but I don't suspect that will happen :)


texts: Is using a rolling code as a constantly-changing shared secret effective for signing?

texts:
I am your average developer looking for some crypto-related guidance.

I am trying to have assurance that a received message is from a particular sender, but have no need for the message content to be encrypted. The sender and receiver are allowed a one-time secure channel to establish a shared secret. I don't want to use a full-on crypto library for message signing because my target audience for the receivers includes websites running on low-end shared hosting where access to such libraries won't always be available. I'm wondering if only needing message signing and allowing a pre-shared secret sufficiently simplifies the problem to where it can be pulled off safely in my own code.

A method I've seen to do this is to simply append the shared secret to the message, apply a hash function to the message+secret, and send the hash function's output along with the message as its signature. That's fine I think except that it would be subject to replay attacks, which is problematic for my application.

If instead of using a static shared secret I used the one-time secure channel to seed a PRNG on both ends, appended the PRNG's current output to each message as input to the hash function, and advanced the PRNG on both ends following each verified communication, would this potentially be effective? I understand there's also a need to make intelligent choices about the hash function and PRNG used, but first of all does this high-level approach have any fatal flaws I can't appreciate as an average-joe developer?

Edit

Since there's been an enthusiastic continued response, let me share a bit more. First, I don't need to be convinced of the benefits of an asymmetric key solution, the problem as I've tried to convey is short of implementing one myself in a scripting language, I simply will not have access to OpenSSL/OpenSSH/GNUPG or anything else capable of using public/private keys on 100% of the systems where this needs to run. I am guaranteed to have SHA-256 and other hashing algorithms and HMAC on 100% of the systems where this needs to run.

The application is as a messaging system between websites running Drupal and another similar content management system and the CMS organization's servers, in order to give the organization a means to push official security updates to sites. Full details: https://github.com/mbaynton/cms-autoupdate-design. FWIW, I do plan to ship the security code changes themselves with an OpenSSL signature, but it will only benefit the sites where the administrators have made OpenSSL available to php. The MAC is basically the fallback so sites without OpenSSL still have some assurance of authenticity of the update package. This in and of itself would substantially diminish the value of the shared secret database were it to be compromised...you'd potentially be able to impact such a minority of sites that you'd almost be wasting your time trying.

Solutions that require a pre-shared key are pretty commonplace for this kind of inter-server web service application, I'll cite http://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html. Doing exactly this might be an even better idea...


texts:
I will venture myself into studying chaotic cryptography. However, I find it hard to explain what chaotic cryptography entails to those that have some knowledge of cryptography. Neither can I explain it - at a more basic level - to those that don't know what cryptography is.

Can you help me explain chaotic cryptography to others?


texts: What are the differences between these AES ciphers?

texts:
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com

Mac Sierra recently deprecated blowfish, but I don't understand use-case differences of other ciphers. This is for testing a remote web project with X11Forwarding. I'm also curious about the last option,

chacha20-poly1305@openssh.com


texts:
secp256k1 (the signature scheme used by Bitcoin) has the interesting property that you can add two public keys to get a combined key that requires both private keys to produce signatures for.

Is there another, more widely used public key cryptography scheme with the same property?


texts: What is the cryptographic strength of sha512ctr when I simply concatenate a counter and 64 bytes from a cryptographic random number generator (in this case RNGCryptoServiceProvider from .net), and some additional optional data such as the user environment block?


texts: Is there a digital equivalent to the Great Seal of the United States?

texts:
Since antiquity (and, for ceremonial purposes, up to the present day), physical documents have had seals affixed. In principle, these seals enable anyone, if he knows what he's looking for, to judge the authenticity of a document without consulting the authority that issued it. (In practice, there are ways of producing convincing forgeries, but leave that to one side for a moment.)
Is it possible, by affixing a string of characters, or suchlike, to a PDF, to achieve the same thing digitally?
I can think of a way of doing something similar:

Come up with a private key and a hashing function.
Hash the private key together with the timestamp for when the document was issued.
Affix the above hash, together with the timestamp, to the document.
When someone wants to authenticate a document, check that hashing the private key together with the timestamp produces the same hash as on the document.

However, the major difference between the above method and a physical Great Seal (e.g., The Great Seal of the United States) is the need to consult someone who has the private key. This check would have to come from a central authority since making the private key public would allow free reign to any forger.
Is there a way, then, of doing something like the above, but without the need for a central authority? If no, is it logically impossible, or is it an open problem?


texts: Real world example of non-interactive zero knowledge proofs?

texts:
I am very interested in finding out more about the non-interactive zero knowledge proofs after reading the simplified and abstract examples about zero knowledge proofs themselves here.

For the NI-ZK, most answers over here are either very technical or on a very generic level that i have a hard time understanding it.

I do understand the concept for using NI-ZK with a common shared string (CRS): Instead of having a challenge from the Verifier, the Prover simulates it. But the CRS is completely known to the Prover and he can look at the consequence of possible commitments, refraining from them if he may be wrong, can't he? If i use the example on wikipedia for ZK proofs:

  In this story, Peggy has uncovered the secret word used to open a
  magic door in a cave. The cave is shaped like a ring, with the
  entrance on one side and the magic door blocking the opposite side.
  Victor wants to know whether Peggy knows the secret word; but Peggy,
  being a very private person, does not want to reveal her knowledge
  (the secret word) to Victor or to reveal the fact of her knowledge to
  the world in general.

  They label the left and right paths from the entrance A and B. First,
  Victor waits outside the cave as Peggy goes in. Peggy takes either
  path A or B; Victor is not allowed to see which path she takes. Then,
  Victor enters the cave and shouts the name of the path he wants her to
  use to return, either A or B, chosen at random. Providing she really
  does know the magic word, this is easy: she opens the door, if
  necessary, and returns along the desired path.

Now if we replace Victor with a CRS, Peggy would f.e. enter at entry A and look at a position that is the equivalent of her decision (or where would she look?) whether she should leave the cave at A or B, in this case B. But why doesnt she just look it up beforehand? She has the CRS and she knows where she would have to look at if she took either sides - she can just see that if she goes to A first, she is supposed to come out at B. So instead of really committing to A, she secretly sneaks into B and gets out there without having to pass the magic gate.


texts: Is the following construction of a secure PRG is also a secure PRG?

texts:
Given a secure PRG $G :\text{{0,1}}^n \rightarrow \text{{0,1}}^{2n}$, I've constructed the following PRG:
$$
G'(x) =
\begin{cases}
0^{2n} & \text{if x is palindrome;}\\
G(x) & \text{otherwise;}\\
\end{cases}
$$
My intuition is that $G'$ is secure because it's "predictable" only for negligible portion of the inputs, so I tried to write a formal reduction.
I tried showing that given an efficient distinguisher $D'$ for $G'$, I can construct an efficient distinguisher $D$ for $G$. The immediate issue I faced is that $D$ receives as input either a random string $r$ of length $2n$, or $G(s)$ for a random $s$ of length $n$, and In the later case I'm having trouble rearranging $G(s)$ to be "suitable" for $D'$. (which I'm using as a black box)
Is my intuition about $G'$ security correct? If so, what's the way of proving its' security?


texts: Limitations of boolean and arithmetic circuits

texts:
Much of modern cryptography is based around working with boolean or arithmetic circuits. For example in Multi-Party Computation the 'famous' results allow for the secure computation of any function that can be represented as a boolean or arithmetic circuit.

I am wondering what the limits of these circuits are, what are some examples of functions are we not able to compute securely --- that is what functions are not representable as a boolean or arithmetic circuit? And in the real world does this reduce the effectiveness of modern cryptography or are these circuits enough to implement everything we require?


texts: Is it possible to make time-locked encrytion algorithm?

texts:
I'm not sure if what I'm asking is even a valid question but here goes.

Would it be possible to add a mechanism to an encryption algorithm that would mean it had to be a certain time of the day or a certain day of the year for the encryption to be able to be decrypted.

To Clarify, It should only be decryptable at a certain time eg

4th February or
11.23 am
or between 1 and 2 pm

working in a similar way to a time clock on a bank safe.

Obviously this would require encrypted access to an internet timeserver to ensure an unspoofed time signal.

Does this make an sense?
Would it be possible?
What would the mechanism be?

I asked this on stackexchange.com but this seems a better place.


texts:
I am working on securing a feature in a csv file.  My goal is to encrypt, anonymize, mask.... etc the content of the records of the feature while preserving the distance between the characters. as example :
        record 1 : mtlcfg
        record 2 : mtlfff

The distance between them is 2 so I want to secure the actual values and preserve the distance on the secured value so the other party is able to retrieve the distance without retrieving the actual values.

I know that adding a noise vector  will work and preserve the distance but it is not secure enough.  All papers that I am reading now are focusing on multi-party secure distance computation such as additive homomorphic encryption. Yet this doesn't match with my case, all I want to do is to be able to calculate the distance on secured content. Can anyone suggest any papers to guidance I am really lost in a lot of papers


texts: What paradigm does ABE, KP-ABE and CP-ABE fall into

texts: Do attribute-base encryption (abe), key policy attribute-based encryption (KP-ABE) and ciphertext attribute-based encryption (CP-ABE) fall into the attribute-based access control (ABAC) paradigm or are they not related?


texts: Solve the congruence using Pohlig-Hellman algorithm

texts:
Use the Pohlig-Hellman algorithm to compute a solution to:
$3^x\equiv 2 \pmod {65537}$

My attempt:

$p-1 = 65537-1 = 65536= 2^{16}$

$x= 2^0x_0+2^1x_1+2^2x_2+...+2^{15}x_{15}$
For $x_0$:
$2^{65536/2}=3^{(65536/2)x_0}$
$1 \pmod {65537} \equiv (-1)^{x_0} \pmod{65537}$
So $x_0 = 0$

Is this right? Because for all other steps after that, I get $0$'s for all $x_i$'s where $i=1,2,3,...,15$

Any help would be appreciated!


texts: How to implement access control for Automotive Embedded Systems using mbedTLS?

texts:
I am trying to implement a security access scheme for Automotive Embedded Systems.I need to be able to generate a Random number(of my desired length), combine it with some secret data to send a Seed/Challenge, generate a Key internally using the same Seed/Challenge as one of the inputs to a function and then be able to compare the received key with the computed key. Could someone help me know whether mbedTLS /PolarSSL library has functions to support me in achieving my objectives? I am new to this topic and there are too many new terms that I do not fully understand.

Summary of my needs:

Generate a RN of desired length (N1 bytes)
Seed / Challenge: RN + secret_data1 (N2 bytes)
Generate Key: f1(Challenge,  secret_data2, fixed data bytes) -> N3 bytes
Compare Key: f2(received key, generated key) -> return SUCCESS / FAILURE

Thank you in advance.


texts: Does it make any sense to sign a GCM authentication tag with RSA?

texts:
To achieve double insurance for authentication, can we sign the GCM final tag with using RSA?
with RSA, no one is able to create his own tag since the private key is not known.
However, according to FIPS.186-4, it looks like the input to RSA must be compliant to NIST approved hashing function.
Possible for this GCM + RSA combination?


texts: Please suggest the link where I can find out the NIST vectors for 4K Key to test my RSA API.


texts: If using large keysizes, is McOE-X actually safe?

texts:
After reading the this question, I found the McOE mode of operation for tweakable block ciphers along with its "X" and "G" conversions for normal block ciphers. A quick research yielded the paper "A Simple Key-Recovery Attack on McOE-X" by Mendel, Mennink, Rijmen and Tischhauser which says that McOE-X is severely broken with $2\cdot 2^{n/2}$ effort (n being block / key size).

Now I want to implement McOE, because of the other nice properties it features but before I do that I need clarity on the security properties, namely:

Is McOE-G unbroken (to public knowledge) as of today?
With the hard requirement of at least 256-bit block / keysize, is using McOE-X still safe?


texts: How to construct a yes/no election protocol, such that only the result is revealed?

texts:
Can we use a threshold scheme to construct a (yes/no)-election protocol, such that every voter can give a positive or negative vote or he can abstain, and such that only the result of the election is revealed, but the number of positives, negatives and abstains stays secret?

Are there some ways to do this without a threshold scheme?


texts: Identify encryption scheme - Many-To-One?

texts:
What type of encryption is used when the encrypted phrase only uses the letters from a keyword?
For Example:
Keyword: Stack
tkc ska ktkkac skccaasca ckssak
This was encrypted using only the letters found in the word Stack. What type of scheme is this called?
Edit: Things I've thought of are that it might be some sort of Polybius Square or some modified Vigenere scheme but I don't know what I'm looking for.
I have not seen any encryptions that map many letters into one. I can't tell if the duplicate letters are meaningful or not. I can't tell if the words are padded. My guess is yes since one of the words in my encrypted texts has like 27 letters.
Edit: More Clues
I noticed all of the encrypted words are multiples of 3. Is this some sort of trifid cipher with one step encryption step using only the keyword as the row and column headers???


texts:
I've been playing around with the Matasano crypto challenges (cryptopals.com). I had a couple false-starts on the challenge that has you creating a program to calculate the key size of a XOR encrypted file using Hamming Distance of the bits (Index of Coincidence). After some head banging and pen and paper work on graph paper, I arrived at a working solution.

I've been playing around with my new toy script with different ciphertexts and key lengths and I noticed that for key sizes greater than 12 bytes, it works well (in my limited testing) and will accurately return the correct key size. For shorter key sizes, the most probable key length returned is a multiple of the correct key size. In fact the first few most probable key sizes are multiples of the correct key size and then the correct key size will appear further down in the results but with a higher probability ranking (based on Hamming Distance), than smaller, incorrect values.

Here's some examples that demonstrate what I'm talking about:

key = "eatoin shrdlu"

key.length

13

Let's XOR encrypt our plaintext with the key and get cipherText:

cipherText = XOR-Encrypt -String data -key key

cipherText (line breaks added)
21041a01001d003501010c090745151503021d000401060c4c31040f54240803491d1b191d4c14
070e011b491a4816482421223a2841161a0e4200070017441a140914114f060800050100101914
0941190e0a06491d0d52011f160411111c454e571b1152011a1017181b010c4e57120606174c01
0a41190e020b00161e171615550714134f1d0645531f1d161f01450e1a0a49014653091e084c01
0c0c114f061c00191d01104c14450301010a06001c0e520c1505004115010d4e571b090644181d
004135190c0047161a014404141304541b064e441c48050d181d45170103070b52120a1b080501
1c4110061a0d4c1c1b0716095b

Let's run this through the XOR brute forcer to see what it says about the key
size:

XOR-Brutr -MaxKeySize 40 -String cipherText -Encoding base16 | Sort-Object AvgDist

KeySize          AvgDist
-------          -------
13               2.74660633484163
39               2.78461538461538
26               2.81730769230769
33               2.8989898989899
40               2.905
25               2.93
38               2.94210526315789
...

Beautiful! The result correctly calculates that the key size is 13 bytes, but
with smaller keys....

key = "eatoin shrdl"

key.length

12

cipherText = XOR-Encrypt -String data -key key

XOR-Brutr -MaxKeySize 40 -String cipherText -Encoding base16 | Sort-Object AvgDist

KeySize          AvgDist
-------          -------
24               2.58333333333333
36               2.66111111111111
38               2.85789473684211
40               2.915
19               2.95215311004785
29               2.97536945812808
22               3.00909090909091
16               3.02232142857143
23               3.03381642512077
18               3.03703703703704
37               3.03783783783784
14               3.05357142857143
30               3.05714285714286
32               3.0625
27               3.06481481481481
12               3.06578947368421
28               3.06632653061224
...

Our top result is not 12, though 12 is the greatest common denominator
of the top two results.

If we set the MaxKeySize to a higher value and use a 26 byte key:

key = "eatoin shrdluuldrhs niotae"

ciphertext = XOR-Encrypt -String data -key key

XOR-Brutr -MaxKeySize 104 -String CipherText -Encoding base16 | sort avgdist | select -First 10

KeySize          AvgDist
-------          -------
52               2.59615384615385
78               2.62179487179487
104              2.64423076923077
81               2.66666666666667
26               2.66826923076923
84               2.67857142857143
...

Again, a multiple of the actual key rises to the top.

Question: Why does this pattern emerge? Why does the Hamming
Distance favor multiples of the actual key size? Should my script
determine the gcd of the first few results and weight the gcd
more heavily and return it as the probable key?


texts: Are additional PGP subkeys still needed for smartcards?

texts:
After having purchased a USB GnuPG smartcard, I visited the manufacturer's website. A tutorial by the FSFE was mentioned there as the preferred way of setting up the smartcard.

However, this tutorial seems to be a bit outdated as the output of gpg --gen-key doesn't offer the option to create a "RSA + RSA"-keypair:

Please select what kind of key you want:
  (1) DSA and Elgamal (default)
  (2) DSA (sign only)
  (5) RSA (sign only)

The author chooses the first option and continues by generating two RSA subkeys of the DSA key. These two subkeys (one for signing, the second for encrypting) are then transferred to the smartcard. The Elgamal key is deleted, unused.

So my questions here – as an owner of a keypair consisting of two RSA keys, default in GnuPG for quite a long time – are: Do I really need to generate new subkeys for the smartcard? Or is this measure included in the tutorial for historical reasons (as smartcards seem to only support storing RSA keys)?

I don't know if, from the security point of view, there are reasons against putting your "master" key on a smartcard. But even if, wouldn't it be enough to generate one second subkey for signing instead of two new subkeys?


texts: Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list

texts:
I have a scenario similar to the one described in Wikipedia: hash list, but with a twist. I'm looking for a cryptographically secure hash function that would create the same root hash for the same file, no matter how the the file is chopped up for the individual hashes in the list.

E.g. case 1: File is divided into 3 parts; the hash list consists of the hashes for the 3 parts; the root-hash is computed from the 3 hashes. case 2: Same file is divided into 2 parts; the hash list consists of the hashes computed for the 2 parts, the root hash is computed from the 2 hashes. Since it is the same file I want the root hash to be the same.

Is this doable (maybe with some restrictions on number and size of file parts)?

[Edit]
Specific use case:
My system stores files for users. Large files are usually sent / stored in smaller chunks (currently I don't control in which way the files are split up into chunks). Each chunk is encrypted beforehand by the client, but accompanied by a hash of the unencrypted content. I now would like to know if two users upload the same file (as this allows me to do some optimization) without having to know the content of the file. So if I could compute a "hash" of the whole file by using the individual chunk hashes I could easily achieve this.


texts: Ressources for implementing cryptography

texts:
I am looking for resources on how to implement cryptographic algorithms. I am a cryptographic researcher, so I am not interested in reviewing the basics,
and I don't need the talk about it not being a good idea to design or implement your own crypto. But I would like to know more about practical considerations of implementing crypto algorithms.

What I am interested in are specialized material such as online courses, university courses, certifications, textbooks, or recorded talks that cover some or all of the following subjects:

Formal/automatic bug-checking
Avoiding side-channel vulnerabilities (e.g. constant-time)
Low-level optimization techniques

Do such resources exist and where might I find them? Am I forgetting an important subject matter in the above list for crypto implementations?

In other words, what does one need to know to implement cryptographic algorithms and where does one learn those skills?


texts: Diffie-Hellman key exchange, then so what?

texts:
I know how the Diffie-Hellman Key Exchange (DHKE) works. But where is it used? And ok, now both have the same key. But how are those keys used anyway?
I've heard that HTTPS is using the DHKE. Ok, but what are they doing with the key? Are they just multiplying the message with the key? And dividing by the key on the other hand?


texts: How does SafeNet MobilePASS generate passwords?

texts:
We use MobilePASS at work but the latest version of the android client seems to be buggy so I wanted to have a go at implementing the algorithm myself.

You can download the client to play with here: http://www.safenet-inc.com/support-downloads/mobilepass-download-page/

It looks to be based on the HMAC-SHA256 OTP algorithm. The client provides the user with the secret key when creating a new token which is copied into a web interface server side.

The bit I'm unsure about though is the pin. It looks like this is also included in the process but I'm having trouble determining exactly how.

Is there a standard way of extending HOTP to include a pin?


texts: How to go about decrypting a cipher with known input and output?

texts:
I have a known input and a known output but how would I go about working out what the cipher was used. Below are a few examples of input and output.
On the last one I noticed a repeating pattern. Would that point me in a particular direction?


texts: Pairing-free group based encryption scheme

texts: Can someone explain what is a pairing-free group ? There is encryption schemes, for example 1, that qualify there proposed construction as pairing-free group. However, they use bilinear group in the setup phase. Therefore, how we can qualify a work as a pairing-free based scheme.


texts: I am currently reading about PBKDF2, and understand that the salt is used only once, while the password is used multiple times in the computation of the final key (see this question). How would the integrity of PBKDF2 change if the roles of password and salt are changed?


texts: Can I make a cipher (ex: Vigenère) harder to break?

texts:
The Vigenère cipher can relatively easy be broken when the key size is small compared to the size of the message. One first finds the length of the key, and then uses frequency analysis to actually find the key.

How can one "add" something non-complicated to the Vigenère cipher to make it harder to break? Would it for example help to first apply a permutation the message in some way?
Are there any general strategies for this when using other ciphers?


texts: How to attack a general polyalphabetic cipher?

texts:
I am able to decrypt Vigenere ciphertext using the index of coincidence and chi-squared test.

However, out of interest, how do you go about attacking ciphertext that was encrypted using a mixed alphabet shifted 26 times?

Also, what about a ciphertext that has been encrypted with 26 random alphabets? (so each line in the tableau is random)

Googling seems to bring up the basic Vigenere, but either an example or a link to a more detailed resource would be good.


texts: Computing/using RSA modulus without knowing its factors

texts:
There are some protocols, e.g. this, that require parties to compute/use RSA modulus: $N$ without knowing it's factors or $\phi(N)$.

One way of doing it is to use a trusted party.

Question: Is there any other way of generating/using $N$ in the above schemes without using a trusted party? (If yes, can you refer me to some papers)


texts: TLS_DH_RSA_* cipher, how can static DH use an RSA certificate?

texts:
I am confused about TLS_DH_RSA_* ciphers because, for DH to work, the server certificate has to include a DH public key, but for server authentication the server certificate needs an RSA public key. Can an RSA certificate include both a DH public key and an RSA public key?

Can somebody help to explain how DH_RSA key exchange works?


texts: What are the key differences between the draft SHA-3 standard and the Keccak submission?

texts:
I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014).

Previously it was discussed here that NIST would be changing stuff compared to the submission, which was seen as problematic (mainly from a reputation point of view).

Did these discussed changes make it into the draft standard?
What else are the changes in the draft standard compared to the submission?
Are any of these relevant from a security point of view?


texts: Limiting password length to "prevent hash function splitting into multiple hashes"?

texts:
Given we are using well-known hashing functions for passwords, i.e. SHA256, SHA512, BCrypt or, PBKDF2.  Our Information Assurance SMEs have advised that we truncate the input into these hashing functions:

  …to prevent the hashing function splitting it into multiple hashes.

I have not heard of hash functions doing this, in fact, I had assumed that hashing a string down with a hashing function would produce a fixed length string - am I incorrect to make this assumption?


texts: Reverse the order of encryption and decryption in CBC mode. Does this work?

texts: To encrypt a message, one uses the algorithm for doing a CBC decryption. To decrypt a message, one uses the algorithm for doing a CBC encryption. Does this work?


texts: How is the One Time Pad (OTP) perfectly secure?

texts:
The Wikipedia entry on One Time Pads (OTPs) states that if this cipher is used properly; ie, the keys are truly random and each part of the key is independent of every other part, it's uncrackable, and yields perfect secrecy, i.e., $H(M|C) = H(M)$.

It gives an example saying that a cryptanalysis on a plaintext "HELLO" will yield all plaintexts like "HELLO", "LATER", with equal probabilities.

Now, consider some OTP encrypted data that I know are English sentences. With infinite computational power, I generate all plaintexts. Now, becasuse each word of the sentence is related to nearby words, I can at the very least narrow down the list of possibilities (I don't know the combinatorics of cramming English sentences into M letters), which does not equal perfect secrecy (entropy $H(M)$ appears to have decreased!).

In short, OTP guarantees $H(M|C) = H(M)$, but my question is that $H(M)$ will be reduced by knowledge of the plaintext, so how is prefect secrecy being ensured?


texts: What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

texts:
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure protocol, such as a strong block cipher mode of operation, you can't distinguish it from another protocol that looks pretty much the same. But how?
Let's say I use regular AES-GCM as part of a protocol, and I also use a protocol that just uses a variant of AES-GCM with the same key size, but with a single round instead of 10+? Or maybe a really weak block cipher, tailor-built to be broken?
Scenario
Say that Alice and Bob have established communications on unsecured channels X and Y. They use protocols named PX and PY. Eve can listen in on both of these channels. A channel is made of two parts: A tape controlled by Alice, and a tape controlled by Bob, but are open to be written to by any machine. Since there are two channels, there are 4 tapes involved.
PX is nearly identical to PY, except that they use different block ciphers. Technically, however, we can say that they are different protocols. Eve cannot distinguish between one protocol and another because everything is encrypted in transit, and Eve only started eavesdropping after Alice and Bob have exchanged Diffie-Hellman parameters and created a session key (no MITM attack happened, since parameters are signed and certified by some TTP).
Universal Composability states (correct me if I'm wrong) that if Alice and Bob and Eve are Turing machines with Eve is able to intercept new symbols written to Alice or Bob's tapes (but not "effectively" write to them*, since doing so requires existential forgery to be possible), and Eve cannot distinguish whether symbols made on either channel is defined by the rules for PX or PY, and one of PX and PY are provably secure, then both PX and PY are secure.
Question
However, PY utilizes a very weak block cipher, despite traffic from the two being indistinguishable**. Eve can brute force the key for decrypting PY symbols with ease. By attempting brute force attacks on both channels, one of them succeeds in polynomial time. Does this not violate UC?
*"Effectively" means that, while Eve can write a bunch of symbols on Bob's tape and pretend to be Alice, Bob can easily distinguish the fake symbols from those that are from Alice.
**Is it even possible for something to be breakable yet indistinguishable? I made a leap in logic here that is probably incorrect.


texts: Negotiating a session key, when only one public-key is exchanged via QR Code

texts:
Question
I want to create a secure channel between a server and a client. It is only important that the client can verify the identity of the server, not the other way around.
In my special case, an ephemeral public key of the server is sent to the client in a first message via a QR Code that is shown on the server device and is directly scanned by the client (My threat model here is a 'weak' MITM that may eavesdrop by shoulder-surfing but is not able to manipulate the scan result).
This creates the not-so-standard situation, where 1) the client get's a new public key from the server in every handshake 2) the first message in the exchange is in-person via QR code.
I think this makes the actual handshake easier in that it removes some constraints from normal "anonymous network" style exchanges.
After the handshake the client should have an authenticated secure channel to the server, whereas the server has an anonymous secure channel to a client.
Is my approach below sane? How does it compare to more traditional alternatives e.g sending the client's public key to the server and doing a DH?
My Approach
My current approach looks like this (I am using libsodium for the cryptographic primitives):
The client simply generates and sends a pre-session key $k$, enclosed in a sealed box to the server's public key $p_s$.
Both parties calculate the same session key $m = h(p_s || k)$. This is done to have the server provide part of the session key.
The server responds with an "ACK" encrypted to the new session key, if it was able to decrypt it successfully.
After the ACK, both setup a secret stream as their secure channel.
At any point if a message is invalid they reset the handshake state and the other party will time out.

Both $k$ and $p_s$ are 256bit keys and should suffice as nonces, to guarantee freshness throughout the handshake, I believe.
From what I can tell this results in the following situation:
Client:

has received a public key that belongs to the server
If $M_3$ is a valid "ACK" encrypted with $k$($m$) the response was sent by the secret key holder i.e the server and cannot be replayed because $k$ is random.
Thus, a secure channel with the server has been established

Server:

$M_2$ could have been replaced by an attacker, but then the client will not be able to decrypt $M_3$ and the attacker has essentially just made her own handshake
$M_2$ cannot be replayed because $p_s$ is generated for each handshake
Thus, a secure channel with an anonymous client has been established

Attacker:

could eavesdrop $p_s$ and replace $M_2$ with her own $k$. That would lead the server to believe it has established a secure channel with client even though the client would discard the ACK. However, the server will time-out as the first message of the secure stream will have to be sent by the client. (I should probably make this part of the protocol).


texts: Proving to have sent data, without revealing it

texts:
This may be easy, but I'm struggling to find a reasonable solution now.

Alice wants to send data to Bob.
The data that Alice wants to send has been verified by Carl in some way, even though Carl has not seen the data. Anyway, given the data, Carl is able to recognize if it's the original data shown by Alice.

Bob receives the data, but now he maliciously claims that he did NOT receive the data.

How can Alice prove that he sent the data, and also keep the data secret from Carl or other parties?

Which real world tool (encryption, service, etc.) can Alice use?

1) It's not enough to prove to have sent something, Alice should be able to show that she sent exactly the data verified by Carl.

2) It's not allowed to use trusted third parties other than Carl. But Carl cannot explicitly see the data.

3) It's enough to prove that Alice sent the data, it's not needed to prove that Bob received.

4) It's not important if the data is encrypted or not. Realistically it will be.


texts: Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it?

texts:
RSA is both an asymmetric encryption algorithm and a digital signature algorithm.  However, in recent years, many cryptographic protocols (TLS, for example) have moved away from the use of RSA to instead prefer ECC because of forward secrecy.

So, my question is, do we still need RSA?  Is there any situation where it cannot be replaced by an ECC scheme instead?

More specifically, if the answer to the above is no, are there any circumstances in which RSA is better suited than the ECC counterpart?  Why is it still in use from a practical point of view?


texts: In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm for the parties comunication in the RSA-DH protocol?


texts: What are the issues of look-up table based implementations?

texts:
Cryptographic libraries mostly use pre-computed lookup tables to implement block ciphers. These lookup tables require large amout of memory and a series of cache miss/hit makes them vulnerable to cache timing attacks.
Are there any other disadvantages of lookup table based implementations?


texts:
I am working with Atmel's/MicroChip's ATAES132A 32K AES Serial EEPROM chip for hardware encryption and decryption. This is my first venture into cryptography. I've been reading through the datasheet and have a question on how to generate the MAC for decryption. I've asked this question on the Atmel forum, but I didn't get any responses. I figured this is more of a cryptography question rather than a technical one.

Per the datasheet:

  I.3 MAC Generation

  The following example shows how the integrity MAC is calculated for an
  authentication operation requiring up to 14 bytes of authenticate-only
  data. This operation involves three passes through the AES crypto
  engine; all three using the same key. If there are more than 14 bytes
  of authenticate-only data, then another pass through the AES crypto
  engine is required. There are two passes through the AES crypto engine
  in CBC mode to create the cleartext MAC. The inputs to the crypto
  engine for those blocks are labeled B0 and B1, and the outputs are B’0
  and B’1, respectively.

  • B0 is composed of the following 128 bits:

  – 1 byte flag, a fixed value of b0111 1001. – 12 byte Nonce, as
  generated by the Nonce command. – 1 byte MacCount, one for first MAC
  generation. – 2 byte length field, always 0x00 00 for authentication
  only.

  • B1 is the XOR of B’0 with the following 128 bits: – 2 byte length
  field, size of authenticate-only data. – 14 byte data to be
  authenticated only.

  • B’1 is the cleartext MAC, which must be encrypted before being sent
  to the system.

  There is one additional pass through the AES crypto engine in CTR mode
  to create the key block that is used to encrypt the MAC. The input to
  the crypto engine for this block is labeled A0 and the output is A’0.
  A’0 is the MAC sent to the system as the output parameter of the Auth
  command.

  • A0 is composed of the following 128 bits: – 1 byte flag – fixed
  value of b0000 0001. – 12 byte Nonce – as generated by ATAES132A
  during Nonce command. – 1 byte MacCount – one for first MAC
  generation. – 2 byte counter field – always 0x00 00 for A0.

  • A’0 is XOR’d with the cleartext MAC (B’1) and sent to the system.

  Input integrity MACs for Auth, Counter, KeyCreate, and Lock are also
  calculated using this procedure. If the input MAC does not match A’0,
  then the command returns an AUTH error.

So my question is, in suede-code, are my steps correct?

B'0 = B0 XOR with the secret Key

B'1 = B1 XOR with B'0

A'0 = B'1 XOR with A0


texts: Performance of Fully homomorphic encryption VS Paillier encryption in Practice

texts:
Consider two schemes both have computation complexity linear to the input size (i.e. number of inputs). One scheme is based on Paillier encryption and the other one is based on fully homomorphic encryption.

Question 1: In general, can we compare their performance (i.e. which one is faster)?

Question 2: In general, can we compare their ciphertext size( i.e. which one has smaller sized ciphertex)?


texts: Difference between eavesdropping and traffic analysis

texts: I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?


texts: Avoiding replay attack on certified announcements

texts:
Suppose two agents A and B share a common secret and A makes a regular unique 16-byte announcement to B every 10mins which B must verify authenticity.

I'm thinking of letting the first 8 bytes be the message and the last 8 bytes be the HMAC(key, msg). The message itself contains an increasing counter, which B uses to reject all future messages with a lower counter.

Given the uniqueness of each message and the strict monotonicity of the counter, should this scheme avoid replay attack?

Overall, is this a secure approach?

Thanks


texts: What happens when a root CA loses its private key?

texts:
Certificate Authorities normally keep their private keys inside dedicated Hardware Security Modules (HSMs).

What happens when such a device is lost (fire, electronic fault, stolen, etc)?

How would that affect a big, established CA such as Comodo?

EDIT: I have seen the question about the key being compromised (see comments below), but my question is about the key becoming inaccessible.


texts:
Is there an entropy source that provides the following three properties?

true randomness
for a distinct time-period, produces same (random) data on two devices that are less than 10 km apart from each other
high throughput, so recording randomness for a few minutes requires terabytes of data storage

I considered sources like atmospheric noise or similar, but I am unsure whether they fulfill property (2) (and (3))...


texts: Difference between Identity-based encryption and multiple key-pairs of public key encryption?

texts:
What is the difference between Identity-based encryption and multiple key-pairs of public key encryption scheme??

Suppose trusted key generator generates a bunch of public and private key pairs $(k_{\texttt{public}}^{(1)}, k_{\texttt{private}}^{(1)}), (k_{\texttt{public}}^{(2)}, k_{\texttt{private}}^{(2)}),...,(k_{\texttt{public}}^{(m)}, k_{\texttt{private}}^{(m)})$
, each of pairs is distributed to each of $m$-parties and all the public keys are public (any one can know it).

In this case, what's the potential difference of ID-based encryption and this instantiation?
Both of them can do the same task where everyone can encrypts its data using one of the public keys such that only the corresponding private key owner can get the data.


texts: Difference between RC2, RC4, RC5 and RC6

texts: Can anyone point out the core differences between RC variations?


texts: Why it is said that “zk-SNARKs need a trusted setup” to work?

texts: What is the meaning of a "trusted setup" in this context? It is often said all around that zk-STARKs and Bulletproofs does not require a trusted setup. How do zk-STARKs and Bulletproofs manage to avoid the need for a trusted setup?


texts: Are pairings still the most efficient implementation for identity and attribute-based encryption?

texts:
I read on Wikipedia:

  [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute based encryption schemes.

Is this still the truth? I cannot find any newer sources for this. Is someone up-to-date on this?


texts: Partial key recovery from linear equations

texts:
I have searched for my question but I didn't find any relevant answer to my situation. I guess maybe it is too easy but I am a newbie in crypto and I can't figure out the answer.
Here is the exercise:

An attacker mounts a partial key recovery attack on a cipher with a
128-bit key and manages to find a system of $k$ independent linear
equations involving the secret key bits with $k < n$.
For example:
$k_{1} \oplus k_2 \oplus k_{63} = 1$
$k_{1} \oplus k_3 \oplus k_{17} = 1$
$k_{43} \oplus k_{56} \oplus k_{60} = 0$
Does this info
help him to attack the cipher? If yes, what would be the attacker’s
gain over the complexity of an exhaustive search?

I know intuitively that this reduces the complexity because of the common $k_1$ in 2 of the equations and I tried using truth tables for each equation but I can't extract the answer from them. Can anyone explain how is the complexity reduced?


texts: Questions regarding the one-wayness and collision-resistance of a hash function based on RSA-like problem

texts:
Problem statement:
"Bob is a paranoid cryptographer who does not trust dedicated hash functions such as SHA1 and SHA-2. Bob decided to build his own hash function based on some ideas from number theory. More precisely, Bob decided to use the following hash function: $H(m)= m^2\bmod n, n= p\times q$, where $p$ and $q$ are two large distinct primes. Does this hash function satisfy the one-wayness property? What about collision resistance? Explain."
Official solution:
"Since p and q are secret, then finding the square root mod n is a hard problem. Thus this hash function satisfies the one-wayness property. On the other hand, H does not satisfy the weak/strong collision resistance property because for any m, -m would also have the same hash value, i.e., H(m)=H(-m)."
My confusion:
For the one-wayness property part of this cryptographic hash function problem, the solution says that finding the square root mod n is a hard problem since p and q are secret. If, for example, this were the asymmetric RSA encryption algorithm, then that would make sense to me because having p and q could allow you to get the decryption key, but for this hash problem, I don't see how knowing p and/or q would make it easier for an attacker to reverse that modular operation even if p and q were known.
Also, about the collision resistance property part of this cryptographic hash problem, can a file that's being tested for not being tampered with provide a negative value as an input to a cryptographic hash function?
Could someone please help me understand what I'm unclear about?
Any input would be GREATLY appreciated!


texts: What will be the MAC size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?

texts:
What will be the mac size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?
Will it always be 128 bits MAC size for no matter how many numbers of blocks?


texts: BIKE: Bit Flipping Key Encapsulation - Inverse encryption / decryption

texts:
I'm trying to understand white paper about BIKE Asymmetric crypt.
And actually read about the inverse matrix that needs to be produced for decryption.
My concern is:
Can I actually encrypt data with private key and decrypt with public key instead too?
If so, there are 3 Versions of BIKE: "BIKE-1, BIKE-2, BIKE-3"
Which one will work?


texts: I was wondering if there is a version of LWE with secret matrices and public seed vectors? Would it be as hard as the popular definition of LWE?


texts: In many lattice based cryptosystems, Gaussian distribution is used. Can you explain why only Gaussian distribution is preferred?


texts: Is it secure to use the hash of key as the IV in AES encryption?

texts:
I need to store some sensitive data for a program. For each copy of the program, there will be a unique key for encrypting one (and only one) file using AES encryption (OFB). The key will not be changed (probably forever).

Is it secure if the hash value of the key is used as the IV?

Update:
The key is computer generated.
The user of the program have no access to the key since it's obtained by the program via secure Web API.
The user can only edit a portion of data stored in the file via the program.


texts: Pseudo-Hadamard transform, most significant bit

texts:
For clarification: The Pseudo-Hadamard transformation is a reversible transformation of a bit string that provides cryptographic diffusion.
Splitting a bit string (with bit length of $2n$) into two equally large bit strings $a$ and $b$ with size $n$:

\begin{align}
a' &= a + b & \pmod{2^n}\\
b' &= a + 2b& \pmod{2^n}
\end{align}
Reverse:
\begin{align}
b &=b' - a' & \pmod{2^n}\\
a &= 2a' - b' & \pmod{2^n}
\end{align}

(Source: Wikipedia: Pseudo-Hadamard transform)

What about the most significant bit (the most right bit) of $b$ in $b'$? Multiplication with $2$ and $\mod{2^n}$ cut this off. We lose any possible diffusion of this bit in $b$. That can't be good. Especially SAFER K and SAFER SK are heavily relying on the pseudo-hadamard transformation, see SAFER at Wikipedia.

My first question:
How does this affect the whole security of a cypher with this transformation? Is there a know attack on SAFER which exploits this characteristic?

My second question:
How can we fix this? Is there any public solution for this problem? Maybe we can replace the multiplication? I did try something with a left rotation of 1, but that combination doesn't work. Either this doesn't work in general, or I just don't know the "other secret key" to reverse the transformation with rotation instead of multiplication:

\begin{align}
a' &= a + b & \pmod{2^n}\\
b' &= a + rotL(b, 1)& \pmod{2^n}
\end{align}

Reverse:  (Warning, wrong equation)
\begin{align}
b &= b' - a' & \pmod{2^n}\\
a &= rotL(a', 1) - b' & \pmod{2^n}
\end{align}


texts: Is it safe to use many nonces for XChaCha20?

texts: I have a very simple question. Since XChaCha20 nonces are 192-bit, there's technically no limitation to the max number of message encrypted, since the chances of two random nonces being the same are very very tiny. Is it okay to use the same key, but difference nonces to encrypt large files in chunks? Basically, I read the large file 1KB at a time, encrypt with the same key but random nonce. If the file is 1GB, then I would have used 1000000 nonces. If I encrypted in chunks of 1MB, then I would've used 1000 nonces. Is doing this secure? (Assume everything is authenticated and I use CSPRNGs for nonces)


texts: Correct use of Fisher-Yates for subsequent selections

texts:
We all know Fisher-Yates takes an array and shuffles it as per the output of a PRNG.

My question is in relation to what would be the "correct" implementation to select multiple sets (e.g. n sets of k lottery numbers).  Is the answer :

Re-initialise array to default state, shuffle and pick ; or
Assuming the array is long enough, continue picking along array; or
Re-shuffle already shuffled array and pick; or
It does't make any difference as long as Fisher-Yates and PRNG are correctly implemented.

At the moment, I'm leaning towards number four. But then I know that "crypto is hard" and that I am merely a learning beginner when it comes to cryptography!


texts: Expected Polynomial time Simulator in Interactive ZKP

texts:
I was reading the Zero knowledge property for Interactive Proofs. It said that for the proof to be zero knowledge, there should exist a simulator that runs in expected polynomial time for all verifiers, such that the simulator can generate a distribution which is identical to the view of the Verifier.
What was the need of formalizing this property with such a simulator?
Is it formalized with a simulator that runs in polynomial time, which has access to the random bits of Verifier, and which generates the Verifier's view only using the input to the proof and the verifier's random bits? This formulation seems much more intuitive to me.
Moreover, it also gives me a better idea as to why we allow the simulator to generate the random public string in NIZKP.
I am also confused as to how exactly the simulator is allowed to interact with the Verifier.


texts: Decrypting an encrypted text out of order

texts:
Does there exist a cipher that can be encrypted twice with two different keys and then decrypted twice using either key first?

For example:

Plaintext is "Lemons are great!"
Encode with Key #1
Encode with Key #2
Decode with Key #1
Decode with Key #2
Result is "Lemons are great!"

To my understanding TLS does something like this, but I'm not sure. I've also tried reading about elliptical curve cryptography to no avail (of useful understanding, that is). I've also tried my own tests with OpenSSL but I feel like it's salting things and therefore is making it not work.

I understand this is possible with a ROT(n), but that's of course not considered cryptographically secure.


texts:
I'm using Blowfish in a toy Diffie-Hellman communications scheme. Random session keys are generated for each connection.

In this case I can simply feed a null array to the IV right? The same plaintext would never be encrypted with the same keystream.


texts: Should we MAC-then-encrypt or encrypt-then-MAC?

texts:
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which include a MAC (EAX, GCM...) but let's assume that we are doing old-style crypto, so we have a standalone encryption method (e.g. AES with CBC chaining and PKCS#5 padding) and a standalone MAC (e.g. HMAC with SHA-256). How should we assemble the encryption and the MAC?

MAC-then-Encrypt: Compute the MAC on the cleartext, append it to the data, and then encrypt the whole? (That's what TLS does)
Encrypt-and-MAC: Compute the MAC on the cleartext, encrypt the cleartext, and then append the MAC at the end of the ciphertext? (That's what SSH does)
Encrypt-then-MAC: Encrypt the cleartext, then compute the MAC on the ciphertext, and append it to the ciphertext? (In that case, we do not forget to include the initialization vector (IV) and the encryption method identifier into the MACed data.)

The first two options are often called "MAC-then-encrypt" while the third is "encrypt-then-MAC". What are the arguments for or against either?


texts: I know, that quantum computers can theoretically break the discrete logarithm problem using the shor algorithm. The problem with quantum computers is not the time, but the space ( the needed qubits ). My question is: Can elliptic curve cryptographie be adjusted so that they are secure against quantum computers? ( e.g. longer key length )


texts: Can neural cryptanalysis be applied to AES?

texts:
In this Wikipedia article about Neural cryptography (section applications) it states:

  In 1995, Sebastien Dourlens applied neural networks to cryptanalyze DES by allowing the networks to learn how to invert the S-tables of the DES. The bias in DES studied through Differential Cryptanalysis by Adi Shamir is highlighted. The experiment shows about 50% of the key bits can be found, allowing the complete key to be found in a short time.

It could very well be that I misunderstood something, but I think that the same "attack" can't be used for AES, since the Inverse Rijndael S-box is public knowledge or am I wrong? Is AES designed this way to prevent an attack by inverting the S-box?


texts: Hash Function to get same value for different messages

texts:
I am studying a function where I found the some hash properties.

Hash functions:

Given a code c is computationally infeasible to find m such
that h(m) = c
Given m is computationally infeasible to find n != m such that
h(m) = h(n)
It is computationally infeasible to find any pair (m, n) such
that h(m) = h(n)

Actually every point is clear to me. But I wondering what is the difference between point 2 and point 3? Can anyone give me any clue? Thanks.


texts:
I would like to know your view about the title, encrypting a plain text with an affine cipher then encrypting that ciphertext once more using the same cipher, but of course different keys. Would it be more secure?

For me, it won't be since it still can be brute forced.  That's what I think, and I have read about Vigenère over a Vigenère, so practically they would be the same case, right?


texts: Find hash and signature algorithms used in an X.509 certificate signed with RSASSA-PSS

texts:
I'm trying to understand the new PSS scheme, but having trouble figuring out how to parse it properly.

When receiving a certificate with OID of RSASSA-PSS, how can I know which hash and signing algorithm was used?


texts:
Consider  a  variant  of  DSA  in  which  the message space is $\mathbb Z_q$ and the hash function is replaced by the identity function.  (So the second component of the signature is now $s := k^{−1} \cdot ( m + xr ) \mod q $). Show that this variant is not secure.

How would one go about this problem?


texts: Camellia is widely used, an international standard now. Its key schedule seems to be too simple compared to other famous ciphers like Twofish and CAST-256. What are the prerequisites for the key schedule, and does Camellia's key schedule have them?


texts:
I am new to Network Security and learning about various security features like Diffie-Helmann and others.

I understand that the Public key send by the server to the client needs to certified that it is authentic. So, a Certificate Authority (CA) needs to sign the public key. But I would like to know how is this public key signed in the certificate. Using some private key? And if so, how does the client decrypt this certificate and finally get the public key of the server? For example: how does it work in case of a TLS handshake?


texts: How can the identity $\textbf{Pr}[\textbf{y}=y|\textbf{x}=x] = \sum_{\lbrace K:x=d_K(y)\rbrace}\textbf{Pr}[\textbf{K}=K]$ be verified to hold?

texts:
How can the identity $\textbf{Pr}[\textbf{y}=y|\textbf{x}=x] = \sum_{\lbrace K:x=d_K(y)\rbrace}\textbf{Pr}[\textbf{K}=K]$ be verified to hold for any cryptosystem?

In his book Cryptography, Theory and Practice (3rd edition), Stinson states the equality for $\textbf{Pr}[\textbf{x}=x|\textbf{y}=y]$, which can be seen in the snippet below.

Intuitively, this seems just fine... But given that $\textbf{Pr}[\textbf{x}=x|\textbf{y}=y] = \textbf{Pr}[\textbf{x}=x,\textbf{y}=y] / \textbf{Pr}[\textbf{y}=y]$ by definition, how can I verify that the claim does indeed hold for any cryptosystem?


texts: Distinguishing between a Polynomial and a Laurent Polynomial

texts:
Let $f(x) \in \mathbb{Z}_p[x]$ (for a prime $p \gg d$) be a polynomial of degree $d$, and let $g(x)$ be a Laurent polynomial with the same degree and only the first negative exponent term ($g(x) = \frac{a_{-1}}{x} + a_0 + a_1 x + \dots a_dx^d$) over the same field.

Now, say we are given oracle access to both these functions with the additional condition that we can only $< d$ queries (Else we can just ask $d+1$ queries and interpolate the points to check if the function is a polynomial or not - this was the only way I could think of.)

Is this possible - if the test doesn't have to be perfect and can have some false positives or negatives?