texts:
could you guys please help me with the following problem or tell me where to find an example or something to understand it:

Find a pair of values a and b so that the elliptic curve forms an abelian group
module 2459, then find the following:
(a) 245 * P where P is an element of the group, specify the value of P
(b) 133 * P with the same P from (a) point.
(c) Use the Gammal to find the key with the two previous items.

I really appreciate your help. Have a good day.


texts: Generate secure password hashes without access to PBKDF2 or bcrypt

texts:
Given is a system, which does provide only implementations of fast hash algorithms (MD5, SHA1, SHA-256, SHA-512). There is no implementation of PBKDF2, bcrypt or scrypt available. The system does provide a generateDigest(algo, input) and generateMac(algo, salt, input) function. The system has also the ability to securely store a private key for the MAC-function. Due to some language restrictions, it is undesirable to implement one of the key derivation functions.

Despite its lack of an adequate key derivation function, the system should be used to generate hashes for given passwords and store them.

I wonder if it would be possible to do some simple key stretching by repeatedly calling generateMac() with the HMAC_SHA512 algorithm:

algo = 'HMAC_SHA512'

for (i = 0; i++; i < ROUNDS) {
    input = generateMac(algo, salt, input)
}

From a naive point of view, this does look like a feasible solution to slow down attacks on the hashes. But i do lack the experience and knowledge, if it would be a right way of doing it cyptographically.


texts: How does the order of Q affect the time it takes to solve ECDLP?

texts:
I use Sagemath's built-in function discrete_log() to solve ECDLP and according to the documentation it uses Pohling-Hellman algorithm to solve an ECDLP.

This is the case for my EC:

P-order => 176648753626148987385153422443570230330
Q-order() => 2

The P-order has these prime factors: 2 * 3 * 5 * 5888291787538299579505114081452341011

Even though the highest prime factor is super-large, the ECDLP through discrete_log() is solved within a second.

I Read about the Pohling-hellman attack and it only mentions that P should have small prime-factors in order for the attack to be successful. It never mentions the order of Q.

How does the order of Q affect the time it takes for the attack to be successful?


texts: Difference RSA keypair creation openSSL and openPGP?

texts:
Creating a 2048bits RSA keypair I figured that doing this using

openssl takes as an input 32bytes of "randomness" from /dev/urandom
pgp (openPGP) takes as input 300 bytes of "randomness" from /dev/random

My questions is. Does the number of randomness influence the cryptographic qualities of the resulting keypairs?


texts: What algorithm to use to rotate values in a predefined manner and be able to decrypt them back to the original?

texts:
What is the best practice to accomplish this? For example, let's have an initial value abc123456 and a seed secret_hash. I want to change the initial value once about every hour to a new value and be able to decrypt any future value back to the original one.

Should I use an external known value, for instance time, in order to encrypt and decrypt, or there is an algorithm that will generate a decrypt-able infinite stream of values just from the seed and the initial value?


texts: Best practice to hash multiple attributes

texts:
I have to generate a signature for concatenation of multiple independent values say A | B | C. Two options are :

concatenate all attributes and generate the hash. Then Sign hash.

$$ signature = Sign\big(Hash(A\mathbin\| B \mathbin\| C)\big)$$

Use hash of previous value along with current value to generate the hash. Sign the generated hash.

$$ signature = Sign\big(Hash\big(Hash\big(Hash(A)\mathbin\| B) \mathbin\| C)\big)\big)\big)$$

Analogous to taking two hashes of a value, option 2 seems cryptographically strong. Kindly help in picking right practice and why?


texts: Replay attack prevention in connectionless UDP encrypted communication

texts:
What are the options for replay attack prevention when two parties exchange UDP messages. No connection or session is estabilished. Communicating parties have pre shared key that is used for encryption (aes-256) and authentication (hmac-sha-256).

Communicating devices:

don't have real time clock. Real time can be obtained from NTP, (but what about NTP security?)
have permanent memory
UDP communication is the only option


texts: Why aren't zero-knowledge proofs used in practice for authentication?

texts:
I read on Wikipedia that zero-knowledge proofs are not used for authentication in practice. Instead (I think) the server is entrusted with seeing a password in plaintext form, which it should then add a salt to and hash. But for a split moment, the server knows the secret. Why should I implicitly trust the server like this? It could go rogue and record my password in plaintext form. I could use that same password for other sensitive things. Aren't zero-knowledge proofs a necessity? Why aren't they used? Or are they used?

Update, an alternative: What about never reusing your password and instead generating different passwords from a master password and website name using only a program that runs on the client? It seems much simpler, because you never reveal the master password. That way, you don't need to trust the website nearly as much.

This clarifies my previous question.


texts: Computing only one byte of a cryptographically secure hash function

texts:
Let $H$ be a cryptographically secure hash function, like SHA256. The output of $H$ is $N$ bytes long, with $N$ usually in the order of $32$ for commonly used hash functions.

Now, be $X$ a string, I can compute $Y = H(X)$, which is a sequence $Y_0, \ldots, Y_{N-1}$ of bytes. Now, I was wondering: is there any way to have some $H^{(i)}$ so that $\forall X,\; H^{(i)}(X) = H(X)_i$ (i.e., a function that extracts the $i$-th byte of $H(X)$) but so that computing $H^{(i)}$ is faster than computing $H$, then extracting the $i$-th byte?

In other words, if I want to just compute one byte of $H$, can I avoid carrying out some computations and save some CPU?

(I hope not. If not, is there a proof for this?)


texts:
I'm trying to understand the following text:

I'm having trouble understanding why $m$ and $m'$ both hash to $H_2$. I tried doing truth tables for $m_1'$ and $m_2'$ given the equations but I don't seem to be getting anywhere with them.

Is it also possible to justify that claim with high probability that $m \neq m'$?


texts: Zero-knowledge proof system which is not proof of knowledge?

texts:
I have learned that a zero-knowledge (ZK) proof system can be constructed by making use of the three-color problem. In this particular case, the proof system also happens to be proof of knowledge (POK), i.e. any prover necessarily needs to know a witness in order to convince the verifier.

Are there ZK proof systems which are not POK?


texts:
My question is How I will be able to count digital signature Scheme that can sign many documents with one private key. There are signature scheme as long as exists private keys in the keys spaces? or There are signature scheme as long as exists methods than RSA, DSA, ECDSA, Hash-Based signature schemes, etc? I am doing this question because I want understand

this paragraph of my lecture

  Hash-based digital signature schemes which are presented in this
  chapter oﬀer a very interesting alternative. Like any other digital
  signature scheme, hash-based digital signature schemes use a
  cryptographic hash function. Their security relies on the collision
  resistance of that hash function. In fact, we will present hash-based
  digital signature schemes that are secure if and only if the
  underlying hash function is collision resistant. The existence of
  collision resistant hash functions can be viewed as a minimum
  requirement for the existence of a digital signature scheme that can
  sign many documents with one private key. That signature scheme maps
  documents (arbitrarily long bit strings) to digital signatures (bit
  strings of ﬁxed length). This shows that digital signature algorithms
  are in fact hash functions. Those hash functions must be collision
  resistant: if it were possible to construct two documents with the
  same digital signature, the signature scheme could no longer be
  considered secure. This argument shows that there exist hash-based
  digital signature schemes as long as there exists any digital
  signature scheme that can sign multiple documents using one private
  key


texts: DGK Cryptosystem Key Generation and Decryption Issues

texts:
I detailed here the DGK (Ivan Damgård, Martin Geisler and Mikkel Krøigaard) cryptosystem, and I managed to get it to work, most of the time...

The BIG problem that I am facing at the moment is that the key generation algorithm sometimes produces bad keys. The paper states that:

we generate $h$ of order $v_p v_q$ modulo p and q
we generate $g$ of order $u v_pv_q$ modulo p and q

That sounds simple enough, right? But what does it mean? The naive approach (and I'm going to provide it only for $h$, since it works similarly for $g$) is this:

If $h \in \mathbb{Z}_n^*$ must have order $v_p v_q$, then the following conditions must be met:

$h^{v_p} \neq 1$
$h^{v_q} \neq 1$
$h^{v_p v_q} = 1$
Must ensure that $h \in \mathbb{Z}_n^* \Rightarrow gcd(h, n) = 1$
Also, we make sure that $h > 1$

Now, I have tested this approach and it seems to take quite a lot of time to produce a "good" value (perhaps I had an error in the code or I have no idea why it takes forever), so another approach would be to use the Chinese Remainder Theorem to obtain $h$ (and $g$):

Compute $h \in \mathbb{Z}_n^*$ of order $v_p v_q$ modulo p and q $\Rightarrow h = h_r^{p_r q_r u} \pmod n$, where $h_r$ is a random number in $\mathbb{Z}_n^*$ and $p_r$, $q_r$ are the random components of p and q. In order to obtain p and q, we choose 2 random primes, $v_p$ and $v_q$ and we compute $p = p_r u v_p + 1$ and $q = q_r u v_q + 1$, such that p and q are prime.
$n = p q$ and $\mathbb{Z}_n^* \simeq \mathbb{Z}_p^* \times \mathbb{Z}_q^*$
h represented in $\mathbb{Z}_p^* \times \mathbb{Z}_q^*$ is $(h_p, h_q)$
$h_r$ represented in $\mathbb{Z}_p^* \times \mathbb{Z}_q^*$ is $(h_{rp}, h_{rq})$
$h^{v_p v_q} \overset{\mathbb{Z}_p^* \times \mathbb{Z}_q^*}{\longleftrightarrow} (h_p^{v_p v_q}, h_q^{v_p v_q}) = ((h_{rp}^{p_r q_r u})^{v_p v_q}, (h_{rq}^{p_r q_r u})^{v_p v_q})$

$h_p^{p - 1} = 1 \pmod p$ and $h_q^{q - 1} = 1 \pmod q$
$p - 1 = p_r u v_p$ and $ q - 1 = q_r u v_q$

$(h_p^{v_p v_q}, h_q^{v_p v_q}) = (1^{q_r v_q}, 1^{p_r v_p}) \overset{\mathbb{Z}_n^*}{\longleftrightarrow} 1 \pmod n$

From the above math, it seems obvious that if I choose $h = h_r^{p_r q_r u} \pmod n$, where $h_r$ is a random number and I ensure that $h \in \mathbb{Z}_n^* \Rightarrow \gcd(h, n) = 1$ and $h > 1$, then I should get a "good" $h$ of order $v_p v_q$, but not of order $v_p$ or $v_q$ in $\mathbb{Z}_n^*$.

Unfortunately, for some reason, this does not work well. I often get $\gcd(p_r q_r u, n) \neq 1$, which means that no matter what is the value of $h_r$, $h_r^{p_r q_r u} \pmod n = 1$. Because of this, I added another condition while generating p and q: $\gcd(p_r, v_p) = 1$ and $\gcd(q_r, v_q) = 1$. Although it seems to avoid the above issue, I am unable to explain it. Also, now I've hit another issue: It looks like I sometimes end up with g of order $v_p$ in $\mathbb{Z}_p^*$, which messes up the decryption algorithm: $E(m,r)^{v_p} = (g^{v_p})^m\pmod p$

Does anybody have any idea how to fix his? I'm almost sure that I have to impose extra conditions while generating p and q, but I am unable to figure it out and it would really be great to understand what exactly is going on... Is there a cleaner way to generate numbers of a certain order modulo n?


texts: Schnorr proof of group with unknown order (but the prover know the order)

texts:
We assume that we have $n = pq$, where $p = 2p'+1$, $q = 2q'+1$, and all $p, q, p', q'$ are large primes. Pick $g' \gets_R Z_n^*$, and compute $g = (g')^2 \bmod n$. Then we have a generator $g$ for $QR_n$. The order of $g$ is $p'q'$.

Both prover and verifier are given $n$, $g$, and $h = g^x \bmod n$. The prover is given $p', q'$, and the witness $x$. Now the prover knows the order of $g$. Both parties start the Schnorr proof.

The prover picks $y \gets_R Z_{p'q'}$, computes $a = g^y \bmod n$, and sends $a$ to the verifier.
The verifier sends a random $e \gets_R \{1, \ldots, n/4\}$.
The prover sends $z = ex + y \bmod p'q'$ to the verifier.
The verifier accepts if $g^z \equiv h^ea \bmod n$.

It seems that this procedure works ok. But when I want to prove the special soundness and special HVZK, I was stuck.

For SHVZK, it seems that the simulator does not know $p'q'$, and thus it cannot perfectly simulate the interaction. A similar problem happens when I want to prove the special soundness. Given $z_1 = e_1 x + y$ and $z_2 = e_2 x + y$, I cannot compute the inverse of $e_1 -e_2$ to recover $x$ since I do not know $p'q'$.

I am wondering whether there is something wrong?


texts: Should you change salt when changing password?

texts:
Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt.  User ID, salt, and hash value are stored in  a table; if the table is compromised, all three values are available to an adversary.

Is there any value in computing a new salt when a user changes his password?

(I think this question only makes sense if the adversary has before and after copies of the password table, but I could be very wrong about that.)


texts: Why was Curve448 Selected for Standardzation but not Curve41417?

texts:
In 2014, Bernstein et al. published the Curve41417 paper, and in 2015, Mike Hamburg published Curve448. They are designed to solve the same problems that Curve25519 solved (e.g. using the Montgomery Ladder for robustness), but targeting more than ~200-bit of security as a stronger alternative, allowing it to be a P-384 replacement.
Eventually Curve448  "was favored by the Internet Research Task Force Crypto Forum Research Group (IRTF CFRG) for inclusion in Transport Layer Security (TLS) standards along with Curve25519", but not Curve41417, why? What are the reasons to prefer one over another?
In fact the Curve448 paper acknowledged Curve41417, and it has a section on performance comparison, but only with NIST curves, not Curve41417... The paper leaves the question unexplained. To me, both curves serve the same purpose and are similar in designs, the most presumable reason I can think of is that Curve448's arithmetic is slightly more efficient to allow a slightly larger field size, so it has a few bits of additional security than Curve41417.


texts:
I'm wondering if there is any library supporting pseudo-random function, so I can specify the key length and output domain.

Is it correct that I need to use a block cipher for this purpose?

Any help with this would be much appreciated.


texts: AES encryption time difference for same data

texts: When encrypting same data with AES, encryption time for the first encryption is longer than the second one.  In the same program, I have written encrypt() function twice and measure elapsed time. I don't know why?


texts: What is the most used Algorithm/Technique in Steganography? I made some research about the algorithm/technique and I think Least Significat Bit(LSB) is the most used algorithm, is there any more efficient algorithm/technique that can be use for Steganography aside from LSB?


texts: How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

texts:
The Digital Signature Algorithm (DSA) uses  $L$-bit prime $p$ and $N$-bit prime $q$  with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$).
In a way, the security of DSA relies on the hardness of the discrete logarithm on $\mathbb{Z}^*_q$ that is given by $ y = g^x  \bmod \mathbb{Z}^*_q$ to find the $x$. This explains the choice of the size of $q$ on the standards, due to the generic discrete log attacks that have cost $\mathcal{O}(\sqrt{q})$.
DSA uses $p$ as a huge prime compared to $q$, NIST SP 800-57 Part 1 Revision 5.

(L = 3072, N = 256),(L = 7680, N = 384), or (L = 15360, N = 512)

I've searched for the reason behind the large $p$, but couldn't find an explanation--neither the NIST documents nor the RFCs offer an explanation. I've only seen Poncho's answer.

Use the Number Field Sieve algorithm to attack the discrete log problem in $Z^∗/p$. NFS is typically seen as a way to attack the factorization problem; it can also be applied (with some additional complexity) to compute discrete logs.

How can the Number Field Sieve algorithm be used to attack the discrete logarithm in $\mathbb{Z}^*_p$ of DSA?


texts: Bad pseudo-random number generator -- any guesses?

texts: I'm trying to diagnose a badly-implemented pseudo-random number generator. The two key features of the bit streams produced by this PRNG are: significant correlation of consecutive bits (approximately 70% of 0's are followed by 0's, and similarly for 1's), and significant anti-correlation of bits that are 17 apart in the stream (correlation coefficient close to -0.6). Are there any obvious guesses for what might be going on here?


texts: A hash function that returns a value interpreted as integer

texts:
I am new in cryptography. I need to compute a hash of a string value represented as follows:
$name||i$ where $i$ is an integer.
I use the following pseudocode:
message = []byte(name||i)
hashize = 1536
// Using SHA256 full-domain-hash with 1536 bits
hashed = fdh.Sum(crypto.SHA256, hashize, message)
Print(hashed)

Here the hash is a vector of integer values. How can I have only one integer that represents the hash of the message?


texts: Salsa20 in Davies-Meyer mode with a fixed key (message): is it one-way?

texts:
Say I have a function that calculates a pseudo random permutation and this function is easy to invert.

For example $P(i) = AES_k(i)$ where $k$ is a publicly known key. So anyone can compute $P(i)$ and also get back $i$ if $P(i)$ is known.

Would the following function be hard to invert?

$$F(i) = P(i) \oplus i$$

I am trying to understand why the Salsa20 construction is secure and would like to know if any construction like this will be secure provided that $P(i)$ is a good pseudo random permutation, or if there is more to it.


texts: Signature security proof in the Random Oracle model

texts:
As a study case, I consider the BLS signature scheme, but the following question is relevant in the general context of security proofs in the Random Oracle model.

Let us briefly recall BLS signature scheme:

Let $e:G \times G \to G_t$ be a bilinear group scheme. Let $g$ be a generator of the group $G$, and let $a \in \mathbb{Z}^*_p$ be a random field element. We denote by $H$ a function that serves as a random oracle.

Keys: secret key is $a$, public key is $(g, g^a)$.
Sign: compute $m \mapsto (m, \sigma = H(m)^a)$.
Verify: check the equality $e(g, \sigma) = e(g^a, H(m))$.

The authors prove that this scheme is secure (or more specifically - secure against existential forgery under adaptive chosen message attack) by describing an algorithm $\mathcal{A}$ that given a forging entity $\mathcal{F}$ breaks computational Diffie-Hellman in $G$.

  The proof assumes that the algorithm $\mathcal{A}$ emulates the random oracle, meaning that every query by $\mathcal{F}$ to $H$ is actually answered by $\mathcal{A}$. My question is, isn't this a very, very strong assumption?

If instead we assume that the random oracle is some third party that both $\mathcal{A}$ and $\mathcal{F}$ can only query but not affect (like in every real-world use case) than this proof completely breaks.

Also, if we provide a security reduction without this strong assumption, our reduction might be far more efficient.


texts:
I have a problem with a task from my university.
We have two banks and these banks are sending data in ECB mode.

Plaintext and ciphertext look like this:

Plaintext: sender number | reciver number | amount

Ciphertext: block1+block2 | block3+block4 | block5+block6

A hacker made exactly 17 transfers to your account, every time with the same amount. After this he knows the ciphertext for his bank account number, and he can replace the receiver account number in all the transfers, but he still does not know a key.

The question is, why does he need exactly 17 transfers?

IMHO, he needs only two transfers if the key is the same all the time, but maybe I'm not seeing something important.

Could you help me with this? Because I don't know if I am wrong or my teacher is.


texts:
I am very new to cryptography. I was reading about GPG/PGP Basics when a doubt arose:

As per my understanding, everyone knows the algorithm (from GPG) with which I generated my key pair. If I show my public key, will it be impossible to trace back my private key? Even after knowing both algorithm and public key?


texts: Benefit of using random key in Shamir's Secret Sharing

texts:
I am implementing Shamir's Secret Sharing, and I find that in (t,n)-threshold scheme, the shares are just using 1,2,3...,n as the key to form the shares (i,f(i)).

For example, I want share "Hello", and the shares look like this:

01-AAAA1,AAAA2,AAAA3,AAAA4,AAAA5
02-BBBB1,BBBB2,BBBB3,BBBB4,BBBB5
03-CCCC1,CCCC2,CCCC3,CCCC4,CCCC5
04-DDDD1,DDDD2,DDDD3,DDDD4,DDDD5

where 01,02,03,04 are the keys and XXXX are the values.

But I find in some place, people are using random numbers as the key. And I want to further extend it by using different key for each character.

For example, the secret is still "Hello", but the share are become:

x1-AAAA1, x2-AAAA2, x3-AAAA3, x4-AAAA4, x5-AAAA5
y1-BBBB1, y2-BBBB2, y3-BBBB3, y4-BBBB4, y5-BBBB5
z1-CCCC1, z2-CCCC2, z3-CCCC3, z4-CCCC4, z5-CCCC5
u1-DDDD1, u2-DDDD2, u3-DDDD3, u4-DDDD4, u5-DDDD5

where x1,x2,x3,x4,x5 are random and distinct.

In this way the only disadvantage is that we need more store space for keys, and it may takes more time to generate random number.

But I wonder whether there is some advantages? Say, Safety issue?

I am new with computer security, hope to get answer. Thanks!


texts: When confusion is applied during encryption?

texts:
I know confusion is used in cryptography to make it more difficult to identify any
relationship between the ciphertext and the symmetric key. I want to know when the confusion is applied during encryption, for example:

Confusion applied on the symmetric key K1 to form the modified symmetric key K2, and then K2 is used in the encryption: enc(Plain_text,K2).
K1 is used in encryption: Cipher_text = enc(Plain_text,K1), and then a confusion function is applied on Cipher_text.

Is it one of these two methods, or something else? An example would be appreciated.


texts: Inner product with homomorphic encryption

texts:
I want to do a very simple thing: Given two vectors, I want to encrypt them and do some calculation, then decrypt the result and get the inner product between both vectors. I want to do this as fast as possible for the biggest vector dimension possible.

Can you recommend any reference which may help me understand things and how to do it?

Or maybe you can even point me to some library that can do this? I found HELIB, but I don´t know if that is the best solution for my purpose. Since I have only basic knowledge in cryptography, I´ld like use it as black box as much as possible without having to put too much effort in the math behind it.


texts: Is the following scheme secure for different cipher

texts:
Let's say I have

two keys K1 and K2.
two messages M1 and M2 of the same length.
Cipher (E,D)
3 ciphertexts: C11, C12,C22 where Cij = E(Ki, Mj)

In situation where attacker knows K2 and all the ciphertexts (which also gives him M2), can I choose a cipher to guarantee that attacker won't be able to compute neither the K1 key, nor first message.

I see three possible options:

Attacker won't be able to compute anything no matter what cipher was chosen [if cipher itself is "secure"].
Attacker will be able to compute either K1 or M1 for some ciphers.
Attacker will be able to compute either K1 or M1 for all ciphers.

Which one is correct?

P.S.: Saying "all ciphers" I mean "all more or less secure ciphers".

P.S. 2: I suspect that it is not the first option because at least for stream cipher attacker can easily compute the pseudorandom sequence for K1 if he knows M2 and C12. Then he will be able to decode C11 using this sequence. Is it true for other ciphers?


texts: Cardinality of the group of units in a cyclotomic ring?

texts:
In the NTRU key generation, one samples a polynomial from $K = (\mathbb Z/q\mathbb Z)[X]/(X^n+1)$ and tests if it is invertible. What are the chances of this to happen? In other words:

Let $q$ be a prime and $n>4$ be a power of $2$. What is the cardinality of $K^*$?


texts: Is it considered insecure in an HOTP implementation to publicly provide the next counter?

texts:
I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources.  I have found plenty of lightweight HMAC hashing libraries.  Therefore it seems to me that an HOTP authentication mechanism would be feasible on the limited resources of the microcontroller.

My concern however is with the authentication of multiple clients.  I know that ideally (or so I am told) in an HOTP implementation each client would have its own shared secret key with the server.  However I don't have the resources to have a database of shared secret keys on the microcontroller.

I was wondering if it would be OK to have all clients and the server share the same secret key and for the server to tell any client that requests it what the next expected counter would be.  This would be an unauthenticated request that would do nothing more than provide the expected counter.  The client could then issue an authenticated command with an HOTP code in it (using the provided counter) that would actually perform the desired action.

As per the RFC that defines HOTP each counter would only be accepted once even if the server gave the same counter to 2 clients, in this case the first one in wins and the second needs to get the next counter.

I know this isn't quite ideal, but it is the best implementation I can think of. Security is about balancing weakness with usability or in my case server constraints.  This is for a door unlocking mechanism for what its worth.  I think that my implementation would be at least as good as a typical physical key.

What are the security implications and trade offs here?  Is there a better implementation (HOTP or not) given the constraints of the inability for the server to maintain multiple keys?


texts:
Definition: Signature aggregation is taking $n$ signatures of $n$ distinct messages and aggregate them into one short signature that has the same length range as the rest of the signatures. The combined short signature, along with the original messages and public keys, should convince the verifier that each message was signed by the owner of the public key.

What schemes support signature aggregation?
Please provide a scheme name and known implementation if such exists.

I am only aware of BLS signature implemented in PBC


texts:
I found some errors in the RingCT 3.0 paper (https://eprint.iacr.org/2019/508.pdf) in the ring signature chapter.
This makes it impossible to implement this algorithm.

Namely:

In the chapter “C.2 Ring Signature with Logarithm Size”/”Challenge 2” was defined:
x = H5(v, w, y, z, T1, T2, m)
At that, the variable v is not defined anywhere else in the text.
In the chapter “C.2 Ring Signature with Logarithm Size”/”Challenge 1” was defined:
str′ = Y ||B||A|| S1||S2||U
At that, the variable U also is not defined anywhere else in the text.

Perhaps someone can clarify the situation.


texts: Given an elliptic curve, how do I calculate the order of the points manually, when we don't know about the curve's points?

texts:
So basically all I can do is

use Lagrange's Theorem and figure which factors of the group order are in line, then
start trying each of these using the Double-and-Add-Algorithm until I get $\mathcal{O}$?

This takes forever if I do it by hand. Is there any easier way to find the order of all points? or find all the points on the curve?


texts: What is Identity-Based Encryption (IBE) and why is it "better"?

texts:
Most CS/Math undergrads run into the well-known RSA cryptosystem at some point.  But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has excited much of the research community and produced a huge flood of follow-up work.

What is IBE exactly and in what way does it improve over conventional public-key systems like RSA?


texts: What would be the most effective way to brute force a 16 char AES key?

texts:
I have a file that is encrypted in AES using a 16 char string. The string is (a-zA-Z0-9) and .,?!. Also, it only contains words from a dictionary (but they can be lower/upper case). What would be the most effective way to brute force this?

(No, I'm not trying to brute force passwords. Who would store passwords in AES…)


texts: Related-key attacks against Salsa20 and ChaCha

texts:
From the Salsa20 security document, DJB states that he doesn't care about related key attacks:

The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are protocols that do not allow related-key attacks on the underlying primitives. I see no evidence that we can save time by violating this condition. The reader might guess that Salsa20 is highly resistant to related-key attacks; but I simply don't care.

Emphasis mine. The only related-key attack I know of is against Salsa20/7 and requires 2217 operations using 224 pairs of keystream blocks from two sets of keystream. I can't find any attacks on ChaCha. The linked paper cites a discussion from the eSTREAM forums which argues the attacks are irrelevant.
What is the state of Salsa20 and ChaCha security against related key attacks? What can be said about their design that would make them resistant to such attacks? How does ChaCha compare to Salsa20?


texts: Is it possible to use a XOF function as csrng?

texts: Let's say we "seed" a xof function (eg. SHAKE256) with x cryptographically random bytes (enough so that they can't be bruteforced), could said function be used as a cryptographically secure random generator? If so, when should the function be reseeded and start the process over?


texts: Proving CCA security for scheme constructed from secure PRP

texts:
We have a $PRP : \{0,1\}^{3n} \rightarrow \{0,1\}^{3n}$ and encryption scheme constructed from this $PRP$.

$E_k(x\|r\|0^n)$, where $r$ is randomly chosen from $\{0,1\}^n$ and $0^n$ is a block of zeros with length equal to $n$.

To decrypt $y \in \{0,1\}^{3n}$, we  compute $x\|r\|w = E_k^{-1}(y)$.

If $w \neq 0^n$ then output error. Otherwise, output $x$

I want to prove that this is CCA-secure (it's definitely secure, since it's a common CCA-secure scheme constructed from secure PRP). I understand the notion of CPA,CCA security and their respective game definitions. I know that for example if I manage to prove that it's IND-CPA and INT-CTXT secure, then it's also IND-CCA secure. However, is it INT-CTXT secure? My intuition is that it's not INT-CTXT, because we cannot check the authenticity (compare if the last block is all zeros) without decrypting.

I would say it's CPA-secure, because the encryption is not deterministic. However, there are schemes that are CPA-secure, but are not CCA-secure, like $E_k(r, f_k(x) \oplus r)$, where $r$ is random, and $f_k$ are PRFs. My other questions is whether a CPA-secure scheme is also IND-CPA secure.

I am struggling to find a formal proof of CCA-security, anyone willing to give me some hints or examples of other CCA-security proofs?


texts: Derivable encryption key - BIP0032 parallel

texts:
I wish to find an asymmetric encryption algorithm that supports key derivation, BIP0032 style.
Meaning that I have some SEED [PRIV] and I give someone some public data [PUB],
then given new public data X (serial number for example), I can generate a new private key and this someone may generate the corresponding public key.

It is important that given one (or more) of those private keys, you may not deduce the other private keys.

Do you know such a scheme?
Thanks!


texts:
One problem with Lamport OTS is that the attacker can repeatedly try random inputs and there is a chance that a hash of a random input will match one of a large set of public keys, reducing the security margin somewhat.

But suppose the public key for the ith bit is calculated as [ TRUNCATE-128(HMAC(S0,i||"0")) , TRUNC-128(HMAC-SHA256(S1,i||"1")) ].

The sender reveals S0 or S1.

Now the verifier expects not just any string that hashes to the given value, but is given a key Sx (either S0 or S1) and expects TRUNC-128(HMAC-SHA256(Sx,i||bitvalue)) to evaluate to the public key part for that bit value.

Now the attacker cannot simply generate random strings and have them match potentially multiple public keys.

Would this raise the security margin and allow use of 128-bit signatures for exactly 128-bit (classical) security?


texts:
I'm looking for the most efficient in memory and time way to verify integrity of  large files which have to be encrypted as well.

Using SHA256 and other crypto hashes over the whole encrypted file?
Split it into blocks and encrypt+hash each one separately?
Use authenticated encryption? Again, block-wise or as a whole? GCM or are there any better options today?
Something else?

Thanks!


texts:
The first part of the classical description of XEX is

$X = E_{k}(I) \otimes \alpha^j$

What I see a lot in sample code on the Internet is that you start with $T_ = E_{k}(I)$ and use that for the first block of the message. You then take $T$ and left shift it one bit. If the carry from that operation is a 1, then you XOR in 0x87 on the bottom byte. That becomes the pre- and post-crypto XOR material for the next block and so on.

This operation is exactly the same as the $K1$ and $K2$ derivation operations in CMAC. That's either an interesting coincidence or... well, I don't know.

Is that functionally correct?


texts:
I am trying to implement AES in C; I would like to make it resistant to side-channel attacks but I can't implement the multiplication in constant time. My current code:
static uint8_t GF28_Mult (uint8_t Poly0, uint8_t Poly1) {
    uint8_t Result = 0;

    for (uint8_t Shift = 0; Shift < 8; Shift++) {
        if (Poly1 & 0x01)
            Result ^= Poly0;

        if (Poly0 & 0x80)
            Poly0 = (Poly0 << 1) ^ 0x1b;
        else
            Poly0 <<= 1;

        Poly1 >>= 1;
    }

    return Result;
}

Is it actually necessary to have this in constant time if GF28_Inverse is in constant time?


texts: What is the recommended x length in the Diffie-Hellman algorithm?

texts:
According to RFC 3526 & RFC 2412, the prime and the generator are defined, but there is no recommended length for the parameters of random number $x$. What is the recommended length of random number $x$?

In my case, I set the length of $x$ at 160 bits with a 1024- & 2048-bit prime.

Is it safe?


texts: What is the run-time on finding collisions with MACs,...?

texts:
I've recently read the claim that finding collisions on block cipher may be not a difficult task, if an attacker can control the key and the message.

So, given a pseudo-random function $f:\{0,1\}^m \times \{0,1\}^{l_0} \times ... \times \{0,1\}^{l_k}\rightarrow \{0,1\}^n$, what is the expected run-time for finding a collision?

$f$ may be any MAC or anything similar.

For $m>n$ and without any other input the answer is trivially $\mathcal O(\sqrt{n})$ (standard hash function), but do the additional inputs change anything?

For blockciphers the case usually is trivial, as second pre-image security is easily broken. Given a pair $(M_1,K_1)$ one can compute $(D_{K_2}(E_{K_1}(M_1)),K_2)$ to trivially obtain a collision.


texts: Static salt for PBKDF2, but unique salt for HKDF?

texts:
Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-then-mac scheme using HKDF (unique salt per encryption).
The password would be shared by two individuals, who would then potentially share many messages. Each message would share the same master key, but would have unique encryption and MAC keys. Does this make sense, or is the unique salts in HKDF unnecessary?


texts:
I've been recently working on a (supposedly) TRNG. I'm still at the beginning of the project, so it is certainly not cryptographically secure yet, for now I'm just playing around.  In fact, I've already discussed the project and the chi square results here in question: Random number generator issue.

At this early stage I'm using ent to see if there is any gross issue, later I'll move to a more accurate test suite.

One of the ent measured parameters draw my attention: the chi-squared. After doing some research I've understood that this value basically says how much, in a set of values, their frequencies match with the theoretical expected frequency.
$$\chi^2=\sum_{i=1}^n\frac{(o_i-e_i)^2}{e_i}$$
where $o_i$ is the actual frequency and $e_i$ is the theoretical frequency.

And that's fine, but how do I understand which would be my optimal value?  For my particular case (values ranging from 0 to 255, uniform distribution) I'm using 254.3 as a reference "optimal value" from ent's manual. (I could be wrong on this, ent manual explicitly states only that for true randomness i should expect my percentage value to be between 10 and 90%, which is centered to 50%, which gives a value of 254.3)

Let's say everything is perfect, I'd have $o_i$ which is equal to  $e_i$, so the difference would be 0 for every $i$, they should add up to 0 and my optimal chi-squared would be 0.

But according to ent my optimal chi-squared is the above mentioned 254.3.

How I should calculate my optimal chi-squared for a different distribution (e.g. the normal distribution) or for a different range of values (e.g. 0 to 65535) ?


texts: Montgomery modular multiplication – confusion with subtraction of modulus

texts:
I'm reading the paper “COMPARISON OF SCALABLE MONTGOMERY MODULAR MULTIPLICATION IMPLEMENTATIONS EMBEDDED IN RECONFIGURABLE HARDWARE” (PDF) on hardware algorithms for montgomery multiplication for modular exponentiation, and I'm confused as to how the standard radix-2 montgomery mulitplication algorithm (R2MM), and the multiple-word radix-2 montgomery multiplication algorithm (MWR2MM) differ with regards to the final subtraction of the modulus.

The standard algorithm is as follows:

$\newcommand{\newkeyword}[2]{\newcommand{#1}{\mathrm{#2}}}%
\newkeyword{\for}{for}%
\newkeyword{\to}{to}%
\newkeyword{\loop}{loop}%
\newkeyword{\if}{if}%
\newkeyword{\then}{then}%
\newkeyword{\else}{else}%
\newkeyword{\end}{end}%
S_0 := 0\\
\for\ i:=0\ \to\ (m-1)\ \loop\\
\ \ \ \ q_i := (S_i + x_iY) \bmod 2\\
\ \ \ \ \if\ (q_i=1)\ \then\\
\ \ \ \ \ \ \ \ S_{i+1} := (S_i + x_iY + M)/2\\
\ \ \ \ \else\\
\ \ \ \ \ \ \ \ S_{i+1} := (S_i + x_iY)/2\\
\ \ \ \ \end\ \if\\
\end\ \for\\
\if\ (S_m \geq M)\ \then\\
\ \ \ \ S_m:=S_m-M\ \ \ \ \ \ \ \ \text{// the final correction step}\\
\end\ \if\\
Z:=S_m\\
$

where:

$\\S$ is the result
$M$ is the modulus
$Y$ is the multiplicand
$X$ is the multiplier and $x_i$ is the single bit (e.g. $X =

The MWR2MM_CSA algorithm is as follows

$
S = 0\\
\for\ i=0\  \to\ (m-1)\ \loop\\
\ \ \ \ (C,S^{(0)}) := x_i\cdot Y^{(0)}+S^{(0)}\\
\ \ \ \ \if\ S^{(0)}_{0} = 1\ \then\\
\ \ \ \ \ \ \ \ (C,S^{(0)}) := (C,S^{(0)}) + M^{(0)}\\
\ \ \ \ \ \ \ \ \for\ j = 1\ \to\ e-1\ \loop\\
\ \ \ \ \ \ \ \ \ \ \ \ (C,S^{(j)}) := C+ x_i \cdot Y^{(j)} + M^{(j)} + S^{(j)}\\
\ \ \ \ \ \ \ \ \ \ \ \ S^{(j-1)} := (S_0^{(j)},S^{(j-1)}_{w-1..1}) \\
\ \ \ \ \ \ \ \ \end\ \loop\\
\ \ \ \ \ \ \ \ S^{(e-1)} := (C,S^{(e-1)}_{w-1..1})\\
\ \ \ \ \else\\
\ \ \ \ \ \ \ \ \for\ j := 1\ \to\ e-1\ \loop\\
\ \ \ \ \ \ \ \ \ \ \ \ (C,S^{(j)}) := C+ x_i \cdot Y^{(j)} +  S^{(j)}\\
\ \ \ \ \ \ \ \ \ \ \ \ S^{(j-1)} := (S_0^{(j)},S^{(j-1)}_{w-1..1}) \\
\ \ \ \ \ \ \ \ \end\ \loop\\
\ \ \ \ \ \ \ \ S^{(e-1)} := (C,S^{(e-1)}_{w-1..1})\\
\ \ \ \ \end\ \if\\
\end\ \loop\\
$

where:

$\\S$ is the result
$M$ is the modulus
$Y$ is the multiplicand
$X$ is the multiplier and $x_i$ is the single bit (e.g. $X = (x_n,...,x_1,x_0)$.
The superscript are the words vectors (e.g. $M = (0,M^{e-1},...,M^1,M^0)$
$(A,B)$ is the concatenation of two bit vectors.
$m$ is the total bit-width of the operands (2048, in my case)
$w$ is the width of choosen words
$e$ is the number of words of bit-width $w$ required to complete the vectors ($e = \lceil(m+1)/w\rceil$

This result is only guaranteed to be in the range of $0<S<2M$, so there is the possibility of needing a final subtraction

The paper states that, in the standard algorithm,

  In typical applications (e.g. RSA, ECC), input operands X , Y are
  transformed into Montgomery domain by pre-multiplication with a factor
  $2^{2m}\bmod M$. The final MM with value ($A = \mathit{MM} (A, 1)$ in the
  exponentiation algorithm) makes the final result smaller than M
  (without any final correction) and provides the result $XY \bmod M$.

My questions are therefore:

If you don't subtract the modulus from R2MM result, then the results of both R2MM and MWR2MM should be identical, right?
If you premultiply both algorithms' input by  $2^{2m} \bmod M$, then the results should still be the same (no final subtraction needed) right?

I ask this because my results do not seem to support this, and I find myself needing to perform subtraction regardless of premultiplication.


texts: Why exactly is Blowfish faster than AES?

texts: I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES accelerators are not used) I'd like to know the exact reason behind it. Thanks.


texts:
Recently, I was given three ciphers to crack for my cryptography class. At this point, I have guessed that one of them is likely a Hill cipher (probably 3x3, as that is the most complex we have done so far).

I have made a fairly good guess of two options for the first seven characters in the cipher, but I found myself unable to figure out the key matrix. So far, I have $\bigl(\begin{smallmatrix}
a&b&c\\ d&e&f\\ g&h&i
\end{smallmatrix} \bigr)$ x $\bigl(\begin{smallmatrix}
14\\ 13\\ 0
\end{smallmatrix} \bigr)$ = $\bigl(\begin{smallmatrix}
10\\ 4\\ 12
\end{smallmatrix} \bigr)$, but since the matrix is modulo 26 there could technically be infinite values for variables a-i (for instance, $14a + 13b + 0c = 10$ could actually be 35, 60, etc.). Is there something that I'm missing?


texts:
Assume that sender and recipient both already have each others public keys(certificates). Sender needs to generate session key to encrypt some data and sends encrypted data to recipient. All offline - without interaction steps. But Sender must be authenticated. Could you advise well-known key management protocol to solve this problem?
I asked this question some times ago but it was deleted. Now I have found the exact answer and want to publish it.
Updated: I answered my own question but would be great if somebody comment or give alternative answer. I want to emphasize that protocol should be offline - interactive protocols like TLS doesn't fit.
If such offline protocol without TLS-like handshakes are not possible without additional threats/attacks (replay and others) - please specify most secure protocol and its threats that it has but TSL doesn't.
authentication of source is necessary. non repudiation is optional.


texts: Seekable cipher, is AES CTR a good solution?

texts:
I'd like to create a simple file-cipher, which provides seekable encryption (so I can decrypt any part of the encrypted message, without the need of decrypt from the start).

Here's my current idea: I generate a 128-bit IV, that will be the first 16 byte of the encrypted file. Then I use AES CTR, and encrypt the file. The initial counter value is IV, then I increment it for each 16-byte block.

The source file is chunk based: each chunk is followed by its SHA256. My need is to be able to read each whole chunk securely. After a chunk decrypted, its hash will be verified.

Is this method secure (suppose that counter values don't overlap)?

Is there a better (more secure) method to achieve this?

Note: I choose to use 128-bit IV, because of the comment of Ilmari Karonen here.


texts: Converting NewHope/LWE key exchange to a Diffe-Hellman-like algorithm

texts:
By a “Diffe-Hellman-like” algorithm, I mean one that has the same API as Curve25519, etc (disregarding trivial differences such as the size of parameters): a function

$$F: (P_\text{other}, S_\text{self}) \rightarrow \text{Shared secret}$$

where $S_\text{self}$ can be used arbitrarily many times with different values of $P_\text{other}$.


texts: AES Message Authentication Vulnerability

texts:
My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out.

  Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you know the pairs $(x_1,y_1)$ and $(x_2,y_2)$.  Without knowing $K$, how can you construct a new pair $(x_3,y_3)$ such that $y_3 = AES(K,x_3)$?

It seems like that shouldn't be possible.... right?


texts: Is the hash function $h(x\|y) = AES_x( y)$ collision resistant?

texts:
If $x$ and $y$ are both 128-bit strings would the function $h(x||y) = AES_x(y)$, where $x\|y$ means concatenation, be considered collision resistant ?

Is there an easy way to find $(x_1, y_1)$ and $(x_2, y_2)$ such that $h(x_1\|y_1) = h(x_2\|y_2)$ ?

I couldn't think of a way but since the hash function is un-keyed something tells me that there is a way to manipulate the key/string pairs?


texts: Inserting a backdoor into a cryptographic hash function

texts: I'm curious as to how a backdoor can be built into a hash function. What might it take the form of? What's probability of getting one that can be backdoored in a way that can actually undermine its security? Could this backdoor be asymmetric?


texts: What is used as a KEY and MESSAGE when using HMAC within a PBKDF2?

texts:
I was studying WPA2 and it's security when I came across this problem. I know that WPA2 uses PBKDF2 to generate a Pairwise Master Key. It does something like this;

DK = PBKDF2(prf=HMAC-SHA1, key=password, salt=ssid, DkLen=64, iterations=4096).

I get that. But what I don't is the PRF module itself. HMAC itself is h(k + h(k+m))
So, The rest of the part I get, but within the HMAC,

What goes in as the KEY and the MESSAGE?
Are both the same?
if not what are they?


texts: A zero knowledge protocol with a deterministic verifier

texts:
Given a language $L$ and $ZKP$ between $v$ and $p$, when $v$ is deterministic polynomial time algorithm,  I wish to obtain a probabilistic-polynomial algorithm which solves $L$. Which, if I am not mistaken, means that for any $x\notin L$ , the algorithm reject $x$ with probability $1$ and for every $x\in L$ the algorithm accept $x$ with probability grater than $\frac{1}{2}$ (by that one can run the algorithm few times to increase the acceptance probability for $x\in L$ ) .
Well, for the second part, when $x\in L$, it seems pretty straight forward since one can use the existence of the simulator and run $v$ on the simulator output, then $v$ accept $x$ with probability greater than $\frac{2}{3}$ since the simulator and $p$ are indistinguishable when $x\in L$. At this point, in case I understand it correctly, we didn't use $v$'s determinism.
I tried to obtain the first demand $P(\{x \notin L : v \text{ accept } x \}) = 0$ by $v$ determinism, however  I couldn't think of a way to do so. I tried to assume that $P(\{x \notin L : v \text{ accept } x \}) = p >0$ and obtain a contradiction to the protocol's soundness, i.e show a prover $p'$ which cause $v$ to accept $x\notin L$ with probability $> 1/3$, yet I didn't manage doing so.


texts: $G_f(x) = x \|f(x)$ is not a PRG with $\operatorname{DPT}$-computable function $f$

texts:
Let $f:\{0,1\}^* \rightarrow \{0,1\}$ be any $\operatorname{DPT}$-computable function.

Show that $G_f(x) = x \|f(x)$ is not a PRG.

Can anyone help me on understand how to prove this?


texts: Differenital and linear attack on specific vulnerabilities

texts:
Consider 128-bit cipher. It has one weakness. In every round you can find such even number $E$ which is encrypted into block that has $0$ as one of $1-128$ bits (lets say it has $0$ as $k$-th bit). And then you can find a numbers $E+2^{i} \cdot n$ $\mod 2^{128}$ which are encrypted into blocks that have $r$ consecutive zeros on $k$, $k+1$, $k+2$,... position, if number $2+2^{i} \cdot n$ is divisible by $2^{r}$.
Lets say $E=14$. It means that number $E+2^{1} \cdot 3$ will got $3$ zeros as $k$, $k+1$, $k+2$ bit (becasue $2+2^1 \cdot 3$ is divisible by $2^{3}$). And for example number $14+2^{1} \cdot (2^{127}-1)$ $\mod 2^{128}$ will got all zeros.
And you can find also odd number $F$ which is encrypted into block that has $1$ as one of $1-128$ bits (lets say it has $1$ as $k$-th bit). And then you can find a numbers $F+2^{i} \cdot n$ $\mod 2^{128}$ which are encrypted into blocks that have $r$ consecutive ones on $k$, $k+1$, $k+2$,... position, if number $2+2^{i} \cdot n$ is divided by $2^{r}$.
Let's assume that all other bits of encrypted blocks are indistinguishable from random. It make sense to attack this cipher using only that vulnerabilities. $k$ is secret (but it is only 7-bit number) and also $E$ and $F$ are secret (they are different in every round).
What is best differential attack on this? Can these weaknesses be vulnerable to linear cryptanalysis? I planned about $20$ rounds, but I don't know will it be enough. It is quite clear how to find differential if keys $k$ are equal to $1$ in every round. Then every even number will got $0$ as a first bit and every odd number will got $1$ as a first bit (we can make differential attack in this case). But $k$ can be every number from $1$ to $128$.
I can give you and example of such cipher. Let's consider $a_{1}$, $a_{2}$, ..., $a_{20}$, $s_{1}$,$s_{2}$,...,$s_{20}$ and $k_{1}$,$k_{2}$,...,$k_{20}$ as keys. In every round we compute:
$P_{1}$ --> $INPUT$ xor $s_{i}$
$P_{2}$ --> $P_{1} \cdot$ $a_{i} \mod 2^{128}$
$P_{3}$ --> move $P_{2}$ block by $k_{i}$ bits
I'm pretty sure that we can attack it somehow using such vulnerabilities, but I can't decide how serious the problem is and how many rounds the cipher should have.


texts: Can you have perfect secrecy with countable message/key spaces by dropping countable additivity?

texts:
This classic paper by Chor and Kushilevitz shows that if the key space and the message space are both countably infinite, then it is impossible to have a perfectly secure private-key encryption scheme.  Their proof relies on the fact there exists no uniform probability measure on the set of natural numbers, which in turn relies on the fact that probability measures are countably additive.
But there’s a generalized notion of measure that only requires finite additivity and not countable additivity.  In particular this paper talks about how the asymptotic density of a set of natural numbers constitutes a finitely additive probability measure that is “uniform” in the sense of translation invariance.
I’m wondering whether that could be used to recover some notion of perfect security.  So let the message space, key space, and ciphertext space all equal $\mathbb{N}$, let the family of measurable sets be the family $F$ of all subsets of $\mathbb{N}$ which have a well-defined asymptotic density, let the key be chosen using the asymptotic density measure, and let the adversary have some finitely additive probability measure $P$ over the message space.  Then my question is, does there exist an encryption scheme such that for all $X,Y\in F$ for which $P(C\in Y)\neq 0$, we have $P(M\in X | C\in Y) = P(M\in X)$? (Note that I’m using the same letter $P$ for bother he probability measure over the message space and the probability measure of the ciphertext.)
Of course dropping countable additivity may make this all unrealistic, but I’m just asking a theoretical question.


texts:
I'm looking at the AES-CMAC RFC and I found somehow counter-intuitive the way test vectors are used in the test code.
Let's look at the key K
K      2b7e1516 28aed2a6 abf71588 09cf4f3c
The least significant octet is 0x3c, right? If this is true, why it becomes key[15] and not key[0] in the test code?
 unsigned char key[16] = {
     0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
     0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
 };


texts: Why wouldn't you just refer to the hash of the jpg file in the NFT storage?

texts: This question is in reference to this tweet. It seems people are using the url of third party websites to record the reference to the content for NFTs. Why can't people just hash the jpg files for their artwork and store it in the smart contract? If someone else tries to duplicate it and create another smart contract with the same hash as storage, we can simply check ownership by checking the contract which was recorded first. Is there something incorrect/unsafe about this procedure?


texts: What cipher requires the full message to solve

texts: I am working on a scavenger hunt and wanted to encode a clue in a cipher that requires the full message to decipher. My goal in this is to prevent players from predicting the result before obtaining all the letters of the clue. If possible it would be nice if the cipher could be solved on paper but, beggars can't be choosers.


texts: Committing Bilinear equation in Groth-Sahai framework

texts:
Groth-Sahai framework enables us to commit to QE, MSME, PP equations. Now, is the equation below committable in GS framework?

A bilinear map $e: G_1 \times G_2 \rightarrow G_T$. $g_1 \in G_1$ and $g_2 \in G_2$ are the generators of the corresponding groups. $K \in G_1$ and $\tau \in G_T$ are constants. $x,y \in Z_p$ are variables to be committed. The equation is: $$e(K/g_1^x, g_2^y) = \tau$$I want to prove the knowledge of $x$ and $y$ without revealing the values. Note that groups have been written in multiplicative notations.


texts: Higher-Order Side Channel Security and Mask Refreshing: linear function?

texts:
I currently read about this paper:
https://eprint.iacr.org/2015/359.pdf

and I wanted to implement Algorithm 4 / Algorithm 5 on my own. There is one thing I cannot understand: where does function g come from (used in Algorithm 4)? It is said to be a $\mathbb{F}_2$-linear function.

Any ideas?


texts:
In the Coursera crypto course, Dan Boneh states that if $F: K \times X \to Y$ is a PRF, if the size of the input space $X$ is $2^{128}$, and the size of the output space $Y$ is also $2^{128}$, then there are $(2^{128})^{(2^{128})}$ different functions that map the set $X$ to the set $Y$.

I guess that's because we can see this as a sampling with replacement : for each element in $X$ we pick a random element in $Y$, and replace the element in $Y$ before picking again. Once we're done, that make a random mapping from $X$ to $Y$, and so there are $(2^{128})^{(2^{128})}$ possible mappings.

What about PRPs? Because in a PRP the mapping functions must be invertible, can we see them as a sampling without replacement? And so, the number of possible functions from $X$ to $Y$ for a PRP should be $(2^{128})!$, is that right?


texts: How to solve polynomial modular equation to create a correct decryption algorithm

texts:
I recently had a variant of the following problem in my cryptography course and I had trouble solving it and was looking to get some help.

Given the symmetric key cryptosystem: $\text{KG, Enc, Dec}$ where $\text{KG}$ is a key generator that produces a random key in the space $Z_n = \{1, 2, 3, \ldots, n-1\}$, $m$ is a message from the space $Z_n$, and $\text{Enc}(K, m)$ is an encryption algorithm which computes ciphertext $c = (5m - 4k + 3) \bmod n$, design a decryption algorithm $\text{Dec}(K, c)$ such that it fulfills decryption correctness.

At first, I just tried solving for $c$ in $c = 5m - 4k + 3$, but realized that it does not account for $\bmod n$. Then it tried the following solution:

$$
\text{let} (d, x, y) = \text{extGCD}(c, n), m = (c\times x+4k-3)/5
$$

Where $\text{extGCD}$ is the Euclidian extended GCD function (essentially finding the modular inverse). That did not work either.

How would one go about solving this problem? What am I missing (so I can look into it further)?


texts: Can I encrypt a message by swapping bits in the text?

texts:
I have tried out an encryption method, in which I swap bits in the text.
The text length is N bit, then I generate several random number pairs in the range 0..N-1, as [n,k] pairs. After that, I swap the n-th and k-th bits in the message, if they are different, of course. After several swaps the message becomes unreadable.
The message can be decrypted by applying the swaps in the reverse order.
Can this be a good encryption method or is it equivalent to the usual XOR cipher, or even weaker?
For example, I can generate the random number pairs with a pseudo-random number generator, with a starting seed. And the seed can be obtained from a passphrase, for example, an integer hash of the passphrase. Then I can use the passphrase to encrypt the message this way, and the same passphrase for decrypting, as the random number pairs will be the same again, due to the same seed applied at the start.


texts: Three-way key exchange with elliptic curves without pairing

texts:
Assume that there are three users, each with their own secret key $d_i$ and the corresponding public key $Q_i = d_i \cdot P$, such that $Q_i$ is a point on an elliptic curve and $P$ is a base point on this elliptic curve.

Is $d_1 \cdot Q_2 \cdot Q_3$ equal to $d_2 \cdot Q_1 \cdot Q_3$ or $d_3 \cdot Q_1 \cdot Q_2$?

How can three users compute a shared key without knowing $d_1 \cdot Q_2$, $d_2 \cdot Q_1$, $d_3 \cdot Q_1$, $d_3 \cdot Q_2$, $d_2 \cdot Q_3$ and $d_1 \cdot Q_3$? The only things that each user knows are his own secret key $d_i$ and other users' public key $Q_1, Q_2, Q_3$. Can this be done without pairing?


texts: Security of Full Domain Hash (or not quite full)

texts:
Full Domain Hash is the simplest signature scheme based on a trapdoor permutation (such as textbook RSA) that enjoys a strict security reduction. It was introduced by Mihir Bellare and Phillip Rogaway: The Exact Security of Digital Signatures - How to Sign with RSA and Rabin (in proceedings of EuroCrypt 1996).
Bellare and Rogaway's security bound was improved by Jean-Sébastien Coron: On the Exact Security of Full Domain Hash (in proceedings of Crypto 2000) and Optimal Security Proofs for PSS and Other Signature Schemes (in proceedings of EuroCrypt 2002).
I first ask a didactic exposition of the security proof of FDH. Preferably, the improved one.
If possible: does that allow to quantify the security loss when the hash is not quite full-domain, but rather is uniformly distributed on a proportion $\alpha\in(0,1)$ of the RSA domain? E.g. if the hash is uniformly distributed on $h\lesssim\log_2N$ bits, we have $\alpha=2^h/N$ .


texts: Understanding an encryption technique algorithm

texts:
I have trouble understanding steps for Key set generation mentioned in an article titled as "An optimized encryption technique using an arbitrary matrix with probabilistic encryption". The steps are:

Consider the sequence for 0 to n-1 values for a source text of size n = pow (p, p) characters.
Convert each element of the sequence into a form with base p.
Represent the values of step 2 in a matrix form A of order n x p.
Subtract 1 from each element of A.
Consider a random matrix B of size p x p.
Multiply the matrix A with B to generate a result matrix R.
Substitute all positive integers of R with +1, negative integers to -1 and zero by 0 using a substitute function.
Increment each element of R by 1.
Convert each row of R, from the base p to decimal to generate the key sequence set.

I can't understand how this works. Can you explain these steps with an example? Or pseudocode?


texts: Can I use PBKDF2 for authentication and decryption?

texts:
I want to store a hash for authenticating a password.  I also want to use the same password for decryption.  Can I use PBKDF2 for both?  (I plan to use different salts for the authentication and the decryption, of course, because otherwise the authentication result would be the decryption key!)

Is that appropriate/secure?


texts: Is XTS basically the cheapest form of (secure) double-encryption?

texts:
XTS, as given by the below equation, is a mode of operation primarily targeting full-disk encryption scenarios.

By the way it works it also doubles the keylength although a meet-in-the-middle attack applies (by enumerating all the whitening values). However one only needs to calculate the whitening value once per sector.

So is there any way to break XTS or a double application thereof in less time and/or space than expected?

The expected time for standard XTS is time $2^{512}$ for 256-bit AES and $2^{513}$ time and $2^{512}$ space for double encryption.

Relation to the title:
XTS is the most well-known / used scheme for turning a 256-bit cipher into a 512-bit mode. It does this in such a way that each block requires merely one finite field multiplication and one encryption operation and every few blocks (e.g. 32+) require one additional encryption operation which means it should be a very "cheap" way of doing double encryption. So the question: Is this as good as it sounds?

The equation as documented by VeraCrypt:

$$C_1=E_{K_1}(P_1\oplus(E_{K_2}(n)\otimes\alpha^i))\oplus(E_{K_2}(n)\otimes\alpha^i)$$

with $C_1$ being the ciphertext, $P_1$ being the plaintext, $K_1$ and $K_2$ being the keys, $n$ being the sector index, $i$ being the block index within the sector, $\oplus$ denoting bitwise XOR, $\otimes$ denoting multiplication in the binary Field $GF(2)\bmod x^{128}+x^7+x^2+x+1$ and $(E_{K_2}(n)\otimes\alpha^i)$ being called "the whitening value".

Justification of the expected time / space values:
Single Encryption case:
This is essentially "single-key" XEX, providing 256-bit security combined with a 256-bit keyed permutation, one needs $2^{512}$ to find the correct whitening key and the correct permutation.
Double Encryption case:
Standard meet-in-the-middle attack: Enumerate all the possible intermediate values ($2^{512}$ time and space) and then try decrypting all the ciphertexts with all possible keys, looking for intermediate matches.


texts: WEP: Why is the challenge string randomized?

texts: In WEP, the 128-bit challenge string generated by an access point would allow for approximately 340 undecillion unique strings. Would it be problematic were a string to be reused? I suppose with $2^{128}$ possible strings it would take a very long time for an access point, with an average amount of associations, to every repeat a challenge. I don't understand why the challenge must be randomized. If it is only used to authentic a client with a legitimate WEP key, then why couldn't the same challenge string be reused for every authentication attempt? Even if an eavesdropper stored all of them in order to reuse them to gain access to an access point, wouldn't it be easier to intercept a single challenge and response and just use XOR to gain access without the WEP key.


texts: Security of simple xor and s-box cipher?

texts:
What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode?

A cipher's internal primitive might be a simple as this:

$C = S[M \oplus k]$, where $C$ is ciphertext, $M$ is the plaintext message, $k$ is the key and $S$ is an S-box.

Assume the follwoing:

The key $k$ is sufficiently large and is random.
The initialization vector used by CBC is random.
The block size is reasonable, e.g. 128 or 256 bits.
The S-box is chosen such that correlation bias between $S[x]$ and $x$ is low.
The S-box is chosen such that $S[a]$ and $S[b]$ are independant for any random $a$ and $b$.

EDIT: Completely re-written to be more general, removing all specific implementation details.

Here's the original custom scheme, which was considered too broad to be a valid question:

$k$ is a 256-bit key, $S$ is a 16-bit S-box that has some set properties.

The cipher operates in CBC mode (as you'll see in the second step), has a block size of 256 bits, and operates as follows for a total of 16 rounds:

$k_r = rot(k, r)$, where $k$ is the key, $r$ is the round number and $rot()$ is a circular shift operation.
$C_n = S[M_n \oplus k_r] \oplus C_{n-1}$ where $n$ is the block number (assume $C_{-1}$ is the IV)
Select $a = 3(r+n) \space mod\space 256$
Select $b = (k_r \space\& \space 255) \space mod\space 256$
Swap the bits $C_n[a]$ and $C_n[b]$
$C_n = S[C_n]$


texts: Finding the subgroup in isogeny-based cryptography

texts:
Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem:

  Elliptic curves are isogenous over $F_p$ if and only if they have equal
  number of points.

Recently, isogeny based public key methods are widely used in articles.  This methods are implemented in computer systems in milliseconds and in android systems in seconds. This show that in future we can use such post-quantum cryptographic systems in practical world.

I studied many articles about this method, and I saw only mathematical methods, not practical methods or source code. In program such as the MAGMA we can find all isogenous curves with given curves defined over rational field, but I looking for finite field. Also in sage we can find $l$-isogeny with subgroup of order $l$, but in several time our defined curve have not any subgroup with order $l$.

This is one of interesting article. In this article we have some computational example (page $15$). Can you help me fo understand this example. When I send mail to its authors I face with mail error.

How can we find cyclic subgroup of order $l$ of the elliptic curve $E(\overline{\mathbf F_p})$, over the algebraic closure of the finite field?


texts: Read/Write speed of encrypted sparsebundle

texts:
I'm in way over my head with even being on this website, let alone attempting to ask a question… but here's an attempt.

Basically, I want to have a password-protected folder on my Mac which is resizable as needed (sparsebundle seems to be best).  It's recommended by Disk Utility to go with 128-bit AES because 256 is "slower".

This got me thinking, how slow is 128?  Is this just while it's initially encrypting?  If so, I don't mind.  The problem is, I'll be storing session files for use with music software in this folder, which means constant reading and writing of files as I work.

Will the encryption slow me down?  I'm hoping that once I put my password in and "open it up", it "stays open" and read/write speeds are as if it isn't even encrypted, but I suspect this isn't the case.  I also don't want to create a speed bottleneck that renders my internal SSDs pointless.  Thanks so much for any thoughts on this situation, much appreciated.


texts: Efficient receiver determination of public posted cipher

texts:
Assume there is a global message board, that people use to send messages to other people. Of course no one else but the receiver should know the content of the message, so senders use asymmetric cryptography to encrypt the message for the receiver.

To determine if a message on the board was meant for me, I could try to decrypt all ciphers on the board and see which message makes sense. Maybe there is a phrase, that is commonly used by everyone, that is also separately encrypted and then I can decrypt all those fields and see if I recognise the phrase.
Of course I could also add the receivers public key in plain text to the message, but then everyone would know who the message is dedicated to (without knowing the content), which shouldn't be possible.

In the worst case I need to decrypt all messages on the board to find the one dedicated to me, which is not very efficient.

Is there a better way that allows me to add a "sign" for the receiver that only the receiver can recognise?

I'm sorry if this is a common and known problem, but after some research I didn't came up with the commonly used terms for the problem, if this problem has a name.

Edit: Pre-shared information between the receiver and the sender is not possible, because the receiver doesn't know, they will receive something.


texts: SIKE involves a Diffie-Hellman like construction using isogenies between elliptic curves. Is it possible to express it as an instance of Diffie-Hellman? I.e. what is the underlying group if so, and further, why wouldn't Shor's algorithm apply and render it vulnerable?


texts:
I would like to implement a protocol using elliptic curves. I'm thinking of using MIRACL so using curves in their Weierstrass form is preferable as it they are supported by this framework.

I don't want to start picking random curves, so I am looking at the available safe curves. None of the curves is in Weierstrass form however. Do you have any suggestions for such curves? Even curves with low security, such as 80 bit curves are welcome.


texts: How to prove that a committed value is the square of other

texts: Given two Pedersen commitments $c_1=g^vh^{r_1}$ and $c_2=g^{(v^2)}h^{r_2}$, where the committed value in $c_2$ is the square of the committed value in $c_1$, is there a way to prove this relation in zero knowledge?


texts: Is this a better involution S-Box for the Anubis cipher?


texts: What is Homomorphic encryption evaluation key

texts:
In some homomorphic encryption schemes (e.g Multi-key fully homomorphic encryption report, Computing Blindfolded: New Developments in
Fully Homomorphic Encryption), it defines an encryption key, a decryption key, and an evaluation key to perform an evaluation f on the encrypted data. Could you please explain what is the difference between the evaluation key and the other keys?


texts:
Sha1/0 (160 bits output), md5(128 bits output) has block size of 512 bits.
Gost has 256 bits.

What is the reason behind having it specifically  512/256/1024 bits?

What are the various factors which are considered while choosing a specific block size for an algorithm ?

Sorry for the naive question !! :-)


texts: What is the inverse function of the finite field GF($2^3$) and GF($2^4$)?

texts:
I am currently reading a paper Cryptanalysis of a Theorem Decomposing the Only Known Solution to the Big APN Problem. In this paper, they mention that they used $I$ which is the inverse of the finite field GF($2^3$) with the irreducible polynomial $x^3 + x + 1$. This inverse corresponds to the monomial $x \mapsto x^6$. Can anyone tell me how this inverse function of the finite field was defined? I understand that there are multiplicative inverses of elements in the finite fields. Are these two the same thing?

How can the inverse function of the finite field GF($2^4$) be derived?


texts: ANSI X9.31 AES pseudocode or algorithm explanation

texts:
I want to write a program that will generate random data by using ANSI X9.31 with AES 128 bit, however I could find the standart only with cryptographic notation, and I did not understand it clearly.

I = ede *K(DT)
R = ede *K(I XOR V)
V = ede*K(R Xor I)

Could you explain me how the algorithms works or suggest me any document to understand it, I tried to understand from the notation but I could not. Thank you in advanced.


texts: Why are there $2^{56}$ possible DES keys when there are 64 key bits?

texts:
On forums I read DES has $2^{56}$ possible keys so it takes x times to brute force it with hardware x.
But there are 64 total bits of which are 8 parity bits.
But those parity bits are a 1 or 0, right?
So since you still have to calculate the parity bits and since they aren't always the same bit, doesn't this mean that you have $2^{64}$ possible DES keys?


texts: Is Pohlig-Hellman Cipher the only option?

texts:
I am looking for a cipher which would allow something like this: E(E(M, a), b) = E(M, ab), where a and b are encryption keys, and ab is a combination of the keys that is impractical to separate into a and b.

So far, the only cipher I could find that would work like this is Pohlig-Hellman Exponentiation Cipher. But as I understand, it has the following drawbacks:

It is slow - though, this is not really a concern for me
I can't find any actual implementations of the cipher. It shouldn't be too difficult to implement from scratch, but still...

Is there another cipher that can accomplish the same thing?


texts: Are covert and rational adversaries same?

texts:
Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar adversaries and called it rational adversaries who act "rationally". I have not seen a simulation-based definition of rational adversaries.

So, in essence, are covert and rational adversaries same? Can they be used interchangeably?


texts: FileVault AES-XTS decryption with cipher text that's missing a part

texts:
My mac was recently upgraded to OS X Yosemite and FileVault2 full disk encryption was turned on. Encryption finished, but things went horribly wrong and key parts of the disk are filled with all 0s (it's a 512GB SSD).

By reading Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption I was able to find the EncryptedRoot.plist.wipekey file. This is an Xml document that's encrypted using AES-XTS with a 128-bit key and all 0s for the tweak key. The entire file is treated as a single block.

On my machine's disk, the entire cipher text is 1888 512 byte blocks. In the middle of the file, 256 blocks (128K) are all set to 0.

Using libfvde, I'm able to decrypt up until the bad blocks, but no further.

Is there any way to alter the cipher text, or alter the AES-XTS decryption to recover the portion of the file after the bad blocks? From what I can tell - block cipher - the rest of the file is gone forever unless I can find my missing 128K.

I can post the cipher text (it's 970K total with 128K of 0s) and the decryption key if it would help evaluate whether more information can be extracted.


texts: Proof that a function constructed from a PRP is, or is not a PRF?

texts:
Let $E$ be a family of Pseudo-Random Permutations of $b$ bits, with $E_K$ indistinguishable from random permutation with effort less than $O(2^b)$, easily computable as well as the inverse permutation, e.g. as instantiated by AES-192 for $b=128$. Let $E_A$ and $E_B$ be two public members of this family.

For an $E_K$ in $E$, let $F_K$ and $G_K$ be the functions
$$F_K:x\mapsto F_K(x)=E_K(E_A(x))\oplus E_K(E_B(x))$$
$$G_K:x\mapsto G_K(x)=E_K(E_A(x)\lor1)\oplus E_K(E_B(x)\land\overline{1})$$
where $\lor1$ (resp. $\land\overline{1}$) sets (respectively clears) the rightmost bit, and $\oplus$ is exclusive-OR.

Question: Are $F$ and $G$ families of Pseudo-Random Functions indistinguishable from random function with effort less than $O(2^b)$ ?

Note: formerly, I thought of an attack on $F$ by considering a cycle in $x\mapsto E^{-1}_B(E_A(x))$; but thinking about it, that attack is $O(2^b)$.


texts:
I have a question that I have not found the answers to in many books.

Does the expansion permutation have to map values to the same space?
For example, in DES, 32 bits are expanded into 48 bits via an expansion permutation where the values are shuffled around but do not change.

Consider the following expansion function for 4 bits into 6 bits

$e[{a_0}{a_1}{a_2}{a_3}]={a_0}{a_0}{a_1}{a_2}{a_3}{a_3}$

Is this a legal permutation? or is it not cause it can map to new values in which we didn't posses before, for example 1001 can be mapped into a new value 110011 that didn't exist before.

I understand the encryption would encrypt regardless, but is using that permutation allows for us to reverse the encryption by running the keys in reverse?


texts:
This is a theoretical question, to improve my understanding of hash functions. Hash functions have a one-wayness such that they are protected from the first preimage attack. From my understanding, if $H(X)=Y$, knowing $Y$, I should not be able to know $X$ is the fundamental behind the first preimage attack.

The question: Does the security of a hash function from the preimage attack also depend on the secrecy of the length of $X$?

If the adversary knows the length of $X$, then it can easily brute force $X$ for smaller lengths of $X$. I understand that smaller length of $X$ will get appended and pre-processed into larger blocks but that does not stop the adversary from brute-forcing since there are no secrets in the pre-processing.


texts: Negating the risk of a random 64-bit nonce

texts:
Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be disastrous). In environments where using a simple counter is not an option, consider the following construction:

staticKey: 256 bit cryptographically secure pseudorandom key
perEncryptionSalt: 128 bit random salt
perEncryptionKey: HKDF(staticKey, perEncryptionSalt, info)
perEncryptionNonce: 64 bit random nonce

Ciphertext = chacha20(clearText, perEncryptionKey, perEncryptionNonce)

The salt and nonce would be appended to the ciphertext and included in the mac. Given that the key changes with each encryption (and thus would unlikely ever be used in combination with the same nonce), is this construction safe? I'm aware of XChacha20/XSalsa20 and they already solve this problem, but I'm curious nonetheless.


texts: Direct Anonymous Attestation to replace CA

texts: In term of authentication, I have the impression that to trust an entity it is mandatory to have a Certification Authority involve. Today I stumble upon an article something called Direct Anonymous Attestation is possible to get rid of CA. How is that possible when a verifier holds no information nor a trusted party to crosscheck with and yet able to trust an entity. I am not a math genius, can anyone explain how Direct Anonymous Attestation work in layman terms?


texts: Encrypting a short phrase into two keys. both with length of 32letters

texts:
It doesn't need to be crazy secure. I wanted to figure out if there's a popular practice when encrypting a short phrase (less than 32 letter long) into two keys (two strings 32 length). Doesn't need to be complicated. It's for a hobby project.

For example:

Key 1: JFHEL1J2J1KD1FK4J4K3LA5D7EKSJX323
Key 2: 1HFK6SJDHG2JEK3DHG5NRJG9HE5K3GJEH
Combined result: Hello World!

So in other words, if two keys get combined, it reveals a sentence. I suppose a simple mod/hash could work, but do you guys know of anything fancy?


texts:
If I want to have a secret conversation, then I can encrypt it (with OTR etc). However, since big brother watches all communication, sending encrypted data will likely raise flags. Does anyone know of an algorithm to take ciphertext and convert it into harmless looking plaintext?

For example, I could take each group of three hex digits, like "3E8" and convert it to an english word, like "peanut". So "2E8A983F7E100B6CE1" gets converted to "fork would said free dish quark". But I think that would still be pretty easy for big brother to detect.

Anyone know of a good algorithm for this? Anyone seen any research on it?

EDIT: Imagine two people want to communicate securely over a channel, but the channel only allows plaintext. If the channel doesn't understand the message, it will block it. So they have to find a way send a strong encrypted message that looks like plaintext.


texts: Correlation power analysis attack on Camellia

texts:
I'm investigating a correlation power analysis on a black-box ASIC I have.
I want to learn about correlation analysis and it seems this ASIC implements Camellia.

I searched for researches that did CPA on Camellia but it seems no-body did it.

I have 2 questions.
1. why ? is this algorithm resilient to CPA ? if it is then why ?
2. If it does not, which correlation should I search for ? this algorithm is not intuitive like AES ... and also I dont really know that this is camellia. only that this is not AES :)

Also,
I assume Camellia since I saw 18 repetitive struct ... maybe 18 rounds ?


texts: Semantic security and indistinguishability

texts:
I have two frames f1 and f2 that are each composed of several elements noted e. Note that, an element can fall into one of those two categories: an identifier or a counter.

What I want is to find a property that verifies indistinguishability of elements between frames. For instance, given the element e as an identifier, if f1.e==f2.e the property is not verified while it is verified if f1.e!=f2.e.

For now, I only suppose that such a property includes probabilities and can be obtained via:

semantically secure block cipher for identifier elements;
PRNG for counter elements.


texts: Maybe Interactive, Not Zero-Knowledge, Arguments of Knowledge

texts:
zkSNARK is a technique composed with the following features:

zk: zero-knowledge
S: Succinct
N: Non-interactive
ARK: ARgument of Knowledge

Everywhere I look on the web for material on cryptographic arguments of knowledge I find techniques that mush these four features together. I am only interested in feature 4, that is a technique with no conditions on features 1, 2, or 3, for Alice to prove to Bob that she correctly performed a computation without Bob needing to perform the computation. Could I find literature under a more commonly used name for this technique than 'argument of knowledge'? Can you please point me to some literature on this technique?

I am curious which of the 4 features are at the core of the research in this area. Is it feature 1 that makes these cryptographic techniques so hard? or features 2 or 3? If the difficulty of current research is in solving a combination of features 1, 2, and 3, then shouldn't there exist simpler, more successful techniques that only need to solve feature 4? If so, I'd like to learn about these techniques. Ideally I'd get a response like "sure, if you don't need features 1, 2, or 3, simply ...".


texts: Modelling broadcast functionality in Universally Composable Framework

texts:
I'm studying the UC framework by Canetti. While I understand the basic idea, there are still a lot of details that I need to work through.

One thing that's puzzling me is how to achieve concurrency under the UC execution mode. For example, in many distributed algorithms, a machine may broadcast a message and then every receiver may do some computation on the message. The result of the computation may be broadcasted again.

The paper says

  In order to simplify the process of determining the next ITI to be activated, we allow an ITI to execute at most a single external-write instruction per activation.

In that case, how does one capture a broadcast functionality, both as an ideal functionality as well as a real protocol?


texts: Does there exist equivalent hash function?

texts: Is it possible to find equivalent hash function? Under equivalent, i assume same input produce same output, but they have different initial integer values and/or different set of bitwise operators. Or in other words, does there exist another algorithm of hash function, but having same input->output mapping. If exist, how to find or construct such algorithm, if not exist, do we have some proof of it? For example, we have different search algorithms, they have same input->output mapping, but different properties, for example complexity. Does this analogy work for hash function?


texts: Tree hash and multithreading for parallelism

texts:
I am using tree hash mode of Skein on a 16 core processor. Will it automatically employ parallelism using more than one cores or do I have to use multi-threading within the tree hash for parallel processing?

Also, the tree hash mode requires three parameters: leaf size encoding, fan-out encoding and tree height. Except for the last one, I am confused about the other two parameters, what are they exactly?


texts: Using ChaCha20 on very short messages with high packet loss

texts:
I'm building a low power wireless network and need to transmit very small packets at regular intervals (10 bytes every minute or so). In order to secure the communications I'm considering using Chacha20 and a pre-shared key.

The problem I have is communicating the IV. I could just broadcast it at the start of each message, but that results in almost doubling the message length and therefor the power usage during transmission.

I considered agreeing upon a method of calculating the IV (i.e. using the transmitter address as a nonce and a simple transmitted packet counter) but this gets risky if messages are dropped for any reason.

Before I go down the path of defining an ad hoc method of solving this issue I thought I'd ask and see if anyone has solved it previously and what recommendations you all had.

My fall back method is to use the address to generate a nonce, then use a packet counter and transmit only the lowest order byte. This adds only a single byte to the message length and allows me to theoretically miss 255 messages and still 'resync' packet counters. Not as robust as I'd like but better than anything else I've come up with myself.


texts: Difference between DCnet and mixnet in terms of forwarding anonymity?

texts:
It seems that with both anonymous communication protocols we can achieve some level of forwarding anonymity, however, is one protocol better than the other in this respect? It seems that they both offer the same level of anonymity with different drawbacks:

Mixnets are vulnerable to replay attacks which can allow attackers to trace the origin of messages, potentially breaking key encryption schemes, or compromise the mix server.
DC-nets seem to be more robust since they aren't affected by the same attacks as mixnets, but they are more vulnerable to attackers attempting to cause intentional collisions.

It seems that dc-nets achieve better forward anonymity at the expense of potential collisions and computational expensive messages since they have to be XORed by every node in the system. Is this a good assumption or am I missing some key info?


texts: RSA Timing Attack on "Extra" Montgomery Reduction

texts:
In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. After implementing a toy example of this attack, I thought I understood it. I created two sets of messages, one set containing messages $m$ where $m^3$ did not require an extra reduction ($M1$) and another set where $m^3$ did require an extra reduction ($M2$). I then augmented a square-and-multiply algorithm to take advantage of Montgomery multiplication while tracking the number of extra reductions that took place over the course of the exponentiation.

This quick experiment did appear to show that the set in which $m^3$ did not require an extra reduction ($M1$) on average would have less extra reductions than the other set. However, the difference in the two averages would be much larger than one. Most of the paper seems to suggest the timing attack they exploited relied on the timing difference a single extra reduction (e.g. section 7.1).

I believe I see an attack here, but its not the exact situation that the authors describe. It sounds like the authors are suggesting that a square-and-multiply exponentiation algorithm that relied on Montgomery multiplication would use $n$ extra reductions for messages in the set $M1$ and $n+1$ extra reductions for messages in the set $M2$ which does not make sense to me intuitively. Am I misunderstanding this attack?

Edit: After comparing my attack code with others, it turns out I understood the attack just fine and my experiment was different. The difference between my results and the results from the original paper was due to my selection of the Montgomery parameters. The value of $R$ used to put numbers in Montgomery form can have a major effect on the number of reductions required per multiplication.


texts: NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?


texts: Why are there so many different elliptic curves?

texts:
There are Chinese, French and NIST curves.  There's a Million Dollar one. The BADA55 Research Team studied 1 million variants.  Some are based on widely different formulae.  Indeed there are entire suites of curves, and we're still actively developing more.  It's all starting to look like a plate of spaghetti.

Why is there not just one or two curves that have been widely accepted as useful?


texts: Is braid-based cryptography proven insecure when looking towards post-quantum cryptography?

texts:
Braid groups has drawn the attention of cryptographers for a few years, as a promising platform for post-quantum cryptographic protocols. The security of the proposed schemes mostly relied on conjugacy problems, and attacks against this problem were discovered, and cryptographers lost interest in those braid groups. But as far as I know, those attacks don't completely break the security of braid groups. For example, conjugacy problems can be solved by computing the USS (Ultra Summit Set) of a braid, but this set can have exponential size in the length of the braid (for some classes of braids).

I don't know much about other attacks on braid groups, but do they definitely put an end to any applications of braids to cryptography? If we could highlight properties of braids comparable to bilinear pairings for elliptic curves, allowing some of the related advanced protocols in a post-quantum world, would they become more interesting or are they definitely too weak for cryptography?

EDIT:

Note that my question didn't mean to say "is anyone still interested in braids", but rather "do we know attacks (that I am not aware of) on conjugacy related problems for braids that definitely label them as 'not suitable for cryptography'". I am certainly not looking for (or expecting)
 as an answer any opinion about how interesting they are.


texts: Differences between OWP and OWF and their IND-CPA security

texts:
I am learning about one way permutations and one way functions and am not sure of the differences if there are any.

Also in the random oracle model are they both IND-CPA secure?


texts: ECC algorithm pollard's $\rho$ complexity

texts:
One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to find w.

The algorithm is supposed to take a time $O(\sqrt p)$.

The authors say its exponential or subexponential, at best. How is it that way?

Is there any relation between w and p which makes it exponential?

Wiki article says without any citation:

  The algorithm offers a trade-off between its running time and the
  probability that it finds a factor. If n is a product of two distinct
  primes of equal length, running the algorithm for $O(n^{1/4} polylog(n))$
  steps yields a factor with probability roughly half.[citation needed]
  (Note that this is a heuristic claim, and rigorous analysis of the
  algorithm remains open.)


texts: BGN encryption scheme with unbounded message space

texts:
In Evaluating 2-DNF Formulas on Ciphertexts stated that

  decryption in this system takes polynomial time in the size of the message space T. Therefore, the system as described above can only be used to encrypt short messages

Is there any other extension with the same properties of (any number of addition and one multiplication operation on the ciphertext) but also allows bigger message space?

In my search, I encounter only in Converting Pairing-Based Cryptosystems from
Composite-Order Groups to Prime-Order Groups, but it does not solve that limitation.


texts: Should I use NaCl or libsodium for my application?

texts:
While looking for end-to-end encryption for my app users, I stumbled upon NaCl and libsodium. I am unsure from a security perspective which of these implementations I should use for my cross-platform app.

Are there big differences in the level of security they offer?


texts: How many rounds is needed to implementing Schnorr Non-Interactive zero-knowledge protocol

texts:
We can use Fiat-Shamir heuristic to replace 3-move Schnorr's protocol with 1-move non-interactive protocol.

When I implement this non-interactive protocol( ref. https://en.wikipedia.org/wiki/Fiat%E2%80%93Shamir_heuristic): That is

Let $G$ be a cyclic group with order $q$.

Peggy needs to prove that she knows $x$ which is the discrete logarithm of $y =g^x$ to a fixed base $g$.

She randomly chooses an element $v \in [1,q-1]$ and computes $t = g^v$.
She computes $c = H(g,y,t)$, where $H$ is a cryptographic hash function (implementing random oracle).
She computes $r = v-cx \pmod q$. The proof is the pair $(t,r)$.
Anyone can check this proof by $t = g^r \cdot y^c$.

My question is that:

Assume that Peggy is prover and Victor is verifier.
Can Peggy send $y =g^x$ and a proof $(t,r)$ in the same round?

Or it should be divided it into two rounds:

The first round is that Peggy sends $y=g^x$ to Victor.
The second round is that a proof $(t,r)$ to Victor.

Does it arise any risk if we combine two rounds?

Thanks


texts: How to attack RSA-CRT with large public exponent?

texts:
Suppose we have $(n,e)$ and the ciphertext $c$ where the public exponent $e$ is of the same length, 1023-bit, as the modulus $n$. It is also assumed that the factors of $n$ are balanced. The message is decrypted using CRT with small exponents but unknown to us, attacker. Is it possible to decrypt $c$ in such a scenario?

I have checked the Wiener's attack on https://en.wikipedia.org/wiki/Wiener%27s_attack but the example requires those parameters that are not available to us in this situation.


texts: Digital Signature Algorithm (DSA) with medium fields

texts:
I understand it when we have to solve Discrete Logarithm Problem $a^x\equiv b\pmod p$, where $a$ and $b$ are given integers and we have to find secret integer $x$ that makes the equation true for some given modulus $p$.

I do not understand it when $a$ and $b$ are polynomials and we are working not only modulo integer but also modulo another polynomial.

Can you give me an explicit working example of DSA applied to this context?
What attacks against it are known?

EDIT: In the original standard, finite field has characteristic 2. By "medium" fields I mean field GF(p^n) where prime $p$ is bigger. Instead of $p=2$ it is around $10^{10}$ and $n=17$ or so.

EDIT 2: My own example:
$$a=4 x^6+10 x^5+11 x^4+3 x^3+x^2+15 x+7$$
$$b=12 x^6+4 x^5+8 x^4+4 x^3+9 x^2+6 x+7$$
$$m_1=x^7-2$$
$$m_2=17$$

Find $e$ that
$$a^e\equiv b\pmod{m_1}\pmod{m_2}$$

I am not sure whether my example is relevant, there are some criteria on choosing polynomial $m_1$ and prime $m_2$. I chose them arbitrary. But I can say $e=103$ is a solution since I brute-forced it.


texts: ECC: Lightweight proof of correct exponentiation

texts:
In the context of ECC.

There's an EC point $P$ which is supposed to be a known power of another known point $G$ (generator). That is:

$P = [k]G$ (in additive notation)

This should be verified on an embedded device, with limited capabilities (scarce memory and weak CPU).

Is there a better way to verify this expression, apart from calculating the point $P$ from scratch?

Can the prover provide some auxiliary data to prove the exponentiation correctness in an easier way?

UPDATE: To be precise, what I actually need is a multiexponentiation.

The point $P$ should be a commitment from 129 different NUMS generators.
The device that should verify this commitment is a HW wallet.
It has both strict memory restrictions (so that precalculating large tables with odd powers is problematic), as well as the computation time is limited.


texts: MAC-then-encrypt in SIGMA protocol for authenticated key exchange

texts:
The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption.
The SIGMA-I variant illustrated below indicates that it uses a MAC-then-encrypt approach:

Here $\{\dots \}_{K} $ denotes encryption of the information between the brackets under a symmetric encryption function using key $K$.
Is there a particular reason to use MAC-then-encrypt rather than encrypt-then-MAC for key exchange protocols? I wasn't able to find a better answer than it seems arbitrary when looking at a comparison between MAC-then-encrypt and encrypt-then-MAC.
Edit: RFC 7366 linked in this related answer gives some hints that encrypt-then-MAC should be preferred (D)TLS communication (none is said about handshaking). In particular, it  states:

TLS and DTLS use a MAC-then-encrypt construction that was regarded as secure at the time the original Secure Socket Layer (SSL) protocol was specified in the mid-1990s, but that is no longer regarded as secure.

Interestingly, H Krawczyk (the author of SIGMA) wrote in 2001 The Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?)—before SIGMA.


texts:
AES uses one S-box to substitute all 16 bytes in one round. Will using 16 different S-boxes (with cryptographic properties similar to the AES S-box (i.e., non-linearity of 112, differential probability of $2^{-6}$ etc) increase some security against the following attacks?

Differential
Linear
Truncated Differential
Boomerang
Higher Order Differential


texts: Elliptic curve group inverse addition in OpenSSL

texts:
I am using group P-256 on OpenSSL with C++.
My understanding was that, if you have a point $xP$ and then calculate (xP)^(-1) with EC_POINT_invert(group, xP_inv, ctx),
then when I calculate:
xP + (xP)^(-1), or
EC_POINT_add(group, result, xP, xP_inv, ctx);
The result should be the identity right? But when I print it, it just looks random. Moreover, should this literally be the same as
EC_POINT_mul(group, result, BN_zero, NULL, NULL, ctx) (i.e. O * P)?
Moreover, if I add P to this value, shouldn't the result be equal to P? It does not.
Obviously I am very confused somewhere. Any help would be appreciated!