texts: How to distribute system parameters in identity-based encryption

texts: Identity-based encryption papers describe that system parameters are declared as public. However,in real scenario, how to distribute system parameters to users?


texts:
Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits.

I don't know much about cryptography, but I can get these numbers generated by a computer. Unfortunately, in my scenario – I can't use the built-in functions to use these numbers.


texts: At what point can you you implement crypto algorithms?

texts:
First off, this feels like it should be a common question, so I'm sorry if I've missed an older thread.

Note that in my question, I'm talking about "implementing AES" rather than "designing AES2" or something.

I am of course familiar with the saying that you should "never implement your own crypto" and I've recently also learned some about why, in terms of all the attacks and common mistakes, etc. However, I've never really liked that answer, because if no one ever implemented it, we would never have it. And since we do have it, someone must not have listened, and implemented it.

My question is: At what point is a person "allowed" to implement a crypto library? Be it for a new platform, a newly released algorithm, etc.


texts: Encrypt-then-MAC when encrypting data in multiple blocks?

texts:
Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ?

For example, the plaintext is 530 bytes long. We read the first 512 bytes into a buffer, process this chunk, but what happens then ?

Do we

1.

write the ciphertext of the incoming chunk
update and write the MAC of this ciphertext

or

2.

while (incoming chunk == 512B)

write the ciphertext of the incoming chunk
update the MAC with this ciphertext

write the ciphertext of the last chunk with length L (<512)
update the mac with this ciphertext
write out the MAC

What about decryption ?

The goal of EtM is to be able to check the MAC before decrypting, so I think 2 is the right way of doing it, except if we just need one MAC tag at the end of the file (like with GCM).


texts:
I did the following problem from the book "Cryptography Theory and Practice" as
I am doing some self-study.

Problem:

a) Suppose that $\pi$ is the following permutations of the set $\lbrace 1,\dots,8 \rbrace$:
$$ \pi=\begin{pmatrix}
1 &2& 3& 4& 5& 6& 7& 8\\
4& 1& 6& 2& 7& 3& 8& 5
\end{pmatrix}$$
Compute the permutation $\pi^{-1}$.

b) Decrypt the following cipher text, for a permutation Cipher with
$m = 8$, which was encrypted using the key $\pi$:

${\bf TGEEMNLENNTDROEOAAHDOETCSHAEITLM.}$

Answer:

a)$$ \pi^{-1}=\begin{pmatrix}
1 &2& 3& 4& 5& 6& 7& 8\\
2& 4& 6& 1& 8& 3& 5& 7
\end{pmatrix}$$

b) To decrypt, I partition the text into groups of 8 giving.

${\bf TGEEMNLE\ \ NNTDROEOA\ \ AHDOETCS\ \ HAEITLM.}$

${\bf TGEEMNLE}$ decrpyts to ${\bf ETNGLEEM.}$

I am fairly sure that this is wrong. However, I do not know what I did wrong.
Please help.

Bob


texts: Cracking a hash when you know the result?

texts:
If I know that the algorithm used is SHA1 constructed as salt+key, and I have the result, is it possible to find the salt?

Example:

sha1(saltExamplealturkovic) => 4e6a306ff65e252571f36972949f45e513b79ba7

In this example, I know that the input value is alturkovic, the result is 4e6a306ff65e252571f36972949f45e513b79ba7, how it is constructed and that SHA1 is used as the hashing algorithm. I would like to find out what salt was used (with some common sense limits of course, such as length).

I tried using hashcat but I can't figure out if this can even be done using such a tool...


texts: In an A5/1 stream cipher, why do the registers have a stepping probability of 3/4

texts: I know that the probability of each register to step is 3/4 but I have yet to find an explanation of why. Can anyone explain this to me?


texts: Can we construct a PRF directly from a one way permutation function?

texts: In Introduction to Modern Cryptography first a pseudo random generator (PRG) is constructed from a one way function (OWF). After that the PRG is used to to construct pseudorandom functions (PRF). Is there a way to construct a PRF directly from an OWF?


texts: How to break homophonic substitutions and nomenclators with too many symbols?

texts:
Early attempts to thwart frequency analysis attacks on ciphers involved using homophonic substitutions, i.e., some letters map to more than one ciphertext symbol.
The earliest known example of this, from 1401, is shown below:

[Source: “Quadibloc” cryptography blog]
One variant is the nomenclator, where codewords are used to substitute many common words and names. The example below was used by Mary Queen of Scots in 1586.

[Source: Simon Singh]
According to Wikipedia,

By the late eighteenth century, when the system was beginning to die
out, some nomenclators had 50,000 symbols.

What is the best way to go about cracking those kinds of ciphers as the number of symbols used increases?


texts: Where do Windows applications get entropy from?

texts: Where does the entropy that cryptographic .NET libraries use for encryption come from? I know with Linux you can use /dev/random, but does a similar pool exist within Windows?


texts:
how sub key generated in initial round process.What is the process involved in generation of key in addround step in initial stage.

how we are getting
[k0,k4,k8,k12

k1,k5,k9,k13

k2,k6,k10,k14

k3,k7,k11,k15]


texts: What stops a physical attacker to use a dumped uninitialized SRAM with SRAM-PUF?

texts:
Does SRAM-PUF require the microcontroller/system to be (1) on the same silicon piece and (2) to prevent access from dumping the SRAM in an uninitialized state in order to be tamper-proof?

  In SRAM PUF, there are two types of challenges that can be applied to the system. The challenge can be either the whole SRAM memory or specific addresses.

source: *Setyawan Sajim, A. (2018). Open-Source Software-Based SRAM-PUF for Secure Data and Key Storage Using Off-The-Shelf SRAM.

Does it mean that the response is only derived from the content of the SRAM in an uninitialized state? How can this be tamper-proof? As an attacker, I could just dump the content of the SRAM in an uninitialized state.


texts: Is integrity important when building anonymity?

texts:
I was thinking about applying an anonymity process based on ECDSA signatures to anonymize blocks of information, not the public-key itself. Using a deterministic form of ECDSA to sign blocks and record only the signature hash in the block header, it is possible to not reveal the public-key. The block ownership is only revealed by requesting a re-signature of the block. Where the interested party can confirm the ownership by validating the signature, apply the hash and verify that it's equal to the one registered in the block header.

I believe this has no major security flaws. However, it's not possible to check the integrity of the block without disclosing the signature. My concern is if there is any use case that will require "anonymous integrity check"?


texts: Hash and sign via trapdoors for lattices

texts:
Both the papers GPV'08 and MP'11 present trapdoors for lattices that allow to recover $s\in\mathbb{Z}_q^n$ and the error vector $e\in\mathbb{Z}_q^m$ when given $y=As+e$, for $A\in\mathbb{Z}_q^{m\times n}$.

Also, they claim that their constructions allow to construct signatures via the "hash and sign" paradigm. That is, given a random oracle $h:\{0,1\}^*\to \mathbb{Z}^m_q$, to sign a message $M$, the signer computes $$\mathsf{Sign}(\mathsf{td},M)=\mathsf{Invert}(h(M))=(s,e)$$ such that $As+e=h(M)$, where $\mathsf{td}$ is the trapdoor for $A$ and $\mathsf{Invert}$ is the inversion algorithm.

My questions are:

Does this means that there are a non-negligible number of words in $\mathbb{Z}_q^m$ that are decodable?
If so, every word in $\mathbb{Z}_q^m$ is decodable or we need to use a similar technique as in CFS'01, the McEliece based signature, where we need to try to decode $h(M,i)$ (for $i=0,1,2...$) several times, before getting a signature?


texts: Which algorithm should be used to replace SHA512withRSA?

texts:
We are working on the web application that is basically generating a self-signed certificate during the installation. It's a Java based app and for generation of the certificate we are using SHA512withRSA. Can I ask what would be the best replacement for it? Something with better encryption level and more 'modern' security?

Any help would be appreciated.

--
Best regards
macosxgeek


texts: Some Questions about the Veracrypt hash functions

texts:
Veracrypt has always been my favourite encryption tool since it came out .
But still there are some things about the tool I don't understand .

Why is there the possibility to use sha256 or sha512 .
This one does not make sense to me at all . As far as I know the output size of the Veracrypt KDF will always have the same length .... so why give the possibility to use a shorter or longer hash ? does it have any advantages ?
Why does Veracrypt use such strange hashes ? sha512 , Whirlpool , Streebog , etc ... Whirlpool is ( as far as I know ) not even officially a KDF . All thes hashes are rather collison resistant , but not one of them is suited as cryptographic strong hash function . Why not Argon2 , scrypt , bcrypt , ..?
Why is Veracrypt GPU resistant ? Attacking a VC hash with a GPU is slow . Why ? I don't see any GPU attack countermesures . All the hashes are well implemented in GPU . they pass through PIM which ( I think ) rehashes the output of the last hash with the same algo . And then they pass through PBKDF2 at some point . But even PBKDF2 is rather GPU friendly .


texts: Is there a LWE based public-key encryption scheme which is CCA1-secure?

texts: Is there a lattice based PKE which is IND-CCA1 secure? Actually I am only familiar with LWE and SIS. So I want to know that what the IND-CCA1-secure LWE based PKE scheme looks like?


texts: Why gcd(r,(p-1)/r) needs to be 1 in benaloh cryptosystem

texts:
I recently discovered the benaloh cryptosystem.
I am working with the system as it is discribed in the following link:
https://en.wikipedia.org/wiki/Benaloh_cryptosystem

However I need some help in order to understand why we need
\begin{equation}
{gcd(r,(p-1)/r)}
\end{equation}

As far as I understand the condition
\begin{equation}
r \mid (p-1)
\end{equation}
guarantees the existence of the subgroup of order (p-1)/r which contains the r-residues.

The third condition

\begin{equation}
{gcd(r,(q-1))}
\end{equation}

allows us to say that there are

\begin{equation}
\mid \mathbb{Z}_n^* \mid /r
\end{equation}
r-residues mod n.

what does the other condition add?


texts: Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

texts:
Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process?
Both are mentioned in the final draft of Recommendation for Stateful Hash-Based Signature Schemes.
I was expecting that both algorithms are candidates in the standardization process as well, but it seems that they weren't even submitted. Can anyone explain why? If they are not considered as candidates for a new standard why does the Recommendation for Stateful Hash-Based Signature Schemes exist and mention exactly those two algorithms?
Is the recommendation just a temporary standard until the standardization process is finished?


texts:
I was looking into the Vignère Cipher when I thought of something.

Would you improve the security of the cipher if you shifted each letter (from the text you want to encrypt) with each letter of the key?

Also, given that the mathematical expression of the cipher is:

  $$C_i = E_K(M_i) = (M_i+ \sum_{i=0}^{l-1}K_i) \pmod {26},$$ where $l$ is the lenght of the keyword $K=K_1K_2\ldots K_l$.

(the encryption part anyway)

How would you express the concept I just explained mathematically?


texts: Is it safe to extend the length of Blake2b’s keyed hash key?

texts:
Blake2b keyed hash variation specifies a maximum key length equal to the digest size. It implements this feature simply concatenating the zero-padded key to a boundary of the block size with the message and then hashing.

I am asking myself: Why this arbitrary key length limit? It is just a concatenation. Allowing arbitrary length keys zero-padded to the block boundary does not add extra complexity to the code nor breaks compatibility with current specification. Are there any security flaws making this slight variation?


texts: Hashing user password without database to store salt

texts:
I am building an Android app that will run purely locally on the user's device, no servers. It has a database that I want to encrypt with the user's password, which requires a 64 byte key. I've considered these 2 ways:

Use bcrypt, but that doesn't give me 64 bytes
Use SHA512 which is much faster to brute-force

The problem with both is that I don't have a reliable place to store a random salt.
The "attack scenario" would be someone pulling the database file off the phone and using a rainbow table to decrypt.

Should I:

add a static salt anyway?
use bcrypt and just fill the missing bytes with 0s, because it's more important that generating a rainbow table be hard?
use SHA512?
something else entirely?


texts: What's wrong with this curve (generation algorithm)?

texts:
In this tweet, Paulo Barreto proposes the following elliptic curve over $\mathbb{F}_{2^{255}-19}$:

$$
E_\mathrm{PB} : y^2 = x^3 - 3x + 13318
$$

with $G_\mathrm{PB} = (-7, 114)$. Now I would like to try to verify the curve by trying to generate it over some sensible domain. For this I am using this algorithm from this website.

I also require that $n$ (the order of $E_\mathrm{PB}$) is prime, and that the cofactor $h$ is 1. After programming for some time I have come up with the following algorithm for generating elliptic curves:

#!/usr/bin/env sage

F = GF(2^255 - 19)
for i in range(15000):
    if i % 100 == 0:
        print('Progress: {}'.format(i))
    try:
        E = EllipticCurve(F, [-3, i])
    except ArithmeticError:
        # Curve probably has a singularity
        continue
    n = E.order()

    # Only accept curves of prime order
    if not is_prime(n): continue

    # Start selecting random points for the rest of the search
    for x in range(-256, 256):
        for y in range(256):
            try:
                G = E(x, y)
            except TypeError: # (x, y) is not a valid point
                continue
            t = G.order()
            # Cofactor MUST be 1
            if n == t:
                bits = int(log(float(E.order()))/log(2.0))
                print('Found prime order for a_6 = {} ({} bits)'.format(i, bits))
                print('Generator G = {}'.format(G))

After a short time it gives me the following curve:

$$
E_{DS} : y^2 = x^3 - 3x + 101
$$

with $G_\mathrm{DS} = (-4, 7)$, which is not Paulo's curve. I expect that Paulo did not make a mistake, so my question is:

What is wrong with my generated elliptic curve $E_\mathrm{DS}$?


texts: Why is there only one keypair in FrodoKEM?

texts:
use pqcrypto_frodo::frodokem1344aes::*;
let (pk, sk) = keypair();
let (ss1, ct) = encapsulate(&pk);
let ss2 = decapsulate(&ct, &sk);
assert!(ss1 == ss2);

In the above code, only one keypair is generated. The public key is then used to 'encapsulate', which returns a ciphertext and a shared secret. I'm going to assume that the shared secret is used to do symmetric encryption with AES or something.

Since there is only one keypair, doesn't that mean anyone can compute the shared secret with the public key?


texts: Multiplication of a Pedersen commitment 10 times

texts:
Suppose I have a Pedersen Commitment $cm(x,r) = g^xh^r$ where $g,h$ are generators of group $G$ of prime order $p$. Based on $cm$, I want to create a commitment $cm' = (10\cdot x,r')$, without of course opening the original commitment, while knowing that $x$ is a relatively small value (e.g. less than 1 million) through a range proof.
Based on the additive homomorphic property, I was thinking of just multiplying $cm$ by itself 10 times, i.e. computing $cm^{10}$ which would open with $(10\cdot x, 10\cdot r)$. Is there anything that can go wrong with this?


texts: Size of $q$ in reductions from lattice problems to R-SIS

texts:
The Short integer solution problem is parameterized by four values:

$n$, the dimension of the vectors that must be added
$m$, the number of samples (dimension of the solution)
$\beta$, upper-bound for the length of the solution
$q$, the modulus defining $\mathbb{Z}_q$

Usually, the reductions from lattice problems to $SIS_{n, m, q, \beta}$ have the following template:

  For any $m = poly(n)$ and $q \ge \beta \cdot \tilde{O}(\sqrt{n})$, solving
  $SIS_{n, m, q, \beta}$ gives a solution to an approximate version of a
  lattice problem with approximate factor $\gamma$ which is a function of $n$.

I was expecting something like that also for the ring version of SIS, namely, R-SIS, that works over a ring $R$ instead of $\mathbb{Z}$. However, on Peikert's survey on lattice crypto , in the end of section 4.3.4, some reductions from $SVP_\gamma$ to $R$-$SIS$ are  cited, but no restriction on the values of $q$ are done.

So, do you know what are the lower bounds for $q$ in the reductions from lattice problems to $R$-$SIS$?


texts: Security of Carter-Wegman polynomial authenticators, and their concatenation?

texts:
Carter-Wegman polynomial authenticators

For a given finite field $(\mathbb F,+,\times)$ of $f$ elements, define a Carter-Wegman polynomial authenticator for a message $M=m_1\|m_2\|\dots\|m_l$ of $l$ symbols in $\mathbb F$ as $$H_{(r,s)}(M)=s+\sum_{i=1}^l m_{(l+1-i)}\cdot r^i$$ where $r$ and $s$ are uniformly random independent secrets over $\mathbb F$  (I'm restricting to neither $r$ nor $s$ reused, even though $r$ could).

Common fields $(\mathbb F,+,\times)$ are $GF(2^b)$ (equivalently: field $(\{0,1\}^b,\oplus,\times)$ where $\times$ is binary polynomial multiplication followed by reduction modulo a public irreducible polynomial of degree $b$ ), and $(\mathbb Z_f,+,\times)$ for prime $f$. AES-GCM uses $GF(2^{128})$ with polynomial $x^{128}+x^7+x^2+x+1$. Poly1305 uses $\mathbb Z_f$ with prime $f=2^{130}-5$ (and some restriction of the domain of $r$, and of the $m_i$'s).

Questions

Tight security bound for elementary attack model: for fixed public $l$ and $(\mathbb F,+,\times)$ of $f\gg l$ elements, an adversary chooses a message $M$ of $l$ symbols, obtains $H_{(r,s)}(M)$ for fresh uniformly random secrets $r$ and $s$, and makes one attempt to produce $H_{(r,s)}(M')$ for $M'\ne M$ of his/her choice (also of $l$ symbols). What's a tight upper bound of probability $\epsilon$ of success (undetected forgery) as a function of $f$ and $l$? Do we reduce $\epsilon$ by excluding some $r$, e.g. requiring $r\ne 0$ ? Are some fields better than others ?
Concatenation of authenticators using the same field: we consider $H_{(r,s,r',s')}(M)=H_{(r,s)}(M)\;\|\;H_{(r',s')}(M)$, with the $r$, $s$, $r'$, $s'$ uniformly random independent one-time secrets in $\mathbb F$. What's a new tight upper bound for probability $\epsilon$ of undetected forgery as a function of $f$ and $l$?
Concatenation of authenticators using different fields: we consider  $H_{(r,s,r',s')}(M)=H_{(r,s)}(M)\;\|\;H'_{(r',s')}(M)$, with $H$ (resp. $H'$) using field $\mathbb F$ of $f$ elements (resp. $\mathbb F'$ of $f'$ elements), with $f'\gtrsim f$ and some public way to plunge $m_i$ into $\mathbb F'$ , $r$ and $s$ uniformly random independent one-time secrets in $\mathbb F$, $r'$ and $s'$ uniformly random independent one-time secrets in $\mathbb F'$. What's a tight upper bound for probability $\epsilon$ of undetected forgery as a function of $f$, $f'$ and $l$? Is this lower than in 2. ?

Motivation

Wide Carter-Wegman polynomial authenticators are non-trivial to implement both efficiently and portably: portable C has no semantic for carry-less multiplication, and no type wider than 64 bits. A generic Poly1305 uses 25 integer multiplications plus significant additions and shifts for 128 bits of message processed (or double arithmetic which a lot of low-end platforms do not have in hardware). It is thus tempting to concatenate narrower authenticators, which are easy and usually efficient to implement: C99 provides arithmetic in $\mathbb Z_f$ for $f<2^{32}$, using the w = ( (uint64_t)u * v ) % f; semantic, and many hardware+compilers have good support for that (or perhaps w = ( (int64_t)u * v ) % f; for $f<2^{31}$ ).


texts: Secure MAC and secure encryption schemes combined to form insecure Authenticated Encryption?

texts:
I'm reading up on Authenticated Encryption and can't really wrap my head around how a generally secure MAC and a generally secure encryption scheme can be combined into an insecure AE scheme, such as in MAC-and-Encrypt.
I'd be fine with just having links to sources so that I may read up more about it on my own.


texts: Parallel variant of Carter-Wegman MAC with incremental property

texts: Is there any variant of the Carter-Wegman MAC algorithm that is fast, parallel and has the property of incremental crypto?


texts: lookup encrypted text by clear text without decryption

texts:
I've implemented vouchers module in my web project where I use it to generate redeem get etc... vouchers.

since voucher codes are considered sensitive, I've considered to encrypt them using AES-GCM.

but how can I query clear voucher code to encrypted one to check voucher validity in order to redeem later?

I've thought of these two solutions

I am thinking to make like a MD5 for the clear code to live in the
document, in order to match it with clear code queries?
Reversed distribute, where to give the user encrypted voucher codes, and store the clear voucher codes on the DB,
when a query is applied to redeem a voucher system decrypt code applied with secret key and iv and looks for a match?

Does those approaches carries less performance overhead than decrypting whole data?, is it safe to consider one of them.

Audience of threats

system admins
attackers
DB data breach


texts: Known risks for publishing ECDSA public keys and signatures

texts:
For an implementation of ECDSA, I'm considering the risks of publishing public keys together with multiple signatures.

From what Google tells me, a common pitfall is the use of the same random value K for multiple signatures.

My question is; are there any other known risks, or common mistakes, regarding the publishing of multiple signatures from one keypair?


texts: Preimage resistance hash in digital signature

texts:
I'm studying about preimage resistance property of the hash functions.
In particularly I'm reading as the missing of this property can be fatal in digital signatures that use RSA.

Further details:

Let $e$ be the public exponent, $d$ the private exponent and $n$ the modulus.

Let be C the attacker.

C could compute:

$y= z^e \mod n$
with $z$ random number, then he could find a $m'$ for the which $h(m') = y$ and finally
to state that Bob has sent {$m'$, $z$} where $m'$ is the message and $z$ is the digital signature.

Here my doubts:

C could choose $m'$ if he could compute:
$h(m') = y$ (the compute is easy, suppose that h is public) and resolve this equation;
$\log_x y = e$ (there is also $\mod n$ in this equation).
This problem seems similar to discrete logarithm but it is different.
In this case the unknown is the logarithm base.

I think that this problem is computationally intractable, do you confirm?


texts:
I understand the concept that when you xor the cipher texts you get the XOR messages cause the keys get XOR-ed and cancel out... This is at least the case when both the messages are of equal lengths.

What about when both the messages are of different lengths? Does the shorter message get padded? Which of the key would be of the original length key (non-padded)?


texts: Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal

texts:
Can we generate two secret keys from same source?

The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/1000$ samples. I put a threshold and assign 0 and 1 to values below and above it.
Since this signal is shared I get a secret key of length $tN_S/1000$ bits.

Now the length of key depends on $N_S$ for a given window. We do agree that it gets harder to track original data if I decrease this $N_S$.

My problem is can I generate two different secret keys using this time varying signal. Approach can be to to use different functions say: digitization and derivatives. I can encode derivative to some bits.

These two functions can give two separate sequences. Now issue is I cannot say I have got additional level of security because: Signal can be compromised and that will compromise both functions results. This is what happens in general cyrpoto key management.
Another point is I can use first method(thresholding) to generate back signal and guess output of second sequence hence its useless to generate that sequence!

My point is viability of back generation of signal depends on sampling rate.If its high the second sequence can be broken. But if sampling is low enough then back generation will be erratic hence second sequence cannot be guessed correctly.

I feel sampling can be optimized and keys generated through one process is not able to capture the full prowess of source and I can generate more keys from the signal which is still secure be it of a small length.

Is there any method already studied in literature of generating two secrets from a signal?

Hash is one practice that is effective in key management but the security level is decided by parent key no matter how many hashed keys we generate ahead. But if we generate two keys from a physical signal(assuming this signal is shared and random enough and cannot be guessed by eavesdropper) can the security level of system be increased?

If not are there analogous to hash functions on such time series signals?
If not one way functions how can we compare feasibility of choosing two such functions? Is cross correlation a good choice?


texts: Is it secure to derive an AES key from a MAC?

texts:
I'm working on a project where we need to encrypt a large number of files and store them on the cloud. And I'm wondering if the following process would be secure (we have a “Hardware Security Module” and an “encryption server” in a private data center, only the files will be in the cloud).

Since the volume of the files is too big to be encrypted in an HSM, my idea is to:

Have a 256 bit master encryption key in an HSM.
Derive an encryption key by generating a 256 bit random number and HMAC-SHA2-256 it with the master encryption key.
Take the rightmost 128 bits from the MAC and use that as an AES key.
Take the leftmost 128 bits from the MAC and use them as the IV.
Encrypt the content in an internal server.
Overwrite the memory where the derived AES key was stored.
Store some metadata of the file (including the 256bits random number from the 2nd step).

I would do something similar to generate a signing key:

Have 256bit master signing key in an HSM.
Derive a signing key by generating a 256 bit random number and HMAC-SHA2-256 it with the master signing key.
MAC the encrypted file with the derived signing key
Overwrite the memory where the derived signing key was stored.
Store some metadata of the file (including the 256bits random number from the 2nd step).

To decrypt the data, I would use the random number to re-derive the key. What I'm trying to achieve with this is a different key per file, plus we can rotate the master key every now and then for extra security. Plus, after a few years, when we don't need those files, we can delete the master key (apart from deleting the files from the cloud).

I know the process above is not 100% secure, as the derived key will exist outside the HSM, but we need to keep a balance between security and cost. If storing the plain random numbers is not secure, I could have an AES key in the hsm only to encrypt the random numbers.

The level of security / assumptions I'm happy to live with is:

If the HSM is compromised, all files are compromised (this quite an obvious one)
If the encryption server is compromised, an attacker has access to the plain text files before they are encrypted (so I don't even bother to think about the attacker stealing the AES keys as they are in memory).
An attacker stealing the database (with the random numbers) plus all the files, cannot decrypt the data.

(I hope these assumptions are sensible - please let me know if you disagree!)


texts: Cryptographic equivalent of family coat of arms

texts:
As a layman when it comes to cryptography, I have recently been asking myself if there was a cryptographic equivalent of a family code of arms. I'm thinking of something asymmetric, that is future proof enough to hand down to another generation and that can be used to maybe access resources. If possible it should also have a graphical representation, similar to a QR code.

Maybe I am totally tapping in the dark, though. If that's the case, please elaborate on why this is a stupid idea.

EDIT: From suggestions, I have come to realize, that I indeed do not know what I am asking about. So here is a clarification:
I want the abstract "coat of arms" to be known "publicly". The authority on that would come from documents and physical proof (signatures, pictures of it being shown by members etc.). The goal would be to make it public enough, to give people a hard time convincing someone that theirs is the real deal, when it isn't. As per suggestion from @MaartenBodewes, using a certificate seems like a great idea to reinforce that by adding a central authority.
Now here is the difficult part: The abstract "coat of arms" could in my eyes be seen as an abstract lock. One that has one or a finite (reasonable) number of keys. Would it be possible to have something like that, so that one could prove beyond doubt that one had a key to that abstract lock, without exposing the key?
So what I'm getting at is: There are two authenticity questions here. One is of the authenticity of the abstract lock and one is of the authenticity of the party trying to prove their membership conncted to that lock. The former can come from CA but the latter can't.

I apologize for the uneducated terminology. Also, I hope this is actually comprehensible. :)


texts:
I need to add AES decryption with a 256 bit key to our software, and of course I won't do it myself; rather, I chose a library that works fine for our needs. It supports various modes of operation, the one I need is CBC (I know GCM would be preferable, but we get data from older hardware, and this is what it uses. The hardware will get an update in a few years...).

However, the library always (like, there is no way to change it, it is hardcoded in the encryption and decryption routines) uses PKSC#7 for padding. Does AES-CBC always use this padding, or is it just a shortcut by the library because PKCS#7 is so ubiquitous with this algorithm that it has become a de-facto standard, and it is not conceivable to use anything else at this point?


texts: Using ePassport with Active/Chip Authentication to sign documents

texts:
I'm a complete newby, so please pardon my ignorance when it comes to basic cryptography aspects.

My question is whether a biometric passport with Active/Chip Authentication (AA or CA) can be used to generate digital signatures for docs (or rather their hashes). If so, is there any API available to do that?

Thank you in advance for your feedback!


texts:
It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where $\ell/8$ is the $L$ parameter in HMAC). All that's missing to apply the familiar
$$\text{HMAC}_K(\text{message})=H(K\oplus\text{opad}\mathbin\|H(K\oplus\text{ipad}\mathbin\|\text{message}))$$
is a definition of the block size $b$, where $b/8$ is the $B$ parameter in HMAC. That is necessary to determine the size of $\text{ipad}$ and $\text{opad}$ (and above what size $K$ needs to be replaced by $H(K)$ beforehand). However, the original and improved security arguments/"proofs" of HMAC are made for the Merkle–Damgård structure, and thus do not directly apply to HMAC-SHA3.

How secure would these HMAC-SHA3-$\ell$ be? What does $b$ needs to be for each of the four $\ell$ values? What kind of security arguments/"proofs" can be made?

Would HMAC-SHA3 be any stronger than the generic sponge MAC?

HMAC is briefly discussed in the Keccak submission (section 5.1.3), but I do not understand that a proof is given or a security claim made.

Update: that makes reference to section 5.1.1 which I now read as suggesting that we should have the HMAC blocksize $b$ multiple of the so-called bitrate $r$; thus for output $\ell$ of 224 (resp. 256, 384, 512), $b$ a multiple of 1152 (resp. 1088, 832, 576). That's in agreement with these NIST slides


texts:
Doing malware research (simple crypto locker) I found out that it uses AES-128 with weak key - every one of the sixteen bytes is represented by (a-z,A-Z,0-9). Thus simple brute-force attack should iterate through $62^{16}$, that is approximately $2^{96}$ keys. I have a file before encryption and after.

Is it feasible in modern world to brute-force it to find a key with a budget of $3-4k?


texts: Ensuring integrity in a multi-user secret vault

texts:
Assume you have a vault containing secrets. Each one is encrypted for at least one authorized recipient using some public key crypto (one file per secret). Each authorzied recipient can decrypt all of those secrets. This implies that each recipient can also add additional recipients by decrypting all secrets and encrypting them again for the previous recipients and additionally the new one.

(The details of the encryption don't really matter here, for simplicity sake assume PGP/GnuPG is used.)

While this approach works well for authentication and confidentially, we have a problem with integrity. Malroy could easily add a malicious secret (i.e. a specially crafted phishing link) by encrypting this secret for all the indented recipients.

We could solve this by signing each secret or some kind of digest over the vault, but then we have to figure out who is authorized to sign a secret or the hash? How can we protect the integrity of our vault while still maintaining the ability to add recipients (authorized user)?


texts: Determine the iteration times using Pollard's rho Method for factoring

texts:
Let's say, we have a large number $n=181937053$ and $f(x)=x^2+1$. And also we know that $n=12391 \times 14683$.

The problem is that ,using Pollard rho method, can we find the algorithm iteration times need to factor this number? ($x_0,y_0 = 2$)


texts: Homomorphic Encryption Notation Question

texts:
What does the following notation mean in a homomorphic encryption scheme?

ENC(x;r)

What does x and r refer to?


texts: Non-uniform Deciders for computational indistinguishability

texts:
I don't quite understand the notion of a decider having a probability distribution function associated with it, and what it exactly says about the decider. From here on page 3-4 it says

  ...Now, in order to carry
  out a reduction that breaks some cryptographic primitive or assumption if the ensembles are
  not
  computationally indistinguishable, it is necessary for the reduction to know the value of
  a
  associated
  with its given
  n
  .  The value
  a
  associated with
  n
  must therefore be written on the advice tape of
  the reduction algorithm, making it inherently non uniform.

If our decider is uniform, why can it not associate $a$ with its given value $n$? Is it because its uniform, all possibilities are equally likely and it cannot tell the difference? If someone could maybe clarify for me I would be grateful.


texts: I am currently in the process of learning how AES actually works and that works great as of now but when it comes to the Rijndael's key schedule I have a question. From what I have read, I have to make a expanded key that is 240 bytes in size to supply enough subkeys to the whole process of a AES encryption using a 256 bit key. Does this mean that I need to make the expanded key exactly 240 bytes or can I make it 256 bytes and discard the last 16 bytes? I ask this because from what I understand, each round of the key expansion gives me 32 bytes of round keys. In that case I have to do 8 rounds of key expansion to supply the encryption with enough subkeys since 7 rounds will only give me 224 bytes.


texts: Showing formally that DDH hardness implies CDH hardness

texts:
As part of homework problem, I need to show that DDH hardness implies CDH hardness.
Assume $CDH$ is hard relative to some group generator.
The intuition is pretty clear, so I've made the trivial reduction - let $A_{CDH}$ be a PPT algorithm that computes $DH_g(h_1,h_2)$ with probability $\epsilon$, define $A_{DDH}$ as follows:
1) Given $g^x$,$g^y$ and $g^z$, return 1 iff $A_{CDH}(g^x,g^y)=g^z$
Now I look at:
$Pr[A_{DDH}(g^x,g^y,g^z) = 1]$  (the group description is given implicitly)
Where the probability is taken over independent choices of x,y and z.
($D_G$ is a description of the group, a generator $g$, and its size $q$)
I want to express the probability above in terms of $A_{CDH}$, so I've written:
$Pr[A_{DDH}(g^x,g^y,g^z) = 1]=Pr[A_{CDH}(g^x,g^y) = g^z]$
But how can I analyze it? If $g^{xy} \neq g^z$ I don't know the probability that $A_{CDH}(g^x,g^y) = g^z$, I only know that it gives (some) wrong answer with probability $1-\epsilon$
If the details aren't clear let me know, I tried to be as concise as possible. Thanks in advance!


texts:
I am a beginner in cryptography. I studied the Elgamal algorithm.
I know that:

p = A big prime number
g = Generator of p
a = 0<a<p-1
B = g^a mod p
secret key= (p,g,a)
public key= (p,g,B)
Encryption= c1=(g^k mod p) , c2=(m.B^k mod p) // 0<k<p-1

Now, I want to solve an exercise.

pk =9789467
g =10895499
n =16777216

c1 =C763515DF26161E21BAB53C35CE2B3B12419B5F5835D1B7B2FE761C9DF5149F4734C149944EA0B4637BBA71EB163CBA99F87611915038DEBA37650E1D69E1380CE6310D7114FD58BC605F1AF334B7044B1

c2 =C57120363903E441B7C90BEB72AFC48AD13D48D5DBF440602DB5C54CE1B490E1604251A1FF47A1D969831C05FFF7D55EAEE120EE7AECDCB0BDF9C5C9B634CACC79EA34485DAC8449D19947E70F1A276EDD

If g is generator, what is pk and n? pk and n are not prime numbers!


texts: Is there a SHA-256 value which hashes to itself?

texts:
Getting curious about SHA-256 cycles (what happens if you hash a value repeatedly), I came across this question:

Cycles in SHA256

The first answer suggests that using a 7-bit hash, it's possible to find a value that hashes to itself. See the red dot which isn't part of a loop but on its own:

I assume from the diagram, this means if I apply the 7-bit hashing function to this value, the output matches the input. So my question is if such values are possible in SHA-256, and if anyone knows what value(s) hash to themselves or has ever found one of those values.


texts:
I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also want to limit the amount of data that is vulnerable in plaintext at a time in RAM. This is so there is less chance of plaintext data being paged to disk. Also the database may be quite large so it needs to be more efficient than decrypting the whole database at a time just to access it. Therefore I am thinking about encrypting the sensitive data on a database row level. This would mean a unique index which references the record is unencrypted, so each record can still be found/retrieved, however the sensitive data itself is encrypted.

My solution would be to have the data per database row:

index | IV | sensitive encrypted data | MAC

A 256 bit database key will be used to encrypt the sensitive data which will be generated using /dev/random.
The IV for each row will be 256 bits from /dev/urandom (faster than /dev/random).
The encryption algorithm will be Twofish.
The MAC of each record will be HMAC-SHA3 of the index, IV & sensitive data using the key.

The system is single user. The user will create a strong alphanumeric passphrase (minimum 14 characters).

A password based key derivation function will be run on the passphrase to create a derived encryption key which will then be used to separately encrypt the database key with Twofish. This is so the user can change their password without having to re-encrypt the entire database - they can just create a new password and re-encrypt the database key instead.

To derive the key from the passphrase, PBKDF2 will be used with 10,000 iterations using HMAC-SHA3 with a 256 bit output and a salt of 256 bits obtained from /dev/urandom.
What I am trying to do is balance the number of password characters required to make the data secure versus making it reasonably fast for users on a mobile device which have slow processors and limited memory. I don't expect the user to wait more than 5 seconds for the PBKDF to complete.
A MAC is created using HMAC-SHA3-256(derived encryption key, salt | encrypted database key) and stored next to the salt and encrypted database key on disk. This can be verified when logging in to make sure they entered the correct password.

When the program loads, the user enters the passphrase. The KDF runs, which generates the key to decrypt the database encryption key. The real encryption key is then the only thing kept in RAM while the program is running and used to verify and decrypt individual database records when required.

What's the optimal length for the row level IV? Is 256 bits fine?
Is the minimum password strength of 14 characters and 10,000 iterations of PBKDF2 strong enough to protect the 256 bit database
key? If not, what parameters would work?
Is PBKDF2 still a good algorithm still to use here? If not, what Scrypt parameters?
Any further changes or recommendations to make the system secure?


texts: Public key encryption and decryption with private key

texts:
I am learning cryptography and here is what I understood so far:

  Story. I decide to talk with my friend over unencrypted channel. We
  exchange public keys with each other so that we can encrypt text files (messages). Once other party encrypts the message with my public key (the public key I given to my friend) and sends that encrypted file to me, I can decrypt message with my private key.

Here is how I create my key pair.

openssl genpkey -out privkey.pem -algorithm rsa -pkeyopt rsa_keygen_bits:4096
openssl pkey -pubout -in privkey.pem -out pubkey.pub

Then I can give this pubkey.pub to my friend who can encrypt message for me and send ecrypted file to me. I try this myself:

openssl enc -e -aes-256-cbc -in text.txt -out message.xxx -pass file:./pubkey.pub

This worked OK, I created encrypred file. But I cannot decrypt it:

openssl enc -d -aes-256-cbc -in message.xxx -out decrypted.txt -pass file:./privkey.pem

bad decrypt
139927387231896:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:529:

I could decrypt with pub key but that is not what I was trying to achieve. What I would like to is implement simple practical example of Alice and Bob https://en.wikipedia.org/wiki/Public-key_cryptography It is all clear and easy in theory, but I could not find any easy and clear practical example like mine.

Added, list of files:

ls -alh
total 28K
drwxrwxr-x  2 user user 4.0K Sep 21 17:59 .
drwxrwxr-x 11 user user 4.0K Sep 21 16:08 ..
-rw-rw-r--  1 user user   64 Sep 21 17:59 decrypted.txt
-rw-rw-r--  1 user user   96 Sep 21 17:58 message.xxx
-rw-rw-r--  1 user user 3.2K Sep 21 17:08 privkey.pem
-rw-rw-r--  1 user user  800 Sep 21 17:08 pubkey.pub
-rw-rw-r--  1 user user   74 Sep 21 17:58 text.txt


texts:
I am using some block Ciphers (AES and Threefish in particular) as RNG for the purpose of parallel Monte Carlo simulations. For each key, simply encrypt a sequence of counters produce a random stream more than good enough for the specific purpose. I don't. need CSPRNG. The use of these ciphers are because good performance (<1 cpb in my implementstion) and easy to setup multiple streams in parallel environment.

For each thread, a new cipher with a new key is used. Each thread has a different key. For the purpose of my simulation, it is sufficent that the two streams of any two threads are statistically  independent. Now my questions is that what is better way to seed each thread.

The first i am considering is simply seeding each with a counter as key, so, thread 1 has key equal to 1, thread 2 has key 2. And so on

The second is to use a seemly random key. For example, Say the cipher in use is AES256, for thread 1, I encrypt value 1 (256bit integer) with a zero keyed Threefish256, and a "random" 256bit number as key for the AES256 cipher. And so on for each thread. Since Threefish as a cipher is also a bijection, there's no risk that two threads having the same keys, up to 2^256 threads, which is far more than enough.

Which of the two will be better?

Edit
I meant to post it as a comment to the answer, but it was too long.

The indistinguishability is the part I don't quite understand. In fact I have read that wiki article for a couple of times before posting this question. Please bare with me. If I understand correctly, the basic principle is that knowing the cipher text without the key, one cannot guess the plain text with any advantage. In other words, given two almost identical streams, or highly correlated streams, and knowing the key of one stream, does not give any advantage of guessing the key of the other. However, my problem is more or less the inverse of this. Does two different keys, either random or related, always produce two uncorrected stream? My intuition is yes, since there are 2^k keys while there are (2^n)! permutations of the period 2^n streams, where k is the bits of key and n is bits of block. Or another way is, is it always the case, that for two keys, k1 ≠ k2, the cipher streams will be apparently uncorrelated? I understand that for k1 = 1, k2 = 2, etc., it should be so, at least if the total number of keys are not too big. But I am not sure if it is so for any two k1 and k2 from the 2^n possible keys.


texts:
I have such problem: party $X$ has an amount of money $M$, which it needs to share with $n$ other parties. Every week the amount of money is different.
Let say not, that I am a party A, which is one of those $n$ parties which are waiting for their money from $X$. Do you maybe know any protocol or commitment schema, which allow $A$ to be sure that he received exactly $\frac{M}{n}$ every single week, without knowing $n$ and $M$?
I would be very grateful for any suggestions with the references to any bibliography.


texts: What are the possible cryptographic implications of Zhang's proof of the Twin Prime Conjecture?

texts: Earlier this year, Yitang Zhang published a proof of a weakened form of the Twin Prime Conjecture. I'm wondering if any of the new mathematical machinery he developed has uses in cryptography or could be adapted for future use in the field.


texts: How can one guarantee that the generated DH secret key is of certain length? Say 256bit. Actually, prime length is not enough since the remainder of the last process, the modulus, may result in too small number.


texts: Can the input to a one way function be pseudorandom?

texts: I know that normally a one-way function takes in a completely random input, but can a one-way function take in something pseudorandom instead of completely random? Will it still be a one-way function? Intuitively it seems like it would be, but I don't actually know why.


texts: When/why is RSA (hybrid) encryption used rather than alternatives?

texts:
I've read that RSA is not meant for encrypting large plaintext because:
(Are these also true for other public-key encryptions like ElGamal?)

It is slow.
Padding makes the ciphertext blocks much longer.
No one uses RSA that way; so its security is not scrutinized.

Instead, a hybrid scheme is used, e.g., samoz's answer at How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?

And apparently, that is also encryption in PGP works:

Select a random symmetric key.
Encrypt plaintext with this symmetric key.
Encrypt the symmetric key using the receiver's public key.
(optionally) Sign (the hash of) the ciphertext plaintext.
Send symmetric ciphertext, the encrypted symmetric key, and (optionally) the signature.

This scheme has the same problem that I asked about here Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?, i.e., encrypting a ''unilateral'' symmetric key with the receiver's public key.

So why not use Integrated Encryption Scheme? This scheme uses the receiver's public key to create a Diffie-Hellman symmetric key. With this, I don't see how public-key encryption would ever need to be used at all. For example, TLS only uses RSA signature (or DSA) to sign key exchange, not RSA encryption. This makes me wonder when and/or why one would use public-key encryption at all.


texts: How do I store encrypted files on a web server and decrypt them locally?

texts:
I want to store files (images) on a public webserver and let users see them if they know a password.  The server shouldn't have the unecrypted files and the server can only serve files, not perform any server-size computation.

One thing that I know about crypto is that I know very little so I'd like a review of the following plan:

Description of the idea:

I plan to encrypt the images with AES-256, random IV, and save them as a concatenation of IV and encryption output.  Some images will have the same passwords, some won't.

To view these files, the user will type his password into an input box on a webpage and javascript will download the encrypted file and use the password that he typed in to decrypt the image and display it.

The download and decryption of images is slow and I expect it to fail if the password is wrong so I'd like to store a "password check" that will execute locally, in javascript.  My idea is to store, in a plain-text "index file", some sort of hash of the correct password.  (The index file is far faster to download than the image.)  The javascript will locally check if the hash of the password matches what's listed in the index file before downloading and displaying images.

I plan to create the index file and encrypted images in .Net and do all the javascript with crypto-js, so any algorithm that I use should be available with those.  I want to minimize download times and javascript run time if it doesn't compromise security.

Questions:

How do I expand the user's password into a valid AES key?  So far, I plan to use PBKDF2 because it's available in .Net and crypto-js.

Should I have a separate salt for each image?

If so, should I store that salt in the encrypted image with the IV/encrypted-file or in the index file?  What advantages/disadvantages are there to the options?  For instance, I could do PBKDF2 while waiting for the image to download.

How do I store the password check?  So far, I plan to use PBKDF2 for this, too, and put a random salt and PBKDF2 output in the index file.  The per-password salts would be different from the per-image salts, of course, because otherwise the AES key for each image would be in plain text in the index file!

Is there any reason that PBKDF2 would be a bad choice for both password-check and image-decrypt?

Any security mistakes that I didn't think of?  I know that downloaded javascript can't be trusted but I'll let my users decide if they want to take that risk or use https to get the javascript.

Edit, resolution: My resolution is Ilmari Karonen excellent answer.  Per valid password, I generate 128-bits with PBKDF2, each time with a new, random salt.  I store the salt per password in the index file.  Per photo, I generate a random IV and random key and encrypt.  In the photo index file, per photo, I store the photo's key, encrypted by the per-password PBKDF2.  I also store a second encryption of the photo's key, this time with the first byte of the photo's key incremented by 1 modulo 256.  That is used to check that the password, already verified as valid for some photos, is valid per-photo.  Doubling the PBKDF2 bits for authentication purposes is far slower than just attempting all the image-key decryptions and testing the results.

This is crypto, not stackoverflow, so I won't include the code here but all the encrypting is done with .Net and all the decrypting in javascript and it works.  I can provide it freely if someone wants it.


texts: A query on Learning with errors(LWE) problem

texts:
In generating an LWE sample, we do

$s\xleftarrow{$}\mathbb{Z}_q^{n}, A \xleftarrow{$}\mathbb{Z}_q^{n \times m}~$and  $e\xleftarrow{$}\mathbb{{\chi}^{m}}$

Then we compute $b^T$ = $s^TA$ + $e^T$ and the sample $(A,b)$ $\approx$ truly random sample.

Now suppose we have a fixed matrix (not random and public) $A \in\mathbb{Z}_q^{n \times m}$. We choose $R\xleftarrow{$}\mathbb{Z}_q^{n \times m}$ and compute $A' = A + R$ and the generate the LWE sample as $(A',b')$.

Will the LWE assumption still hold? If it doesn't hold, then is there a way to mask matrix $A$?


texts: Under which conditions would it be OK to use “H(pass||data)”?

texts:
I understand that the main motivation for HMAC is extension attacks.  If data always has content-length either implicit in the app or even explicitly put into the hash, I get the impression that HMAC is not necessary.  The motivation is to allow password based encryption of keys, using widely available primitives, and periodic rotating of master-password without re-encrypting data (but re-encrypting keys):

file.name = "foo.txt"
file.iv = freshRandom256Bits()
filekey = freshRandom256Bits() #only master learns this
#encrypted key
file.encryptedKey = sha256(masterpwd+":"+file.iv) ^ filekey
#make it hard to forge data
file.auth = sha256(masterpwd+":"+file.owner+":"+file.encryptedKey)
#write data stream and file meta, then filekey goes out of scope
writeEncryptedIO(file, filekey)

In this case, the encryptedKey has a known length.  In that case, HMAC is not strictly necessary, no?  If I did use an HMAC variant like:

$$h(k || h(k || data))$$

Does it really buy me anything? Is it OK to omit the XOR with constants that are prescribed?  I'm under the impression that the whole reason HMAC is good is that it solves the extension problem by making the thing appended to k be of a known length.


texts: Is it OK to use a hash of the key as nonce for AES GCM?

texts: I don't see an immediate risk of using the hash of the key as the nonce for AES GCM. Is there something I could be overlooking?


texts: LSB extraction in MPC: Doubts about correctness

texts:
I have doubts about whether the protocol below for LSB extraction (denoted Mod2) from the paper Improved Primitives for Secure Multiparty Integer Computation is correct. Clarifications will be appreciated.

The protocol above calls PRandM(k, 1) in line 1 to generate random shared values $r''$ and $r'_0$ (it ignores $r'$) and then uses them in line 2 to blind $a$ and then reveals it to extract the LSB of the blinded value after which it computes the random secretly shared value $a_0$.
The protocol $looks$ correct because the LSB of $c$ is essentially $r_0\oplus a_0$ and then in line 3 we XOR it again with $r'_0$.
That is... in case $2^{k-1}+[a]+2\cdot [r'']+[r'_0]$ doesn't overflow the prime field $p$.
When it overflows the prime field, then the LSB flips and then the math is no longer true.
We also don't know whether $c$ overflows or not, because $[a]$ can be $p-1$ and in that case $c$ will be bigger than $2^{k-1}$ .
Any idea what I am missing here?


texts: Can there be more than one valid private exponent for a given p, q, and e in RSA encryption?

texts:
For example, given:

p = 173, q = 149, e = 3

Using phi(n) gives d = 16971

While using lambda(n) gives d = 4243

Both values satisfy the checking equation (de)%phi=1, so are both correct, and if so, is one better than the other?


texts:
In most applications, all passwords are salted independently. In terms of security (e.g. attack complexity), what are the consequences of the following differents approaches:

All passwords are salted with the same salt.
The application does not use salting, but end users choose their passwords by appending to them a (truly random) salt. We make the assumptions that these users are able to remember this much longer password, and that an adversary has access to both the identities of users and the salts that have been used in the associated passwords.

I know that the second is impractical, but I am curious.


texts: How hard is to invert the function that computes the middle-bits of (x^2)?

texts:
I'm designing a function f that should be moderately hard to invert and very fast to evaluate in a modern CPU. The function will be used in a proof-of-work function.

I've read that the middle-bits of multiplication are the harder bits to obtain, so I suspect that they are the hardest to invert.

Let $f(x) = ((x^2) >> 16)$ where $x$ is 32-bits and $f(x)$ is truncated to 32-bts, and the multiplication is carried on a 64-bit architecture.

(alternatively one could use $f(x) = ((2^{32}-x-1)*x) >> 16 )$

Suppose that, since $f$ may not be bijective, any pre-image (if exists) is accepted.
Suppose also that there is no enough memory or time to precompute $f^{-1}$ for all possible $f(x)$ values (although there might be some memory/time to precompute a much smaller table)

Again, this is not a strict crypto question. In this context "hard" does not mean cryptographically hard. I'm asking approximately how hard it is, measured in number of instructions of a standard computer (with a standard instruction set). A bound on the number of any operation would be great.

I'm posting here because the question does not fit well in theoretical computer science not in programming stack-exchanges.

Maybe there is a paper that describes this?


texts: How should the key schedule be designed for this general block cipher?

texts:
After looking at the Wikipedia page for the Fiestel cipher, I thought about making a variation of it that is very general.

I basically followed the diagram on Wikipedia in order to structure the algorithm. The way my algorithm encrypts messages follows this diagram (the decryption is just the reverse method as seen in Wikipedia):

In case the diagram fails to let you know what is going on, I have made an implementation in python without a strong key scheduling method here.

The main question I have is what key schedule method should I create/use/adapt for this cipher? A side question is any general improvements that could be done. The key schedule needs to be able to generate an arbitrary amount of keys and be able to take an arbitrary length key.


texts: How to alter text that was encrypted with AES CBC using PKCSPadding7

texts:
Assuming, I had a ciphertext along with its decrypted plain text result but not the IV or the Secret Key. (keep in mind that the text was encrypted with AES/CBC/PKCSPadding7).
How would I go about changing specific characters in the ciphertext?
For Example:
Ciphertext: 08226C1C87A83DDF02C54CF0802624D8
Plaintext: Apple1

How would I change the ciphertext to decrypt to Apple2?


texts: How to setup secure communications using AES-256-GCM?

texts:
I need to have a way to communicate securely over a local network. There are two computers, computer A and computer B, computer A is the server and B is the client.

B opens a channel to A, at which time A generates a session key, that it can then share with B. This certificate is good for one session.

The channel which joins them can be monitored, so a MITM attack is possible, but for the sake of argument lets say the attackers cannot intercept the session key.

The source code will be readily available for both the server and the host.

This must be able to be implemented using C and OpenSSL. Everything must me local so we cannot use a CA or trusted third party.

I am thinking I should use AES-256-GCM but I am open to other options using OpenSSL.

What would be the best way to assure the communication will be secure?

Thanks in advance.


texts:
I was reading the zerologon whitepaper by secura named:

Unauthenticated domain controller compromise by subverting Netlogon
cryptography.

I'm trying to understand the zerologon attack. The issue is on the KDF function (AES-CF8) that uses a IV with all zeros, I tried to follow the AES implementation with the block mode chosen and my main question is, the secret used on AES encryption is the computer password hash or the server nonce?
My guess is that it's the server nonce else the output of the AES would always be equal. Also, if am I correct, this explains the reason that 256 tries should be needed, because we have 1 possibility in 256 options in one byte (first one). Is it correct?
Also, the document has a figure showing the output of the AES operation with only 8 bytes, however the document state

The basic AES block cipher operation takes an input of 16 bytes and
permutes it to an equally-sized output.

The protocol just transfer the last 8? Or transfer everything and he just did it to illustrate?


texts:
I'm conducting an experiment dealing with differences in padding across different aes operations for my Intro to Crypto class, and the question says OpenSSL uses PKCS5 padding, and that I need to prove this. All we've been taught up to this point was how to encrypt something by doing this:

openssl enc -aes-128-cbc -e -in example.txt -out example.bin -K 1001001 -iv 0100110

Now my question, really, is: Where do you implement the padding into this shell command, or is the padding automatically added, and if it is auto added, why can I not see in it my hex editor?


texts: Why is RSA unsafe if N=pq can be factored?

texts:
I just started learning about cryptography and specifically RSA, and the texts I have read don't have a proof or explanation for why RSA is unsafe if you can factor N=pq, it merely asserted this. Is there a formal reason for this?
Thank you in advance :)


texts:
In a solution to the problem of finding $q$ in

$$
c_1^{e_2}\cdot 5^{e_1e_2} - c_2^{e_1}\cdot 2^{e_1e_2} = q^{e_1e_2} \bmod n
$$

it is given as:

$$
q = \gcd\big(c_1^{e_2}\cdot 5^{e_1e_2} - c_2^{e_1}\cdot 2^{e_1e_2}, n\big)
$$

How can $q$ be found like that?


texts: About numberical comparison in Attribute based encryption

texts:
The first CP-ABE scheme in [BSW07] gave an example how to present a numberical comparison (e.g., a<11) to a Boolean access tree. But it seems like this feature is not implemented in Charm.

In the paper, the access policy a<11 is presented as:

("0***" OR ("*0**" AND ("**0*" OR "***0")))

And one attribute a=9 is split to 4 attributes for encryption:

"1***", "*0**", "**0*" and "***1".

My question is:

Is it true that the access policy only use "0" bit string? If yes, it is safe enough to encrypt the message with 2 attributes "*0**" and "**0*" (i.e., "1***" and "***1" are not needed)?
Do you know a reference that describes how the choice of gates are made?


texts:
In complexity theory, how do you interpret multi-argument poly notation, such as $poly(a,b)$ or $poly(a,b,c)$?

Does it mean $poly(x)$ for $x=\max(a,b,c)$?


texts: Is it possible to generate a message using the mac and the key?

texts: Say that you have the Key and the MAC value that was generated from the Key using CBC.  Is it possible to generate a message with just the mac and the key?  If so, how would you do it?


texts:
I have some project encrypion real-time. I want use Voip SIP to implement the stream cipher.

What I have done so far :

Simple app android Voip SIP https://github.com/android/platform_development/tree/master/samples/SipDemo
Stream cipher. It can encrypt and decrypt file (but can't open it). It can encrypt .wav audio, you can play it and make weird sound. Also you can decrypt it again and make it back to normal.

My problem :

I dont know how to take audio to encrypt it and how to take the encrypted stream to decrypt it.


texts: Why is RSA usually limited to messages up to 1 block

texts:
I'm wondering why RSA encryption usually is only used for messages that fit into one block.
For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution of choice e.g. c.f.
Bouncy castle FAQ.

I know about the advantages of hybrid encryption considering

better performance
efficient handling of multiple and changig recipients

Are there any other reasons not to use only RSA?


texts: What is the cryptography job market like these days?

texts:
The security field seems to have jobs aplenty, but what about cryptography specifically? Is the field ridiculously difficult to break into, even with a relevant degree, or are industry/government/academia recruiting as heavily as industry is of software developers?

I already know of iacr.org/jobs. If that is an accurate representation of research jobs in cryptography, that particular area of cryptography doesn't look too good.

Is the government really the only game in town in terms of realistically getting a cryptography-related job, or is the job-to-competition ratio not too bad for industry jobs in cryptography?

(Sorry if I'm not supposed to post questions like this here, but I didn't see any mention of a ban on it. workplace.stackexchange just didn't seem specific enough to warrant good answers to this question. Also, I don't consider this an opinion-based question. The current supply and demand for cryptographers is a knowable, concrete fact, even if most people have only a vague sense of it rather than hard statistics.)


texts: How to guarantee every plaintext is in a rainbow table?

texts: This guide says that for a rainbow table or pre-computed hash chain, you can only get a probability that a plaintext is in a table, not a guarantee. Is there a way to guarantee every possible plaintext (of a certain length) is in a table? My thought would be by storing entire chains and generating more chains if a plaintext isn't in any of them, but I think that defeats the purpose of a rainbow table.


texts: data transferred when certificates are used

texts:
I tried to find some information about how certificates work on a technical level but wasn't really able to find something that answered all my questions.
Can one explain which data is transferred from a user A that sends a signed data package to user B, which data is encrypted or plain and how the verification works?


texts: Is it possible to get an RSA encryption key by comparing the unencrypted and encrypted file?

texts: Exactly what the title says. If I have a RSA encrypted file, and the exact same file but decrypted, can I tell the key that was used from that information?


texts: AES GCM vs other encryption modes in embedded environment for network traffic

texts:
I'm doing a lot of research since I'm doing an internship for a company where I need to upgrade their security level. Their own protocol needs a cryptographic upgrade and I'm leaning towards AES since it is well known (also good from a sales standpoint).

Now the idea is there are different modules which can talk to one an other with a specific self-design protocol. This entire protocol gets encrypted (It works on top of TCP).

Currently there is no good authentication, every modules has a secret key (the same, though one of the future wishes is to use a key diversification method) and the current way of authentication (knowing it comes from one of our modules) is because if it can encrypt/decrypt it has the key so it is one of our modules. which is cute but nowadays this could be done better.

So now for what I've figured out so far:
- GCM provides authentication (the company said their way of authenticating is good enough, i disagree).
- AES is fast and can be implemented in very little code. (I don't know about GCM but CBC works like a charm)
- With GCM making sure you have a secure IV is of the utmost importance. (It has scared me a bit when i read how much can go wrong with GCM)

My questions:
IS AES really the best way to encrypt a lot of network traffic or would a stream cipher like salsa20 (or any other stream cipher, i only know a bit about salsa) be better?

How can one make sure if you use GCM (or CBC) the IV stays secure, would simply generating a random number and then adding 1 to it be secure enough? I have the feeling it won't be, haha.

Like i said every module has a secret key (the same secret key), should this secret key be used every time as the AES key or should every x messages a new key be derived from this secret key?

Just to clarify, Things like full TLS would be to big to run on the hardware it would take up to much space and processor power but it is a light weight version of TLS we are working towards since the modules must eventually negotiate a crypto standard to use. <-- making your own encryption? not really though making our own combination might be as bad? I don't know.

As you can tell I'm quite new to all of this, i know the math behind AES and RSA but implementing it PROPERLY isn't remotely the same so I'm really careful with the things I do which is why i ask these elaborate questions.

EDIT: Should i have placed this on security.stackexchange?

EDIT2: the embeded specifications for our test device (other production devices will most probably have a better chip)
it's a 32-bit CPU with 100Mhz, 2MB Flash ROM (program storage), 32KB Flash ROM (for data storage) and 256KB RAM
see: Development board or RX63N group specifications


texts: hyperelliptic curve scalar multiplication

texts:
F = GF(next_primt(2^80))
x = F['x'].gen()
f = x^5 + x^3 + 1
H = HyperellipticCurve(f, 0)
J = H.jacobian()(F)
P = H.lift_x(F(3))
D = J(P)             # divisor

Is D the divisor? And can it be multiplied by a random integer to generate a secure parameter like the one used with elliptic curves?

And if this is correct, why is ECC time = 13.2 milliseconds, but HECC time = 185 milliseconds?


texts:
Let's say that I have a plain computational process that consists of several divisions and I do not want to do it with non-interactive homomorphic encryption.

I would like to ask how can I call this process: Until a division, I do the computations non-interactively. When I face with division operation, here comes interactivity. I should send encrypted numerator and denominator to a party and get the division result back. This second party should not learn the contents of numerator and denominator.

Since I cannot call the process, I cannot find papers to read. I want to use this kind of solution, but I am new to homomorphic encryption. I have experience with non-interactive homomorphic encryption. But I would like to get experience on this interactive one.

I have no idea which scheme I can use and how to implement this. Do I need garbled circuits for this?


texts: How to have a bound (upper or lower) of Gaussion distribution over lattice based crypto>

texts: In lattice-based crypto, we always need to sample 'noise' from Gaussian distribution, but how to measure the bound the noise? For example, if the Gaussian distribution is D_{u,\sigma}, where u is the meaning value and \sigam is the standard deviation, and we sample e \gets D_{u,\sigma}, then how to get the bound of e, i.e., |e|? Similarly, if \sf{e} is an n-dimension vector, what it the bound of \sf{e}, i.e., |\sf{e}|? I am confusing how to use the meaning value u here?


texts: How to use Galois LFSR to find multiplicative inverses

texts:
My question is how can a Galois Linear Feedback Shift Register be used to discover multiplicative inverses of polynomials?

This is a homework assignment. Here is a list of things I did before asking here:

Learned about finite fields
Learned how to do modular arithmetic with polynomials
Learned about multiplicative inverses in Galois extension fields
Simulated several different LFSRs on paper
Plowed through all of my course material

I've got nothing.


texts: When does a multiple Vignere cipher become intractable?

texts:
Multiple Vignere ciphers do not repeat the key until the message gets longer than the LCM of the cipher lengths.  Are messages shorter than that safe?  If not, what is the attack strategy?

I believe there is a known plaintext attack which has an algebraic solution if the message is longer than the sum of the cipher lengths.  Are messages shorter than that safe?

Are messages shorter than the longest key in the set of ciphers safe?


texts:
Let talk about Implementation and performance analysis of
Barkan, Biham and Keller’s attack on A5/2. In this paper, mentioned that we need to brute force attack on register 4 ($R_4$) to get keystream from below:

$$HP^{-1}C=HP^{-1}K.      \tag{1}$$
Where $HP^{-1}$ is parity check and $C$ is ciphertext and $K$ is keystream.

On the other hand, the equations on the key stream must be adapted into equations on the variables of the $LFSRs$. So we have the following linear
system:

$$Sr=K. \tag{2}$$

where $S$ is multiplication matrix of size $1368*656$ and $K$ is the concatenation of $3$ unknown key streams $k_1$, $k_2$, and $k_3$, and $r$ is the vector of unknowns representing the state of the $LFSRs$.

Where is $R_4$ influence in the first equation?
How we can construct the second equation(Please with details)?


texts: RSA finding p and q integer with condition

texts:
I'm given $N=p\,q$ and told that $44\,p\approx 17\,q$ (with the value given for $N$ some 49-digit integer 8124642558124642555899928124642555899924479992447).

In RSA $p$ and $q$ must be prime.

So how can I solve this equation?

I'm using Maple, I began with s := evalf(solve(eqns, [p, q])) with eqns := {N = p*q, 44*p = 17*q}.

The result is not a prime number. How can I put another condition to force $p$ and $q$ to be prime? Or am I missing something?

Note of the editor: superlative HUGE removed for $N$, since it is way too small for RSA being secure.


texts: Verify commitment C commits to the same value that E encrypts

texts:
Given the following (using additive notation):

$G$ - generator of an elliptic curve group of order $q$
$s$ - secret drawn uniformly from the distribution $1..q$
$k$ and $K$ - a private public keypair
$E$ - an encryption of $s$ under $K$
$C$ - a commitment to $s$ such that $C = sG$.

Note that it's important that $C$ is formed as $sG$ - though pointers to general literature using any kind of commitments that satisfy the below problem would be appreciated as well.

How can I produce $E$ in such a way that, given $E$, $C$, and $K$, (and some other normal public info like generators, etc) one can verify that $C$ commits to the value that $E$ encrypts?


texts:
Let $p$ prime number $q/p-1$ prime and $g\in (Z/pZ)^*$ element of order $q$.Also $a\in \{1,...,q-1\}$ the private key and $y\equiv g^a\pmod p$ the correspoding public key.For each of the following systems ElGamal give the verification(authentication) algorithm of signature $(r,s)$

$r\equiv g^k\pmod p$      ,$s\equiv k^{-1}(h(m)+2ar^2)\pmod q$
$r\equiv g^k\pmod p$,$s\equiv kh(m)+ar\pmod q$
$r\equiv g^{-k}\pmod p$,$s\equiv a^{-1}(kh(m)+r)\pmod q$

Can anyone give me any hints to solve this problem?


texts:
Am I thinking about this correctly?

  Consider that the keyspace of the Playfair cipher is equivalent to all permutations of the alphabet, e.g. the number of distinct permutations of 25 objects, and is equal to $1.551 · 10^{25}$. (A lot!)

  1)    What is the keyspace of Four-Square, when considering both keys, as presented in this class?

Reading through the modules presented in this class, one may find:

  Like Playfair, the four-square cipher is a polygraphic substitution cipher. However, this cipher uses four 5 by 5 (four squares) boxes instead of one.

Using wolfram , you can see that $1.551 · 10^{25} =$ a very large #.
Since 4 square uses 4 boxes instead of one, we get: $1.551 · 10^{25} · 4 = 6.204·10^{25}$, which is our keyspace (another huge number).

  2)    If the alphabet for a Four-Square type cipher contained: uppercase, lowercase, the digits zero to nine, and the ligatures 'ae' and 'ce', in that ordering, (that is 64 codons); and the Four-Square tables were also extended in size to hold all of these characters, without omitting Q or combining I and J, what would the keyspace be? Would there be any problem working with this cipher?

Now there are 64 objects to deal with instead of 25.  Consider if this was a Playfair cipher: $1.551 · 10^{64}$
Again, since 4 square uses 4 boxes instead of one, we: $1.551 · 10^{64} · 4 = 6.204 · 10^{64}$.  Even though this is a lot more than our 25 codon keyspace, there shouldn’t be any problem working with this cipher (although you may need a super computer):

  The encryption procedure is simple; find the first character of the plaintext digraph in the box that is keyed with $k_1$, and the second character of the digraph in the box that is keyed with $k_2$. Then complete the square, giving the first character of the cipher text digraph is that is located in the upper-left box; and giving the second character that is located in the lower-right box.


texts: Diffie-Hellman server/client generated secret size

texts:
So I have implemented a client and a server performing Diffie-Hellmann, however sometimes the symmetric key is not valid?

Example:

Prime: 23
Primitive root: 5
client secret: 14
server secret: 16

This results in a faulty generated symmetric key.

Client shared key:      $${5^{14}\mod 23}=13$$
Server shared key:      $${5^{16}\mod 23}=3$$
Client "symmetric key": $${3^{14}\mod 23}=4$$
Server "symmetric key": $${13^{16}\mod 23}=8$$

So we can conclude that the provided arguments resulted in a faulty Diffie-Hellman since $4\ne8$.

What is the rule for the pseudorandom generated secret keys of the server and the client?

Javascript is used for the calculations, e.g. 13**16%23.


texts: Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?

texts: Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the registration phase, the authentication phase and the authenticated key exchange phase? Normally, we should separate these different phases, but, for examples, when we discuss the authenticated key exchange, it implies that authentication and registration are executed in advance.


texts: How to securely map an element from an smaller domain to the other element in a large domain

texts:
Problem: I have a small sized domain, say s-bit. It's clear that the probability for an adversary to guess an element is $ \frac{1}{2^s}$. I need to make the probability negligible. However, I need to use a public encoding (or mapping) techniques, so anybody can map its elements from an small sized domain to a big one.

Question: What techniques can I use?

Please note that encoded data is going to be computed, so public key encryption naively may not work, as different participants have different keys. Thus I'm wondering if there is any generic encoding technique that does not require any secret keys.


texts: Does encrypting twice using the same block cipher produce a security weakness?

texts:
If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system.

Is this the case?


texts: With TLS and ECDHE, how does curve selection work?

texts:
Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the DH keys work?

Is the curve somehow negotiated and if so how does that work (in the context of TLS)?


texts: How to determine which type of transposition cipher I have?

texts:
I have some ciphertext that I have determined using frequency analysis to be most likely encrypted using a transposition cipher, as the letter frequencies are similar to plain English language text. I believe the next step should be to determine which transposition cipher it is, but I don't know how to do that.
Am I right to assume that what I have is definitely a transposition cipher? And if so, how do I determine which transposition cipher it is?
For what it's worth, here is the ciphertext I have. But (as asking for decryption of a specific ciphertext would be off-topic here) I'm interested in general techniques that could be applied to any ciphertext.
CTCRAL TYNIH ORFLN NLONH LTOWH SLINI IIEER NOENT AHRNE NWAAM CTEAK ERDHH
DMIOD AEINA YTFEI IEINM FSTGI UOVED GLMEI YINEE EYNGS BSCRA TUVGU UEIEV
OHIDA TISRO IEEEA TETMG RSFHD DHARA ICSEU EVHNS WIYII YIRND TFVCX GSMVL
IUELH RETRG NNREC ONEYI OTLUN SBRSH AIIEE TTOOI ESCLS KWSLE ETGHN EOTNU
STGIM EEACR TAEEN LAPEH RHNHE GWIEH EWRNN UETHT EPREN SDNFW YUFGI TUEAY
ETLMR TBIPW UPANI OEFUS RSEAT NRTDP RENOA EETIL HNNAD HECWD TTILI UECDT
DTLAM RQERS MVVTR HYTYO UFOAM ONCNS NFSST EEVHA YHERE OEONM RE- GAO HCVLO
COIYT HSENZ FAHHL LYRII USBAS IEHEO IOSOT TILAI EOGOT ETEHL DEENP AEISP
IDDMT RHNBI EEEMO NTIOE ISGZE SEAEE IDLNI TRTTD RIDUT PTNIY NIYNQ MMMIR
BDAOI AYDOT DTELG HAIHO BDESA RSYLN HNWCN TRLRE NTAMN AESEI EHAEY NHGMO
REFOT TFTUP AEREE HTONG OISHT TVEHO MSEFO OLINE TOLET SOATR AERTC TGEGT
STTNA ONNTG OHAIA TYUOT IIARN TENCO TKGAU TSEHH EIBWO SDTUW INDTR UECHC
RSEAT DEOEW ENWFA ELGKM


texts: Decryption issue with self-coded AES-128

texts:
I have written my own AES-128bit implementation in Java, till yesterday I thought it would be alright. (I was working on the encryption)
Now I’m trying to decrypt my encrypted cleartext, but this fails..

So, I hope I can ask such questions on here..

My Cleartext is: abcdefghijklmnop

This will be converted to the State Matrix (4x4, hexadezimal):

61 65 69 6d
62 66 6a 6e
63 67 6b 6f
64 68 6c 70

After that, it is going through the 10 rounds (The Key is generated randomly at the beginning, after that computed for every next round, will change that to a hash function later):

Round 1:

    2c d3 db c6
    3c 31 83 91
    21 a9 f5 0d
    48 9c 69 0a

Round 2:

    9f 81 b2 c8
    6e 4a 61 94
    0a b8 cb a3
    a4 4c 6c 57

Round 3:

    01 3e a4 af
    f0 69 fe 64
    1f de 19 e1
    cf a6 78 9e

Round 4:

    d0 c9 40 e5
    bd 81 de dc
    8c 5a fd e2
    61 84 37 65

Round 5:

    19 51 92 00
    63 f4 e9 33
    15 48 8e ba
    13 ae 7e 7a

Round 6:

    1e 75 41 3d
    34 ed fe 24
    f6 02 64 39
    ea 94 50 b1

Round 7:

    a9 6a 6e 8a
    7d 84 59 dd
    b3 11 f3 d2
    4d d8 e2 9c

Round 8:

    e4 c3 89 0a
    60 0a 29 e9
    91 68 2c e4
    13 23 e0 d8

Round 9:

    24 c2 1c db
    87 8c 22 bc
    0b a8 3d e9
    35 c2 3f 21

Round 10:

    a9 58 3c 76
    c0 db 39 20
    58 db 80 3d
    b6 63 b4 4e

And the KeyBlock from the beginning is:

d2 66 1b 52
08 fb 35 20
76 e9 11 1c
d3 7d 36 e0

And now, if i do the encryption backwards (with reversed tables and so on), i got this:

Round 1:

    bf 5b d2 27
    df 15 d0 d8
    a6 70 69 07
    b8 4c 4c 47

Round 2:

    89 16 66 bc
    1c 22 0e 56
    bc db f0 77
    7f b1 9e d4

Round 3:

    bf ac 65 b8
    70 70 8c a4
    ef 6b 38 cc
    63 13 ef 3e

Round 4:

    28 ba 4b bd
    44 63 d2 8c
    33 aa ab 76
    ba 71 02 00

Round 5:

    ef 45 ee b9
    fd e3 ce 09
    1a 91 de 70
    b2 95 22 2b

Round 6:

    6c 95 6a c3
    91 12 ec 27
    62 df b7 49
    ad ac 11 56

Round 7:

    8a f5 d9 c7
    68 0d be 3e
    b0 58 45 bc
    68 a1 ad b9

Round 8:

    45 11 77 dd
    84 cd f0 87
    20 06 e8 3e
    fe 32 4b e3

Round 9:

    97 77 6c 8f
    8c 36 c5 a7
    56 ef f9 22
    2d 4f 7d 03

So as you can see, there is something going on wrong.. I used this paper as main source of information (It’s in German), and I also used many other sites and Wikipedia (English Version) about Rijndael.

If someone can tell me anything with this information, that would be very very very cool, besides that I can also provide the source via email.


texts: Can hash functions improve a lousy PRNG?

texts:
If I have a poor PRNG, could a cryptographically secure hash function make a better output?

Say the PRNG can produce as much numbers as you wish, reasonably random, but not good enough to be used in crypto applications.

If I split the PRNG output into chunks, say $128..512$ bits, and feed those to a cryptographically secure hash function, could it be that the result is somehow "better" or more secure than the original pseudo random string?

If I got it right Fortuna does something like that. Could it be?


texts:
As far as I know, in IGE mode (infinite garble extension) each block depends on the previous one.

In that case, can the encryption be parallelized? Is there some way to do it?


texts: Implementation of a side channel attack?

texts:
As homework I need to find the password of a crackme in ascii-coded binary. We were also given a specific part of the crackme (in the image below), which we will need to use a side channel attack against, most probably a timing attack.

I know that, based on the function given, you can find out the right password length, since the program would take longer to compute when the length is right.
I'm just not sure how I would implement the timing attack.

Could somebody please help?


texts: Finding the AES key with access to the function

texts:
Say an attacker has access to a non-rate-limited API that takes (IV, data) and outputsAES-CBC(key, input, data), with the key remaining on the server side. However, the attacker can pass any (valid) IV and data that they want in an attempt to recover the key.

Is there any optimal way to recover the key with such access?


texts:
Is there such thing as "hash reset sequence" that brings hash to the same known state?

A hash function has a state. In MD5 and others vulnerable to the length extension attack, the attack works by continuing computation from existing hash.

So, the question here is - when I continue computing hash, is it possible that there is a sequence of data that will start moving the hash function output into some known corridor with known results? Similar to http://numericana.com/answer/magic.htm#1089 and other magic tricks.


texts: DFA on aes Giraud's attack on 10 th round

texts:
I am trying to implement an attack on aes using Giraud's attack on the last round of aes using a fault injection of one bytes
here is the situation
normal byte in the 10th position (1,2) of the 4x4 matrix s[10]= 0xdc => 1101 1100
other corresponding bytes of 3 itérations                s^[10]= 0x13 => 0001 0011
s^[Nr] = 0x0e => 0000 1110
,                                                       s^[Nr] = 0xe8 => 1110 1000
I tryied several time to implement this algorithm, no result:
in this document, giraud's algorithm is explained here page 59-60


texts: How exactly would someone crack a private key passphrase?

texts: Lets say for a PGP/GPG pair with a passphrase.


texts:
I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme?

Like 100 possible?


texts: How insecure is AES-128-CTR to encrypt any kind of data using the Ethereum keystore file format?

texts:
I am using the Ethereum keystore file format to encrypt any other data such a plain text or JSON.

Here is an example of pseudocode of the implementation:

MY_PASSWORD = "VeryDifficultPasword432131!@!#%"
MY_TEXT = "This is my secret text"

iv = randomBytes(16)
kdfparams = {
    dklen: 32,
    n: 262144,
    r: 1,
    p: 8,
    salt: randomBytes(32)
}
key = scrypt(MY_PASSWORD, kdfparams)
ciphertext = encryptCipheriv("aes-128-ctr", MY_TEXT, key, iv)
mac = sha3(key[16:32], ciphertext)

With this code I can generate the keystore file that looks like this:

{
    "crypto" : {
        "cipher" : "aes-128-ctr",
        "cipherparams" : {
            "iv" : "83dbcc02d8ccb40e466191a123791e0e"
        },
        "ciphertext" : "d172bf743a674da9cdad04534d56926ef8358534d458fffccd4e6ad2fbde479c",
        "kdf" : "scrypt",
        "kdfparams" : {
            "dklen" : 32,
            "n" : 262144,
            "r" : 1,
            "p" : 8,
            "salt" : "ab0c7876052600dd703518d6fc3fe8984592145b591fc8fb5c6d43190334ba19"
        },
        "mac": "102aedfe8c308c735a76295f9908d9b7de40fb1c07f2f71e05de7a0b2f323a12"
    }
}

This is the standard file that store millions of dollars of people in Ethers.

Questions:

Is this secure?
If not, why?
If yes, is also secure
encrypting plain text or JSON (no hexadecimal format)?
Is secure to set a smaller kdfparams.n?

Edit:
To clarify why I'm asking this is because another person said this:

  This is not secure at all. This implementation contains many basic errors. One example is using
  an insecure random number generator, which utterly destroys the
  security of the encryption. Another is using AES-128-CTR without
  authentication.


texts: Can I map 2 plaintext letters to 1 ciphertext letter?

texts:
Plaintext: "abcd" where P1,P2,P3,P4 map to each corresponding letter.
And C is the ciphertext where C1,C2,C3,C4 map to each corresponding letter.
Keys = (x,y,z)
Can I use the following encryption algorithm? Is there a corresponding decryption algorithm?
C1 = xP1 + P2
C2 = yP2 + zP3
C3 = P4 + zP3
C4 = xP3 + yP4

It doesn't seem like I could reverse the encryption algorithm to get the decryption algorithm.


texts: Is overflow-ing possible in CKKS FHE scheme?

texts:
I'm using the CKKS Fully homomorphic scheme using Microsoft SEAL, and wonder what will be the result of overflowing a certain floating point variable? Is it even possible to do so?
I found a statement here that overflows can't be detected. If not detected, then what will be the decrypted result?
Thanks!


texts: Is finding a three way hash collision infeasible

texts:
Is there an equivalent to the birthday paradox for more than 2 messages.

Solving Hash(x) = 0 takes $2^{bits}$ steps on average

Solving Hash(x) XOR Hash(y) = 0 takes around $2 ^{bits/2}$ due to the birthday paradox.

Is there an algorithm that can solve Hash(x) XOR Hash(y) XOR Hash(z) = 0 in $2^{bits/3}$ steps (or similar)?

If so, does it get easier to find a solution if you add more terms?

[edit]
The second post by Squeamish Ossifrage is what I was looking for, thanks.


texts: Asymmetric non-interactive proof of work scheme

texts:
I'm looking for a non-interactive proof of work scheme. I want for it to (1) be faster to find solutions to if you're in the possession of an arbitrary secret, like a private key, and (2) for the domain of the solutions to be bounded, so that if you're in the possession of the key you can trivially enumerate the solution space.

For instance, a function $y = f(x)$ that takes T time to run where $x, y ∈ \{0, 1, 2, ... 2^{32}\}$, and has a fast inverse function $x = f(y)$ that takes $T'$ time to run would work. Then, if $T = 100\ ms$ and $T' = 10\ \mu s$ the solution set could be enumerated in 12 hours with the secret key, but 19 years without it. Of course, the higher $T/T'$, the better, but preferably at least above $10^3$.

An algorithm based on standard RSA or such satisfies (1), but not (2); the solution space is too big. Otherwise, the following algorithm would work: encrypt a nonce, if the ciphertext ends with sufficient zeroes it's a solution, else try again. The secret inverse function would just be decryption for every solution in the solution space.

A partial hash inversion puzzle satisfies (2), but not (1): try to hash a nonce $n$. If $H(n)$ ends with sufficient zeroes, $n$ is a solution, else try again. But you can't get any edge for enumerating the solution space with some given key as I see it.


texts: How to obtain a one-value share in Shamir's secret sharing

texts:
This is a trivial question, but I had to ask:

since each generated share in a Shamir's secret sharing scheme initially consists of a pair of values (representing the coordinates of a point on the plane), how do I reduce the two values to one, so that the share that I eventually hand out will consist of only one value?

The way this is normally done is:

Share #1: (1, 65428)
Share #2: (2, 935747)
Share #3: (3, 3524)

But this does not seem very satisfactory to me, because the share still consists of two values, as the share's number (which could be seen as a metadata) is still one of two values. This way of doing is also inconvenient in the sense that if a share is marked as Share #7, this normally implies that there are at least 7 shares, possibly more.

The solution I am looking for is a way to have shares with totally random x values, such as

(324,4634634)
(23, 945)
(8, 45634)
(944, 356345)

and no serial number on a share (e.g. Share #8), so that by intercepting one share, and adversary cannot even try to guess how many shares there are.
Of course, the share generating mechanism is exactly the same. The only difference is that the x values, instead of being 1, 2, 3, 4… are random numbers.

So, now the question is: assuming I decide to use random x numbers, how can I conflate the two values of each share into one value, also assuming that no external (metadata) markings of the share (e.g. share #3) will be used?


texts: what is the relationship between epsilon and sensitivity in the Differential-Privacy?

texts:
In some Differential-Privacy(DP) papers, they use epsilon as the x-axis in the figures of the experiments' result while other papers use the sensitivity.

What is the relationship between epsilon and sensitivity in the DP?
How can I compare the results of different papers?


texts:
Is the following function a secure PRG?

  Given $F$ is a secure PRG and $k$ is choosen random from key space $K$.

  $$G(x) = F(k,x) \oplus F(k,x \oplus 1^s)$$

My solution is $x \oplus 1^s = x'$ so $G(x)$ becomes $f \oplus f'$ with $f = F(k,x)$ and $f' = F(k,x')$. Clearly $f$ and $f'$ are PRG, i.e. generate random strings; and $\oplus$ of these will be random.

Correct me if I am wrong.


texts: Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte?

texts:
Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte?
Interpreting it byte by byte makes it easier to process, but in case one of the shareholders decides to tamper with some of the bytes in his possession, this will affect the secret reconstruction.
This is a serious risk, and I don't know how it could be prevented.

Would it be sensible, as an alternative, to interpret the secret message as a whole string, instead of byte by byte, transforming it into an integer? In this case, what I am worried about is the huge size of the integer...


texts: What SMPC protocols make use only of additive secret sharing?

texts:
In Appendix G of the Hawk paper, where it talks about financially fair SFE, it mentions that it's possible to run a SMPC protocol where, at the end, each party has a share of their own output y, and a share of a nonce ρ, where ρ must be reconstructed in a fair exchange, and the party obtains their output by computing xor(y, ρ). In Theorem 3, the paper implies that the underlying secret-sharing protocol is information-theoretically secret against n-1 corruptions (i.e. t=n) and that this SMPC protocol is UC-secure against an arbitrary number of corruptions, while still being able to evaluate arbitrary functions.

This is a much better security property than any SMPC protocol I'm aware of, and certainly better than what I've come to expect of SMPC. I've tried looking up this protocol, but with no name or citation I can't find anything. What SMPC/secret-sharing protocols satisfy all these requirements? I want to learn more about them.


texts: I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the IV in front of the AES-GCM data, or do I need to protect it somehow?


texts: My encryption message system & question about security

texts:
I made this small tool for make & read easily an encrypted message without nothing to install, just a simple private key like a word or a couple of words to share. (Without say it directly of course but with a guess, like a place gone together with the correspondent, renembered).
I think the result message and the system is not bad to run safely for my (basics) needs, anyway an expert view could be great!
Please note i am just someone who like learning new things, really not an expert into coding or cryptography!

I used this tools:

Cryptoxi is the primary script
jcryption for aes256 browser encryption
Mcrypt for serpent256 server encryption
Tinymce
Base64 drag &drop
jq
jq-mobile
(..)

Here is the routing process:

Client connect, send an automatic unique hash generated by javascript, server respond a main and unique key based on the previous hash. This is used for
encrypt all
       future GET and POST requests with aes256 into browser by javascript.
Client input a private key, write his message with pictures if need, validate for convert into html and base64 for
pictures.
Client send this trough the AES tunnel to server.
Server decrypt aes, encrypt into serpent-256 & re-send it encrypted to client trough aes tunnel again,so final message is encrypted into serpent256 only. Then client send it by their own tools, like mail or sms.
Receiver do the same process on the other side by pasting or just click the generated url with the encrypted hash (Whith ?bin=... php variable on it) and of course by writing the private key.
When both user quit or refresh the page, keys and internals data are destroyed.

Here the site, sorry it's French, hope this is not a too big problem!
http://cryptop.at/m_.php. Also a YouTube video description (also in French).

So the question is, Do you see some kind of security hole?

Of course the main problem looks like if the primary hash is intercepted, but this allow only one connection, one time, so I think it's just impossible to catch & use this hash for reed the second user private key, or I am wrong?