texts: AES-GCM for Securing Bluetooth Low Energy Application

texts:
I have a task at hand on designing security on Bluetooth Low Energy application layer. The system is created so that only smartphones with symmetric key (long term) could communicate and control my BLE device. The symmetric key will be stored securely on cloud server and programmed on BLE device with JTAG read protection. The mechanism to distribute this symmetric key to intended smartphone is outside the scope of this thread.

I use AES-GCM on my embedded processor and phone app. It can be summarized like this:

Smartphone request connection to BLE device
Smartphone read a characteristic which will respond with a challenge $C$:
$C = \operatorname{AES}(K, S, N)$
$K$ is the symmetric long term key
$S$ is 1-byte of secret generated randomly by BLE device
$N$ is nonce/IV controlled by BLE device and starts from $0$
Smartphone prepares the legitimate command $I$ by encrypt and authenticate with incrementing the nonce received by $1$:
$I = \operatorname{AES}(K, D_{0} \mathbin\Vert S, N+1)$
$D_{0}$ is the opcode for specific operation for BLE device
BLE device then increments its nonce to $N+2$ for future smartphone connect and read the challenge, and so on...

At first I though it would be secure but later I found that it might break if someone impersonate BLE device (MAC address clone) and replay the previous legitimate response such as:

Smartphone request connection to impersonate device
Smartphone read a characteristic and impersonate device replies previous challenge:
$C = \operatorname{AES}(K, S, N)$
Smartphone does not know about previous challenge and proceed with:
$I = \operatorname{AES}(K, D_{0} \mathbin\Vert S, N+1)$
I think this would not be a problem if the data is the same $D_{0}$. However if the data is different, lets say the phone would send $D_{1}$ then:
$I = \operatorname{AES}(K, D_{1} \mathbin\Vert S, N+1)$

It leads into condition where different data is encrypted and authenticated with same nonce. I am worry that adversaries could recover the long term key.

My problem seems similar with these:

Establish a secure connection between a Bluetooth Low Energy device and an Android App using ECDH
Encrypting small packets with low data rate

But it uses ECDH while my system does not use public key cryptography

My questions are about:

If I use a mechanism to produce symmetric session key before proceeding with above flow. Is it one of solution to mitigate the above problem?
What is the good mechanism to securely generate session key when both parties have that same long term symmetric key?

I have a true random number generator on my BLE hardware and for apps I can use secure random number generator library but my knowledge is limited on key exchange technique.


texts:
I have to implement protocol of secure data transfer that can be described as

Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table)
Alice encrypts selected data with some symmetric(!) algorithm and sends it to Bob.
Bob decrypts data and get $m$
Bob verifies that $m\in M$. It's important to realize here that Bob have no need to authenticate Alice, he must only be sure that $m$ is belong to $M$. However, Bob have no direct access to $M$
If $m\in M$ then Bob sends $m$ via secure channel to Carol, else Bob ignore the $m$.

In other words, Bob serves as a gateway that provide secured communication and keeps Carol away from flooding of invalid messages.

Is there a protocol to achieve my goal? Please share any thoughts about it.

P.S. I don't want to use any TTP.


texts: What is the cost of encrypting of long message with public-key cryptography?

texts:
Let m be a message of arbitrary size, potentially very large.
Is it necessary to use larger parameters in the public-key encryption scheme in order for the receiver to decrypt that message?

My guess is that, in the case of RSA, the size of the message cannot exceed the size of the modulus. I assume this holds for any public-key encryption scheme.

If so, what kind of algorithmic complexity are we talking about: is it linear in the input size (the message), or worse? [I assume it's worse]

EDIT: I don't want to use symmetric-key cryptography.

EDIT 2: You can assume that we possess a secure channel over which we'll send the encrypted message.


texts:
I am writing an application, running on a server, where multiple users access data from a database which is AES encrypted with a master secret. The master secret itself is initially randomly generated, and then AES encrypted with a user-secret to yield a 'user-hash'. The master secret is never stored, but the user-hash is stored in a database.
When a user enters his user-secret, the user-hash is decrypted to temporarily (on the fly) yield the master-secret which is used to decrypt the data. The data is then send to the user.

If a user is deleted, the user-hash is deleted. He may have saved decrypted data, but cannot decrypt further data.

The question is: How safe is the master-secret in this constellation? If the database is compromised, an attacker has access to the user-hash and the encrypted data. If the attacker was a user, he may also have decrypted data. Will he then be able to break the master-secret?


texts: what kind of custom header add to encrypted file to identify my encryption,consider safe and reliable.like pseudo format extension or file size

texts: I want to  add some  custom header to encrypted file to identify my encryption,consider safe and reliable.like pseudo format extension or file size.Is there any algorithm or tool to make it?


texts:
Shannon's paper states:

  A system is pure if all keys are equally likely and if for any three
  transformations, $T_i$, $T_j$, $T_k$ in the set, the product
  $T_iT_j^{-1}T_k$ is also a transformation in the set.

But this is exactly the construction of Triple-DES! So, using this terminology, it is not a pure system, since that would mean a 56-bit DES brute-force attack could be successfully mounted against a 168-bit Triple-DES key. Is that right?


texts: Is the "grain" in this converted image indicative of Steganography?

texts:
I'm checking an image in every way I can for steganography. I've checked the file signature, compared it to it's original source and extracted the pixels, many methods but nothing's coming up. Apologies if I say something that isn't right because I'm very new to cryptography, especially steganography.
However something I was recommended from a hacking CTF guide was converting the file to .xmp to view the palette. So I used imagemagick in my terminal to do so. The result has some weird "grain" around areas of the image and I wanted to know if this was just due to the image conversion or if it may be bytes that have been tampered with and indicative of steganography.
Sorry if this is a dumb question because I figure it's likely due to the image conversion, but I just wanted to check.


texts: What to watch for with openssl generating weak keys? (low entropy)

texts:
(Disclaimer: I am regular software engineer with only basic crypto knowledge, so helpful if can be explained for a layman.)

I am concerned about generating weak keys on a shared linux box with openssl.  Some questions:

How low does entropy have to be for it to be dangerous?  If I run cat /proc/sys/kernel/random/entropy_avail i get anything from about 130 to a couple thousand. And it seems to fluctuate quickly.

Is an attack feasible at 130, or how low would it have to go (50, 10, 1, 0)?  I haven't seen any hard numbers on this.  Is the attack just theoretical or how much work would it take to break it in practice?
Does openssl block until there is sufficient entropy to generate a key?  My understanding is that /dev/urandom does not block and is the default, but /dev/random does.  I assume /dev/random is not the default for performance/consistency reasons?  Is there a flag or option in openssl where you can choose to use /dev/random instead in case you want to be sure?
On a shared box, is there any way a neighbor could deplete all the randomness on the system, and force you to generate a weak key?  It seems like blocking until there was sufficient entropy would solve this (#3) above.
Given a public/private key you've already generated - is there any way you can prove it was generated with low entropy?

Sorry for multiple questions, but they seemed related so wanted to post it as one.  Many thanks!


texts: Ranking "amount of randomization" in a sequence

texts:
I'm facing the problem of implementing pseudo random bit generator (PRBG) on a very low power device. NIST.SP800-22 "Statistical test suite for Pseudo Random Generators" suggests a suite of 15 tests for randomness.

Is there a way to use those tests as "randomness measures" except from pass / fail?

That is, suppose you want to do changes in your random generator, and to measure, whether you improved the randomness or not. The NIST suite suggests a way to decide whether you are random or not, but its hard to extract the information of "improvement": For two different algorithms, it may happen that for some tests the first gives higher p-value, for other tests the same PRBG gives lower p values, although both pass all tests. So'

is there some "measure of amount of randomness" test, or or how can NIST tests turn to be such?


texts:
I'm building an application where users can be a part of groups, and can obtain and distribute URLs from the group page that allow anyone who clicks on them to join said group. Groups should not otherwise be join-able without a proper URL (or an invite from within the system, but that's another matter).

Currently, I have it set up so a URL to a group looks something like "host/JoinGroup?groupKey=ABCDEF", where the groupKey is a ciphertext created by encrypting the group's ID# using AES with a static key and IV across all groups (which I know is normally bad). Doing this, I can decrypt the key on the server and use it to determine which group the user should join so I can update the database. My goal with this is not to hide what is being encrypted, but rather to make sure it is very hard to generate a valid groupKey and join any group they want.

With this in mind, is this method insecure? I know the standard IV reuse attack allows someone to find the XOR'd plaintext, but I'm not trying to hide the plaintext, just the key itself and valid ciphertexts, so that an attacker can't generate valid URLs. Should I change the IV used for each group, but continue using a static key? Would using a keyed hash (i.e., "host/JoinGroup?groupId=5&groupKey=hmac_of_groupId") be better?


texts: How to prove that a rainbow table is complete?

texts:
Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well.

But I am missing something about the rainbow tables; how can one be sure that the hashes for all valid passwords are covered by the table ?

Lets say the passwords are 8 characters are long from [a-z][A-Z][0-9]. If I am constructing a rainbow table with 10000 hash & reverse iteration in a chain how can I determine at what point the table is complete ? ie: the password and the final hash stored includes the hashes for all the 628 valid passwords somewhere in the chain ?

Is there a mathematical way to verify the completeness of a rainbow table ?


texts: Would buffering socket send resist timing attacks

texts:
I have been reading and thinking about timing attacks on cryptographic systems. The answer to this question mentions the following:

"The way to defend against timing attacks is to make sure the time taken to execute cryptographic operations does not depend on any secret information."

My question is, assuming a model where an adversary is connected to an oracle via networking, would write buffering socket.send at the application level to only occur every x milliseconds protect against crypto operations that would otherwise leak data?

My idea is to use the select system call say, every .01 seconds, to handle any reads and writes. Since data would only leave the server at constant intervals, does it matter if short circuit comparisons or the like were used?

The most obvious downside I can think of is that it would add some latency to all application network requests, even non crypto related ones.

Is this a valid defense against side channel attacks in situations where networking delivers the queries/responses?


texts: Why encrypting with private and public keys produce the same result?

texts:
Let say $e = 5$, $n = 119$ and $d = 77$. If I encrypt, for example, $m=15$ I get:
$$m_1 = m^e=15 ^ 5 \mod 119 = 36\qquad\text{and}\qquad m_2 =m^d= 15 ^ {77} \mod 119 = 36$$. Why? Is it always like that in RSA? Is it bad?

My question was prompted by an answer to Why hash or salt when signing? : why does this work?


texts: Password derived hash to encrypt known plaintext as password check

texts:
The title sounds way too adventurous for what it actually is. I am currently building a system which features some encryption. There is already a system in place, which is built after that scheme if somebody is interested in more context: https://stackoverflow.com/a/44925718/5395110.

As a next step I have to plan user authentication (typical username-password-login). First I thought of a standard password-hash approach using Argon2i hashing. That sounded reasonable but then I realized that with enough bad luck I would essentially give the attacker a free pass to the data in combination with the already built system. To prevent that I thought of integrating password checking into the existing system and get rid of any hash stored as plaintext.

What I came up with:

User inputs password and sends it to the server
The password gets hashed with Argon2i => hashed password
Hashed password is used to decrypt a AES-256-GCM-secured ciphertext
If the ciphertext can be decrypted and is equal to a known static plaintext then the decryption was successful and the password is valid

So my question: Is a password checking system that uses a password-derived key to decrypt a authenticated block cipher to determine validity a reasonable alternative to just saving the hash?

The advantages are that there is no hash which can be extracted so an attacker would have to first find the key to the AES-container and afterwards find the plaintext to an Argon2i hash which seems like a very unrealistic task.

The bad feeling I have with this method is that it would probably work but completely miss the point of a authenticated block cipher since what I'm essentially doing is generating a HMAC of the hashed password(secret) and the known plaintext reference password(message) in a weird and unnecessary complicated way.


texts:
I am wondering about the crypto-period for keys used in pseudo-random functions.

For example, let's say I am using HMAC-SHA256 with a secret key $K$.

After how many computes do I have to update $K$?


texts: Block cipher linearity (in relation to hill ciphers)

texts:
So while I knew hill ciphers were a form of block cipher (I'm assuming all the ones I have solved to date were ECB or something similar), so that got me thinking. Is it possible to use hill ciphers in other modes (ctr, ecb, cbc etc) on a binary alphabet?

A) Could you provide formula/examples of how it would work?
B) How would one launch a plain text attack against these?
C) How would I protect against this attack?

CTR. Assuming d is even (for the nonce and counter), and the nonce and counter are d/2
CBC.
Any other relevant block cipher it could function as


texts: Is it safe to use a timestamp to build a nonce?

texts:
I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with AES-GCM and ChaCha20-Poly1305. Both of them need a nonce of 96bits, and it is recommended to use a counter, to make sure the nonce never repeats for this key.

Since I cannot think of a reliable system to guarantee the uniqueness/state of this nonce (the server is passive and only offers storage), I thought about using a timestamp to build the nonce:

Nonce-96-bit = Timestamp-Milliseconds-64bit combined_with CsRandom-Number-32bit

Is this a correct way to solve the problem? I'm aware of XChaCha20-Poly1305 which solves the problem with a bigger nonce so a random number can be used, but at the moment I'm working with the BouncyCastle library which offers the necessary .Net cross-platform support.


texts: Counting the $\operatorname{XOR}$ of an Element over the Finite Field $\operatorname{GF}(2^q)$

texts:
Definition: The $\operatorname{XOR}$ count of an element $\alpha$ in the finite field $\operatorname{GF}(2^q)$ is the number of  $\operatorname{XOR}s$ required to implement the multiplication of $\alpha$ with an arbitrary $\beta$ over $\operatorname{GF}(2^q)$.

Example: Consider we want to compute the $\operatorname{XOR}$ count of $\alpha=x +1$ over $\operatorname{GF}(2^4)$ with the irreducible polynomial ${\bf f}=x^4+x+1$. We denote the element $\alpha$ with $(0,0,1,1)$.
 Let $(b_3, b_2, b_1, b_0)$ be the binary representation of an arbitrary element $\beta$ in the field $\operatorname{GF}(2^4)$, then we obtain

$$
\begin{array}{rcl}
(0, 0, 1, 1) · (b_3, b_2, b_1, b_0)
&=& (b_2, b_1, b_0 ⊕ b_3, b_3) ⊕ (b_3, b_2, b_1, b_0)\\ \\
&=& (b_2 ⊕ b_3, b_1 ⊕ b_2, b_0 ⊕ b_1 ⊕ b_3, b_0 ⊕ b_3),
\end{array}
$$
which corresponds to $5$ $\operatorname{XOR}$s.

Note: The $\operatorname{XOR}$ counting problem is depending on the irreducible polynomial of the field.

For instance, consider $\operatorname{GF}(2^4)$ with the irreducible polynomial ${\bf f}=x^4+x^3+1$, then we get

$$
\begin{array}{rcl}
(0, 0, 1, 1) · (b_3, b_2, b_1, b_0)
&=& (b_2 ⊕ b_3, b_1, b_0, b_3) ⊕ (b_3, b_2, b_1, b_0)\\ \\
&=& (b_2, b_1 ⊕ b_2, b_0 ⊕ b_1, b_0 ⊕ b_3),
\end{array}
$$
which corresponds to  $3$ $\operatorname{XOR}$s.

My question: Is there an algorithm or a software such that its input be  a finite field $\operatorname{GF}(2^q)$ and an element $\alpha$ of $\operatorname{GF}(2^q)$ and its output be the $\operatorname{XOR}$ of $\alpha$ over $\operatorname{GF}(2^q)$.

Thanks for any suggestions.


texts:
I have a hidden function $f(x) = x \pmod{n}$ and would like to solve for $n$ based on a set of input and output pairs which can be chosen freely.

I would like to do this without brute force (i.e. start at $x_0=1$ and iterate $x_{i+1}=x_i+1$ until $f(x_i)=0$).

So far I have observed that if I expand $x=an+b$, then by subtracting $f(x)=b$ from the input, I am left with $x-f(x)=an$.

I can repeat this operation for various inputs and obtain a list of different multiples of $n$, but I cannot work out how to use them to solve for $n$ itself.

If I use the above procedure to obtain distinct $a_0n$ and $a_1n$, I could compute $gcd(a_0n,\,a_1n) = kn$, but there is no guarantee that $k=1$, and the situation remains the same no matter how many $a_in$ are processed in this way.

Is this even a solvable problem or do I need to include extra constraints on the function, like being explicit about the domain, perhaps $f := \mathbb{F_2}[x] \to \mathbb{F_2}[x]$ (polynomials with binary coefficients)?


texts: What is the relationship between a NIZK protocol and a digital signature scheme?

texts:
I am reading about the Fiat-Shamir heuristic to take a $\Sigma$-protocol into a non-interactive zero-knowledge proof (NIZK). I am now wondering whether there is a relationship between a NIZK proof and a digital signature scheme?

Specifically, can we take a NIZK proof obtained from applying Fiat-Shamir to a $\Sigma$-protocol and turn it into a digitial signature scheme? (Are there specific requirements for the underlying $\Sigma$-protocol?)


texts:
When looking through elliptic curve and modulus posts i can see many examples of people referencing $p$ and $n$, in upper and lower case, and sometimes $Q$ is written instead of $p$ or $P$, and I think I've seen $N$ written as $Q$ once.

For example, this is one of the things I've seen for sepc256k1:

  $p$ = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
  $P$ = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
  $n$ = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
  $N$ = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
  $Q$ = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f

I am confused about which is considered the correct way to write $p$, $n$ and $Q$. Is it considered better to use $Q$ instead of $p$? Is there an agreed standard? Does uppercase signify something different than lower case? I see a lot of things, and all of this wastes a lot of thinking energy worrying about the correctness of how to write a letter.

What is the correct way to notate elliptic curve properties?


texts: How to multiply Elliptic curve point $S = (7 + 257 \times u, \space 258 + 21845 \times u) (\bmod 257^2 )$ on curve $y^2 = x^3 + 23\times x + 11$?

texts:
First of all I'm not good at English. Hope you will understand my question.
In the paper 'Lifting and Elliptic Curve Discrete Logarithms' by Professor J. H. Silverman I found this example.

  Example
  : We let $p = 257$ and consider the field $k = F_{257}$ and the elliptic curve
  and point

$$e : y^2 = x^3 + 23 \times x + 11 , s = (7, 1) ∈ e(k)$$.

It is easy to check that $e(k) = 249 = 3 \times 83$ and that $s$ has order $n = 83$ in $e(k)$.
We lift $e$ to a p-adic curve $E$ in the obvious way,

$$E : Y^2 = X^3 + 23 \times X + 11$$

We will lift $s$ to a point $S \bmod p^2$. We write $S$ in the form

$$S = (7 + p \times u,\space 1 + p \times v) \bmod p^2$$.

In order for $S$ to represent a point on $E \bmod p^2$ , we need

$$(1 + p \times v)^2 ≡ (7 + p \times u)^3 + 23 \times (7 + p \times u) + 11 (\bmod p^2)$$

Expanding this gives

$$1 + 2 \times p \times v ≡ 515 + 170 \times p \times u (\bmod p^2 )$$

so we find that $v ≡ 85 \times u + 1 (\bmod p)$. Thus $S$ has the form

$$S = (7 + p \times u, 258 + 85 \times p \times u) = (7 + 257 \times u, 258 + 21845 \times u) (\bmod 257^2)$$

My question is how do we find $41 \times S$. It was given here that

$$41\times S ≡ (59609 + 12336 \times u, 39178 + 44718 \times u) (\bmod 257^2)$$

When doubling a point, let's say $$2\times S$$ needed to find the tangent line of the point to the curve.
$$Slope = ((3 \times a[0] \times a[0]) \times inversemod((2 \times a[1]),p)) (\bmod p)$$
$$ = ((3 \times (7 + 257 \times u) \times (7 + 257 \times u)) \times inversemod((2 \times (258 + 21845 \times u)),257^2)) (\bmod 257^2)$$
$$ = (10794 \times u + 147) \times inversemod((43690 \times u + 516),257^2)) (\bmod 257^2)$$

I'm stuck at here. How to get this step solved? Simple Python or Sage code would be greatly appreciated.


texts: Does knowing multiple hash of the same content make it more likely to generate original plain text?

texts: Say I'm trying to brute force the original plain text of an SHA256 hash, does knowing the RIPEMD160 hash of the same text help? In other words, does providing access to hash values of the same text generated by multiple algorithms decrease security?


texts: Why is adaptive security stronger than CCA1 security, and weaker than CCA2 security?

texts:
We know in CCA1 security, after seeing the challenge ciphertext,

no more decryption oracles are allowed to the adversary.

But in adaptive security, what should the adversary do?  Please help me solve the puzzle.


texts: How to express difficulty of breaking crypto when writing?

texts:
When writing for both technical and non-technical readers I find my self naturally wanting to write things such as :

"..therefore it would be impossible to decrypt the data."

When trying to convey the real world difficulty in breaking AES for example.
My question is, what is the most succinct yet correct term for expressing this, both from a work effort perspective and a side-channel one?.
For a pure work effort perspective :

"Computationally infeasible"

Sounds good, but would not take into account side-channel type attacks.
Any appropriate term would need to be technically correct but strong enough so that non-technical readers understand the risk is extremely low.
Thanks


texts: Are there known practical attacks on RC4-dropN?

texts:
RC4 is known to leak information about the first few bytes of the ciphertext due to keystream biases.

However, are there known attacks on RC4-drop[N] where N is large enough, that leak information about the plaintext?

Edit: I am NOT planning on using this in actual software (I would use ChaCha20, Salsa20, or XSalsa20 instead, which are far more secure and just as fast), but rather interested as a matter of curiosity.


texts:
I am trying to reverse engineer a program that encrypts a file with a password.

So far i figured out that the start of the file is always the string "DecryptOK" encrypted with the password of course.

With a password of "one" an "empty" file turns into

ED5BDE97BB90DE1377948A31B0EECB4B4D8B

which i assume would be

ED5B DE97 BB90 DE13 7794 8A31 B0EE CB4B 4D8B

aka "DecryptOK".

So my question is how do i continue from here? How do i figure out what encryption method is being used?

Here are some texts i encrypted with the password "one":

123 to 3366 7FAD CAF5
abc to 3336 7FFD CAA5
cookies to 3334 7FF0 CAA9 33F7 D2D2 60AB 86EB


texts: What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

texts:
LibSodium, (https://github.com/jedisct1/libsodium), has a function crypto_box_detached() which does authenticated encryption using the public key of the recipient and the private key of the sender (using Curve25519). I believe this function is compatible with Daniel J. Berinstein's corresponding function in NaCl (http://nacl.cr.yp.to/), although with a different interface.

If Alice creates a message for Bob using this function and a random nonce, is it possible for Eve to distinguish the ciphertext+MAC from random data?
What about if Eve has the public keys of Alice and Bob, does that make it easier to distinguish it from random data?
If Eve has their public keys, can she in any way deduce that the message came from Alice or that it is destined for Bob?


texts: What gives SHA-256 its preimage resistance?

texts:
I was reading some guy's description of the SHA-256 algorithm and I noticed that the basic operations it uses appear trivial to reverse: addition, rotate bits, etc. When I say "reverse" I don't mean retrieving the exact input used to generate the hash, I mean finding some input which generates the same hash (finding a collision). I would like to understand why this is actually difficult.

  Preimage resistance: For a given h in the output space of the hash function, it is hard to find any message x with H(x)=h. Source

Here is an general explanation for why a function can be easy to calculate in one way, but very difficult to reverse (calculate the other way). What in particular gives SHA-256 this property? If someone tried to generate a hash collision, which obstacles would they face?

The initial values for A-H are predetermined in the algorithm. The actual input comes from W. In this sense the "initial state" can be thought of as a combination of user input and predetermined values. Does this contribute to the difficulty in finding collisions? If the initial values for A-H could be any arbitrary values, would it be trivial to find hash collisions?


texts: Security implications of using a high entropy password with a low iteration count for a key derivation function

texts:
This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in our current case the password's entropy isn't as high.

If a low iteration count is used, it can allow for fast brute-forcing, but what if the entropy of the password is high enough (50 bits? 100bits? more?)? Would it still matter this much?

Would there even be a way of determining a minimum entropy?
A limited charset like "0123456789ABCD" would surely hinder reaching high levels of entropy, but given a long enough length, it's rather hard for me to guess if it could still be considered safe or not.


texts: Does DROWN attack break 2048-bit key itself or just the plaintext encrypted with the RSA key

texts: Does the DROWN attack enable breaking strong RSA keys (e.g. the 2048-bit key itself) or enable breaking the plaintext (i.e. pre-master key) that is encrypted with a 2048-bit (or any strong) RSA, if the key is shared with SSLv2 server?


texts: Security of S/MIME in case of CA compromise

texts:
Suppose Alice and Bob are exchanging messages using S/MIME, protected by certificates that have been issued by either the same CA or by two mutually independent CAs. There exists an adversary Mallory who wants to get the ability to compromise the confidentiality of the communication, or the integrity, or both. We may assume Mallory is subject to the following restrictions:

Mallory does not have access to the private keys of Alice or Bob. Mallory might however have access to the private certificate signing keys of the CAs.
Mallory has full access to the network communication between Alice and Bob.
Mallory wants to avoid detection. Primarily, Mallory wants an attack that is completely transparent to both Alice and Bob, and in worst case, an attack that will interfere in a detectable way with the communication, but only infrequently and can be rationally explained as network failure, software failure or hardware failure.
Normally, we might assume Mallory delegates most actions to an automated service. In particular, we might assume that even if Mallory has managed to compromise both confidentiality and integrity and in both directions, most of the time the exchanged messages will be let through without interference, and it might be hard for Mallory to alter the messages in real time, when some information (such as certificate thumbprints) is exchanged that might lead to exposure of the compromise.

Technically, Alice and Bob will normally establish a confidential channel by Alice sending a signed only message to Bob, Bob extracting the certificate of Alice, and replying with a signed-then-enveloped message to Alice. Given the first three restrictions, such an exchange might be trivially compromised in the following way:

Mallory creates a key pair $Pub_{FA},Priv_{FA}$ and a certificate $Cer_{FA}$ that is signed by a CA that Bob trusts and which (dishonestly) identifies Alice. Mallory creates a key pair $Pub_{FB},Priv_{FB}$ and a certificate $Cer_{FB}$ that is signed by a CA that Alice trusts and which (dishonestly) identifies Bob.
Alice sends a message $Sign_{Priv_A}(M_A,Cer_A)$ to Bob which is intercepted by Mallory who replaces it with $Sign_{Priv_{FA}}(M_A,Cer_{FA})$.
Bob sends a message $Env_{Pub_{FA}}(Sign_{Priv_B}(M_B,Cer_B))$ which is intercepted by Mallory who replaces it with $Env_{Pub_{FA}}(Sign_{Priv_{FB}}(M_B,Cer_{FB}))$.

Now, my concern is that this attack does not necessarily comply with the fourth restriction. For instance, if Alice and Bob somehow manages to, without detection, exchange certificate thumbprints over the compromised channel, the compromise will be detected immediately.

Are there any better attacks, or might we assume that the four restrictions make S/MIME relatively safe from attackers such as Mallory?

Edit: Mallory is a threat to the confidentiality and integrity of Alice and Bob. Conversely, Alice and Bob are a threat to the transparency of Mallory. Considering that Mallory gets to pick the targets Alice and Bob, but not the other way around, to what extent might Alice and Bob trust their confidentiality and integrity, based on their being such a threat to the transparency of Mallory, that Mallory might be safely assumed to not attack them?


texts: Having doubt in Rijndael Algorithm- coding for decryption

texts:
I am doing a project on the Rijndael Algorithm. I have already written the encryption code which produces the correct output. Now I want to implement decryption as well. I'm doing using VHDL, targetting the Xylinx platform.

Can anyone help me coding for ADD_ROUND_KEY step in decryption.


texts: Are there any Secp256k1 ECDSA test examples available?

texts:
Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those values: http://point-at-infinity.org/ecc/nisttv .

Moreover, what other ways one should test an implementation of an elliptic curve to make sure it is working correctly in all the scenarios used in encryption software?

Are there any easy to understand examples/tutorials of how to program and test elliptic curve algorithms that are available online?


texts: Additive ElGamal cryptosystem using a finite field

texts:
I'm trying to implement a modified version of the ElGamal cryptosystem as specified by Cramer et al. in "A secure and optimally efficient multi-authority election scheme", which possesses additive homomorphism between ciphertexts, as opposed to the original version, which presents multiplicative homomorphism.

The BIG problem (as always) is that the paper is annoyingly scarce on the "small" details. Here's what I have so far:

Configuration parameters

size of $ p $
size of $ q $
message space

Key generation

pick a prime number $ p $ of a given "key size", ensuring that $ p - 1 $ has a large prime factor $ q $ (of a given size)
pick $ g $ as a generator of the cyclic group $ \mathbb{Z}_{q}^* $
generate a random number, $ s \in \mathbb{Z}_{q} $, and compute $ h = g^s \pmod q $
The public key is $ (g, h) $ and the private key is $ (s) $

Precomputations

Since the scheme requires computing discrete logarithms in order to perform the decryption (see below), the messages must be small so we precompute each $ g^m \pmod q $ and we store them in a lookup table

Encryption

pick a random value $ \alpha \in \mathbb{Z}_{q} $
compute $ (x, y) = (g^{\alpha} \pmod q, h^{\alpha} g^m \pmod q) $

Decryption

$ y x^{-s} \pmod q \equiv h^{\alpha} g^m g^{-s \alpha} \pmod q \equiv g^{s \alpha} g^m g^{-s \alpha} \pmod q \equiv g^m \pmod q $
we use the precomputed lookup table to find the corresponding message, $ m $, for the computed $ g^m \pmod q $

Questions:

I'm not sure if the implied modulus of each operation is $ q $, as I added myself to the above formulas. Could someone please clarify this? The paper omits it...
If, indeed, the modulus of the operations is $ q $, then I need to add it to the public key, right? If I do this, doesn't the scheme become insecure?
Regarding the private key, the paper does not specify the set from which to select it, and I assumed it to be $ \mathbb{Z}_{q} $. Is this correct?
what should be the size of $ p $ (in bits) in order to have similar security as provided by RSA 1024?
what should be the size (in bits) of the large prime factor of $ p - 1 $?


texts: Deniable Encryption from simple primitives

texts:
Is there a deniable encryption scheme $M = E(p_1,k_1,p_2,k_2,...,p_n,k_n), p_j = D(M,k_j)$ of $n$ plaintexts $p_1,p_2,...,p_n$ and $n$ keys $k_1,k_2,...,k_n$, such that we can fix $D$ to be a known algorithm such as AES (without preprossessing $M$) and such that $|M| \ll \sum_{i=1}^n {|p_i|}$ (since this leaks information about how many false plaintexts there are to a party suspicious their adversary may be using deniable encryption)?

Let me expound a little bit on the motivation for these constraints. Let's say that a soldier of country A were captured and country B wanted said soldier to aid them in deciphering the data on his military issued laptop. Country B is not going to allow the soldier to operate the decryption himself. They are going to take an image of his hard drive and ask which algorithm and key he used. The soldier had better reply with a standard algorithm (not known to be deniable). In addition we would expect every bit of the ciphertext is required to decrypt the plaintext, or else country B may begin to suspect deniable encryption.

This last constraint (pertaining to the ciphertext size) seems information theoretically impossible. So let me ask my question in a less rigorous way:
Most deniable encryption systems seem to me to be heuristic engineering solutions. Out of purely academic interest: What scholarly work has been done on deniable encryption that meets the motivation for my formulation?


texts: Is Deterministic Ed25519 Key Derivation from Master Key and String Secure?

texts:
I am wanting to make deterministic (i.e. always the same for the same inputs) Ed25519 key from a master Ed25519 key and a target string (e.g. a website name, ala SQRL). My algorithm takes a 32-byte Argon2 hash using the password as the 32-byte master private key and the salt built from SHA-512 of the target string. It then uses that for Ed25519 generation. Here it is in Go code:

package identity

import (
    "bytes"
    "crypto/sha512"

    "golang.org/x/crypto/argon2"
    "golang.org/x/crypto/ed25519"
)

// KeyDeriver is a simple interface for deterministically deriving keys.
type KeyDeriver interface {
    // Derive a key for the target from the master and target string. For the same input, this must give the exact same
    // output.
    Derive(master ed25519.PrivateKey, target string) ed25519.PrivateKey
}

// DefaultKeyDeriver uses common Argon2 params with ArgonKeyDeriver
var DefaultKeyDeriver KeyDeriver = &ArgonKeyDeriver{Time: 1, Memory: 64 * 1024, Threads: 4}

// ArgonKeyDeriver derives keys based on Argon2 hashes of master and target values.
type ArgonKeyDeriver struct {
    Time    uint32
    Memory  uint32
    Threads uint8
}

// Derive implements KeyDeriver.Derive
func (a *ArgonKeyDeriver) Derive(master ed25519.PrivateKey, target string) ed25519.PrivateKey {
    // Build a 32-byte argon2 hash with the private part of the master key as the password, the SHA-512 target as
    // the salt, and the other argon params as given. Then use that 32-byte hash as the input for an ed25519 key.
    // I.e. ed25519-gen(argon2(P=master, S=sha512(target), ...))
    targetHash := sha512.Sum512([]byte(target))
    argonHash := argon2.IDKey(master[:32], targetHash[:], a.Time, a.Memory, a.Threads, 32)
    // Based on reading, only reason this returns an err is if random does which it shouldn't
    _, ret, err := ed25519.GenerateKey(bytes.NewReader(argonHash))
    if err != nil {
        panic(err)
    }
    return ret
}

Ignoring the Argon2 time, memory, and threads parameters, is this a reasonably secure approach? Would I be better served switching the password and salt values?


texts: How secure is it to use password as AES key?

texts: I am developing a steganography app where user encrypt any file into an audio file. The user can enter a password to protect the hidden data. The same password is converted as a 256 bit key and the hidden data is encrypted using AES. I was wondering, how secure is using password as the AES key?


texts: What kind of analysis can I perform on my implementation of Salsa20 and Rabbit ciphers?

texts:
I've implemented both the Salsa20 and Rabbit ciphers in C#. My implementation is for academic purposes and I've tested both of them against the test vectors. I implemented a system that encrypts a file twice, once with each form of encryption. I want to find out what kind of analysis I can perform to test their various aspects such as speed, security, performance etc.

While I understand that some of you might think this is not a good idea, I am doing it purely for academic purposes and this will never be used in a real world system.

I would like to perform some tests where I compare the plaintext and ciphertext and note any observations. I have no experience or idea regarding where to start or what to do. Though I do not need to go into depth on this topic as my professor doesn't require it.

Thanks


texts: Which algorithm would be ideal for ephermal key generation followed by DH key exchange?

texts:
Bob and Alice, both generate a temporary public key pair each using X algorithm on their individual PC.
After being authenticated by a third party, they use the DHE to come to get a common symmetric key; This key is used for the encryption of messages sent between them for that session. After the session is over, all the mentioned keys are forgotten.

My question primarily is what would be an appropriate algorithm 'X'
Also, if there is a vulnerability in the above presented scenario, kindly mention it.


texts: How to determine if a generalized $\sigma$ function (similar to what is defined in SHA-2) is invertible?

texts:
Let $ROTR^n(x)$ and $SHR^n(x)$ denote the rotate right (circular right shift) and the right shift operations, as defined in SHA-2 standard.

Consider any function of the form $$f(x) = ROTR^{n_1}(x) \oplus ROTR^{n_2}(x) \oplus \ldots \oplus ROTR^{n_z}(x).$$

According to the fifth element of this list, such functions are reversible (and bijective) if and only if the set $\{n_1, n_2, \ldots, n_{z-1}, n_z\}$ contains an odd number of elements (assuming that $0 \le n_i \le w-1$, where $w$ denotes the length of a word $x$). For example, $\Sigma$ functions in SHA-2 are of this form ($z=3$).

But I want to ask about functions of the form $$g(x) = F^{n_1}(x) \oplus F^{n_2}(x) \oplus \ldots \oplus F^{n_z}(x),$$ where $F^n(x)$ is either $ROTR^n(x)$ or $SHR^n(x)$ (assuming that $0 \le n_i \le w-1$ and $w$ denotes the length of a word $x$). How to determine if such function is reversible (for example, $\sigma$ functions in SHA-2 are of this form)?


texts: In theory, are there algorithms where everybody can read a message but only one person can write it?

texts:
I know that there are a lot of asymmetric algorithms out there that use the public key to encrypt and the private key to decrypt. I was thinking about having exactly the opposite.

I do also know that the current way of doing it is sending it in plaintext and adding a signature to verify that its coming from the correct sender. But for me it sounds like it is just some sort of "overhead" with an additional signature to check and transmit.

In my mind it would be cool to say: If you can decrypt it, it is the right sender and if you can't, someone must have altered it / is not trustworthy.

If there isn't such thing, why is that exactly?
Because the signature "method" is the way to go?


texts:
I've been studying encryption on a hobby basis, and wanted to know if I got this basic cypher construction right (this is another experiment, see the AES ECB experiment thread earlier).

Encryption:

XOR plain text block, initialization vector and counter together.
AES resulting block.
Increment counter.
Goto 1 until all plain text blocks are done.

Authentication tag:

Sha256 cipher text.
AES resulting hash using authentication key.


texts: What is the (classical) algorithm of choice for finding discrete logarithms in composite-moduli groups?

texts:
I've recently written an answer on how to find the factorization of a $n$ if we can find the order(s) of elements in the associated group $\mathbb Z_n^*$. This also lead me to Shor's algorithm which does basically just that: Find the order and then compute the factorization from that.

Now, probably for a learning experience, I've thought about implementing the above factorization method but I'm short of an algorithm to find the discrete logarithm in the generic $\mathbb Z^*_n$ group without factoring $n$ first.

So what is the algorithm with the best run-time complexity that can find discrete logarithms in $\mathbb Z^*_n$ for $n\in\mathbb N_{\geq 2}$ without factoring $n$ first?


texts: XORing Algorithm Outputs To Guard Against Breakthroughs

texts:
My question is how safe is XORing two algorithm outputs together...

...For Symmetric Encryption:

Master key from CSPRNG ==> MK
HKDF-Expand(MK, info="AES") ==> AES Key
HKDF-Expand(MK, info="ChaCha20") ==> ChaCha20 Key
Ciphertext = Message XOR AES-256-CTR_STREAM(AES Key, counter) XOR ChaCha20_STREAM(ChaCha20 Key, counter)
The counter will increment per message.

...For Hashes:

SHA3_512(message) XOR SHAKE256(message, 512)

... And lastly for MACs:

Create separate keys like in the encryption example (KMAC Key, Poly 1035 Key)
KMAC(message, KMAC Key) XOR Poly1305(message, Poly1305 Key)

How safe are these constructions?

If this question it too broad because of the separate algorithm types please let me know and I'll edit.


texts: Does simulation extractability require that the protocol have a backdoor in it?

texts:
As I understand it, one of the properties required to prove UC-security is simulation extractability. One example is the paper by Kosba et al adapting NIZKs to the UC model, but in their construction the witness is encrypted and the ciphertext appended to the proof, and whoever holds the private key can extract the (confidential) witness. (There's also a separate trapdoor that can forge proofs, but for the forged proofs the extractor is not required to work.)

Is this property required for simulation extractability? Would any UC-secure NIZK system also have a backdoor in it? Or am I misinterpreting what simulation extractability means?

Link to the Kosba et al preprint: http://eprint.iacr.org/2015/1093


texts: Is there an asymmetric encryption algorithm where the public key cannot be derived from the private key

texts:
Is there an encryption algorithm that will produce a public key and a private key such that the public key cannot be generated using the private key.

For example, if the private key is compromised but the public key is not then messages can only be decrypted and not encrypted.


texts: How to combine a PRG and a non-PRG to design a PRG?

texts:
I'm trying to solve the following exercise:
Let $G_1, G_2: \{0,1\}^\lambda \to \{0,1\}^{\lambda + l}$ be two deterministic functions mapping $\lambda$ bits into $\lambda + l$ bits (for $l \ge 1$). You know that at least one of $G_1, G_2$ is a secure PRG, but you don't know which one. Show how to design a secure PRG $G^*:\{0,1\}^{2\lambda} \to \{0,1\}^{\lambda + l}$ by combining $G_1$ and $G_2$.
I think that $G^* := G_1(s_1) \oplus G_2(s_2), s_1, s_2 \leftarrow_{\\\$} \{0,1\}^\lambda$ could be a valid PRG. Anyway, I don't know how to prove it; probably with OTP?. How could I prove it using reduction?


texts:
The specification doesn't seem to indicate how to pad messages to the requisite 512-bit boundary.

What is the padding scheme for the original Tiger hash?


texts: Ciphertext indistinguishability (IND-CPA) for symmetric cryptography

texts:
My understanding are these steps are necessary for symmetric cryptography to be IND-CPA:

The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger.
The challenger selects one of them at random and encrypts it with the symmetric key and gives cipher-text C.
The adversary has to guess which message was encrypted based on C with a probability greater than 1/2 for the cipher-text to be distinguishable.

If the adversary wants to play the game again can he do $M_0$ and $M_2$? Or do they have to be new plain-texts?

Also I have an encryption algorithm that I am trying to apply IND-CPA test on it. How do I go about finding the probability mathematically, any hints or steps should I take?


texts: Why is (gy, gx) signed in STS (station-to-station)?

texts:
My question relates to the station-to-station protocol as described in https://en.wikipedia.org/wiki/Station-to-Station_protocol [1] and http://cacr.uwaterloo.ca/hac/ [2] p 519.

(1) Alice → Bob : gx
(2) Alice ← Bob : gy, EK(SB(gy, gx))
(3) Alice → Bob : EK(SA(gx, gy))

I fail to understand the reasons behind why Bob signs gy+gx (concatenated) and Alice signs gx+gy. [1, 2] say the order of gx and gy is important. Why? And why sign gy+gx? Are there variants of what is signed? A random challenge could be included?


texts:
How is it possible to find a similar message-digest for SHA3-512 for the first 80 bits or so?
There was a Q/A on this site where the answer stated that 80 bits that $2^{42}$ computations are required. But shouldn't it be $2^{40}$ considering the root of 80? Why did it state $2^{42}$?


texts:
I want to use AES-CBC for secure firmware upgrades on a microcontroller, with AES-CMAC for checking the integrity of the firmware image. The AES-CMAC algorithm needs a AES-128 encryption funtion. For the firmware upgrade, I need decryption only. Thus, I'd like to replace the AES-128 encryption by AES-128 decryption to reduce the program size by omitting the AES encrypt function.

Are there any implications on security if the AES-CMAC algorithm is modified in this way?


texts: Asymmetric encryptions' computational complexity

texts:
I need to know the computational complexity of the public key encryption (e.g. Paillier), please.

(i.e.Paillier in his paper mentions that the computational complexity of most of public key encryptions is $O(n^3)$, but is not clear to me why)


texts:
I found this thread from 2011:
Is there a secure cryptosystem that can be performed mentally?
Are there new secure hand or pen-and-paper ciphers in 2020? (I know, that hand ciphers are not as secured as digital ciphers).


texts: Is there any strong enough pen-and-paper or mind cipher?

texts:
Some ciphers are talked about at “Is there a secure cryptosystem that can be performed mentally?”, but (at the time of writing) I don't see an answer.

Are they strong enough, or are non-computer ciphers more or less just a toy and one should abandon using them for practical purposes?


texts:
I saw that non-negative integers with the addition operation cannot be the Diffie Hellman group. I'm having trouble understanding why it cannot be the DHKE group.
To be DHKE group, there are five properties to be held,

The operator is closed
associativity
identity element exists
inverse element exists
commutativity

I tried with the group of {0,1,2,3,4,5,6} and p=7, and all the above properties were held. I couldn't find any appropriate example to show the above properties are not held. What other examples can show that the non-negative integers with addition operator is not one of Diffie Hellman key groups?


texts: Is it a cryptographic risk to share the same encrypted data over and over again?

texts:
Regular scenario

Let's say I have secret files which I will encrypt. The resulting container will be shared and might be intercepted. Not good, but that's okay - that's why I encrypted the data in the first place.

Scenario in question

However, now, I'll encrypt and share the same data again. With the same passphrase. The container will be different (because the key changed) but the data inside it is identical. And the attacker knows this. Does this open the encryption to any vulnerabilities from a cryptographical standpoint?

Pardon my lack of technical terms. I guess this would be a ciphertext-only attack? But modified in a way that each plaintext (my data, my files) prior to encryption is the same?

(It's a general question, the encrypted container might be from dm-crypt/LUKS or VeraCrypt or even an encrypted ZIP archive. But I think all of them are using 256-bit AES.)


texts: What are the implications of a birthday attack on a HMAC?

texts:
After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag.

This paper states:

  Then, for any string x, (m1,x) and (m2,x) have the same tags (with high probability in the case of HMAC, and with certainty in the case of CMAC). The attacker can then request for the tag of (m1,x), thereby also obtaining the tag if (m2,x).

Does this mean that it is possible to attach any string x on m1 and the tag of it will be the same as the tag for x attached to m2?

If my assumption is true could this be considered as a length extension attack?


texts: Do most TLS 1.2 implementations express curves in a canonical form when performing EC arithmetic?

texts:
Sorry if this is a silly question, but does anyone know if the cryptographic libraries which implement TLS 1.2 for Firefox, Chrome, etc. express a given curve in a canonical form (i.e. one of Weierstrass, Montgomery, or Edwards form for an arbitrary curve) where possible in order to simplify EC arithmetic?

I am just starting to learn about ECDH(E) and was wondering if EC curves are often represented in a common form in order to simplify EC operations where possible, since a given prime curve can often be represented in one form, over another since all EC curves are isomorphic to a curve in Weierstrass form.


texts:
I am trying to find polynomial , but don't know how to get matrix
matrix must look something like this:https://www.oreilly.com/library/view/computer-security-and/9780471947837/sec8.8.html
For example if output is 11010110 and length of register was 4, how to get such matrix:
1   1   0   1   0
1   0   1   0   1
0   1   0   1   1
1   0   1   1   0


texts: Number of combinations with a max. of successively repeated characters

texts: I would like to calculate the possible password combinations for a password that is 60 characters long, has the letters a-f and numbers 0-9. Also no character should repeat successively more than 7 times. Is there any way to calculate the possible combinations? Thanks in advance.


texts: XOR instead of Multiplication in ElGamal encryption

texts: In the ElGamal encryption scheme, the message $m$ is multiplied with the secret $g^{xy}$ Wikipedia. I don't understand the advantage of it. Why we can't just XOR our message with the shared secret? As far as I know, multiplication is costlier than the XOR operation. Also, both the schemes will be CPA secure but not CCA secure, in that case, we have to add a MAC anyway. Can anyone please explain this to me?


texts: Are the weaknesses of my s-boxes attackable?

texts:
I got specific problem with my s-boxes in $128$-bit block cipher. One round of encryption is like that:
input - sbox - reverse block - $sbox^{-1}$ - output
Every s-box got specific $128$-bit key. $sbox^{-1}$ means that we are looking for such input to s-box that will give us such reversed block.
First problem is with numbers divisible by $2$. Every input block in s-box of the form 000...0001... also will give us the same first zeros and one. Fore example:
000001...0111101...
go into:
000001...1111001...
All the rest of the block depends on key and there is no know way to guess it without the key. It also means that block 000...0001 always gives the same block 000...0001 and block of only zeros goes into the same block. It also means that every block with $1$ as the first bit will also go into block with $1$ as the first bit. I think it can be solve, by xoring with some key before every round, let's ignore that problem for now.
Second problem is that every $input + 2^{n}\cdot l$ will give output block with the same first $n$ bits in s-box.
Can you find a way to attack it? Main idea is to avoid problems by reversing blocks and then looking for such input to s-box, that will give us such reversed block - it destroys patterns which we have in that s-boxes. Let's say we want to encrypt block 000...0001. We know what block will gives us first s-box (exactly the same), but without the key of the second s-box we can't tell which number is giving 1000...000 block in that second s-box.


texts: Ensuring no unintended leaking before authentication

texts:
Assume my authentication system consists of querying an endpoint to get sign in parameters cost and salt, auth_hash.

After receiving these parameters, I will use cost and salt to derive a 768 bit key using PBKDF2:

key = pbkdf2(user_password, salt, cost, 768).hex

I then split the key three ways:

server_password = key.first_third
encryption_key = key.second_third
auth_key = key.third_third

I will then use auth_key to authenticate the parameters sent from the server and make sure the computed authentication hash matches the incoming auth_hash:

local_auth_hash = HMAC(cost.to_string + salt, auth_key)
abort if local_auth_hash != auth_hash

Now, during normal app flow, I will encrypt user data with encryption_key and authenticate it with auth_key.

My question is, is it safe to use auth_key in both of these contexts (sign in and data encryption)? The reason I would suspect that it might not be ok is that the server can return any cost and salt, and have me authenticate it with my auth_key, and potentially try to glean information this way.


texts: Security impact of signing small data using RSA

texts:
I have an application which consists of a client and a server. Both have a pair of public and private key (RSA). For communication, both sign their messages and send them to the other part. So a message Looks like this:

_____________________
| HTTP Post request |
|___________________|
|     Post data     |
|___________________|
|     Signature     |
|___________________|

The post data is signed with the private key and the signature is added to the data. Sometimes the post data is very small (sometimes it just contains one number).

I know it can impact performance very much if I sign every little piece of data, but this time I'm not concerned too much about performance as the frequency of signing is very low.

Can it cause security problems if I sign very small amount of data such as just one number?


texts: Pohlig-Hellman and Shanks algorithm on ECC

texts:
First, sorry for my english which is not my natural language and secondly, I hope I am posting on the right section.

So let's explain my problem.

I am trying to implement the Pohlig-Hellman algorithm based on elliptic curves with the Baby-Steps-Giant-Steps for each iteration.

My Python implementation use a curve on finite field with a smooth prime modulus $N = 2*853*3593*4339$.

With the curve : $y^2 = x^3 + 521x + 1331$ on $\mathbb{F}_{26596586063}$

And the generator $G = (20197258757, 24233149744)$

In theory, and if I understand correctly, the worst complexity in the Baby-Steps-Giant-Steps phase will be $\sqrt{4339}$, right ?

My implementation seems to work (I have the right solution) but I don't have the right complexity : the Polhig-Hellman problem reduction seems useless because I have the same complexity with the Baby-Steps-Giant-Steps running alone.

When I try to solve the discrete logarithm : $H = xG$, my implementation run with a complexity of : $O(\sqrt{x})$ approximatly.

I don't understand my mistake and I am very confuse...

Thanks for your answer.

Here is my implementation (in Python):

def baby_step_giant_step(curve, G, H, order):

    m = int(math.ceil(gmpy2.sqrt(order)))
    L = {}

    # Baby steps
    for j in range(0, m):
        P_tmp = curve.mul(j, G)
        L[str(P_tmp)] = j

    mG = curve.mul(m, G)

    # Giant steps
    for i in range(0, m):
        P_tmp = curve.mul(i, mG)
        if not P_tmp.isInf():
            P_tmp = ecc.Point(P_tmp.x, (-P_tmp.y) % curve.p)

        P = curve.add(H, P_tmp)

        index = str(P)

        if index in L:
            return (L[index] + i*m) % curve.p

    return None

# Solve the equation : G^x = H (mod curve.p)
def pohlig_hellman(curve, G, H):
    N = curve.p-1
    factors = decompose_order(N)
    x = 0

    for i in range(len(factors)):
        ni = factors[i][0]**(factors[i][1])
        tmp = N//ni
        G_prime = curve.mul(tmp, G)
        H_prime = curve.mul(tmp, H)

        # Now, use the Baby Step Giant Step algorithm to solve :
        # H_prime = x_prime*G_prime
        x_prime = baby_step_giant_step(curve, G_prime, H_prime, ni)
        while x_prime == None:
            order *= 2
            x_prime = baby_step_giant_step(curve, G_prime, H_prime, ni)

        # Use the CRT to solve the equation x_prime = x (mod ni)
        (gcd, x0, x1) = xgcd(ni, tmp)

        x += x_prime*x1*tmp

    return x % N

# (A, B, N)
curve = ecc.Curve(521, 1331, 26596586063)
G = ecc.Point(20197258757,24233149744)

H = curve.mul(523151, G)

x = pohlig_hellman(curve, G, H)
print("x = %s" % x)

PS : don't be afraid by the WHILE loop, it was only for debuging purpose.


texts:
What are the security pitfalls that may occur by signing a list of file hashes, versus signing individual files?

In short, the security trade-offs between:

for file in $FILES; do
    gpg --clearsign $file
done

And:

sha256sum $FILES > signatures
gpg --clearsign signatures


texts:
The official NIST publication I saw says for federal applications 3DES with three keys should be used. I have such questions:

what does it mean federal? Does it mean for industrial applications that requirement doesn't hold? What security do I get with 2 keys? by two keys I mean when K1==K3, but K2 is different? Is it average security?
Three key approach with (globally) fixed second key which is still different from each K1 and K3 pair: Imagine I have server which communicates with many clients. Is it ok if with each client i it uses distinct (K1[i],K3[i]) pairs (but K3[i]==K1[i] for each pair), and K2 I take such that it is different from each (K1[i], K3[i]) key pair in my system, but it is fixed (globally) for all clients?

EDIT: The crypto will be done by dongle so that someone will decompile my soft and get 2nd key doesn't hold as mentioned in one of the answers.


texts: is this possible to use asymmetric encryption schemes as order preserving encryption

texts: Are we able to use order preserving encryption in asymmetric schemes, is this work efficiently. is this secure at any one of the  situations


texts: Efficient universally composable protocols for aggregate statistics

texts:
Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value.

An ideal functionality $\mathcal{F}$ would allow $C$ to register a subset of parties $\mathbf{P}$ linked to some kind of abstract data identifier $id$. $\mathcal{F}$ would collect data from all parties of $\mathbf{P}$ corresponding to $id$, calculate the average and return it to $C$.

I specifically mention the average as the protocol should not necessarily provide the option to do any sophisticated computation on the data. It would completely suffice do "easy math" on the data and maybe therefore having a higher efficiency of the protocol.

Are there any efficient universally composable protocols for aggregate statistics of this kind (ideally in the CRS-model) ?

I somehow fail to find any protocols specific to this obvious scenario. Generally I would assume that a combination of a universal composable secret sharing protocol and a homomorphic encryption scheme could do the job.


texts: Is there a notion of "computational security" in quantum cryptography?

texts: In classical cryptography, security proofs are often based on the (assumed) computational hardness of some mathematical problem. Using the principles of quantum mechanics might provide means to design cryptographic protocols that can classically not be implemented (information-theoretically) securely. But is there also a notion of computational security in quantum cryptography (assuming a polynomial-time quantum adversary)? Why does or doesn't make this notion of security sense?


texts: Why should a signature use PSS padding in RSA?

texts:
Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and integrity of the message.

I can decrypt the hash with the public key (authentication) and compare the decrypted hash with a hash I generate from the message (integrity).

Why is it wrong to use OAEP for padding?


texts: Public key exponent coprime with totient proof

texts: I read this question a while back (In RSA, why is it important to choose e so that it is coprime to φ(n)?). I was wondering whether there is a proof that shows that a public key exponent e that is coprime with the totient of the modulus N will result in a unique answer when the cipher text is decrypted. Please help.


texts: Building a stream-cipher out of a hash function?

texts:
I've already read this:
Is it feasible to build a stream cipher from a cryptographic hash function?

However, my proposed construction differs…

Suppose the hash generates N bits. These bits are split into two parts:

$S$ bits are kept secret,
$X$ bits are used for the encryption, xor'ing the bytes the usual way
$S + X = N$
$H_i^S$ is the $S$ bits of the current hash $H_i$, in iteration $i$
$H_i^X$ is the $X$ bits of the same hash value
$P_i^X$ is $X$ bits of buffered plaintext in iteration $i$
$C_i^X$ is $X$ bits of ciphertext in iteration $i$

The algorithm:

generate a random key $K$ that will be shared between the peers
$i=0$, generate $H_0 = hash(K)$
$C_i^X = P_i^X \oplus H_i^X$
$H_{i+1} = hash(H_i^S|P_i^X)$
$i=i+1$, goto 3.

Analysis:

Even if the attacker has the plaintext and thus can retrieve $H_0^X$, say in the first round, since $H_0^S$ is unknown, he will not be able to calculate $H_1$. If $S$ is sufficiently large, guessing/brute forcing will be unfeasible. On the receiver side, if the stream was tampered, the bytes decoded in that round will have the same bit errors, but then in the next round, the hash's avalanche effect will kick in, making decoding bytes in the next rounds impossible.

Note:

The bytes used for xor'ing could come directly from the hash's state (keccak comes to mind), and the original bytes could go there, too, performing the specific bit mixing operations of the hash after each cipher round.

Eg:

For SHA256, 128 bits could be used for $S$, and 128 bits for $X$. Or, 64 bits for $S$ and 192 bits for $X$. The later would result in less processing per byte, with somewhat less security.

What is your take on this?


texts:
I want to know if having a 8-byte hash value is better than 16-byte hash value for use within hash trees.

My mind tells me that the shorter the hash value, the better. But doesn't a smaller hash value make it easier to invert? More strings would lead to the same hash value.

I guess this is very opinion-based, but I'd like to hear different reasoning for your answers.


texts:
Is it possible to find points that are on two elliptic curves, and how?

More precisely, I'm looking for coordinates $(x,y)$ that satisfy the defining equations of two elliptic curves on prime fields $\mathbb{F}_{p_1}$ and $\mathbb{F}_{p_2}$:
$$
\begin{cases}
y^2 \equiv x^3 + a_1 x + b_1 \mod{p_1} \\
y^2 \equiv x^3 + a_2 x + b_2 \mod{p_2} \\
\end{cases}
$$
Is this even tractable, and if so how can I calculate at least one intersection point? Is it tractable to have the private key on one of the curves (for given generators)?

I'm curious about the question in general, but in order for this to be practically useful to me now, the curves need to be supported by the software I'm working on: two curves among SECP256R1, SECP256K1, BP256R1 or their 224-bit or 384-bit counterparts.

The motivation is a data validation bug in this software that leads to a public key to be interpreted on the wrong curve, but it has to satisfy both curves' equation. I want to understand how easy it is to exploit it and I'd like to write a non-regression test (which only requires the public values).


texts: The attacker model of the Lucky13 attack in TLS

texts:
Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page:

  The attacks involve detecting small differences in the time at which
  TLS error messages appear on the network in response to
  attacker-generated ciphertexts.

My question is: Can a passive adversary perform Lucky13? In other words, I need to know if Lucky13 attacker's model is active MitM or passive network attacker who just collect traffic and perform analysis afterwards?


texts: Is asynchronous perfect forward secrecy possible?

texts: DH key agreement protocols require the participation of both parties, so are only suitable for synchronous connections.  Is it possible to implement PFS in a fashion usable for asynchronous protocols, like e-mail, or storage?  I'm intuitively thinking not, but I haven't be able to find conclusive proof one way or the other.


texts: Encrypting a JPG, where the output is a scrambled JPG

texts:
Is there an algorithm or program that can take an image, be encrypted, still be opened by an image viewer, but is restored when decrypted?

Basically I want the ability to secure images but still have them seen as "image files".


texts: is there an effective attack against rsa by knowing the coefficient $u$ of the private key?

texts: consider that an attacker has the public key $(n, e)$, where $n$ is $1024$ bits long, the $32$ largest bits of $p$ (where $n = p \cdot q$), as well as $u = p^{-1} \pmod q$. Is there an attack that would allow this attacker to perform an attack on rsa and therefore be able to decrypt a message or retrieve the private key $(n, d)$?


texts: Getting a key size of DSA/Elgamal certificate

texts:
I've tried to get a public key size of DSA/Elgamal PGP certificate. Using the Cleopatra I find out that there is actually two public keys - one with DSA with key size 1024 bits and the other Elgamal with 2048 bits.
Now my question is which of this key sizes is the actual key size for this certificate and more importantly, why?


texts: Breaking an addition-based cipher with two ciphertexts but no known plaintext

texts:
I'm attempting to break a system which uses decryption code functionally equivalent to the following:

$key = md5($somePassword) . foo($somePassword);
for ($i = 0; $i < $payloadLength; $i++)
{
    $data[$i] = (ord($data[$i]) - ord($key[$i]) % 256;
}

Where foo() is a bunch of nonsense pseudo-cryptographic logic involving substrings of MD5s of reverse password strings and ord() returns the numeric value of the character. For non-PHP devs, a . denotes concatenation.

I have two samples of ciphertext which differ a little, which makes me think they're using the same key but with different ciphertexts. Unfortunately I can't make many guesses about the ciphertext since it is compressed with the DEFLATE algorithm in raw mode, so there's no header.

It is important to note that the md5 function, in this case, does not return 16 raw bytes, but rather 32 ASCII hexadecimal characters in the set 0-9 a-f.

I would like to recover the MD5 hash.

My initial thought is to break it like I would a Vigenère cipher, as follows:

$c_1 = m_1 + k \pmod{256}$

$c_2 = m_2 + k \pmod{256}$

thus:

$\require{cancel}
c_2 - c_1 = m_2 + \cancel{k} - m_1 + \cancel{k} = m_2 - m_1 \pmod{256}$

However, without known plaintext I'm finding it difficult to continue. I had a think about eliminating potential nybbles of keys based on whether the resulting key bytes would contain hexadecimal characters, but I'm not really sure where to go from here. The plaintext has some known or predictable bits (see RFC1951) but not many.

Is it possible to recover the hash in this scheme?


texts: Simulation-Based Proof: When a Secret Key is Involved

texts:
Assume we have a protocol in which a party receives an encrypted random polynomial. The polynomial is encrypted using his public key.

We want to construct a simulator for this party (so this party is corrupted). We want to show that in both models (i.e. real and ideal) it receives the random polynomial so they are indistinguishable.

Question:

When we construct the simulator for the party, do we need to pass the secret key of the party to the adversary? (so the adversary in the ideal model can decrypt the message and retrieve the random polynomial)

Or

We can ignore encryption and only pass the random polynomial to the adversary.


texts: Can you help me understand this "Message Modiﬁcation by Meet-in-the-Middle" related to Tiger Hash?

texts:
I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message Modiﬁcation by Meet-in-the-Middle" in plain English?

Here's a screenshot of that section:


texts: Why does the Content Scrambling System have two different length LFSRs

texts:
CSS uses two LFSRs of length 17 and 25.

If we have two periodic functions $f(t)$ and $g(t)$ and consider the function $h(t) = (f(t), g(t))$, then $h$ will have period $pq/\gcd(p, q)$
where $p$ and $q$ are the period of $f$ and $g$, respectively, and $\gcd$ is the greatest common divisor.

How does this principle explain the choice for two different LFSRs?


texts:
I am learning about Shamir's secret sharing scheme and I've come across this problem:

Let's suppose we have a combination of a (3, 6) and (1, 2) Shamir's schemes, where participants $P_1$ and $P_2$ get shares in both schemes and others in the first scheme only. The shared secret is the sum of the two shared secrets. Is such a scheme perfect? My guess is that it is, because I can't see how some unprivileged group would learn anything about the secret.


texts: Cryptographically secure PRNG from a hash function

texts:
Is it possible to get a secure random number generator from a secure hash function this way

First choose a natural number $n$ as seed, then if we are looking to generate random numbers from $0$ to $F$ (in hex), the first in the sequence is the last digit in the hash of $n$, the second in the sequence is the last digit in the hash of $n+1$, and so on. Does this  make a secure PRNG.


texts: Difference Between PEM vs P12 vs CRT vs JKS vs keystore vs PKCS vs x509 certificates

texts: Sorry noob here. I am so much confused about lot of files used client authentication certificates. Can anyone guide me on the difference between PEM vs P12 vs CRT vs JKS vs Keystore vs PKCS vs x509 certificates?


texts: Why did replicated secret sharing use correlated randomness?

texts:
When I read the AFL16 paper by Araki, each party's share is adding a correlated randomness, like  r1 = (a1b1−x1y1+α)/3 ,  r2 = (a2b2−x2y2+β)/3, r3 = (a3b3−x3y3+γ)/3 with α+β+γ=0, and use AES to generate that.
Also in the ABY3 paper they add the similiar randomness to each party in arithmetic operations.
I wonder why this is necessary. I notice that even without that randomness, the protocol is still correct. Did this miss any security guarantee?
The full name of the paper is "High-Throughput Semi-Honest Secure Three-Party
Computation with an Honest Majority", can anybody help to explain it?


texts: Attack of the Middle Square Weyl Sequence PRNG

texts:
The Middle Square Weyl Sequence PRNG was proposed as illustration of properties of CSPRNGs in this answer (now deleted). This PRNG was introduced by Bernard Widynski in Middle Square Weyl Sequence RNG (arXiv, 2017). That was without claim of cryptographic security, but v5 of the paper conjectures that it would "be difficult to determine the internal state by examining the outputs".

The PRNG has a 128-bit state consisting of two 64-bit variables $x$ and $w$. The PRNG input consists of the initial $x_0$ and $w_0$, and an odd value $s$. The state's evolution and 32-bit pseudorandom outputs $r_i$ are defined (for $i\ge0$) by
$$\begin{align}
r_i&\gets x_i\bmod2^{32}\\
w_{i+1}&\gets(w_i+s)\bmod 2^{64}\\
x_{i+1}&\gets((x_i^2+w_{i+1})\bmod 2^{64})\ggg32
\end{align}$$
where $\ggg32$ swaps the halves of its 64-bit left argument.

[The notation was modified so that $r_0$ is output, for consistency with an answer]

The paper gives a reference C99 implementation (with input $x_0=w_0=0$ and a certain $s$; the output starts at $r_1$)

uint64_t x = 0, w = 0, s = 0xb5ad4eceda1ce2a9;
inline static uint32_t msws() {
   x *= x; x += (w += s); return x = (x>>32) | (x<<32);
}

Assume we have a $r_i$ for $0\le i\le9$. How can the rest of the sequence be predicted efficiently? That would be a total break.

If not feasible, lesser breaks (only distinguishing the output from random, or requiring more plaintext, or working only for a fraction of the inputs) are also welcome.


texts: Can multiple hashing weaken the password?

texts:
Problem. I want a longer key out of password than my hashing function provide.

Idea.  I want to hash password multiple times rotating chars one position each time and use composite key.

Question. Do I really weaken the password?

Example:

Password=carphagen

Key1= BCrypt("carphagen")=OZrxJo..IAwipd8hHm69IGFiPz/Y/veK
Key2= BCrypt("ncarphage")=PiG1Qndv8kOHDFoEwhbM.rqtM4O5XNR2
Key3= BCrypt("encarphag")=Hbrz35n4pwOLsWnMdyuQ7Ze1XMH/QnmC
. . .
KeyN= BCrypt("rphagenca")=OapAj6P0OS5P0m20f5oAKY482hEvfLhy

N < less password length

Key = Key1 + Key2 + . . . + KeyN

Question. The attacker knows Key, does he get help with password?

Small Update: BCrypt Salt is the same and is known. It is removed from the hash and not used as a part of the Key


texts: AES, is this method to say "The password you entered is wrong" secure?

texts:
(TL;DR at the end)

Let's say the plaintext hello is encrypted with AES (CFB mode). I noticed that decryption works no matter the given password! Of course if the password is wrong, the output will be garbage, but no error will be thrown (example in Python):

import Crypto, Crypto.Random, Crypto.Hash, Crypto.Cipher.AES
p = b'hello'
iv = Crypto.Random.new().read(Crypto.Cipher.AES.block_size)
cipher = Crypto.Cipher.AES.new(Crypto.Hash.SHA256.new(b'password1').digest(),
                          Crypto.Cipher.AES.MODE_CFB, iv).encrypt(p)
print(Crypto.Cipher.AES.new(Crypto.Hash.SHA256.new(b'wrongpassword').digest(),
                          Crypto.Cipher.AES.MODE_CFB, iv).decrypt(cipher))
# b'\xfdQ\xd7\xa3\x1b'

I read that HMAC etc. can be used to ensure integrity, or AES in GCM mode.

But to keep things simple, I wanted to know if this method is secure or not:

p = b'hello'
startingtag = b'504B0304'   # fixed constant, like "MZ" for DOS .exe files, or "%PDF-1.5" for PDF files
iv = Crypto.Random.new().read(Crypto.Cipher.AES.block_size)
cipher = Crypto.Cipher.AES.new(Crypto.Hash.SHA256.new(b'password1').digest(),
                          Crypto.Cipher.AES.MODE_CFB, iv).encrypt(startingtag + p)
s = Crypto.Cipher.AES.new(Crypto.Hash.SHA256.new(b'wrongpassword1').digest(),
                          Crypto.Cipher.AES.MODE_CFB, iv).decrypt(cipher)
if s[:len(startingtag)] == startingtag:
    print('ok good password, here is the plaintext:')
    print(s[len(startingtag):])
else:
    print('wrong password entered.')

What does it do? A starting tag is encrypted along the plaintext. Then we check if the first bytes of the decrypted text matches this starting tag.

This is basically the method explained here. I had the same questionning than a comment there:

  if the first block of the plaintext is a known value, can't an attacker easily get the key from looking at the first block of the ciphertext?

But on the other hand this seems true as well:

  Having a known header isn't a problem, otherwise encrypting something like a Microsoft Word document (that also has a known header) would be insecure.

TL;DR:

Is it secure to encrypt with AES CFB mode a plaintext for which the first bytes are known (e.g. %PDF-1.5 for a PDF document),
or does this give too much information to an attacker? Then does this mean it's a bad to encrypt documents with known headers with AES?


texts: Why is simulation-based security for functional encryption impossible in the standard model?

texts:
Boneh et al.(Functional Encryption Definitions and Challenges) present that simulation-based security for functional encryption is impossible in the standard model.
I can not understand this.

In addition, why can we construct a simulation-based secure scheme where a bounded number of ciphertext queries is necessary when considering adaptive queries in the standard model.


texts: VKO GOST R 34.10-2001 (described in RFC4357), Key Agreement Algorithm. Looking for its implementation/detailed description/examples

texts:
VKO GOST R 34.10-2001 was described in RFC4357 Page 7
But the description is very poor. Here it is:

  This algorithm creates a key encryption key (KEK) using 64 bit UKM, the sender's private key, and the recipient's public key (or the reverse of the latter pair).

  Let $K(x,y,UKM) = ((UKM*x)(mod q)) . (y.P)$ (512 bit), where

  $x$ - sender's private key (256 bit)
  $x.P$ - sender's public key (512 bit)
  $y$ - recipient's private key (256 bit)
  $y.P$ - recipient's public key (512 bit)
  $UKM$ - non-zero integer, produced as in step 2 p. 6.1 [GOSTR341001]
  $P$ - base point on the elliptic curve (two 256-bit coordinates)
  $UKM*x$ - $x$ multiplied by UKM as integers
  $x.P$ - a multiple point
  Calculate a 256-bit hash of $K(x,y,UKM)$:

  $KEK(x,y,UKM) = gostR3411 (K(x,y,UKM))$

  Keypairs $(x,x.P)$ and $(y,y.P)$ MUST comply with [GOSTR341001].

  This algorithm MUST NOT be used when $x.P = P, y.P = P$

I want to implement it. Would be great to get more detailed description of that alogirthm with standard values for all parameters, with several examples (to be used in testing my own implementation) of all intermediate and final values on both sides. Here’s an example of a great description for Signature Algorithm GOST R 34.10-2012 (PDF, Russian language).

There is an implementation in OpenSSL of VKO GOST “engines/ccgost/gost2001_keyx.c”, but I'm not familiar with OpenSSL, so understanding of those functions internals is difficult for me. Maybe someone has at least some C++ (or any other language) implementation of VKO GOST key agreement algorithm (could be through OpenSSL) so that I can run it and get golden test values for testing my own implementation.

I just finished with implementing my own Big Integer C++ library with elliptic curves support. I've implemented Key Agreement from RFC4357 and surprisingly it works! You get the same$ K(x, y, UKM)$ on both sides while only sharing public keys and UKM between both parties.

Just found a nice description of VKO GOST in the next document Using cryptographic algorithms related to GOST R 34.10/11-2012 (PDF, Russian language). It has reference examples of computing shared key $K(x, y, UKM)$ after hashing it with Hash GOST R 34.11-2012.

Still looking for real detailed standards with real values. Maybe some other Key Agreement standards that are well used in Russia or related to GOST R 34.10 standard.


texts: Forward-secure static-ephemeral ECDH key agreement protocol

texts:
The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved.

Assumptions

Alice is a persistent entity with a static and well-known public key.
Bob is a transient anonymous party who would like to exchange some private information with Alice over the public Internet in a session of short duration (less than an hour), in a way that is forward-secure (has the forward secrecy or PFS property).
Bob has a good copy of Alice's static public key.
Bob must authenticate Alice, but Alice need not authenticate Bob.
All key and ECDH operations use Curve25519 or another SafeCurve.
The final shared secret that is the outcome of the protocol will be used to secure the data transfer between Alice and Bob (which takes place with a separate protocol) by serving as the key to an Encrypt-then-MAC authenticated encryption (AE) procedure (for example, XSalsa20/Poly1305) that also requires a unique-per-(key, message) nonce as input.
The transport protocol is message-based (not TCP), and protocols such as TLS and DTLS are not applicable.

It is well known that using mature and battle-tested key exchange protocols is usually the right answer, so pointing this out is unnecessary.  Useful answers will provide specifics as to any problems with this protocol and, especially, how they can be corrected.

Protocol

Bob generates an ephemeral (private, public) keypair (b, B).
Bob computes the DH shared secret X using his private key and Alice's static public key A, and then K(X), the result of applying an appropriate key derivation function (KDF) to the combination of A, B, and X.
Bob initiates communication with Alice by sending her a (cleartext) message that contains some fixed protocol information such as a magic number and version, and a copy of Bob's public key B.
Alice receives the message and computes the DH shared secret X using her static private key a and the public key B that Bob sent.  She then computes K(X) as Bob did.
Alice generates an ephemeral (private, public) keypair (e, E).
Alice generates a unique nonce N0 and the ciphertext C that results from applying AE with nonce N0 and key K(X) to her ephemeral public key E.  She then sends N0 and C to Bob.
Bob receives the message and authenticates/decrypts it with AE using the nonce N0 sent in the message and key K(X).
Both Alice and Bob compute the DH shared secret Y using their ephemeral keys (e, E) and (b, B), and then K(Y), the result of applying the KDF to the combination of E, K(X), and Y.  The values X, K(X), and Y are discarded.
At this point the protocol is complete, and data transfer is carried out separately using AE with key K(Y) and a unique nonce sent in the clear with each message.  When the session is finished, the ephemeral keys (b, B), (e, E), and K(Y) are discarded.


texts: Digital cash and blind signiture: coherence between signature and serial number

texts:
My question is about the basics of the topic "creating digital cash".

At the very beginning of that topic the amount of the banknote and a serial number are the requirements for generating a signature. This signature is placed to avoid pirate copies of the banknote. That implies that the bank can trace the banknote and their customers by the serial number.

To anonymize the tracing a method called blind signature is introduced. My question is about the coherence between the serial number and signature for that banknote.

How can the bank generate a signature for a banknote without noticing the serial number while keeping the coherence between the signature and the serial number?


texts: I have a question about the chi-square test How can we use it in cryptography? And what results should we expect from it when a file is encrypted? I mean, when a file is encrypted, should its value increase?


texts: What algorithm would give the shortest ciphertext for very short plaintexts?

texts:
I have to encrypt some very short messages (approx. 5 characters) and I would like the ciphertext to be as short as possible.  I am currently using AES but the initialization vector (IV) is making my minimum cipher text be 32 bytes, even for plaintext of 1 byte.

Can I do better than 32 bytes?


texts:
In RSA signature scheme, it is a common practice to 'sign' the hash value of the message so that the length can be fit.

Question: If we have $s=m^d \bmod n$ where $d$ satisfies $ed \equiv 1 \pmod{n}$ and we also know $s$ and $m$, is this still considered secure?


texts: Why do we need special key-wrap algorithms?

texts:
Wikipedia says:

  Key Wrap constructions are a class of symmetric encryption algorithms designed to
  encapsulate (encrypt) cryptographic key material.

We are using these algorithms to encrypt (and authenticate) a key, using a symmetric algorithm (and symmetric key, named key encryption key).

Some of these algorithms are quite complicated, like the AES-keywrapping algorithm AESKW defined by NIST originally in 2001, with a new draft 800-38F available now. In the following image, each red box is one invocation of the AES block cipher, to encrypt in total only 256 bits (i.e. 2 blocks) of plaintext (including a constant part as integrity check/authentication):

(Image from Figure 7 of Deterministic Authenticated-Encryption - A Provable-Security Treatment of the Key-Wrap Problem, by Rogaway/Shrimpton, 2007.)

Why do we need such complicated algorithms, when a simple combination of CBC or CTR mode with a MAC, or an authenticated encryption mode like AEX would give us the same security result?


texts: What prevents ProtonMail from sending me the wrong public keys?

texts:
I've recently been looking at ProtonMail, an email service which provides transparent end to end encryption between users with PGP. In order for the encryption to be transparent, ProtonMail manages all of the public and private keys.

When sending an email from a ProtonMail account to another ProtonMail account, the ProtonMail server sends the destination's public key to the client. The client then encrypts the email using the given public key and sends the mail to the server to forward to the recipient, who can decrypt it with their private key.

Since ProtonMail's server only ever sees the encrypted email, and it doesn't have access to any cleartext private keys, it cannot read the email. According to ProtonMail, this means we don't need to trust the ProtonMail server to know it doesn't read the email (assuming it doesn't send malicious javascript with the client).

However, what, if anything, prevents ProtonMail's server from conducting a man in the middle attack by sending the wrong public key? If the server sends the public key corresponding to a private key they control, they could decrypt the email, then re-encrypt it with the correct public key, and send it to the intended recipient. In normal PGP the user must explicitly mark each public key as trusted, but no explicit trust is requested from the user of the ProtonMail client. So how does the ProtonMail client know to trust the public key sent by the server?


texts: Full encryption of IDs, partial decryption with customer specific key

texts:
I am looking for a "partial" encryption/decryption algorithm.

Let's say I am encrypting the following List of IDs (long values) $[1,2,3,4]$ (with a secret key) to an encrypted string $e$, I would like to produce several keys $k_1,k_2,...,k_n$, which can decrypt just a subset (some IDs).

For example:

val rawIds = [1,2,3,4,8]                         # Array of Long
val e = encrypt(rawIds, secretKey)               # An encrypted String

decrypt(k1, e) = [1]                             # Decryption of e with key k1
decrypt(k2, e) = [2,3]                           # Decryption of e with key k2

Both the encryption and decryption must be very fast in terms of computation time (<1ms). We want to produce keys, which can decrypt the value $e$ in way that only a subset of IDs can be decrypted.

$k_1$ for example is able to decrypt $e$ (but only retrieves $ID_1$) where $k_2$ can decrypt the same encrypted value but retrieves $ID_2$ and $ID_3$. He might even get $ID_5$, but this was not in the raw string.

When creating the keys, we could add the IDs which can be extracted somehow to the decryption key.

Update:

The possible values of the IDs are known, there is a predefined set (let's call them $ID_1,ID_2,...,ID_n$).

The business purpose is the following:

I have 2 customers, where I know that customer1 is only allowed to see $ID_1$, therefore I create a key $k_1$ (and add the meta information $ID_1$).
The second customer is allowed to see $ID_2$, $ID_3$ and $ID_5$ (therefore I create a special key $k_2$ for him).
Both customers will get the same encrypted value e, and both can decrypt it but will get back a list of IDs, where every element is allowed to be extracted by that customer).

This was meant by: I add the IDs to the decryption key.

Some additional information:

It's only one entity which is encrypting, don't need to decrypt with the secret key
No need to check authenticity of the encrypted value (always trust)
When creating keys, the actual IDs (Long values) which can be extracted can be added to the actual key.

Where to start? Has anybody an idea of a similar existing approach?


texts: Why can't AES-GCM be used in IKEv1 phase 1?

texts: I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we could use it in both phases. I have already checked the RFC articles but there was no explanation. Is it only because AES-GCM came after IKEv1 or something like that?


texts:
Hi I have a stream cipher which uses a keystream of:

F(r) || F(r+1) || F(r+2) || ...

Suppose F(r) is the RSA encryption algorithm:

F(r) = r^e mod p where e and p are known , e = 3

My question is:
If we know F(r), F(r+1) and F(r+2), how can we calculate the subsequent key sequence?

Is there some obvious relation between F(r+3) and F(r),F(r+1),F(r+2) I don't  see?


texts: $P \ne NP$: a proof relating complexity theory to block ciphers

texts:
I started thinking about P vs NP after reading another question on this stack exchange. Here I propose a proof that relates P vs NP to the existence of a secure block cipher in the elf model.
Let's say I have a (normal) Turing machine and I want to model a nondeterministic machine with it. According to certain models, a nondeterministic Turing machine can branch at each decision to multiple instances of itself. If I have an input $N$ of $n$ bits, let's say I must make a decision for each of $n$ bits: that's $2^n$ possible branches, operating in parallel. Since  a normal Turing machine must loop through every state of $N$, operating on each independently, wouldn't that mean $P \ne NP$ since I can construct a problem in $NP$ which requires me to operate on all possible $N$.
If we consider a an ideal block cipher we can say there exists a construction which requires you to operate on every possible input (consider the elf model). In the elf model, one must either form a lookup table of the entire mapping ($2^b$ blocks where $b$ is the block size) or iterate on every possible block. Therefore, if there exists a secure mode of operating on multiple blocks in the elf model, there must exist a problem in $NP$ which cannot be performed without iterating over every possible $N$. Since secure modes of operations are known to exist (if a secure block cipher exists), and the elf model proves a secure block cipher exists, this would prove $P \ne NP$.
If I can create a cipher which requires me to solve a cipher with a smaller block size (a perfect block cipher), I can force the decision to depend on every input bit, making the security rely only on obtaining perfect diffusion among the possible states, which many ciphers do already. This way I can create a secure block cipher from another secure block cipher, of smaller block size. Effectively, every SP-network is proof that $P \ne NP$.
Is this valid, or is there anything I'm missing? Is there anything unclear about my reasoning?


texts: AEAD using AES-CBC and MAC: how to order the input to the MAC

texts:
I'm writing code to provide an AEAD utility.  It uses AES-256-CBC for encryption and SHA-512(key+data) truncated to 256 bits as the MAC.

encrypt(
    aes_key: byte[32],
    mac_key: byte[32],
    plain_text: byte[],
    aad: byte[],
) {
    iv = crypto_random_bytes(16)
    cipher_text = aes_256_cbc(aes_key, iv, plain_text)
    aad_encoded_length = int_to_little_endian_4_bytes(aad.length);
    auth_state = sha_512(key + aad + iv + cipher_text + aad_encoded_length)
    auth_tag = truncate_bytes(auth_state, 32)
    return cipher_text + auth_tag
}

I'm primarily interested in how to order the data I'm passing to sha_512.  I based it off of this: https://www.ietf.org/archive/id/draft-mcgrew-aead-aes-cbc-hmac-sha2-05.txt

Is that the best ordering?

(P.S. Though not really part of this question, my decision to use AES-256-CBC and truncated SHA-512 was based on library availability, performance, and resistance to accidental nonce reuse.)


texts: Type of values that can be accumulated in bilinear map (multiplicative) accumulator reg

texts: Is there any restriction that  the members to be accumulated in bilinear map (multiplicative) accumulator need to be relatively prime to $P$, where $P$ is the order of the group.


texts: Generate key pair deterministically from a particular seed

texts:
I've been reading "SQRL Secure QR Login" at Gibson's website, and I'm wondering if there is a way to generate an RSA private/public key-pair based on some cryptographically secure input, so that if the input stays the same we keep getting the same key pair on the output.

The linked web-site uses elliptic curve cryptography to achieve this property.  Is it not possible with RSA?


texts: Cryptographic Tagging of Information over an Insecure Channel

texts:
Is there an efficient algorithm for the tagging and location of information over an insecure channel, where two parties (the tagger and the intended recipient for the tag) can recognize a piece of information has been tagged, but it looks like random data to an outside observer?

Preferably not something linear, maybe O(log n) instead.

Example:

A professor has multiple classes full of students, and would like to publish the set of grades for every piece of homework a student has submitted over the last 10 years. The professor wants the grades to be visible to the public so that analysis can be run on them. (e.g. to show how certain classes might be doing better than others)
The professor would also like to tag each grade with a code so that each student can recognize which grade is theirs, but could not tell which grade belonged to another person. An attacker should not be able to establish that a set of grades belongs to the same individual through this tag.
For reasons (and that I can't come up with a better example), the professor and students can only communicate through an insecure channel to establish this tag.

I understand that asymmetric encryption can be used here, but having each "student" run a check on millions/billions of entries to figure out which "grades" are theirs will be too computationally costly.


texts: Economically Rational as a security proof

texts:
Is it possible to prove the security of a cryptocurrency payment protocol by saying that the actors will seek to maximize their profits. Would I need to set this up as a game and prove it that way or what can I do to get started?

The information I have is the state of the system and then I have just iterated each agents ability to change the system and just show that by following the protocol each agent maximizes their profit.


texts:
SHA-1 is on the way to deprecation, in particular for digital certification (x509). But I can't find ressources about SHA-1 deprecation from SSL/TLS Cipher Suites.

Is it implicit, as deprecation implies that SHA-1 usage will be deprecated in all cases ? Or is there a different strategy concerning SHA-1 usage in Cipher suite ?

I also don't understand how attackers could forge SHA1 certificate signature, as the hash is still "protected" by the signature (CA private key). So forging the hash with collisions, ok, but one would detect that hash is not trusted anymore (signature wouldn't be the same). I miss something ?


texts:
I am disturbed by assertions that this or that classical cryptographic primitive is "quantum resistant", but my understanding is that no one knows yet how to demonstrate quantum hardness, or even if such demonstrations are possible. At best, there may be cryptographic primitives for which no quantum attack has yet been found (but of course the world does not have much experience yet with quantum computers!)

Is this correct? Or, is there a rigorous way to demonstrate quantum hardness that I have not yet seen?