texts:
Assume we have 2 prime numbers in form p = 2q + 1.
Is it safe to use the cyclic group of order p-1 instead of one with order q in ElGamal encryption? I couldn't find any suitable source to explain why we should use q as order of our group and avoid p-1.
Most websites and sources just say:

use cyclic group of order q

without any explanation.
What have I tried?
I assumed p = 11 and therefore q = 5. I did all calculations of ElGamal-Encryption by considering 10 as my group order($Z_{p}^{*}$):

Group(G) = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
Group Order(q): 10
*Generator(g): 7
Message(m): 9

and there was no problem in decrypting the message. So I think there is something wrong with its security!
I thinks there is no need to mention the calculations using q = 10 But if you need them, just comment below the question to bring them into the question as an update.


texts: Maximum number of possible keys for a fixed-length password?

texts:
I'm reviewing some information and possibilities regarding key space size following a unique password requirement, as it were.

This particular requirement is a fixed-length password of 12 characters, with exactly 1 capital letter, and exactly 1 digit.

My understanding is that, let's say we have 26 letters, then we'd take 26^{(number of characters)} so for a 10 character password, your possible key combos is in the neighborhood of 141,167,095,653,376.

If you included all upper case and lower case, that'd be 52^{(number of characters)}, so on and so forth--the question I'm stumped on is how that changes if you have exactly 1 of a UC and exactly 1 of a digit, if it does at all.


texts: Does IKEv1 support multiple combinations of a source IP range?

texts:
I saw in several places online that the different between IKEv1 and IKEv2 is the use of multiple combinations of a source IP range as left and right subnets (locally and remote), a destination IP range, a source port range and a destination port range are allowed per Child SA.
I am using Strongswan 5.3.5 version on Ubuntu 16.4 LTE.


texts: Binomial distribution sampling - concrete example

texts: Can anyone give me an explicit example of how one can samples from the binomial distribution defined in NewHope's paper? What is the difference of sampling from rounded Gaussian in practice?


texts: Changing plaintext for encryption in RSA

texts: In the RSA crypto scheme, the message $x$ (plaintext), is encrypted to produce ciphertext ($y$), by computing $x^e \bmod n$. Of course, that means that $x$ has to be a numeric value for this to work, and I am assuming this is found by tables such as ASCII. But, what is this plaintext $x$? Is it a single character in the message, or larger parts of the plaintext that are encrypted together, as the examples I have seen have not really expanded on what $x$ really is, and have just given it a small numeric value for exampes, and I am interested to understand what $x$ is in practise.


texts: Vulnerabilities if encrypting the same data with 2 different keys

texts:
Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it to Bob. From there, Alice and Bob exchange a lot of messages back and forth, using AES-256 to symmetrically encrypt the data with the key kaes1.

Then, Charlie comes along and wants to participate, so Alice and Charlie complete a key exchange and Alice then uses that key k2 to encrypt the same original kaes1 and sends it over to Charlie. From there, Alice and Bob and Charlie now exchange a bunch of messages symmetrically encrypted with AES-256.

Eve has been listening in this whole time, and she has all the data, but none of the keys. Does Eve gain an advantage if she knows that kaes1 was the payload for 2 different messages encrypted with 2 different keys k1 and k2?


texts: What does the comma mean in m, c := E(K, m)

texts:
Disclaimer: I'm a beginner to cryptography.

Background: I'm reading Cryptography Engineering by Ferguson, Schneier, and Kohno, where the authors use this image:

Question: What do the commas mean here?

My attempt: m, c :=  --- seems to mean "given" m, c equals ...


texts: Inversion Free Elliptic Curve Operations

texts: Is there a way (different than projective closure) to obtain inversion free elliptic curve addition formulas ?


texts: Distributed generation of random numbers

texts:
I have a network of $N \gg 1$ nodes. Some relatively low fraction $p$ (e.g., $p \simeq 0.01$) of them is under the control of a malicious attacker. Nodes can talk to each others and verify each other's identity (i.e., when a node communicates with another one it can verify the other's identity and membership to the network).
Now, I need my nodes to agree on a random number. It should be the same random number for all the nodes, and it should indeed be random. In other words, the malicious attacker shouldn't be able to steer the distributed random number generation to produce a number of its choice, unless $p$ is larger than some reasonably large amount (e.g. $0.1$).
Is there any way to do so with $O(N \log(N))$ communication complexity? For example, a trivial way of doing this with $O(N^2)$ communication complexity is that each node generates a random number, hashes it with a secure hash and communicates it to all the other nodes. When all the commitments are exchanged, everyone sends out its own random number, and all the numbers are XOR-ed or modulo-summed or so. But this is expensive in terms of communication, and definitely not scalable.
What I need this for
I am developing a peer to peer storage network, where a potentially very large set of nodes contribute to storing each other's data. I am working under the assumption that only that fraction $p$ of the nodes is malicious and willing, e.g., to corrupt or make unavailable some data. Now, I am using a redundancy protocol where a group of, e.g., 36 nodes store each other's data using an erasure code that allows up to 12 nodes to be wiped before the data is lost. This is nicely reliable, as long as the attacker has no way to infiltrate more than $12$ nodes in any specific group. Since $p$ is small, if I have a way of organizing the nodes into groups at random, the probability of any group having more than $12$ malicious nodes is vanishingly small.
This is why I need globally verifiable random numbers: I need all my nodes to be certain that the groups they have been organized into are really random.


texts: Solution to Discrete Log as a Commitment

texts:
Is the solution to a discrete logarithm a reasonable commitment scheme?
By my analysis, the following scheme is a reasonable commitment scheme:
Let $p$ and $q$ be large primes such that $q∣(p−1)$, let $g$ be a generator of the order-$q$ subgroup of $Z^*_P$. Let $m$ be a value from $Z_q$, and $c=g^m\text{ mod }p$. The commitment is $c$ and to open the commitment, the sender reveals $m$.
I believe this scheme is:

(Perfectly?) binding: The discrete logarithm only has one solution and so the sender can't reveal another value, $m'$, such that $c= g^{m'}\text{ mod }p$

(Computationally?) hiding: Obviously, this scheme is not perfectly hiding. But assuming the discrete logarithm is hard, receiver or an adversary can't determine the committed message prior to reveal, so I believe this provides computational hiding.

Is my analysis of the binding & hiding properties correct? Are there other flaws not captured by hiding and binding?


texts: How to use sagemath to find nonlinear invariants of S Box

texts:
I read a paper about a nonlinear invariant attack that is "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"
And i found a website of sagemath : https://trac.sagemath.org/ticket/21252 where they have a code to find nonlinear invariant for any Sbox, but it's not official so it's not included in sagemath. Anyone know how to do it? I want to write a code in C++ to find nonlinear invariant but i dont get the idea of the author. Thank you


texts: Verification of NIZK proof with algebraic MACs

texts:
The paper Algebraic MACs and Keyed-Verification Anonymous Credentials, includes a way to instantiate a NIZK proof with algebraic MAC. This is given in Appendix E where this NIZK is a part of the Show protocol. I understand the proof generation given in E.1, where the protocol outputs proof P. The hash $c$ in P is given as:
$c = H(param||\{C_{m_i}\}_{i=1}^{n}||C_{u^\prime}||\{\tilde{C}_{m_i}\}_{i=1}^{n}||\tilde{V})$
But I do not understand the Proof Verification part given in E.2. Particularly, I do not understand the construction of $c^\prime$ which is given as:
$c = H(param||\{C_{m_i}\}_{i=1}^{n}||C_{u^\prime}||\{C_{m_i}g^{s_{m_i}}h^{s_{z_i}}\}_{i=1}^{n}||VX^{s_{z_1}}...X^{s_{z_n}}g^{s_r})$
The verifier checks whether $c = c^\prime$. But I do not see how they can be computed to be equal even if everything is right. The first 3 parts of the construction of $c^\prime$ have the same elements as $c$, so for them to be equal, the particular equations below should be satisfied.
$\{\tilde{C}_{m_i}\}_{i=1}^{n} = \{C_{m_i}g^{s_{m_i}}h^{s_{z_i}}\}_{i=1}^{n}$, and
$\tilde{V} = VX^{s_{z_1}}...X^{s_{z_n}}g^{s_r}$
But upon expanding the left-hand-side of either of the equations, they do not equate to their corresponding right-hand-sides. Where am I going wrong here?


texts: Security of encrypting many short values with AES in GCM mode

texts:
We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised.

The intention is that each field is individually encrypted with AES GCM with a 128-bit key and 128-bit randomly generated nonce. Fields will generally be quite short in length so there will be many short values encrypted with the same key.

AES GCM was chosen on the basis that it provides authentication in addition to encryption.

There will be approximately 50 million data items with 30 fields each. The intention is to use different keys for subsets of the fields, so likely 5-10 keys initially.

Would AES GCM be suitable for use in this scenario?


texts:
Is it possible to contract NIZK proof that a cipher was randomised?

Suppose Alice creates a cipher $c = \text{Enc}(m,r)$ and ZK proof that $c$ was formed correctly (for example, $\text{Enc}$ could be the lifted ElGamal encryption function). Bob wants to randomise $c$ and construct $c' = c\cdot \text{Enc}(0,r')$. How can Bob prove that $c'$ was indeed computed correctly?

Thank you!


texts: What are the randomness requirements for inputs to PBKDF2?

texts:
I need to generate one 160-bit HMAC-SHA1 key for each user in my system. Can I use the username as the input to PBKDF2 function to generate the key?
Is it safe to use known values like username as inputs to PBKDF2? Or should the input to PBKDF2 function be random? If random, then how random?


texts: Somewhat Homomorphic Encryption versus Fully Homomorphic Encryption?

texts:
Is that correct that Somewhat Homomorphic Encryption is more efficient that “Fully Homomorphic Encryption” (FHE) but less efficient than Partially Homomorphic Encryption (e.g Paillier encryption)?
Is that correct that in Somewhat Homomorphic Encryption (e.g. used in Private Database Queries Using Somewhat Homomorphic Encryption (PDF)), the plaintext can be defined over a “known finite field”, so after homomorphic operations – when we decrypt – the plaintext is in that finite field?


texts: Given the encryption formula and flow chart for block-chaining. How could I make the decryption version of this? Would it just be everything in reverse?


texts:
Please explain the difference between TLS re-negotiation and resumption.

My understanding is as follows: in the context of TLS 1.2, re-negotiation and resumption look the same, but the former can be started with either a HelloRequest/ClientHello from server/client while the latter can start with just with ClientHello from the client. In both cases, a client-server dialog followed by an abbreviated handshake occurs (or not ?), security parameters do not change, and new keying materials are recalculated using an "old" pre-master secret with new random numbers.

From the record layer point of view, all re-negotiation/resumption messages  should be processed using "current record state"-- which means they are encrypted/authenticated using "current" keys.

Re-negotiation may happen in the middle of an existing session, a "session ticket" or "session Id" are not required to find "current state parameters", just 5 tuple may be used to look for proper running session context. ( is it true ?)

Moreover, resumption may happen even after actual connection has been closed (is it true? ) and we need sessionTicket or sessionId to look for security parameters and DO decryption, BUT the ClientHello message itself is encrypted.
How is this solved for TLS1.2 ?

In the context of TLS1.3, renegotiation is done by using KeyUpdate message, and is clearly described by draft, but resumption has the same issues.
How is resumption solved for TLS1.3 ?


texts: How to calculate the avalanche effect in aes-256?

texts:
I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key.

I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using BASE64encoder.

Avalanche effect is to calculate ”changed bits / total bits”. If I want to calculate the avalanche effect for AES-256, what are the right procedures to calculate the avalanche effect, and  what are the rules in how long the plaintext, key, and ciphertext should be?

0-15 character plaintext produces 24 character ciphertext.
16-31 character plaintext produces 44 character ciphertext.

24 chars is 192 bits and 44 chars is 352 bits, how to get 256 bits in ciphertext?


texts:
I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-analysis and some use power analysis to get the key. Once the manufacturer - and other parameters - have been obtained it is trivial to create an arbitrary number of remotes to your garage, car, or whatever.

I have two questions about that :

Do manufacturers in general (cars or garages) still use Keeloq as their algorithm after these attacks and vulnerabilities have been exposed?
Or are other algorithms used, for instance manufacturer specific ones?
If the manufacturer key is not public and is stored in the receiver, how do some Chinese manufacturers sell some car remotes (specifically some older models)? Do the original manufacturers publish their keys after the car is out of production? Do the keys get leaked?

Because honestly I don't think Chinese mass production companies would go through all the trouble of breaking the cipher to get the key.


texts: Need to generate same ciphertext everytime

texts:
I am developing in android and working with numeric ids. Say for e.g., 5001.

I upload videos with this id prefixed in in the uploaded video's name.

For e.g. 5001_profile_video.mp4 is a filename. Then if 5001 gets encrypted to xx841jf==, the file name would be xx841jf==_profile_video.mp4.

I need this to be same every time. Say I uploaded video for profile id 5001, the and the file name was xx841jf==_profile_video.mp4. Then, next time I retrieve video for id 5001 I should be able to form part of  the file name as xx841jf== for retrieving video from server.

I need to encrypt 5001 but I need it to be same every time I call the encrypt method. I am currently using Cipher class in java but the results are different every time.

What should I do? Is encryption what I should be looking for OR should I look for something else?


texts: Can an attacker predict value of $d$ if attacker already used $n$ for encryption?

texts:
In RSA we have value of n and e which is known to sender.
If the sender keep maintaining a database of possible n's he can easy calculate $\phi(n)$ because he already know $p$ and $q$ then. $d$ is $e^{-1} \mod \phi(n)$.

If we choose a large number which is product of two primes, can an attacker predict value of $d$?


texts: Using public-key signature instead of having API key

texts:
I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then I could store it or its hash on the server-side for authenticating clients. But after Googling some HN threads I found that sending API keys in HTTP headers might leak if HTTP request logs have been leaked at some time in the future, and then the attackers could very easily use the keys to impersonate the clients.

Then I looked at the AWS model, which I have always wondered how it actually works. AWS doesn't just give you an API key, it gives you a couple of tokens, probably like a private-public key pair and the client's HMACs, some request-specific string (HTTP method, HTTP path, timestamp, etc...), and then the server simply authenticates the client by checking the signature with the public key.

Now, if this public-key signature is truly much more secure than the usual API key, I want to know whether my implementation is secure enough:

When the user registers, the server generates a ed25519 or curve25519 key pair, the server gives the user the private key as an API key and the server stores the public key.
When the user sends a request that needs to be authenticated, he computes the current timestamp and then signs it with libsodium's  crypto_sign() and sends the signature in an HTTP header.
When the server authenticates the user by simply verifying the signature using libsodium's crypto_sign_open()

In that way, the user never has to send a static API key that might get stored and leaked in some log's store in the future. Additionally, the server should check the timestamp in order to verify it is not an old one that might be involved in some weird replay attack. Also, I am assuming that the server is using HTTPS with TLSv1.2 at least.

I feel that I am right, but I also understand that I should not invent my own security. I just need your recommendation of this type of public-key signature authentication


texts: Are encryption algorithms with fixed-point free permutations inherently flawed?

texts:
Flaw in Enigma
One of the Enigma machine's flaw was the derangement (fixed-point free permutation) of the produced ciphertext, or simply put: No plaintext-letter can be enciphered to itself. See this example from Wikipedia of how this text (in German) "Keine besonderen Ereignisse" can or can't be encrypted:

More modern encryption algorithms used during WW2, such as the Enigma-alike Typex machine used by the British, eliminated this flaw, meaning that a plaintext-letter sometimes could indeed be encrypted to itself.
And as far as I know most modern encryption algorithms (i.e. AES) also allow for the possibility of plaintext-letters being encrypted to themselves.
Questions
My questions are:

Are all encryption algorithms with fixed-point free permutations inherently flawed?
Can it be mathematically proven that all fixed-point free permutation algorithms can be broken with a "faster-than-brute-force" attack?


texts: Primitive polynomials and irreducible polynomials?

texts:
This question may seem annoying to some scholars as it is a very silly question but as I am new on this topic, it seems quite confusing.

  All minimal polynomials or primitive polynomials are considered as irreducible polynomials but all irreducible polynomials are not considered as minimal/primitive polynomials.

Can anyone please clarify this statement?


texts: is it necessary to write C=E(K,P), Can we write C=E(P,K)?

texts:
I just want to know that can we write encryption and decryption formula like
$C=E(P,K)$ instead of $C=E(K,P)$


texts: After reading this document about MD5 collision attacks, I still don't understand how collisions can make digital signatures insecure. In the paper, the researchers created two files with the same hash, one innocent and one malicious. The malicious party first sends the good file, gets it signed, and then copies the signature to the bad file to be used against the victim. My question is this: since it is impossible to create a collision without a giant jumbled mess somewhere in the file (though not necessarily immediately visible to the user, for example if preceded and followed by """ in a Python file), why can't users simply ensure that files don't contain blocks of seemingly random bytes if they're digitally signed? For example, why can't SSL certificates hash with MD5 and then use client-side code to verify they don't have any weird strings in them?


texts: When using DES, how large would the key space be if we only use letters as characters?

texts: Would it be safe? Or is it susceptible to brute force attacks or something else?


texts: Is the decompression of compressed and encrypted data without decryption also theoretically impossible?

texts:
We have two communication points in an information system, call them A(lice) and B(ackup).

B has to store encrypted data received from A. The storage of B is encrypted, but not compressed1.

B should have no option to decrypt the data of A2.

However, the data channel between A and B are too narrow, compared to the data volume, making the compression of the communication a requirement. However, encryption maximizes the entropy of the content, making it incompressible.

Another option would be to compress the data, and then encrypt it, but then B should be able to decrypt the data to decompress it.

My first idea was that these requirements are contradicting, as it seems with the practical tools known to me. But I am not sure, how does it look from a theoretical view?

Is an encryption possible, what does not worsens the compressibility of the data in it, despite that it is "enough" secure?

1The reason is here data safety and the support of incremental backups, if it matters (I think, it doesn't).

2It has obvious security reason - a backup storage having all data of a complex network becomes a security bottleneck.


texts: What exactly is addition modulo $2^{32}$ in cryptography?

texts:
EDIT: I've been confusing this the whole time. What I've been wanting to say this whole time is addition modulo $2^{32}$ not addition modulo 32 as the question originally said. Thanks for pointing that.

I can't find any information on this and I really want to know. We discussed in class number theory and after making some proofs on division algorithms we made some modular arithmetic. It is my understanding that the definition of addition modulo $2^{32}$ is: $a +_n b = (a + b) \bmod (n)$.

So if I were to have for example 27 added to 8 modulo 32, I would have something like $(27 + 8) \bmod (32) = (35) \bmod (32) = 3$.

Is this right?
Is this the same hashing algorithms talk about when mentioning addition modulo $2^{32}$? Why can't I find this anywhere?

Why isn't there a Wikipedia article with details on the addition modulo $2^{32}$ that is talked about on cryptography?

I ask if this is the same hashing algorithms talk about because in my understanding, this answer here says that in Java addition modulo $2^{32}$ is the same as simply writing "+", but I don't think a simple sum can possibly be the same. I'm totally lost.


texts: Can Encrypt-then-MAC be used with session ticket resumption?

texts:
In TLS 1.2, say a session ticket is created for the current session (Session Tickets RFC 5077), and the current session uses the Encrypt-then-MAC extension RFC 7366 (I.E. both client and server offered the extension in their Hello).
When resuming a session with that session ticket, is the use of Encrypt-then-MAC implied, or are the two features independently negotiated in each handshake?
Session tickets should prevent servers retaining any knowledge of past sessions, so if Encrypt-then-MAC is to be used in the resumed session, would it have to be explicitly advertised in either the hello extensions or be bundled into the ticket?
Beyond ETM, are there any prior extensions implied/included in the resumed session?


texts: Is AES S-Box resistant to side-channel attacks?

texts: I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?


texts: LED (AES like) algorithm Decryption-Mixcolumn

texts:
I want to program decryption algorithm for the LED cipher.
The lightweight block cipher LED(Jian Guo, Thomas Peyrin, Axel Poschmann, Matt Robshaw:CHES 2011).
All the things is routine except the MixColumn component which is like the MixColumn of AES but with a different matrix.
 In fact we have 64 bit of plain text in structure of a state[4][4].
In the MixColumn component each column of the state multiplies with the matrix M  and the result will be replaced with the old column(in the encryption process)

I wanna to have decryption so I need ReverseMixcolumn function.For that i need the inverted matrix M which I have no idea about calculating it.
I know nothing about calculating matrix inverse in the field of operation.
Even I dont know what is the field of operation in algorithm hence it is not pronounced in paper(eprint.iacr.org/2012/600.pdf)

This is code of MixColumn component:

const unsigned char MixColMatrix[4][4] =
{
    { 4,  1, 2, 2 },
    { 8,  6, 5, 6 },
    { 11,14,10, 9 },
    { 2,  2,15,11 },
};
void MixColumn(unsigned char state[4][4])
{
    int i, j, k;
    unsigned char tmp[4];
    for (j = 0; j < 4; j++) //j=0 soton 0
    {
        for (i = 0; i < 4; i++)
        {
            unsigned char sum = 0;
            for (k = 0; k < 4; k++)
                sum ^= FieldMult(MixColMatrix[i][k], state[k][j]);
            tmp[i] = sum;
        }
        for (i = 0; i < 4; i++) //taaghir sotoon
            state[i][j] = tmp[i];
    }
}


texts: Computing $g^y\bmod p$ from $g^{y^2}\bmod p$ if Diffie-Hellman is compromised?

texts:
Given generator $g$ of a multiplicative group mod a prime $p$ the Diffie Hellman problem is to find $$g^{xy}\bmod p$$ from $g^x\bmod p$ and $g^y\bmod p$. The best way to solve this is through discrete logarithms. Assume we can do this without breaking discrete logarithms.
Then is computing $g^z\bmod p$ from $g^{z^2}\bmod p$ doable in polynomial time?


texts: Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

texts:
In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE.

More precisely, it is said that the critical Hermite factor for the "large" challenge with lattice dimension $n=32768$ is $\delta = 1.0081^n$.

How is this Hermite factor computed ?


texts:
I recently got a question that I’ld like to share here, since answers might be useful (or at least interesting) for people diving into Merkle-Damgård hash constructions for the first time.

We know that the Merkle-Damgård hash function is based on a fixed size $\{0,1\}^{m+t} \rightarrow \{0,1\}^m$ compression function.

Why can an arbitrary compression function mapping $\{0,1\}^{m+2^m} \rightarrow \{0,1\}^m$ not seriously be considered collision resistant?


texts: Zero Knowledge Proofs: to establish a public key cryptography encryption

texts:
I am very interested to know in the general sense how two parties who know each other are able to continue a conversation IF and ONLY IF they both earn the same salary. For example, we have a person X who earns 75000USD, but they only want to continue speaking to person Y IF and ONLY IF person Y also earns 75000USD. They do not really know how much person Y earns but much rather they get a bit of some sort similar to a signature where b=0 if personXSalary != personYSalary and b=1 if personXSalary == personYSalary. Only if b=1, then does person X know the actual salary of person Y

My question is, how would one instantiate such a public key encryption scheme to ensure this? I was thinking of something along the lines of Zero Proof Knowledge but then MACs also was another thought


texts: verify fails on 3rd party after signing with BouncyCastle

texts:
I am using BouncyCastle to perform ECDH and then encrypt the data between the mobile (Android) and my hardware with ECIES. It all works fine. When I try to sign a byte array and send it to the hardware, the hardware fails to verify. My code to sign is as follows. You can see in the code below that I use NONEWithECDSA but I have tried also SHA256WithECDSA and SHA1WithECDSA.

public static byte[] sign(Context context, byte[] s) throws InvalidKeyException, NoSuchAlgorithmException, UnsupportedEncodingException, SignatureException
{
    /*
     * Create a Signature object and initialize it with the private key
     */
    byte[] strByte;

    Signature dsa = Signature.getInstance("NONEwithECDSA");

    PrivateKey privateKey = SecUtils.getPrivateKey();

    dsa.initSign(privateKey);

    if (s == null)
        strByte = "This is string to sign".getBytes();
    else
        strByte = s;
    dsa.update(strByte);

    /*
     * Now that all the data to be signed has been read in, generate a
     * signature for it
     */

    byte[] realSig = dsa.sign();
    return realSig;
    //(new BigInteger(1, realSig).toString(16));
}

Verify

public static boolean verify(Context context, PublicKey publicKey, byte[] baSource, byte[] baSignature) throws NoSuchAlgorithmException, InvalidKeyException, SignatureException
{
Signature ecdsaVerify;
byte [] baText;

PublicKey pk = SecUtils.getPublicKey(SecUtils.publicType.ENUM_REMOTE);

ecdsaVerify = Signature.getInstance("NONEwithECDSA");

ecdsaVerify.initVerify(pk);

if (baSource == null)
    baText = "This is string to sign".getBytes();
else
    baText = baSource;

ecdsaVerify.update(baText);
boolean result = ecdsaVerify.verify(baSignature);
return result;
}


texts: Why is lcm(n) used now instead of $\varphi(n)$ in RSA?

texts: I know that lcm(n) or Carmichael's totient function $\lambda(n)$ is now used instead of $\varphi(n)$ or Euler's totient function to generate the public key in RSA encryption? Why is this so? Are there any mathematical, computer scientific reasons behind this related to key security or efficiency?


texts: The relationship between a private and public key?

texts:
It's known that the relationship between public and private key allows data encrypted by the public key to be decrypted only by the corresponding private key.

As I understand it, this means that normally there is a relation between them (regarding obtain one from the other).

But I found this:

  It is almost impossible to obtain the private key from the public key.

My question is how a private key can decrypt data encrypted with a public key, without it being possible to obtain the private key from the public key, since there has to be a relationship between them for decryption to work?


texts: Forge valid token with misuse of OTP key reuse

texts:
I'm new to OTP and received a challenge.
Challenge

Context: A server uses OTP to encrypt and decrypt authentication tokens.
Misuse: The server always uses the same key.
Objective: Forge a valid token for user "master".

API

I can register unlimited users.
Username: Between 8 and 32 alphanumeric characters.
Password: At least 8 characters.
Login: I get a token for every time log in.

The Token

Encryption: plaintext ⊕ key = token.
Misuse: The key will be the same for every token issued.
The first 32 characters of the encrypted token contains the username.
If username is shorter than 32, a fixed padding char will be used to fill.

I've tried
I've registered a new user
username: "usernametest",
password: "passwordtest"

And logged in two times
1st Token: F11D8C3559DACFF766C22A14E81DE3853F895947008EDDD53BC831CF5919C6F28CE938EDDFBC7914949C881FE1659E516B6DF43E267F537990791BBD4C2B528F42553E2577E5208BF815CCA3A9F290A453C46051E5A6

2nd Token: F11D8C3559DACFF766C22A14E81DE3853F895947008EDDD53BC831CF5919C6F28CE938EDDFBC7914948EAD47EE6E9245003B914F4727017BE75337B94836528F42553E2577E5208BF815CCA3A9F292A55BC26259EAAD

I know that "usernametest" appear in both messages.
I've encoded the word to a hex string: 757365726e616d6574657374.
1st Token ⊕ 2nd Token: 1225580F0B0C146B56657161585202772A2C04041D000000000000000000000000000000000201080602080F0B
1st Token ⊕ 2nd Token = ("usernametest" + fill + plaintext) ⊕ ("usernametest" + fill + plaintext).

Does it make sense? How should I proceed?
I've been stuck at this stage for more than a day. Can someone help me?
Reference:
Many Time Pad Attack - Crib Drag


texts: Communication Complexity of Equality comparison (Catrina and de Hoogh)

texts:
I was reading secure MPC protocol for finding a secret representation of whether a secret value equals zero, from Catrina and de Hoogh (summarized here).

In the paper, the communication complexity costs are measured in terms of "invocations of a primitive in which every party sends a share ... to the others" (page 3). The paper shows a way to do equality-to-zero testing in a constant number of rounds. This seems to require the following costs:

Generating a secret random number r, as well as secret representations of its lower $k$ bits by calling PRandM (Protocol 3.7, step 1). This requires $k$ invocations (see Table 1).
Making a secret value public. (Protocol 3.7, step 2). This requires $1$ invocation.
Generate a public product of two secret numbers by calling MulPub. This is done $2k$ times. (Protocol 4.2, steps 4 and 9) This requires $2k$ invocations.
Generate a secret product of two secret numbers. This is done $k-1$ times. (Protocol 4.2, step 5) and requires $k-1$ invocations.

(I am assuming Protocol 4.2 is how KOr from Protocol 3.7 is implemented.)

What does an invocation mean? Does it mean $O(n^2)$ data complexity? Does this mean the total communication complexity is something like $O(kn^2)$?

The SPDZ protocol, shows that the multiplication of secret values to generate a secret value (Cost #4) can be moved to a pre-processing phase by generating Mulitplicative Triples. Can Costs #1 and #3 also be moved to a pre-processing phase?

I was pointed to Catrina and de Hoogh here as an implementation of secure equality-to-zero test that can be used in a SPDZ-like environment. By SPDZ-like environment I mean each secret number $a$ is represented by each party having a 'share' of that number $a_i$, such that $\sum a_i = a (\mod p)$ for some large prime (or exponent of a prime) $p$. Is Catrina and de Hoogh the most computationally efficient constant-round protocol currently out there that does a secure equals-zero test of a secret value to generate a secret result?


texts:
Skein is defined for three different internal state sizes: 256 bits, 512 bits, and 1024 bits – with Skein-512 as the “primary proposal”.

Is there any advantage, other than potential memory or speed performance reasons, when picking a state size different from 512? If there is, what would the advantage(s) be?


texts:
I'm looking for the homomorphic version of the following (I'm using Python here):

$ a = [1,2,3]
$ s = sum(a)
$ print(s)
6

Is there an open source fully homomorphic library which is able to do $sum(vector)$? So far I just found libraries allowing operations with input-output either only vectorial or only integer. Here I'm asking for a vector to integer operation.

Of course there is another way, namely encrypting every integer element of $a$ individually, summing in the encrypted domain, and then decrypt the result. Since I would like to take advantage of the speed of vector batching, I'm not considering this as a good solution.


texts: What does the "scale invariant" mean in some FHE schemes?

texts: In some paper about FHE, the term "scale invariant" often appears. What does it means?


texts: A timestamping authority (digital notary)

texts:
Does there currently exist a free online service that accepts a file, hashes it, takes an authoritatively chosen timestamp (from one or more time services), signs these and sends this signed message back? E.g. a digital notary, but only with regards to the timestamp and not the validity of the content as legal notaries might be obligated to guarantee.

Such a service might have an extremely simple API: Simply wget http://service/<checksum> and receive a signed message containing one or more timestamps and the checksum. The emphasis would be on the type of authority who might make such a service.

Edit: Although the original question did not emphasise the following, the Bitcoin-based timestamping services provided below do not rely on one authority, but rather the entire Bitcoin network. They can be seen as tamper-proof and verifiable without the help of the service that helped you sign it!


texts: Is Shoup's Practical Threshold Signatures considered secure?

texts:
I am planning to use threshold cryptography in a Java application. So far, I have only found ThresSig and a ECDSA implementation used in TwoFactorBtcWallet. However, ThresSig is based on a 15-years old scheme, Shoup's Practical Threshold Signatures, and I can't figure out how to re-use the aforementioned ECDSA implementation for my own needs (I am not even sure if the code supports more than 2 parties).

Are Shoup's Practical Threshold Signatures considered secure nowadays? Are there any well-known pitfalls or recommendation on sizes, etc.? If not, is ECDSA an appropriate building block and how?


texts: Meaning of Dilithium-1024x768 or Dilithium2

texts: Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?


texts: Problem about complexity of Chinese remainder theorem

texts:
I have a question about CRT.
Assuming, that we have this system (S):
x=a0 mod n0
x=a1 mod n1
with N=n0*n1 and n0,n1 are two distinct prime numbers.
Then the complexity in terms of binary operation is O(log(N)^2) in order to find x.
My problem is that I study  the complexity of Pohlig–Hellman algorithm in term of the number of multiplication in a cyclic group G of order N=n1*n0. Pohlig–Hellman algorithm use CRT algorithm.
So, I don't see how can I measure the complexity of Chinese remainder theorem in term of the number of multiplication in G of order N.
Any ideas?


texts: Can I always derive a key pair from password+salt with libsodium?

texts:
I'm using libsodium to create public/secret key pairs from a password and salt combination by using crypto_pwhash_scryptsalsa208sha256 to generate a seed and passing that seed to crypto_box_seed_keypair.

Is it safe to recreate the key pair using the password+salt every time I need to use it so I don't have to store the keys (encrypted or not) anywhere in the system?

I would store the salt, and ask for the password again every time it is needed.


texts: No IV for one off symmetric file encryption

texts:
My question is (hopefully, for somebody) a simple one; but my project is holding as I'm not sure.

I read on SO that generating encryption keys without an IV is a bad idea, so is using a constant IV as the first part of any cipher block will be the same across multiple encryptions.

If you're encrypting a single file (a private key for local disk storage for example) is it safe to use a constant IV (as the users password will vary)? The problem is, every time I rehash/generate the encryption key from the plain text password, a new random IV is generated resulting an a completely different decryption key for that file.


texts: Security trade-off when using low number of rounds with SHA256

texts:
I have a web application that stores hashed password reset tokens in a database table. The tokens are randomly generated 256-bit values. I'm currently using Python's passlib sha256_crypt function to hash the tokens which defaults to using 535000 rounds.

In order to speed up the hash computation, I'd like to decrease the number of rounds that the sha256_crypt function uses going forward. Passlib allows you to choose a rounds value between 1000 and 999999999, inclusive. Given that I'm hashing random 256-bit values, would it be safe for me to decrease the number of rounds to as low as 1000? Would there be any serious security trade-off from doing so?


texts: Is it possible to unscramble a scrambled ed25519 SSH key?

texts: Let's say I generate an ed25519 SSH key with ssh-keygen -t ed25519. Then I take the private key file and randomly scramble the order of base64 encoded characters. Is it practically feasible to recover the original key from this scrambled file?


texts: Can we parallelize the Feistel Networks?

texts:
Classic Feistel Networks and various types of FN's are sequential in nature. [1]has a good overview of different types. But is there a way we can do Feistel Networks in parallel and achieve good security bounds ?

Hoang, Viet Tung, and Phillip Rogaway. "On generalized Feistel
networks." Advances in Cryptology–CRYPTO 2010. Springer Berlin
Heidelberg, 2010. 613-630.


texts: How is the order of a point calculated for elliptic curves over GF(p)

texts:
My question is about elliptic curves over $GF(p)$: How is the order of a generating element $G$ (which is to my knowledge also the order of the cyclic subgroup $G^n$) calculated? Taking P-256 as an example, I know basically what the base point $G$ is and also what its order is.

But how is the order of any point calculated? The order is really a very big number and I think that its value was not found by brute force.
Under what circumstances is the order of the subgroup $G^n$ the same as the order of the whole group (co-factor = 1) ?
Why must the order always be prime?
is each group for elliptic curves over $GF(p)$ group cyclic? In this case there is a generating point G (a base point) and all sub-groups are cyclically, too.
How are "good" points found and what is the cryprtographic meaning of "good" ?

From group theory I just know, that the order of a subgroup divides the order of the complete group, which gives rise to the definition of the co-factor h, but that doesnt help.

The questions are not of practical interest, but I want to understand what I'm doing. The information I read so far seem to appear from nowhere. If the mathematical background, needed to answer those questions is not totally out of scope for a non-mathematician, where can I read about that?


texts:
I was reading the ZK proof of knowledge of Schnorr and fiat shamir transformation, and I figured out that replay attacks are possible. Why these protocols don't take into account this attack? That seems very strange.

Thank you.


texts: Why is CBC-MAC with length appended not secure?

texts: I've just read about CBC-MAC for the authentication of arbitrary length messages. In particular I cannot figure out why appending the message length before computing the MAC yields a non-secure MAC. I've already read other topics on crypto about this problem, but i did not find a rigorous proof.


texts: Intuition for random variables in cryptography

texts:
I have a simple question about the use of random variables for encryption schemes, to make sure my intuition is correct.

We say $P(K = k)$ to represent the probability that a particular key $k$ is chosen by the probabilistic algorithm Gen. Formally, $K$ is a random variable that denotes the value of the key.

So the expression $K = k$ denotes an event: specifically, a subset of the sample space. But all the keys are unique, so is this event really a set of size one? And is it then just an elementary event?

Then, why can't we just say $P(k)$ to denote the probability of $k$ being output? Do we use the random variable to be more explicit and clear?


texts:
I'll be using AES from OpenSSL.  I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with electronic codebook.

But what I'm missing, is some sort of comparison table with all the other modes so I understand the positives and negatives of the various modes.  Where can I find this information so I can make an informed decision on what mode to use?

Update 1:

Looks like OpenSSL's EVP api (which I believe is the recommended API when using OpenSSL?) only supports 2 modes [OpenSSL][1] – GCM and CCM – which drastically reduces my choices.

1: https://www.openssl.org/docs/crypto/EVP_EncryptInit.html

Update 2:

Unsurprisingly, that OpenSSL page is somewhat misleading or incomplete.  Looking at /usr/include/openssl/evp.h I see there are 30+ variations on AES to choose from, including:

EVP_aes_*_ecb()
EVP_aes_*_cbc()
EVP_aes_*_cfb1()
EVP_aes_*_ofb()
EVP_aes_*_ctr()
EVP_aes_*_xts()
...and many more!

So I'm back to reading about all the different modes so I can make a semi-intelligent choice as to which I should be using.


texts: What is the complexity of the Square attack against the reduced 4-rounds 128-bit Rijndael variant?

texts:
I'm looking at a square attack against a reduced version of AES-128 with only 4 rounds (with block and key size of each 128 bit). I have a set of 256 plaintext-ciphertext block pairs.

What is the complexity of the computations, in number of encryptions, partial encryptions, memory usage, and data requested?


texts: Is it possible to combine two hash functions in such a way that cracking the constructed hash would require cracking the constituent hashes?

texts:
Suppose A is some arbitrary hash function, for example BCrypt or MD5. And B be some other arbitrary hash function, maybe SHA256 or SCrypt.
Let passwordHashedWithA = A(password) and  passwordHashedWithB = B(password).
If an attacker is given just passwordHashedWithA and finds a pA such that:
passwordHashedWithA == A(pA)
Then the attacker has performed a successful preimage attack on A.
I want to know if it is theoretically possible to construct a hash function C out of two arbitrary hash functions A and B, such that for any A and B, performing a successful preimage attack on C would require performing a preimage attack on both A and B. The question can be extended to build C from N arbitrary hash functions.
I strongly suspect that this is theoretically impossible; it seems like a free lunch. But I cannot begin to think how to prove it.
If such a thing does exist then it would be incredibly useful: we could combine old, proven hashes like BCrypt with slightly newer and fancier hashes like SCrypt, such that we have the best of both worlds. Like I said - sounds too much like a free lunch.
I am asking this from a theoretical perspective, I'm aware that BCrypt or SCrypt are probably good enough for most production systems.
I'm looking for a proof that this is impossible, or a construction of C that provides these properties.
Examples of C that don't work
Suppose we try C(password) = A(password) + B(password) where + is just concatenation of the hashes.
The result of this is obviously a weaker hash: we can preimage C by finding the original password by cracking  A or B.
If we try C(password) = A(B(password)), this initially looks stronger but you really can't say much about C without looking at the specifics of A and B. For example if A was a completely useless hash that always returned a constant string, the strengths in B would be irrelevant, and any string would be a preimage of C.


texts: how to compute IV with AES CTR if key, plaintext and ciphertext are known?

texts: Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using $IV = E_k^{-1}(c \oplus p)$?


texts: Abstract Cryptography: why local simulators?

texts:
In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ressource looks like a resource $R$ running some protocols, then $R$ securely constructs $S$. But I don't understand, why the simulators must be local, and can't be global? It does not matter for most cases when there is a single malicious adversary, but I'd say that it does make sense when several adversaries are corrupted. And if I'm not wrong in Universal Composability, the simulator is global.

More precisely, this theorem states that if $\langle \Phi,\Sigma, \approx\rangle$ is a cryptographic algebra, and if there exists for all interfaces $i \in \mathcal{I}$ some converters $\phi_i, \psi_i, \pi_i, \sigma_i \in \Sigma$ (where $\pi_i$ is the protocol of honest party $i$, $\sigma_i$ is a simulator connected to interface $i$, and $\phi_i,\psi_i$ are some filters) such that $\forall \mathcal{P} \subseteq I$, $\pi_P \phi_{\bar{P}}R \approx \sigma_{\bar{P}}\psi_P S$, then $R_{\psi} \sqsubseteq^{\pi} S_{\psi}$ (when we write $\sigma_I$, it means that we connect for all interace $i \in I$ the converter $\sigma_i$ to interface $i$).

And I'd expect this theorem to be true also when $\sigma_I$ is not just the parallel execution of all $\sigma_i$ (for $i \in I$), but also for any global simulator $\tilde{\sigma}_I$ having access to all the interfaces in $I$ at the same time.

So why does this theorem restrict the simulators to be local simulators, especially when it's not the case of UC? If I do need to use a global simulator, does that mean that I need to define a "weaker" ideal functionality that will basically create a channel between the two interfaces and allow the simulators to communicate through it?


texts: Sequential public key generation with secret private keys?

texts:
So this is an idea that popped into my head the other day and I wonder if there are any known crytographic schemes with these properties?

Is there a way to construct a public / private key system in such a way that I can somehow compute some "seed" like 0x22EDEF67FFEED that can be used to derive an infinite number of public keys, while NOT being able to generate the corresponding private key?

To be able to generate the private keys you need to know a secret that was computed together with the above "seed".

Example usage:

Alice publish a public key seed with the above rules with the value 0x22EED...
Alice then makes the promise that she will make the private key for the Nth derived public key public every Nth day.
Bob can now encrypt some secret with the 100th derived public key and publish it, knowing that the data will be publicly available in exactly 100 days.
After 100 days Alice publishes the 100th private key and Bob's secret can be decrypted by anyone.

I have no idea if this would be useful in the real world, but it peaked my interest anyway.


texts: How does failing to square a value in this version libcrypt++ cause a timing attack vulnerability?

texts:
I'm a crypto beginner and reading about blinding, and my fundamental understanding about preventing timing attacks is that you need to sort of process information in a way that will produce similar processing times for each set of operations.

In CVE-2015-2141 something as simple as failure to call r = modn.Square(r); in a single func seems to have caused a timing attack vulnerability in libcrypt++ in 2015.

I have a multi part question about this:

First it seems like you'd need some special helper func designed to produce random timing results called in each subroutine to blind a func, why is the process of squaring a value sufficient?
Second, surely this algorithm has many hundreds of routines that get called every single time it's used - it seems like if nearly all of the subroutines are blinded, the failure to blind just one wouldn't leak enough timing information to cause the entire function to be vulnerable to a timing attack, can someone explain this?
Is the goal to make every subroutine take exactly the same amount of time to complete, or a random unpredictable time? Why couldn't we paste a helper function call into every module that runs in a securely random amount of time so the timing information released becomes useless?


texts: Can encrypting well known files hurt the security of the key?

texts:
I wanted to know if mass encrypting files (both well known and not so well known) on my external HDD would somehow hurt the security of my private key.

As for the details: I am using GPG with a key that is 4096 bytes with RSA and DSA set as the algorithm. I am also using a long passcode on the key. I am mass encrypting these files using a bash script I wrote up earlier today as these files were long overdue to be encrypted and I did not want to encrypt the whole drive, just parts of it.

I took a look at this question, but I am not sure that this is the same thing as my question as this talks about hashes. I appreciate the patience as I know almost nothing about cryptography.

TL;DR : Can encrypting well known files (think "known plaintext attack" etc.) hurt the security of the key?


texts: Is there a way to perform a one way function on encrypted data?

texts:
Does the following scheme exist?

Let f be a one-way function (say, an encryption scheme). Let $Enc_{sk}(x)$ be an encryption of x. We then have $Eval_{pk}(f, Enc_{sk}(x)) = f(x)$.

Note that this is not homomorphic encryption since in that case, $Eval_{pk}(f, Enc_{sk}(x)) = Enc_{sk}(f(x))$.


texts:
Let $\omega$ denote the set of non-negative integers. For $n\in\omega\setminus\{0\} $ define the rotation function $$\text{rot}_n:\{0,1\}^n \to \{0,1\}^n$$ by
$x \mapsto x'$ where

$x'_k = x_{k+1}$ for $k\in\{0,\ldots, n-2\}$, and
$x_{n-1} = x_0$.

Let $\bar{0}_n \in \{0,1\}^n$ be the constant $0$-sequence of length $n$. Fix $s_0\in \{0,1\}^n$ and define a function $f_{n,s_0} : \omega\to \{0,1\}^n$ inductively by setting

$f_{n,s_0}(0) = \bar{0}_n$, and
$f_{n,s_0}(k+1) = f_{n,s_0}(k) \;\oplus \; \text{rot}_n(f_{n,s_0}(k)) \; \oplus \; s_0$.

(By $\oplus$ we denote componentwise addition in $\mathbb{Z}/2\mathbb{Z}$, or equivalently, bitwise XOR.)
Question. For what values of $n\in\omega\setminus\{0\}$ is there $s_0\in \{0,1\}^n$ such that the image of the function $f_{n,s_0} : \omega\to \{0,1\}^n$ is all of $\{0,1\}^n$ (i.e. $f_{n,s_0} : \omega\to \{0,1\}^n$ is surjective)?


texts: Where to obtain a common/weak password list (black list)?

texts:
The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords)
https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver
specifically section "5.1.1 Memorized Secrets"

When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised.

and Appendix A. A.3 Complexity

it is recommended that passwords chosen by users be compared against a “black list” of unacceptable passwords.

Where should the Verifier get such list?
How and how often this black list is supposed to be updated?
If NIST doesn't provide such list, how can I be sure that the list downloaded from some source is nearly acceptable for use?


texts:
Root certificates are normally self-signed.
What is the reason behind that convention?
I mean, one must trust the root certificate in a non cryptographic way anyhow.


texts: Why do the game-hops in Kyber and related papers contain 2 steps at a time?

texts:
In the Kyber paper in section 3 about the Kyber IND-CPA Encryption there is a proof by sequence of games containing three games. I understand that in the first game hop the M-LWE advantage is used to bound the advantage of distinguishing the games.
The second hop (from $G_1$ to $G_2$) exchanges two elements ($\boldsymbol{u}', v'$) in the protocol at the same time with essentially the same reasoning.

A similar proof based on R-LWE instead of M-LWE can be seen in the paper by Bos et al. in section 3.

Why is this done in one hop instead of two distinct ones and would it be valid to do it in two hops, i.e exchange one element first and the second one in a second hop?


texts:
So, my understanding of homomorphic encryption is that Alice has a private key and an algorithm, gives an encrypted copy of the algorithm to Bob, Bob runs the algorithm without understanding it, and gives the encrypted result back to Alice, who decrypts the result with her private key.
There's a variant of this concept that interests me.  Consider the following scenario.  Alice has a proprietary algorithm.  Bob is interested in using the algorithm, but is frequently out of network access or something, and doesn't want to have to communicate back with Alice for every evaluation.  Alice uses a newfangled method called (e.g.) Autonomous Homomorphic Encryption to encrypt her algorithm, and gives it to Bob.  Bob runs the algorithm, unable to understand it, but when he gives inputs to the algorithm, it can (at its own discretion) output plaintext results.
Has any significant work been done on such an encryption mechanism?  Does it have a name?  Has it been proven possible or impossible?


texts: SSH - Diffie-Hellman; prime & g exchange

texts:
The Diffie-Hellman key exchange algorithm can be used with SSH.
But how does SSH exchange the large safe prime p and the generator for a subgroup of GF(p) g?
According to RFC 4253 the first steps are to send e & f which are calculated depending via:
 e = g^x mod p
 f = g^y mod p

Now x & y are randomly generated but how do both parties come to the same values of g and p? There seems to be no exchange happening of them.
Does anybody have an explanation for this?


texts: Cryptography used for login and signing transactions

texts:
My bank uses a smartcard reader (separate module not connected to the computer) as depicted below:

When I need to log into my account it provides me with a challenge and  I need to provide some details:

I need to provide the 8 digits, enter my pin and then it returns an 8 number sequence which is then to be entered after which you are logged in.

A similar mechanism is employed for signing transactions but using the M2 button (blue one) rather than the M1 and instead of a random number you need to first give the amount and then the timestamp. I'm interested in the cryptography used behind it (if it's symmetric, assymetric or a combination of both) and how the signing is actually done.

a user guide can be found here.


texts: Point multiplication twice - can it be squeezed into one equation?

texts:
p_1 := (d_1)G
p_2 := (d_2)p_1

$P_2$ is calculated as shown above. Will $P_2$ be the same of $P_2$ in the second equation?

p_2 := ((d_1 * d_2) % curve_order)G

If I understand correctly, it shouldn't have any problems with the point at infinity. Are there any differences between two ways to calculate the point?


texts: Understanding MACs and why cleartext is sent over

texts:
Assume both Alice and Bob have a symmetrical key, let's call it $k$.
They agree on a cryptographic hash function, let's call it $\mathsf{HASH}$.
Now Alice wants to send an authenticated message.
She sends $\left(\mathsf{msg}\parallel\mathsf{HASH}_\mathsf{k}(\mathsf{msg})\right)$ to Bob.
Bob calculates the hash from $\mathsf{msg}$ and checks whether it's equal to the hash he received from Alice.
My question is:

When Alice sends $\left(\mathsf{msg}\parallel\mathsf{HASH}_\mathsf{k}(\mathsf{msg})\right)$, Eve, an eavesdropper in the network, sees this packet in cleartext, which break the confidentiality?
How to protect the confidentiality?

My guess is: the whole MAC authentication $\left(\mathsf{msg}\parallel\mathsf{HASH}_\mathsf{k}(\mathsf{msg})\right)$ is wrapped in some kind of cryptographic function?


texts: In search of a pedagogically simple example of asymmetric encryption routine?

texts:
(I am not a cryptography expert; I do write software)

I am working with some youth (ages 11-13) and wanted to explore for an hour or so some basic cryptography. Doing symmetric ciphers is pretty straightforward. It's easy to explain the various "two key" metaphors of asymmetric encryption, but I'm finding it hard to find a good easy-to-work mathematical example of asymmetric encryption. There are lots of good examples of RSA broken down, but even with small numbers you get into "big" numbers fast because of the power functions.

Is there a good example of a "toy" algorithm to illustrate the asymmetric encryption/decryption process?


texts:
Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q.

Then, you would like to actually let me factor N, except you should tell me as few bits of information as possible. Say p and q are 4096 bits, then how many bits do you need to tell me in order for me to factor N in feasible amount of time?

Note that you can arbitrarily design how these bits are derived, as long as there is a PPT algorithm to compute these bits and there is a PPT algorithm to use these bits to factor N.


texts: Elliptical curve cryptography key generation time

texts:
I am currently trying to learn more about Elliptical curve crypthography and have finally started to get things working and undestanding the different pieces.

I've written a small project in C# and are currently testing it using really big numbers (the .NET BigInteger class). So far I've implemented the key generation algorithm, the point addition, doubling, encryption and decryption.

Now my problem is the key generation. The formula for generating a key is:

Q = d * G

Where Q is the public key, d is the private key and G the generator point.

If I for example want to use a 256 bit private key n would become a BigInteger with 78 numbers in it right (2^256)?

Now to calculate Q this will take a lot of time since it means I will need to perform point addition an insane number of times unless I'm not understanding something about it.

How is this accomplished in practise? Am I thinking about it in the wrong way or will I need to perform the point addition up to 2^256 times? What is the expected amount of time for modern computer to generate the key-pair?

Thank you!


texts: Is TrueCrypt's multiple/cascading encryption safe?

texts:
Is TrueCrypt use of cascading encryption safe?  Is it useful?  TrueCrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very unconventional scheme.

The software offers cascading encryption, where the user can specify either double or triple encryption using any combination of AES, Twofish, and Serpent.  Unusually, multiple-encryption is performed on each block, before moving on to the next block, as opposed to encrypting all the data and then encrypting the resulting ciphertext.

After having spent a lot of time reading through crypto.se, the consensus seems to be that multiple/cascading encryption offers little (or perhaps no) extra security, and some even argue that if may be weaker than just following a standard protocol (although the latter rarely seems to be substantiated by any reasoning).  However, in Bruce Schneier's Applied Cryptography (considered by many to be a quintessential text on cryptography), he advocates the use of multiple encryption (albeit cautiously, and with some caveats).  See sections: 15.7 Cascading Multiple Block Algorithms, 15.8 Combining Multiple Block Algorithms, and 17.11 Cascading Multiple Stream Ciphers.

Another example of going against this consensus would be the Tahoe-Lafs 100 Year Cryptography Project, which has been recommended on crypto.se. Their protocol involves encrypting with AES in CTR mode and then encrypting the output with XSalsa20.

So my question is, is TrueCrypt's use of multiple/cascading cryptography reasonable, and why?


texts: AESManaged Trade Compliance Issue in United States

texts: I am currently using AESManaged encryption for my silverlight application. Does AESManaged encryption have a severe trade compliance issue in Bureau of Industry and Security in terms of shipping the application internationally?


texts:
I have this cryptography puzzle I'm stuck on, spoilers please with hints since I want to figure this out myself.

I'm given that a code in the form of x:y:z is required to access a particular goal, the example given is this:

alpha:2c174:Uw9BX1U=

And I'm meant to extrapolate Gamma. I think I've figured out how to get the middle section from the first but I'm not certain, and I have no idea how the third section relates to this in any way.


texts: Known-plaintext attack on 1-round Feistel networks

texts:
Consider a simple, 1-round Feistel network.

Because the ciphertext is essentially $(L_1,R_1)$, if one knows the plaintext $(L_0,R_0)$, the only unknown left is $K$.

However round functions in Feistel networks are not necessarily invertible. For example, one could in principle use a cryptographic hash as a round function.

The Feistel network equation would become:

$R_1=L_0 \oplus \operatorname{sha2}(R_0,k_1)\\L_1=R_0$

One could XOR $R_1$ (known ciphertext) and $L_0$ (known plaintext), thus obtaining $\operatorname{sha2}(R_0,k_1)$, but this would not yield the key unless one uses brute force.

Clearly brute force is always possible - and there are other issues with a 1-round Feistel network, for example it leaks half of the plaintext - but I was wondering.

When one talks about KPA against 1-round Feistel networks, is it implicit that brute force can be used in the end to obtain $k$, for non-invertible round functions?


texts: Why is SHA3 prefixed with SHA despite the fact that it is structurally different from SHA2 and SHA1?

texts:
Why is SHA-3 prefixed with “SHA” despite the fact that it is structurally different from SHA-2 and SHA-1?

SHA-0, 1 & 2 and MD5 is based on Merkle–Damgård construction, while SHA-3 falls under Sponge functions.

Therefore why SHA-3 is still prefixed with “SHA” despite the fundamental difference in its construction?


texts: With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?

texts: Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$?  (Assume that $k$ was chosen at random.)


texts: Where is the proof of security of Diffie's cipher?

texts:
There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this:

Measure the length of the plain-text, $n$.
Multiply it by $128$.
Generate this much ($128·n$ bytes of) real random data and split it out into 128
byte-arrays of length each equal to the plain-text. This can be thought as a two
dimensional array:

One of the indices gives the sequence number ($0\dots 127$).
One of the indices gives the position in the sequence, $0 \dots n-1$.

Use a 128-bit key to choose which of these streams to XOR together. Each bit of the key corresponds to "yes/no" on whether to use particular sequence. All the selected sequences are XORed together to make a single keystream, $K$.
Compute $P \oplus K$ to give the cipher-text $C$.
Serialize the two dimensional array and append it to the cipher text.
Send the whole package to Bob, who can then decrypt by de-serializing the matrix
and selecting the same rows.

Apparently, this scheme is completely secure. The attacker has to examine every possible combination of sequences ($2^{127}$ on average) in order to break the encryption scheme.

What is the proof of this? I can't find the paper that discusses this anywhere.


texts: Are collisions in AES-128 theoretically possible when the plaintext is the same?

texts: Is it theoretically possible to find $P$, $K$, and $K^\prime$ such that $E_K(P) = E_{K^\prime}(P)$ where $E$ is AES-128 and $K \ne K^\prime$? I'd imagine this would be infeasible, but is it actually impossible?


texts: How Paillier cryptosystem can be used practically to encrypt and decrypt big messages "m"?

texts:
I want to use the Paillier cryptosystem for encryption and decryption purposes in my research work. But i haven't found a way to encrypt big input messages;
As i want to encrypt the message i,e m :

m = 0xa56f89d6aa234776b22347293429ff074928ab3749cc2837c492b874ebfaba78364ba0912efe862f628347982478b

Key Gen:

p =887, q = 907 , n =804509 ,n² = 647234731081;
g = n+1 = 804510;
λ = LCM(p-1,q-1) = 401358;
μ = L(g^λ mod n²)^(-1) mod n = 637146

Encryption:

Let random r = 1987
 c = ((g^m) * (r^n)) (mod n^2)

How can calculate g^m for such big input m?

If encrypted, then how can decryption work for big messages i,e m?


texts: Currently I have a 2048-bit PGP key. Suppose I create a new 4096-bit key. Can I add that old key as a subkey of this new one?


texts:
I have a basic understanding of perfect secrecy. In the case where |K| == |M|, I see that there is only one key to encrypt a given m to a given c. Therefore each m is equally likely with same probability 1/|K|.

For the case of |K|<|M|, I have some intuition that it is not possible to map a random variable on set x to be a random variable on set y if |x| < |y|. But I'd like a formal proof of this. Or maybe this is the wrong way to look at this problem - I just want to see how we can prove that |K|<|M| result in non perfect secrecy.

This case of |K|<|M| is not a homework question; it is briefly mentioned in Boneh's Cryptography I, but not proved.


texts: Which is more secure, using just bcrypt or SRP?

texts:
OK, here's the two different ways I was thinking about making the authentication for the login thing to store the passwords securely.

The first is the following.

Client hashes password bcrypt(username.static_salt.password)(cost is 7)

this is mostly to make it harder for someone to get in trouble if they reuse passwords in other places/to make me feel better.

then they send it to the server. The server then hashes it with bcrypt again(cost is7) there is a per-user salt which is appened to the user's password and hashed together. Another static salt stored in the code(ie for bcrypt itself) is in there. And we have another salt stored on the server(ie no database).

The other one is to use srp6a except to use bcrypt(with the same cost as above) for H(). Which of these is more secure in the long run against an attacker once they get the database. the N is going to be 2048bits.

Also assume all of this is done over TLS/SSL. I'm personally leaning towards the first one, but I want to be sure before I commit to one or the other.

Edit: Now everyone should be using scrypt or argon2 for password hashing with unique salts.


texts:
Are there any commutative one-way functions for floating points?

I tried to explain why I need these functions.
First, I describe the problem on a high level and then I further formalize it;

There are three parties. Alice, Bob, and Charlie.
Charlie wants to check if Alice and Bob have the same value without knowing the exact value except if it is the same. This problem is called the socialist millionaire problem. However, there are four extra additional constraints/requirements in this situation:

There are three parties instead of two. Alice and Bob don't want the other parties to know their values.
The values to be compared are not integers, they are floating numbers.
We would like to know if the values are roughly the same.
There is no back and forth communication possible between Alice and Bob and Charlie. Only two one-way messages. One from Alice to Charlie and one from Bob to Charlie.

More formally,

$x_a$ and $x_b$ are the values of Alice and Bob respectively.
They are represented by floating numbers, $x_a, x_b\in\mathbb{R}$.

Charlie wants to check if the values are roughly the same:  $x_a \approx x_b$.
This can be written as $|x_a - x_b| < \epsilon$, with $\epsilon$, a small positive floating number.

If we would have commutative one-way functions for floating numbers, it could help here to keep the exact values secret.

Alice and Bob would transform their values with the one-way function:
$y_a = f(x_a, k_a)$, with $k_a$, a public key produced by Alice
$y_b = f(x_b, k_b)$, with $k_b$, a public key produced by Bob
Then Alice would share ($y_a$, $k_a$) and Bob would share ($y_b$, $k_b$) by sending a single message to Charlie .

Charlie can then check if $|x_a - x_b| < \epsilon$ by checking
$|f(y_a, k_b) - f(y_b, k_a)|<\delta$, which is equivalent to
$|f(f(x_a, k_a), k_b) - f(f(x_b, k_b), k_a)|<\delta$

Is my assumption correct that I need commutative one-way functions for floating points?

Does anyone know of any commutative one-way functions for floating points?


texts: How terribly flawed is this design for key storage?

texts:
Dave here, with a plan for storing secrets.

Threat model:

Database and keyfile may (will?) be stored on un-trusted servers.
Database contains many valuable secrets (passwords), encrypted by key stored in keyfile.
Source code is public.
Keyfile and database SHOULD never be stored on the same server, but will always need to be accessible from the client.

Out-of-scope threats:

keylogger, malware, rubber hose, chocolate

Failure mode:

Attacker obtains a copy of both keyfile and database and derives the encrypted key by attacking the keyfile.

Defenses:

keyfile is encrypted with a key derived from a password.
prototype uses bcrypt as the key derivation function.
The high-entropy master password is selected randomly (diceware).
the keyfile has no visible signature/structure -- someone who happens upon it will be unable to distinguish it from from random noise. This is not a big deal, but it adds plausible deniability.

Details

What I am most interested in is whether I am botching the keyfile encryption. The prototype (see https://github.com/scholarly/pynacl/blob/master/examples/bcrypt_wrap.py) is written in python using pynacl and py-bcrypt.

workfactor: 1 byte, default: 8
nonce: 24 random bytes
salt: 32 random bytes
key: 32 random bytes
magic = 24 bytes of sha1(salt+MAGIC+workfactor) [optional, looks random to casual observer]
kek = bcrypt.kdf(password,salt,key_bytes=32,rounds=1<<workfactor)
ciphertext = nacl.secret.SecretBox(kek).encrypt(key,nonce)
keyfile = magic + salt + ciphertext

Questions

Is this an appropriate way to use bcrypt.kdf? (which seems to be  PBKDF2withBcryptHash. I don't know if this is a standard implementation or only used in py-bcrypt)
Is there a problem with using SecretBox instead of a specialized key wrapping cipher?


texts: How many NVidia 3090 would you need to brute force a 1024 key in one day?


texts: Combining several symmetric ciphers using XOR

texts:
I have seen a talk by Rüdiger Weis, where he says that you can combine two symmetric ciphers using XOR. According to him, that has the effect that its sufficient if only one of the ciphers is secure.

How does he do that? I have thought of

ciphertext = twofish(message) XOR aes(message)

but I can't see how the receiver would decrypt that, as he does not know either twofish(message) or aes(message).

I also thought of

ciphertext = twofish(aes(message))

But there is no XOR involved. So whats the problem with the above approach?

I have seen this answer but I don't think its relevant anymore. Using multiple ciphers may be needed to defend against NSA mass surveillance.

EDIT: The two formulas is what I came up with. Rüdiger Weis only said, "you can combine ciphers and XOR is involved".


texts: Understanding SSL vulnerability within Apple's GOTOFAIL

texts:
Currently learning and reading about the fascinating SSL Key Exchange and came upon the Apple GOTOFAIL incident back in 2014. I'm going through the code during that time and came across this section.

err = sslRawVerify(ctx,
                ctx->peerPubKey,
                dataToSign,                              /* plaintext */
                dataToSignLen,                   /* plaintext length */
                signature,
                signatureLen)

I am not quite sure which portion of the SSL Key Exchange protocol this belongs to. It seems like it is trying to verify the public key, date signed, and signature, however I don't think I can recall any portion of the SSL protocol with these three components in one transmission.

As this is known to deny the certificates, it would make sense that this portion came across before(or during) the time when server sends the certificate over to the client.

What exactly is 'sslRawVerify' doing?

here is a post with more detailed code.

Thanks!


texts: Simple reversible algorithms that satisfies SAC

texts:
What are some simple algorithms that …

operate on a block of fixed size (or can be easily made to do so), i.e. the input block has a fixed size, e.g. 256 bit, and the output is a block of the same size
are reversible (can't be a hash function)
satisfy the strict avalanche criterion (SAC)

I'm not interested in any other cryptographic properties. It doesn't have to be a secure cipher.

I use the word simple in a very general sense. I'm interested in anything that most engineers would call simple, easy to implement in software and/or hardware, although there is likely a correlation to well-defined measures like computational complexity.

I have considered AES or a hash function like SHA-256, which I believe exhibit a strong avalanche effect (not sure if they satisfy SAC), but a hash function is not reversible and AES seems unnecessarily complicated if you do not require the algorithm to be a secure cipher. I thought there must be something simpler. I could, of course, be mistaken.


texts: Modifying an Enigma machine to allow unchanged letters

texts:
One of the biggest flaws of Enigma was that a letter couldn’t represent itself because the route through the machine was one-way. I was thinking a quick fix could be to introduce a rotor position that deflected the signal so that nothing would light up - no response would indicate that the letter you just pressed is unchanged. When decrypting, the rotor position should also produce no response and so you know that letter in the message is unchanged.

Would the fix really have been that simple or am I missing something?


texts: What would happen to AES if we replaced MixColumns with ShiftColumns?

texts:
I have this as a question in an assignment and I guess I don't fully understand the steps.
I understand that if we omit MixColumns, then every byte of the ciphertext would not depend on every byte of the plaintext. But if we insert a new operation, ShiftColumns, which is like ShiftRows, but operates on columns, wouldn't this, combined with ShiftRows, provide a solution?


texts:
I have set myself a little challenge, to see if I can decrypt my own text file from with a ZIP file...

The AES Key from my encrypted ZIP is all I have    managed to extract,
how do I decrypt the zip using this AES Key...

It asks for a password, so how am I supposed to bypass that and only decrypt using the AES Key.


texts: Algorithm accepting every passphrase to fool unlegit user

texts:
I'm looking for specific names and literature on crypto algorithms that accept every passphrase input by the user, in order to 'decrypt' - even with false passphrase - and present the unlegit user with a false plaintext. The unlegit user should not be able to determine whether the 'decrypted' text is real or fake - as it accepts every passphrase.

Of course using the legit passphrase reveals the legit plaintext.

I found two examples of what I mean:
The Fraunhofer Institut in Germany invented a smartphone password-manager app that uses this kind of technology. Its called iMobileSitter. And I think on Eurocrypt2014 a paper called 'Honey Encryption' with a  similar algorithm has been submitted.


texts: Decrypt a message which is encrypted using XOR?

texts:
This is a puzzle asked in a contest. Given that encryption , decryption happens as per following rule/code:

    Encrypt(PlainTextBytes, KeyBytes){
        for(int i = 0;i < PlainTextBytes.length; i++) {
            Cipherbytes[i] = PlainTextBytes[i] ^ KeyBytes[i];
        }
        return Cipherbytes;
    }

    Decrypt(Cipherbytes, Keybytes){
        for(int i = 0; i < Cipherbytes.length; i++) {
            Plaintextbytes[i] = Cipherbytes[i] ^ Keybytes[i];
        }
        return Plaintextbytes;
    }

    Send(message){
        key=Read from file "SymmetricKey.txt"
        Convert key to keyBytes and message to messageBytes using ASCII encoding
        print "Message to be sent: ", encrypt(messagebytes, keybytes)
    }

    Receive(receivedmessage){
        key = Read from file "SymmetricKey.txt"
        Convert key to keyBytes and receivedmessage to receivedmessageBytes using ASCII encoding
        print "Message for you : " , decrypt(receivedmessagebytes, keybytes)
    }

Given 3 encrypted message sequences as follows

    120, 84, 25, 1, 15, 17, 42, 21, 9, 12, 3, 49, 8, 29, 82, 31, 87, 118, 88, 92, 93

    125, 87, 44, 7, 31, 41, 6, 8, 17, 51, 14, 17, 42, 27, 86, 19, 66, 92, 88, 86, 7

    123, 84, 16, 28, 9, 10, 4, 2, 31, 55, 7, 6, 13, 61, 91, 62, 89, 91, 83, 87, 86

Some one has discovered that there is some flaw in encryption. IMO flaw doesn't lie with code it's in Cipherbytes. Cipherbytes may be having some patterns so that we can decrypt this message.

Is there a way I could get the source message of these three encrypted messages?

I have look at How does one attack a two-time pad (i.e. one time pad with key reuse)?
That question is different from this since that assumed that cipher text uses same pattern to encrypt in this case it's not true . I wrote simple program to test nothing prints on output.

as

char a1[ ]={120, 84, 25, 1, 15, 17, 42, 21, 9, 12, 3, 49, 8, 29, 82, 31, 87, 118, 88, 92, 93 };
     char a2[ ]={125, 87, 44, 7, 31, 41, 6, 8, 17, 51, 14, 17, 42, 27, 86, 19, 66, 92, 88, 86, 7};
     char a3[ ]={123, 84, 16, 28, 9, 10, 4, 2, 31, 55, 7, 6, 13, 61, 91, 62, 89, 91, 83, 87, 86 };

    for(i=0;i<256;i++){
            for(int l=0;l<22;l++){
                s1[l] =  (a1[l]^i)^a2[l];
                s2[l] =  (a1[l]^i)^a3[l];
            }
            flag=1;
            for(k=0;k<22;k++){
                if(s1[k]!=s2[k])flag=0;
            }
            if(flag){
               for(int k=0;k<22;k++){
                cout<<(s1[k]^a1[k]^a2[k])<<" ";
              }
              cout<<"\n";
            }
    }


texts:
Write the decryption of a 2-round generalized Feistel network given below.

  $P_i$ denotes plaintext blocks of each 32-bits.
  $RK_i$ denotes the round keys.
  $WK_i$ denotes 32-bit keys applied only at the ﬁrst round (whitening keys)

  Continue the lines for the decryption.

  The whole ﬁgure will input 4, 32-bit plaintext, encrypt it for 2 rounds and continue with decryption and will output the same input

Can anyone help me for this question?


texts: Is this password migration strategy secure?

texts:
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess any but the weakest passwords in a reasonable period of time.  I know there's not much I can do for people who choose "password" for their password, but I think we can protect most people who use words from a bigger dictionary, e.g. "regenerating".

Some of the databases are from the 90's and the existing authentication tokens are stored as

 MD5(salt + password)

and some of the salts are pretty weak.  Other databases use somewhat better hashes and salts, but still not strong enough to resist attacks from today's computers.  However, we don't want to wait until people login to update their database entries.  So my plan is to simply take the output of whatever hashing algorithm the password system is currently using and to feed it into bcrypt and store that result as the new authentication token, e.g.

 bcrypt(MD5(salt + password), new_secure_salt)

Does anyone see a weakness with this procedure? It seems to me that this will not be any worse than using bcrypt(password, new_secure_salt) but I know better than to rely on just myself for the evaluation of a cryptographic protocol.

I wouldn't recommend this procedure for new applications, but this method is the best I can come up with for immediately securing an entire database of insecurely stored passwords in a way that is transparent to users.


texts: Is the difference distribution table of AES S-box uniform?

texts: I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?


texts: Meaning of Signature hash algorithm field in certificate

texts:
I'd like to understand what is the meaning of this field, especially considering that when calling a crypto library to sign data the digest method is specified by the caller.
For example, this simple C# code:

RSACryptoServiceProvider rcsp = certs[0].PrivateKey as RSACryptoServiceProvider;
rcsp.SignData(data, "SHA256");

Why would I even specify the algorithm if it's dictated by the certificate? And what is the meaning of the resulting signature in the above code, if say, the signature hash algorithm in the certificate is sha1 and not sha256?


texts: Which properties of a group are used in the steps of Diffie Hellman?

texts:
I’m trying to understand which properties of a group are used in DHKE at each step.

For example, Alice and Bob’s public keys appear to only use the closure property of a group and maybe identity  (e.g. $k_{pubA}$ = $A^{k_{prA}}$ (mod p)?

When creating the shared key Alice and Bob appear to also use the associative property of a group $k_{AB}$ = $B^{k_{prA}}$ (mod p)?

So to perform both main steps of DHKE the multiplicative inverse property does not seem to be used at all?


texts: Could any one suggest alternative Zero knowledge proof protocol to Schnorr protocol ZKP?

texts:
I read that Schnorr protocol cannot be proved zero knowledge on that link:

Perfect zero knowledge for the Schnorr protocol?
Could any one suggest alternative Zero knowledge proof protocol so a prover can prove to a verifier that he knows the private key corresponding to a particular public key?


texts: Encrypting a broadcast message decryptable by a subset of receivers

texts:
I wasn't certain how to title this request/problem, but here goes:
I'm A, and I want to send a message that is received by B, C, D.
Each receiving entity here is part of some set of domains D1, D2, D3:
B: {D1, D2}
C: {D2}
D: {D3}

How do I encrypt a message with a single key that I, A send to B, C, D such that it can only be decrypted by receivers in a given domain subset (e.g Msg(D1,D3) = B and D can decrypt the message)?
Assume it is possible to convey to A, B, C and D some security material ahead of time before having to send the message.


texts: Does encrypting the key with itself make it easier to crack the ciphertext?

texts:
As the title states; Is there any risk from encrypting the key with itself? EG. $C = AES(K=K, M=K)$

I'd assume not; after all, how does having the key for a safe inside the safe make it easier to pick the lock?


texts:
I am reading an article on cryptography at following location:
http://www.entrust.com/resources/pdf/cryptointro.pdf

Historically, encryption systems used what is known as symmetric cryptography. Symmetric cryptography uses the same key for both encryption and decryption. Using symmetric cryptography, it is safe to send encrypted messages without fear of interception (because an interceptor is unlikely to be able to decipher the message); however, there always remains the difficult problem of how to securely transfer the key to the recipients of a message so that they can decrypt the message.
With symmetric cryptography, as the number of users increases on a network, the number of keys required to provide secure communications among those users increases rapidly. For example, a network of 100 users would require almost 5000 keys if it used only symmetric cryptography. Doubling such a network to 200 users increases the number of keys to almost
20,000. Thus, when only using symmetric cryptography, key management quickly becomes unwieldy even for relatively small-scale networks.

How did the author conclude 5000 keys for 100 users and 20,000 keys for 200 users?


texts: Is it possible to use X.509 for a symmetric-key algorithm?

texts:
I read on wikipedia what is X.509:

  In cryptography, X.509 is a standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS[1], the secure protocol for browsing the web. They are also used in offline applications, like electronic signatures.

but as a beginner it looks still unclear to me, do you please have any concretes examples of daily use cases concerning X.509 ?

As I assume it is a standard defining the format of public key certificates, could it still be used concerning Symmetric-key algorithm ?


texts: Fortuna: why are source ID and data length added together with entropy data into the pools

texts:
Section 9.5.6 of Cryptography Engineering states that

  The concatenation [of source number, length of data, and data itself] is then appended to the pool.

Why are we including source number and data length? The source number is fixed for each source, the length of data is constant for many sources, so aren't we contaminating the pool with low entropy data?


texts: Is this discrete log generalization a well known cryptographic assumption?

texts:
Assume you have a finite group $\mathbb{G}$ and an integer $n$. Given $g_1,\dots,g_n,t$ chosen uniformly from $\mathbb{G}$, consider the problem of finding a vector $(a_1,\dots,a_n)\in \mathbb{Z}^n$ such that
$$g_1^{a_1}\cdot \ldots \cdot g_n^{a_n} = t $$

Is there any class of groups where the problem is known to be computationally hard? Does the computational assumption have a well established name?

For $n=1$, the problem is equivalent to discrete log, and in general it is easier than discrete log (meaning that solving DL immediately gives a solver for this problem).


texts: Where is the key in white-box AES cryptography?

texts:
After an initial study of white-box cryptography, specially around the first article (Chow et. al.), I understood each step of transforming the lookup tables of AES into new ones.

If I understood it correctly, the purpose is to redefine the AES algorithm to propose new tables in each step and to perform lookups into different tables in order to obfuscate the key.

I have trouble understanding where the key is supposed to be in the white-box version of AES. During the AES development into code, is the key defined statically or it is diffused into tables in a "pre-calculated" manner always before the AES execution?


texts:
If ed25519 is that attractive that it seems to be, can someone explain why adoption has been slow and if there are, if any, challenges with implementing ed25519.

Nathan Aw


texts: How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

texts:
When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure:

Using PBKDF2 with then entire 128 bit random salt and generating 512 bits of derived data to split into a 256 bit AES Key and a 256 bit HMAC key.

or

Using PBKDF2 separately for each key using two 64 bits salts to generate a 256 bit AES Key and a 256 bit HMAC key.

or

Better option?


texts: Trouble understanding range proof of Greg Maxwell's Confidential Transaction

texts:
i've some trouble understanding the base of the range proof presented at
https://elementsproject.org/elements/confidential-transactions/investigation.html

I've understand the base of the Pedersen Commitment but I lost when he speak about commitment to zero:

  A pedersen commitment can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the public key. Using the public key in the signature is required to prevent setting the signature to arbitrary values and solving for the commitment. The private key used for the signature is just the blinding factor.

Why to prove a zero commitment it make an hash of the commitment? Does he intend this ( if we call $C$ the commitment)?

$Hash(C)H + C$

But if I know the Publik key $P=kG$ cannot simply check if $C= P$ because we have that $C= kG + 0H$?

Thanks!


texts: IV generation best practice for AES-256 CBC

texts:
I saw some SWIFT code that generates IV for AES 256 from selecting 16 characters from a-zA-Z0-9 space. Is this secure? Sufficiently secure?

What is the best practice to generate IV for AES 256? Will picking random 16 bytes from 0x00-0xff be good?

We want to store key and IV in Database and retrieve it for encryption/decryption. We want to store it as a string of values (i.e "1, 255, 126, 124 ..." - 16 values like this). Then decrypt the fields using the decoded values as bytes.

Is there anything to look out for when it comes to IV generation other than making sure that the random generator is good?

We want to use AES-256 CBC.


texts: Why not consider modification in ciphertext part in identity-based encryption

texts:
In identity-based broadcast encryption system, the ciphertext is

$$ C=<c1,c2,...,cn,U,V,W>$$

There can be a man-in-the-middle who can modify one or all of the $c1,c2,...,cn$ values so that the receiver can not get the correct plaintext.

Why isn’t such a situation considered? (Maybe my thinking is somewhat awkward.)


texts: Estimating difficulty of "Memory-Hard Proof-of-Work" based on "size of memory"?

texts:
In Bitcoin proof-of-work, the difficulty of Proof-of-Work is estimated and calculated based on total hashing power of the participants. If total hashing power of the participants is higher, then PoW is more difficult.

If we use a Memory-Hard-Proof-of-Work scheme, the difficulty of Proof-of-Work is still estimated based on the hashing power ? OR based on the size of memory ?
In other word, is it feasible to design a Memory-Hard-Proof-of-Work scheme in which we could estimate the Pow difficulty based on the size of memory, instead of hashing power of participants ?
Has such a Memory-Hard-Proof-of-Work scheme designed yet by which we could estimate the difficulty based on memory size?

Just as an example: a Memory-Hardened Proof-of-Work Scheme: https://eprint.iacr.org/2017/1168.pdf

P.S. 1: Related question: Memory-hard proof-of-work: are they ASIC-resistant?

P.S. 2: If you need any further complementary explanation about the question, please let me know.


texts:
Thank you for the answers, I have edited my questions.
It is a known fact that encrypting the files increases the file entropy. You can see the average entropy values of encrypted and non-encrypted versions of the different files in this
paper (see figure 2). After I read this paper I check out my encryption algorithm and I notice that I was using base64 encoding while overwriting the file and that was decreasing the file entropy. So my problem is solved.


texts: Design a simplified version of the protocol for secure addition

texts:
To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) number in $Z_p$.

The objective of secure addition is to compute the function $f(x_1, \ldots, x_n) = \sum_{i=1}^{n} x_i \bmod p$

My attempt:

Suppose there are $n$ players. Then for player $P_j$, I set $r_{j,n} = x_j - \sum_{i=1}^{n-1} r_{j,i} \bmod p$ and give $r_{j,i}$ to player $P_i$. Here $r_{j,i}$ is randomly chosen, so that $r_{j,n}$ is randomly distributed as well.

Now, to compute $x_j$ each player $P_i$ must reveal $r_{j,i}$.

Then to compute $f(x_1, \ldots, x_n) = \sum_{i=1}^{n} x_i \bmod p$ each player $P_i$ reveals all shares $r_{j,i}$ for $j=1,\ldots,n$ and they compute:

$$\sum_{i}\sum_{j} r_{j,i} = \sum_ix_i \bmod p$$

I don't think my approach is right, since in the original protocol an intermediate step of computing "intermediary" shares is performed.

Also, how many players may go toghether before the protocol is broken?

http://cs.au.dk/~jbn/cdn/Introduction.pdf


texts: Create MAC and IV given known IV and MAC for previous message

texts:
I've been given a AES-CBC-MAC, a message and the IV. I don't know the key. Given a second message I am supposed to derive the IV and create a valid MAC.

I believe I've successfully created the second IV, (Message1 XOR IV1) XOR Message2. However I'm not able to create a valid MAC - but this is where I'm unsure if I have misunderstood something: Given the same key for both messages, shouldn't MAC1 and MAC2 match given how I've created IV2?

And yes, as you've certainly guessed, this is a homework question. I've been driving myself crazy trying to figure this out, but I've come to the realisation that my understanding of AES-CBC-MAC is lacking.


texts: What is the time complexity of the RC6 encryption?

texts: I am confused to analyze time complexity of rc6 encryption. Please help me


texts: Beginner question about secure communication with one user using DES

texts:
I am currently learning about encryption and I was asked a question:

If a customer only had a DES system how could I secure messages as DES is not secure.

I was researching this and I came across a Hybrid crypto system, where a symmetric-key crypto system (DES) is used and a public-key crypto system is also used.

Would this be a viable option or do both parties need to use both systems?

Any help would be much appreciated.


texts:
Note - I know SSLv3 is dangerous but that is why I am using it to do demo of POODLE attack using server and client written in python.

So the question is I am using "ECDHE-RSA-AES128-SHA" cipher for connection between client and server.I also implemented the MITM(Man-In-The-Middle) proxy
for connection. And when I am seeing the size of data being transmitted for every message then it is not multiple of 16 bytes.

Data is of like something structure ---

header with 5 bytes -- "\x17\x03\x00\x00 " (yes there is space in the end)
and the remaining encrypted data.Amusingly the new data length by subtracting these 5 bytes is still not multiple of 16.

For single letter messages the size of data transmitted after encryption is 74 bytes(including that 5 byte header which never changes). And as soon as the message becomes more than 11 characters one block of 16 bytes is added so now the size becomes 90 bytes.

Isn't the size supposed to be the multiple of block size? So what is actually the structure of data being transmitted .

Note - I am using ssl.wrap_socket method to create ssl socket


texts: Mutating a SHA-2 input would allow us to have multiple hashes for a single input, would this increase SHA-2's security?

texts:
Let me elaborate: Say we have two distinct inputs: $A$ and $B$. We also have some arbitrary deterministic mutation protocol $M$ (for example reversing the characters and performing a Caesar cipher).

Say by chance (I understand this is extremely unlikely) $A$ and $B$ result in the same hash when run through SHA-256. However, when $A$ and $B$ are mutated with $M$ first, and then run through SHA-256, they have different hashes.

Am I correct in this thinking? Deterministic mutations would allow us to have multiple hashes for a single input which would make the probability for collisions even lower, because another input would have to have the same hashes for all mutations.