texts: Is it possible to encrypt a message's destination as well as its content?

texts:
I have imagined a way to break through any kind of censorship but since I don't have enough professional knowledge of cryptography I don't know whether it is feasible or not.

If there is a method that can only enables the recipient to know this message is for him, and when others catch this message they don't even know who will receive that, then no one can block a certain site unless he can decrypt it.

I hope some professionals can respond to this question and tell me if this is possible.


texts: Are all public-key encryption protocols based on one-way functions?

texts:
Are there any public-key cryptography protocols which don't rely on one-way (or trapdoor) functions?

RSA and Diffie-Hellman cryptographic protocols both rely on one-way functions (prime factorization and discrete logarithm). Lattice-based cryptography is based on the Shortest Vector Problem which is NP-hard, but is it a one-way function?


texts: Is it safe for the ChaCha8 nonce to be deterministic?

texts:
ChaCha8 takes a 8 byte nonce (or IV) that should not be the same twice for the same key. Generating this nonce randomly makes me very very nervous for collisions.

Is it safe to generate this nonce deterministically?

For example the first 6 bytes could be the number of milliseconds since the Unix epoch, with the last 2 bytes being an unsigned counter wrapping around. This will prevent any collisions from happening for 9000 years if no more than 65535 streams get encrypted in a millisecond (things get more complicated if the same encryption key is being used by multiple machines/threads, but let's ignore that for now).


texts: How can hashes be unique if they are limited in number?

texts:
I'm curious, how can for example SHA-256 be unique if there are only a limited number of them?!

For clarification:
how many MD5 hashes are there?
$16^{32}$ MD5 hashes can be produced.
$16^{64}$ SHA-256 hashes can be produced.
while there are $16^{128}$ just SHA-512 hashes, let alone long texts.

For more clarification:
assume we want MD5 of all the SHA-256 hashes.
we can have $16^{32}$ number of MD5 hashes, while there are $16^{64}$ SHA-256 hashes.
we will have 3.4*$10^{38}$ duplicate MD5 hashes!

And so is for SHA-256 hash, if we calculate SHA-256 of all the SHA-512 hashes, we will have 1.15*$10^{77}$ duplicate SHA-256 hashes!

Edit: This is not limited to a particular hash like SHA-256.


texts: Is it possible to construct a hash-based public key encryption scheme?

texts:
I know hashes can be used to construct symmetric encryption schemes (HMAC running in counter mode), signature schemes (SPHINCS), pseudorandom generators, etc.

One thing that's missing is public key encryption. Is it possible to create a hash based public-key encryption scheme?

My intuition says no. But it would be nice if there is a proof that it can't be done.


texts: Naor Pinkas OT - senders security; reduction to DDH

texts:
This question concerns the security of the sender in the Naor Pinkas OT. The protocol can be found here.

We can reduce the security to the DDH assumption. How exactly is this done? Can someone construct an adversary that shows this reduction?

To simplify the question. Working with the simulation based definitions the real and simulated views leave us with the job of showing $(g^a, g^b, g^c, g^{a\cdot b})$ and $(g^a, g^b, g^{a\cdot b}, g^c)$ are indistinguishable.

Let us assume that $D$ can distinguish these two distributions (can distinguish with probability that is non negligible).

That is,
$$|\mathsf{Pr}[(D (g^a, g^b, g^c, g^{a\cdot b}) = 1] - \mathsf{Pr}[(D (g^a, g^b, g^{a\cdot b}, g^c)) = 1]|$$ is non negligible.

What adversary can be constructed that breaks the DDH assumption? That is we must construct $A(D)$ (it takes in $D$, as an input) such that
$$|\mathsf{Pr}[(A(D) (g^a, g^b, g^{a\cdot b}) = 1] - \mathsf{Pr}[(A(D) (g^a, g^b, g^c) = 1]|$$ is non negligible.

Thanks


texts:
This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves?

I assume you could do it by supplying ECDSA with deterministic input instead of randomness during signing, resulting in "sudden death" if two messages are signed by the same key. This however includes all the complexity of ECDSA. I feel like there's probably a way to get one time signatures out of elliptic curves via some simpler construct.

(One-time-ness is normally an undesirable property, but imagine it's a desired property. You explicitly don't want multiple signatures per secret key, so you want to strongly discourage that by making it result in loss of security.)


texts: Security of pairing-based cryptography over binary fields regarding new attacks

texts:
In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$.

Pairing-based cryptography using binary fields currently relies on fields such as $\mathbb{F}_{2^{4\times353}}$ (80-bit level of security) and $\mathbb{F}_{2^{4\times1223}}$ (128-bit level of security).

Do these new attacks apply for these fields? How much security loss is expected for them? (It seems to me that they are not heavily impacted since there is a "large" prime factor in the exponent, but I don't know how much safer they are.)

While I believe the issue is not yet settled, here are some comments about the issue:

"This should signal the death knell for pairing based cryptography on Type-1 curves in small characteristic." - Nigel Smart

"it is not clear how well Joux's method applies for quasi prime extensions $2^{2\cdot r}$" -
Francisco Rodríguez Henríquez

"one consequence of the new algorithms may be that characteristic 2 and 3 fields are not appropriate for pairing-based cryptography." - Steven Galbraith


texts:
This is question about how many RCON values are used in AES 192 and 256.
I read the NIST Publication introducing AES and in Appendix A.2 and A.3 (Key Expansion for 192 and 256-bit keys), only $rcon_1$ to $rcon_8$ were used for 192 bits and upto $rcon_7$ for 256 bits. My question is how can only 7 or 8 values of $rcon$ be used when we have more rounds in AES 192 and 256.
To my understanding, $rcon$ is used every round so should't we have more $rcon$ values (owing to the increased no. of rounds in  AES192 and 256) instead of less?


texts: HMAC SHA256 - fixed vs dynamic key - security and collision impacts

texts:
Assume we should apply an hmac sha256 on different messages made of incremental numbers (Ex. 1 to 1 billion).
Does it make sense in terms of security to apply a different fixed key for each message?
message 1 key X1
message 2 key X2
...
message n key Xn
Will applying a key for each message impact the collision rate?
If yes, will it increase or decrease the collision possibility?
The aim is to generate unique deterministic tokens starting from sequential values as source domain.


texts: Does piping MT19937 random stream into SHA512 make the state of MT unrecoverable in practice?

texts:
It's well known that state of a Mersenne twister is quite easy to recover after you observe enough samples. But what happens if we pipe blocks comming out of MT into SHA512 and give this as output.
Since there is no mathematical proof that SHA512 is not invertible there probably wouldn't be a way to proove that MT state recovery in this scenario is impossible.

Is there any real practical way to obtain the MT state in this setup and hence be able to predict next blocks?
Or maybe prediction is somehow possible without state recovery?
I have read that there are CSPRNG designs that use an MT generator internally. Do they work like this, just take an MT stream and obfuscate it in some way or are they completely different?

Thank you!


texts: Constant size commitment to a bivariate polynomial

texts:
In this paper by Kate et al, a constant size polynomial commitment scheme is described.

The commitment scheme assumes a public reference string:

\begin{align*}
\Big\{
\{ g^{ \tau^i }, g^{ \alpha \tau^i }  \}_{i=-d}^{d} \}, \ \
\{ h^{ \tau^i }, h^{ \alpha \tau^i }  \}_{i=-d}^{d}, \ \ e(g, h^{\alpha} )
\Big\}
\end{align*}

where $\alpha, \tau \in \mathbb{F}$ are two secret values and $d$ is a large integer. The commitment goes as follows:

Commit: let $f \in \mathbb{F}[x]$ with degree at most $d$. The commitment is a group element $F$ defined by
\begin{align*}
F := g^{\alpha f(\tau) }.
\end{align*}
To open the commitment to a certain value $z$, compute the proof $W$ which is another field element, defined by:
\begin{align*}
W := g^{ \frac{ f(\tau) -f(z) }{ \tau-z } }
\end{align*}
To verify a correct opening given $(F, z, (v, W) )$:
\begin{align*}
e(W,  h^{\alpha \tau}  )  \cdot  e(g^v \cdot W^{-z}, h^{\alpha} )  == e(F, h^{\alpha } )
\end{align*}

We note that the the commitment to the polynomial $f$ is constant size, as well as the proof of correct opening for a given value $z$.

My question is,

  Given the above reference string, or a similar reference string of roughly the same size (linear in $d$), is there a known constant size commitment scheme to a bivariate polynomial?


texts:
I am learning Hash Algorithms and in a presentation (PDF) about these algorithms I read that:

  Length of $h(m)$ much shorter then length of $m$.

Now my question is:
What if we talk about an empty string, is it true that hash length is shorter than the length of message?

I searched the internet and  found that:

  The MD5 Hash of an empty string is:d41d8cd98f00b204e9800998ecf8427e


texts:
It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong.

However, these statements are always made about the raw block ciphers. How about GCM-AES256, CCM-AES256 and the like? The MAC tag in GCM is at most 128 bits. Does this mean GCM is not post-quantum secure, even if I use AES-256? What mode of operation that gives me authenticated encryption also gives me post-quantum security?

UPDATE

So I have found some interesting papers, namely:

Secure Signatures and Chosen Ciphertext Security
in a Quantum Computing World
Quantum-Secure Message Authentication Codes

GCM uses Carter-Wegman MAC, and per the second paper (p. 18): This MAC is not, in general, secure in the quantum setting. But the authors (Dan Boneh and Mark Zhandry) do give an example of a modified CW-MAC that is secure in quantum settings. So I guess that rules out the GCM mode, but what about CCM and others?

I am not sure whether the construction of MAC is the only issue in authenticated crypto, or the MAC tag space as well.


texts: Can ChaCha20 be repurposed as a general purpose permutation function like Gimli?

texts:
I like the idea behind Gimli and libhydrogen but in my benchmarks Gimli permutation function is considerably slower than ChaCha20 one. By considerably I mean four times slower using SIMD builtins. This is a big difference. Moreover, ChaCha20 is more mature and a more conservative choice.

Can ChaCha20 be repurposed as a general purpose permutation function as Gimli? What are the security risks to consider?

EDIT

My objective is to patch libhydrogen to use ChaCha20 instead of Gimli. I do not have the knowledge on this field nor the intention to do anything else.


texts:
The commonly-used ECDSA signature consists of 2 scalars $(r,s)$. There's also a Schnorr signature. Given private key $k$, public key $C = [k]G$ and the message $M$:

Generate random scalar $k_1$
Calculate the $C_1 = [k_1]G$
Calculate the challenge $e = H(C_1 \mathbin\Vert M)$ where $H$ is a selected hash function
Calculate $k_2 = k_1 + e\cdot k$
Signature is $(C_1, k_2)$

The verifier then verifies that $[k_2]G = C_1 + [e]C$

Both schemes seem to be nearly equally secure. I like more the Schnorr's scheme, because it uses nothing more than just a common ECC arithmetics. However the drawback is that the signature is bigger: instead of 2 scalars it's now scalar + point (with 2 coordinates).

One way to solve this is to store the curve point in a compressed way: its $x$ coordinate and the sign bit, from which the $y$ coordinate may be recovered. But this requires extra calculations.

I thought about an easier way. Let's just store the $x(C_1)$—the $x$ coordinate, and the challenge formula should be adjusted to account only for $x(C_1)$.

The verifier should verify the following: $x([k_2]G - [e]C) = x(C_1)$. That is calculate the left-side curve point, take its $x$ coordinate and compare to the signature.

Is this a common practice? Is there a potential flaw in this scheme?


texts:
Wen-Her Yang and Shiuh-Pyng Shieh proposed two password authentication schemes by employing smart cards, one is timestamp-based and the other one is nonce-based. Their scheme consists of 3 phases: Registration, login and authentication phase.

Considering timestamp-based scheme, step 3 of registration phase says:

  Find an integer $g$ which is a primitive element in both $\operatorname{GF}(p)$ and
  $\operatorname{GF}(q)$, where $g$ is the system's public information.

What happens if we use a $g$ that is not a primitive element of those two fields? How can this affect scheme security?

I myself think that by selecting a $g$ that is not a primitive element, we end up using a smaller group which probably can make things easier for an attacker to solve discrete logarithm problem $h_i=g^{\mathit{pw}_i\cdot d}$ and obtain $\mathit{pw}_i\cdot d$.


texts: Encryption scheme with arbitrary length message

texts: Is the definition $\Pr[\operatorname{PrivK}_{\mathcal A,\Pi}^{eav}(n) = 1] \leq \frac{1}{2} + negl(n)$ still valid in case we have an encryption scheme  $\pi (Gen,Enc,Dec)$ with arbitrary length, and the adversary $\mathcal A$ is not outputting equal length messages?


texts:
I started working with RSA two weeks ago. But I couldn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algorithm.

I am trying to generate "EM" from a signature of length 256 bytes, public modulus $n$ (256 bytes) and exponent $e$ (0x10001). But I am not getting the expected output ("EM"). So I started debugging code.

Can someone clearly explain what OS2IP & I2OSP do?


texts:
By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view.

Differential and Linear Crypt-analysis. Number of Active S-boxes along-with the Differential and Linear probabilities of S-box contributes towards resistance against these attacks which also depends upon the branch number of the P Box. (Diffusion layer).
Truncated Differential. If there does not exist an iterated truncated differential with higher probability than exhaustive keysearch then cipher is safe against this type of attack. (I need to learn more about how to counter this attack)
Impossible Differential. There exist one 5 round impossible differential in feistel cipher with bijective F function. So cipher with more than 10 rounds will have a good security margin against this attack.
Boomrang Attack. This uses two differentials and security against these again depends upon number of active S-boxes along-with the Differential probability of the S-box.
Higher Order Differential. To resist this attack, Degree of the Boolean polynomials of the S-Boxes should be higher.
Equivalent Keys. Use of original key as one round subkey reduces the chance of Equivalent key classes.
Slide Attack. Ciphers with iterated identical round functions are suspect-able to such attack however use of Pre and Post whitening keys provide resistance against this attack.(assuming Pre / Post whitening keys have been generated from a strong keyschedule)

Do i have right understanding countering these attacks?


texts: Security importance of Key Schedule in Block Cipher

texts:
For example block cipher AES-128, Key size is 128bit and it is used to make a 10 round key which is total 320bit.

Question 1. If i use another Key schedule algorithm in AES, then security decreased or remain same? In other words, if the key schedule algorithm of AES has some relationship with AES encryption itself, then it will be decreased, or it will be same if the new key schedule algorithm is safe enough.

Question 2. Why we expand key? brute force will take O(2^128) time regardless of the key schedule is strong or not. what is the advantage of making key expend?
I was curious about this when I was learned about 3DES.
Which developed because the former DES has weak key length 56bit so vulnerable to brute force attack, i was wondering why doesn't they just remove key schedule process and use the whole round key as a key.


texts:
https://raw.githubusercontent.com/andres-erbsen/salsa20/master/salsa20.c

I tried it, and it's working fine. Now question: is it real salsa20?


texts: Generate 2 independent keys from a master key

texts:
The scenario is like this: I need 2 keys for different purposes (encryption + encryption, encryption + mac, or whatever). Because it is not good practice to reuse the same key, I'd like the 2 keys to be independent. But remembering 2 different keys are cumbersome (don't question this please), so I think there should be some way to generate these keys from one common master key.

The closest crypto tool for this job I can find is a KDF. However, the KDF usually takes as an additional input: the salt. Should I randomly generate and remember a salt, or simply use a hash function such as SHA512 and divide its output into 2 keys?

I think in this scenario, there's no need to worry about the possible recovery of the master key from the derived keys, because the derived keys are no less important than the master key. The compromise of the derived keys is just as bad as that of the master key. The importance is instead focused on the independence between the 2 derived keys, since at least there are some encryption and mac schemes such that, when used together, would become totally broken if keys are not independent.


texts: ElGamal encryption and signature using same keys

texts:
In ElGamal scheme we have message $M$; $p$, $g$ and $y=g^x \bmod p$ as public key where $x$ is unknown private key.
Encrypted message $(c,d)$, where $c=g^k \bmod p$ and $d=M \cdot y^k \bmod p$.
Signature $(r,s)$, where $r=g^k \bmod p$ and $s=(M - xr)\cdot k^{-1} \bmod p-1$

If $c=r$ then message encrypted and signed with the same $k$.
Is there a possibility to obtain private key $x$?


texts:
The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission.

Security
N
q

Moderate
107
64

High
168
128

Highest
503
256

What are attacks done so far that have broke the moderate and high security level parameters? The papers I came across mainly talks about the theoretical aspects of the attacks but are there any papers that did an actual implementation and manage to break the parameters?
Or in other words, what are the attacks that have caused the secure parameters to change? What is the largest parameter broken for NTRU?


texts: Why are hashes padded only at the end of the block?

texts:
Cryptographic hash functions pad the input message with some indicator of length.  This is done as to avoid attacks and allows an input message of 0000 to be differentiated from 00000.  As far as I can see, padding /length inclusion invariably occurs after the message data either immediately after or right up at the end of the block.

Is there some fundamental /security reason that the length of the message can't be pre pended instead?  So it would go at the start of the first block.  Is it somehow connected with sequentially reading in files /data of unknown length?  Would it make a difference if you always knew the length of the message to be hashed?


texts: Using an AES-256-GCM key as a salt to SHA-256

texts:
Assume 256 bit keys are randomly generated and data is encrypted using AES-GCM-256 prior to being sent to a server.

The goal is to enable the server to determine uniqueness of data it receives without actually revealing the plaintext data.

Would it be safe to use SHA-256 where the input to the hash function is the key in addition to the plaintext data -- so SHA-256(key + plaintext)? By safe I mean does doing this reduce the safety properties of the key by a significant margin?

If not safe, how large of a random byte string is needed to make the SHA sufficiently difficult to brute force?


texts: I just started a course in web security, and I was just wondering quickly if SET in any way would use SSL? I noticed it was developed in part by Netscape. But all I can find is comparisons between the two. People are saying that SSL is a more general while SET would have been just for e-commerce, but then they mean that SET would handle everything itself and not use SSL for the link?


texts: Securely register a client in server using AES an RSA

texts:
I've designed the following protocol to send the client's public key to the server. Initially, the client knows server's public key, but the server does not know the client's public key.

client draws a random AES key
client enciphers the AES key using the server's RSA public key and sends the result
server receives this and deciphers it using the server's RSA private key
server generates userID and stores it with the client's public key for later use
server creates message with userID, signs it with its private key, enciphers it using the AES key and sends it to the client
client deciphers it using the AES key, validates origin using server's public key and stores userID.

What can go wrong? Can replay attacks cause any damage? What about Eve-in-the-middle attacks?


texts: RSA key length choice for TLS when confidentiality not important?

texts:
I've a couple of questions about this, the scenario is embedding a key pair in a hardware device which will speak with other hardware devices over tls.  computing resources are an issue so i want to make intelligent choices about where they go on.  We're using TLS to authenticate one device to another, and to ensure integrity of messages in transit.  Immediate or long term confidentiality of messages is not a consideration.

All the recommendations are in the case of RSA to use 2048 bit keys because that will be secure until 2030.  However, in my application the RSA key is used only to provide a TLS handshake for the lifetime of that key on that device, so it doesn't need to remain secure until 2030.  The AES session key is renegotiated every 24 hours and beyond that it doesn't need to be confidential.  TLS is being used to ensure integrity in transport only, the communicated data doesn't need to be confidential.

I'm aware 768 bit numbers have been factored, but my understanding is that factoring one 768 bit number does not help much to factor other 768 bit numbers.  I haven't found docs to say how long it takes to factor a number of X bits with equipment Y.  As an an example I'm going to say 5 years with budget X and equipment Y to factor 768 bits - then people can tell me if the following analysis is solid or not.

E.g. my device will be in use for the next 5 years.  I choose RSA 768 as key size and I change the keys every 12 months.  From day 1 an attacker tries to do every attack he can on the TLS crypto. After 2.5 years technological advances mean he can recover my RSA year 1 private key. However the year 1 can no longer be used to establish a TLS session so there's no impact there. The attacker can also recover the session keys of year 1 which were negotiated with the RSA year 1 key, but as the confidentiality of year 1 data wasn't important there is similarly no impact.

So given this why aren't RSA key size recommendations given in terms of attacker motivation, key lifetime, key usage rather than blanket recommendation of 2048?
Practicalities of generating keys / certs on build machines.  Being conservative I'd say this should be avoided, would it be reasonable to generate device keys via an OpenSSL script with FIPS options on an up to date build machine with appropriate controls, or should there be a hardware crypto-module ?  Or put another way, would an expert witness lambast us in some possible future court case if we had generated device keys in software on a build machine or is that a reasonable way to go about things ?
If I tried to factorize RSA 768 on my home PC and I was a competent mathematician, how long would it take me?  Same question but I have access to a computing cluster.  It seems that in 2009 the factorizing took 3 years, 6 labs, many mathematicians and hundreds of computers..


texts:
I understand how public/private key cryptography works, and I understand how one-way hashing algorithms work.

I have read through this explanation of how digital signatures work, but something still isn't clear to me. Can someone please help me understand how the receiver of a message that has been digitally signed can be sure that the message has come from the claimed sender, unaltered.

Here's my own breakdown of the explanation in the linked article, which assumes the receiver is using some sort of program ("the program") to receive the message, and verify the signature.

The SENDER of the message sends to the RECEIVER:

A PLAINTEXT copy of the original message
A digital signature which consists of an ENCRYPTED hash of the original document, encrypted using the signer's private key
A PLAINTEXT copy of the signer's public key

The RECEIVER receives the message, and verifies that it is unaltered and from the claimed sender by:

Using the PLAINTEXT public key received in the message, the receiver decrypts the hash. The receiver then re-hashes the original document, and ensures that both hashes match
The program also validates that the public key used in the signature belongs to the signer

What's going on in step 2, above? How does the receiver perform this verification step? I can follow everything up to this point, but based on what's been explained up to that point, it would very easy for someone to intercept the message being sent, rip out the signature, create a new hash, attach a new public key, and send it on its way. So at step 2 above, how can the RECEIVER be sure that the message they are looking at is both unaltered and from the intended sender? How do they "verify" it at that point in the process?

Thanks in advance.


texts: Merkle-like hash tree that mirrors existing tree structure

texts:
I'm wondering about the security of a hash-tree structure that mirrors the structure of another tree. In an ordinary Merkle tree the block hashes form the leaves of the tree, and all internal nodes are computed by hashing their children, but what if the data being hashed already conforms to a natural tree structure T? Could you securely create a hash-tree from T by replacing the leaf nodes of T by their hashes and the internal nodes of T by the hashes of their children?

My motivating example for this data-structure is a hierarchical filesystem. I've written some code that realises this idea but I'd like to know if this method is actually secure.

Proof-of-concept code here: https://github.com/michaelsproul/antifa/tree/master/src

I've attempted to make it second-preimage resistant by adopting the framing bytes from Certificate Transparency. The hash of a file is h(00 || contents) and the hash of a directory is h(01 || child1 || child2 || ...). Children are sorted by name before hashing, but their names aren't included in the hash (although perhaps they should be to avoid an order-preserving renaming attack).

Here's an example run on the src directory of the PoC:

$ tree
.
├── bin
│   └── shasum.rs
├── hash.rs
├── lib.rs
└── main.rs

1 directory, 4 files

$ cd .. && target/release/antifa src
[]: SHA-256:9c9489d389f253820a7b7b04a00f38cc04e7d9381e6e6792a69cade7982c6ab1
["lib.rs"]: SHA-256:e070004ebdeca318c5451f5f4e716d5322c286e7a347b3bef987402efc362454
["main.rs"]: SHA-256:83e39d33c072b917ac299bb761442f51e473ccb69b0b40cbf87a80e892fb68b6
["bin"]: SHA-256:22065eed254ac789dddc348d1f429f0e27a09f4e7f0a432d7c4f70e26d5b0e4a
["bin", "shasum.rs"]: SHA-256:c91146c4ac71b8b336cdd8d70475ea8fed3186b16e189ba9d3e003fc80da9113
["hash.rs"]: SHA-256:984b35e7bb55608982bcf1e76d461e0bacd6e75b54f0f0fca5dfac12b23e6135

(the file paths are shown as a list of their components for now)


texts: How to calculate the complexity of a meet-in-the-middle attack in terms of the key size k (Use big-O notation)

texts:
I dont understand this question at all what is it trying to tell me:

  The meet-in-the-middle attack means that two successive encryptions
  using two different k bit keys do not give the security against a
  brute-force attack that you would expect from a 2k bit key.
  Blockquote

(a)

  Consider the situation when using two successive AES encryptions.
  Calculate the complexity of a meet-in-the-middle attack in terms of
  the key size k (Use big-O notation). Assume that a 2-DES attack
  required you to build tables containing the “middle” values. Making
  simple assumptions, what is the size of these two tables? Show your
  working.
  Blockquote

(b)

  In the meet-in-the-middle attack, if we built the tables
  first and then looked for matches, we would have another high
  complexity problem. For each of the table 1 entries, compare with all
  the table 2 entries; this algorithm has complexity of O(22k). Explain
  how the matching could be done while building the tables, resulting in
  the total complexity remaining at O(2k+1).


texts: Is there a way to slow down collision attacks using iteration?

texts:
The simple way to iterate a hash function $H(H(m))$ only makes brute force preimage finding slower, but leaves collision attacks as fast since a collision in the inner hash function is a collision in the overall function.

Is there an iterative algorithm that also slows down brute force collision attacks? Without expanding the output size?

I am looking for something that reduces to the standard properties of the hash function, rather than only working for an ideal hash or a random oracle.

The use case is that a short hash is used, e.g. 128 bits with 64-bit collision resistance. Collision finding attacks should be slowed down sufficiently to be infeasible, e.g. to $2^{100}$ hash function calls.


texts:
After reading many posts, I am still confused about the differences between these two.

Let me know if my understanding is correct:

MAC is encrypted string that is generated using a secret key and a message, and it's used to check no-repudiation.

HMAC is a MAC that is generated using a hash function and it's used to the check the integrity of the message.

Some questions below:

Is HMAC an extra security layer over MAC?
Should HMAC be always used instead MAC?
In which scenario are both used? on TLS?


texts:
Let $(n,e)$ be an RSA public key. Suppose $c = m^e \pmod n$, where $c>1$ is a very small integer. For concreteness, say $c=2$ or $c=4$.

  Is it hard to find $m$ under the RSA assumption (or any of its variants)?


texts: Availability of a simple limited PRNG algorithm

texts:
I am in need of a really simple limited PRNG, that either exists or can easily be created in virtually any language on any platform.  It takes only the initial seed, and is only expected to generate a small amount of output in its lifetime, normally 32-64 bytes but potentially more with very low probability.  It will not reseed.  There is precisely one consumer of its output - an ECDH key generator.  If given the same initial seed on different languages or platforms, the PRNG must generate the same exact output.  (Hence, given the same initial seed on different languages or platforms, it is possible to determinstically recreate the same ECDH keypair.)

The requirement for cross-platform consistency and no need for reseeding are driving me to seek a well known standard implementation of some standard PRNG.  It will not be Yarrow or Fortuna because they obviously don't fit the requirements.

Does there exist some well known PRNG that fits this description?

Note:  I removed "My Simple Limited PRNG" as it is no longer relevant.  Because the answer to the first question "Does something like this already exist, that is well known" is yes.


texts: Using different hashing function with ECDSA

texts:
I came across an IC device configuration & security flow and the details are illustrated in image below.
I'm wondering must the ECDSA pair with the SHA Hashing function?
Alternatively, what if using the AES-GCM to generate both CIPHER & TAG? The GF generated TAG later go through the ECDSA to be encrypted with the private key.
So from the decryption side, it exactly work the same like the image except replacing the SHA engines with the AES-GCM engine. I'm wondering why this is uncommon in all the industry practice?
Or will anything go wrong with the scheme I describe above?


texts:
The zk-STARK is a proof zero-knowledge proof system that, in contrast to the zk-SNARK, no longer relies on a trusted setup where the "toxic waste" parameters are initialized.

What are, in layman's terms, the basic building blocks of the zk-STARK, and how do they work?


texts: Real-world offline phase implementation in MPC setting

texts:
I've been reading up on various basic MPC primitives (multiplication, inversion, exponentiation and so on of secrets shared between multiple parties).
One of the problems of implementing MPC in real-world is performance. One of the common solution trends is splitting of the protocols into offline (preprocessing) and online phases.
The more complicated and resource-intensive a computation is, the more we win by offloading it into the offline phase... and I am trying to imagine what would that mean in practice:
I am imagining a constant stream of requests for some "business" functionality (say, for example, for computing AES), each of which requires for some (potentially multiple) preprocessed data pieces (say, Beaver Triples) to have already been prepared in the offline phase... so, basically, an even (computationally) bigger stream of "offline" processing to be happening in the background...
My own vision includes either computing such offline resources in background when the "business" load is lower, pooling those in some storage (which is also sensitive, I guess?) or trying to offload the preprocessing into separate processes (servers?).
So, my main question is:
Are there any works/guidelines that discuss the way to implement such offline phase(s) in practice?


texts: Zero-Knowledge proof for data being decryptable to a given hash preimage

texts:
Alice has $m$ which is the hash preimage of $h_m$, namely $\operatorname{SHA256}(m) = h_m$.

Consider the following protocol.  Alice does the following:
\begin{align*}
  r &:= \operatorname{Gen} \\
  h_r &:= \operatorname{SHA256}(r) \\
  \hat m &:= \operatorname{Enc}(m, r),
\end{align*}
where $\operatorname{Gen}$ is some secure random key generator and $\operatorname{Enc}$ is some symmetric encryption algorithm (say AES).

At this point, provided that Alice would give Bob $h_m$, $h_r$ and $\hat m$, can she prove to Bob using ZKP (e.g. zk-SNARKS) the following statement?

  There exists $r$ such that $h_r = \operatorname{SHA256}(r)$ and $\operatorname{SHA256}(\operatorname{Dec}(\hat m, r)) = h_m$?

I know the first part is possible ("there exists $r$ such that $h_r = \operatorname{SHA256}(r)$") but I'm not sure about the second part, specifically the composition of $\operatorname{SHA256}$ and $\operatorname{Dec}$.

My intuition is that it is possible, since we can have a witness for that question which can be verified at polynomial time, and thus it's an NP language, but I'm not sure.


texts:
Differential privacy defines "privacy" of a mechanism $A$ as the "closeness" of the two distribution $Pr[A(D) \in S]$ and $Pr[A(D') \in S]$ where $D,D'$ differ in one element. And the distance between these distributions is multiplicative, i.e.

$\left| \frac{Pr[A(D) \in S]}{Pr[A(D') \in S]} \right| \leq e^\epsilon$

I have difficulty in understanding this choice of this multiplicative distance measure, as opposed to the standard distance (statistical difference) as in cryptography (indistinguishability), i.e.

$|Pr[A(D) \in S] - Pr[A(D') \in S]| \leq neg(.)$

The paper "Calibrating Noise to Sensitivity in Private Data Analysis" by Dwork et al. put forth two reasons for using the multiplicative distance:

It is more stringent, since if one probability is 0, the other must also be 0 (which is not guaranteed when using standard measure of statistical difference). This, I understand.
The leakage (distance between the distributions) must be non-negligible for the utility of the mechanism. This I really struggle to understand. Could anyone give an simple example to illustrate this, please?


texts: Kerckhoffs’ principles – Why should I make my cipher public?

texts:
As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that

  A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

To be more precise, it's the 2nd principle that states

  It must not be required to be secret, and it must be able to fall into the hands of the enemy without inconvenience;

Of course I understand why I should keep the key secret, but publishing my protocol's internals seems counter-intuitive. Why should I do it? Wouldn't that give the advantage to the attacker?


texts:
Since I am not able to comment under the topic, I would like to ask here why in question 2 old post, we cannot distinguish the two distributions, even with unlimited computational power? Also, what can be said about the distribution of exponents a+b modp when b is taken at random from Zp, but a is fixed?

Any help would be appreciated a lot.


texts: Are there any cryptographic flaws in my webhook signing process?

texts:
Out of band my services have exchanged secret keys. These secret keys are then used to prevent two things of the webhooks (HTTP calls triggered by Service A to Service B when an event occurs in Service A).

Webhook Spoofing
Webhook Replaying

The basic problems with webhooks involve the fact that, short of Client SSL Certificates, there's no way to know that the sender of the HTTP call is who we think they are. Because of these, a mechanism is needed to ensure that the webhook is not being spoofed and that it isn't being replayed. For this, I'm using a Nonce and HMAC-SHA256. The definition of the Signing process (and a Python example) follows:

Creating the Signature

Generate a Random UUID.
Add this UUID as the HTTP Request Header "x-webhook-nonce".
A new, empty string is created, henceforth known as the signing string.
In alphabetical order of the Header names, append the HTTP Request headers (names and values, in that order, in lower case) onto the signing string.
Base64 encode the request body. Append the resulting Base64 encoded string to the signing string.
Using HMAC SHA256, create the signature. The previously exchanged key is to be used as the key and the signing string as the value to be signed.
Take the resulting HMAC value and Base64 encode it. Create the HTTP Header “x-webhook-signature” with the resulting Base64 encoded HMAC string as the value.

Verifying the signature:

This process is almost the exact same as generating the signature with a few minor changes.
 1. Verifiers should not generate their own nonce, but use the one provided in the “x-webhook-nonce” header.
 2. Verifiers should first check and ensure that the nonce has not been used before. If it has, it should ignore the webhook.
 3. When arranging the headers for the signing string, do not add the “x-webhook-signature” header.
 4. Once you have generated a signing string, compare it to the included “x-webhook-signature” to ensure that the generated signature and the header value are the same. If they are, the request is valid. If not, ignore the webhook.

Generating Signature Example in Python:

signing_key = "SIGNING_KEY_FROM_SUBSCRIPTION"
nonce = uuid.uuid4()

body = "{\"url\": \"https://example.com/\"}"
headers =   { 'Content-Type': 'application/json',
    'Content-Length': 25,
    'Host': 'example.com',
    'x-webhook-nonce': nonce
}

to_sign = ""

for key in sorted(headers):
    if key != "x-webhook-signature":
        to_sign += key + headers[key]

to_sign += base64.b64encode(body)
signature = base64.b64encode(hmac.new(signing_key, to_sign, digestmod=hashlib.sha256).digest())
headers["x-webhook-signature"] = signature

So, after that large wall of text, does this solution correctly prevent against spoofing and replaying of webhooks?


texts:
I'm trying to test the ring signature scheme proposed by Rivest Shamir and Tauman in the famous paper "How to leak a secret".

One of the step consist in

  4) the signer solves the following ring equation for y1: Ck,v(y1,y2,y3)=v"

I have everything except $y_1$.

It's defined that

  $C_k,v(y_1,y_2,y_3) = E_k(y_1 \oplus E_k(y_2 \oplus E_k(y_3 XOR v)))$

where $E_k$ means symmetric encryption with the key $k$.

So what I have to solve is something like:

$y_1 = ? \\
y_2 = 1010 \\
y_3 = 1011 \\
v = 0011$

I have no idea whatsoever on how to solve this. Can you at least tell me if this is possible?

I know that I should provide k and other things but the only thing i need to know if it is possible to actually solve that thing above and how.
In reality I'm using 64 bits binary numbers, not 4 bits.

The main question is: can I solve this for $x$, knowing the key $k$?

$$E_k( BinaryNumber \oplus x ) = BinaryNumber$$


texts:
I was reading Apple's public letter here regarding the "backdoor" that they have been asked to create.  I'm very unclear exactly what the issue is.  There was no backdoor in the encryption algorithm that was actually used on the phone and it's doesn't seem as if they are being asked to create one (and sneak it onto phones) for the future.  Instead it seems like they are being asked to remove a feature of their phones which deletes data if too many wrong attempts are made.  A couple of questions:

This seems like it has nothing to do with cryptography or with a government inserting backdoors into encryption algorithms.  Therefore the consequences aren't nearly as universal as they make it sound (in their example of a "universal key").  Is this correct or incorrect?
If the data is encrypted and they just want to be able to brute force the data , why do they need apple to create this piece of software?  Given the resources of the FBI why can't they get the data off the phone and brute force it offline,  or why can't they have their own software engineers (along with some reverse engineers) design whatever it is that apple is supposed to do?


texts: How can I verify a client's identity by requesting a digital certificate?

texts:
So I am registering users and I need to know they really are who they say they are. More importantly that they represent the company they say they represent.

I was told I can ask them to send me a verisign (or similar) certificate. Basically the company (the more reputable ones) emiting certificates are meant to have already made sure that person is who he says he is and/or really works for Company X Inc.

So when a user fills in his registration form, I ask for an email address, name, company name,etc. and I also ask for this certificate to be uploaded (with a short list of the actual certificates I will accept, e.g. Verisign Pro EV.)

So how do I then use this file to verify that the certificate is valid?


texts: If I have the key, the ciphertext under AES-CBC and the plaintext, then how can I guess the initialisation vector?


texts: Why use RSA-2048 for plaintext when AES-256 is much more secure?

texts:
Why do we use RSA encryption for ANY text/communication/data encryption when everybody on internet is writing that AES-256 is much stronger than RSA-2048? If this is true, why do encrypted email services like Protonmail even use RSA encryption for their email communication when it is not as secure as AES-256?

I have read that it is currently impossible to break AES-256 using brute force attacks, but RSA is not such a big problem to break. Why is this method even used in cryptography when it is slower and weaker than a symmetric cipher like AES?

Is the only reason for using RSA is because of its asymmetric geometry (private/public key)?

I know that this question is not easy to answer but I will give one example:
If I want send secure and encrypted plaintext of - for example - two full A4 pages of text, is it better to use AES-256 or RSA-2048? What I know much stronger and also faster is using AES, but maybe I am missing something?


texts: Number of possible access structure with $n$ person

texts:
I want to count number of possible access structures in closed form(if possible) as a variable of $n$,the number of share holder. I have tried in several ways. Still no good progress. It is very hard to consider all cases and count it and I think there will be work by others on approximating the number. Is there any approximation of that count so that I can get some idea ?

All possible access contains $(k,n)$ - Secret sharing scheme( general access structures). Can anyone give any idea how to proceed?

Example:  In General access structure, we will call the set of collection of all people who can get the secret by $\Gamma_{qual}$ . Consider a case of $n=5$ , we have to consider the case like $$\Gamma_{qual}= \{\{1,2\},\{2,4\},\{1,3,5\}\}$$ but we can't have an access structure where a shareholder is not present, means we always need $$ \cup_{X\in \Gamma_{qual}}X = \{1,2,\cdots,n\}$$


texts:
Salts should be unique so that an attacker can't brute force multiple passwords at once. However, since usernames are unique, wouldn't it be possible to use some representation of the username as a salt?

Of course that means that if a username changes, the password needs to be rehashed. I'm asking from a cryptographic perspective, not a user-experience perspective.


texts: Is there any difference between cryptography and cryptology?

texts:
Is there a difference between cryptography and cryptology, if any?

An internet search suggests that both terms can be used interchangeably.


texts: With AES-CTR does the block input need to be implemented as nonce || counter?

texts:
I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify length, or how many bits are dedicated to the counter (the rest will act as a nonce.) So if you specify e.g. length = 32 the block input will be nonce (96-bit) || counter (32-bit). It then says that the counter should be large enough that it does NOT wrap.
My question is why not just use the full 128-bits as a nonce AND counter. Initialize it with a random 128-bit value and increment the whole thing and as long as you don't wrap all the way to where you began then everything is fine.
https://developer.mozilla.org/en-US/docs/Web/API/AesCtrParams#Properties


texts:
Why are Fermat primes ($2^{2^n}+1$) useful as $e$ (the public key) in RSA encryption?

I understand why $2^n+1$ primes are useful, because they would simply be 100...001 in binary, which for computers is faster in calculations. But why is it important that the exponent is also a power of 2?


texts: What Feistel network block ciphers do not use data-dependent table lookups or modular additions?

texts:
I am looking for block cipher algorithms based on Feistel networks. The algorithm is required to not use data-dependent table lookups (or data-dependent rotations) or modular additions/multiplications.

The only two algorithms that I have found are Simon and Simeck. Are there any alternatives?


texts: Streaming mode of operation that is more resistant against nonce reuse

texts:
Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality?

In this question it would be allowed for the streaming mode to leak if ciphertexts are (partially) identical or not - like in CBC mode of operation. It is of course not permitted to introduce other secrets or random values other than the key and original nonce.

I've got the feeling that this is only possible by mixing in information from the plaintext, but that would make the cipher much less efficient.


texts: Does Grover's algorithm effect block size or only key size?

texts:
We know that Grover's algorithm can speed up cracking symmetric keys. Basically the keyspace is halved. This means we have to use at least a 256-bit key (to get 128-bit security).

I heard somewhere it also has an effect on the block size (so we should use 256-bit blocks instead of 128)!

Is that true?


texts:
Let's say $p$ is the pool of files in a folder. And $k$ is the files in the pool that are "key files" for authenticating in a service.

Note: The order of the key files matter.

Then we have $c$ which is the character set of our passphrase. And $l$ is the length of our passphrase.

For each possible passphrase we also have to add the additional possibilities of the key files.

$t$ is the total possibilities of all the passphrase and the key files.

The formula I believe to be right is:

$t$ = $c^{l*(p^k)}$

And we get all the possible passphrase and key files.

We will assume this passphrase is a PIN, with 10 digits allowed, and with a length of 4. And we have a folder with 4 files, 2 of them are key files.

$p$ = 4, $k$ = 2. $c$ = 10, $l$ = 4.

$10^{4*(4^2)}$ = 1e+64 possibilities.

I have some questions about this.

If $p$ is very large, is it making this kind of authentication of knowing and having something because only I know which files in $p$ are $k$?
Is my math correct?
What reasons are there for websites to not implement key files?
Would it be good to implement in a website?
Is this good authentication?

It looks like this when we're storing the data: passphrase_hash(passphrase . keyfile1_hash . keyfile2_hash).

This requires knowing which files of $p$ is $k$, which ORDER $k$ goes in, in possession of $p$, and to know the passphrase.

Note:: $p$ is at least the value of $k$. If there is ONLY 1 of $p$ and $k$ then it's not knowing something. It's only having something.

EDIT:

This is to be used in a website. Each user has a passphrase, and some key files. The key files' contents are hashed to represent as it. Each of the key file hashed get appended/suffixed to the password/passphrase, all of these going directly into the password hashing function.

password_hash(password . keyfile2_hash . keyfile1_hash)

That is how it is stored. When they go to authenticate as themselves, they must select the files in the website's form, then they submit it along with their password/passphrase.

However, the math I did was a more general scope about the key files themselves, and how many more possibilities they add (the more there are, the more secure). Remember, the order of the key files matters. So they must upload the right key files, in the right order. Otherwise when we go to validate the hash ...

password_verify(password . keyfile1_hash . keyfile2_hash)

It will fail. They didn't upload them in the right order. The hash will output COMPLETELY different even though they are using the same key files.

Hopefully that clears things up.


texts:
There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications.

So, I was wondering how hash functions like SHA1 or MD5 would perform in such a scenario / compare to actual PRNG's. For instance, one could use the a1 = hash(seed) to generate the first batch of random bits and then a2 = hash(seed + a1) for the next series and so forth.


texts: Are there any weak nonce-misuse resistant encryption scheme?

texts:
Nonce-misuse resistance seems to have two standard notions:

The stronger notion: this reveals nothing unless the exact same nonce is used to encrypt the exact same message twice. In this case, the only information that is revealed is that the same message was encrypted twice. This can be used to notice that a message is resent.

AES-GCM-SIV has known to have the strong nonce-misuse resistance.

The weaker notion uses some prefix of the message to achieve nonce-misuse resistance. Nonce misuse occurs if a nonce-key-message-prefix triple is reused.  A crib-dragging can be used to reveal the rest of the messages.

Is there any encryption scheme that has weak nonce-misuse resistance?
Is there any other encryption scheme that has strong nonce-misuse resistance other than SIV mode?

Note: The weak notion is not to be confused with another weak notion of nonce-misuse resistance which allows leakage of the length of the common prefix for two messages encrypted under the same key-nonce pair.


texts: DROWN Attack - Which is the SSLv2 vulnerability exploited?

texts:
In order to get the session key used in TLS communication, an attacker must capture X TLS handshakes based on RSA key encryption, and switch to a server supporting SSLv2 protocol, and sharing the same private key.

The same RSA key lenght is used for encryption between SSLv2 server / TLS 1.2 server in order to use the attack right ?

So why it is mandatory to switch to a server supporting SSLv2? Can you explain me the SSLv2 vulnerability exploited in the case of a DROWN attack?

Thanks.


texts: Disk/File modes of encryption and authentication

texts:
Secure disk/file encryption has been actively studied over the years. Beside XTS and CBC-ESSIV, are there any other modes of encryption that are commonly used? Which could be the most secure mode?

Due to the non-existence of integrity and authentication mechanisms, what are good methods to prevent a malicious person from modifying the data?

I am looking for a practical scheme that meets security and does not significantly impact performance.


texts:
Are any Certificate Authorities using 4096 bit keys for their intermediate and root certificates?

I know you can, of course, use a 4096 bit key for your server certificate, but I usually see 2048 bit keys from the Certification Authorities, and wonder if any are using 4096 bit keys yet?

Thank you.


texts: What are the security implications of multiple hashing?

texts:
There are plenty of questions on this site about hashing passwords. However, none of them quite cover this topic. One of those links covers using multiple different hash algorithms; one covers general hashing, and the other covers how passwords should be transferred. However, I want to know what the security implications of using one hash function multiple times.

I came across an article a while ago saying that this is not a good idea. However, I want some definitive answers. So, what are the security implications, good or bad, of using a hash system like this:

hash(hash(hash(password) + salt) + pepper)

In other words, hashing the password, then hashing the hash of the password with the salt, then hashing this hash with the pepper.


texts: Using crypto to build a clone resistant system

texts:
My question is related to using cryptography to build clone resistant system.

I am building an embedded system with ARM based commodity hardware board. Thus the intellectual property which makes the product differentiated lies all in software. What kind of cryptographic measures can be used so that the software on my system even if copied out of a genuine product can't be used to run on another board of same type and build a cloned fake?

Basically, some sort of hardware platform authentication is required in software. It should be practically unfeasible to bypass this authentication step by tampering software binaries. What options do I have?


texts: data migration: bcrypt to bcrypt different salts

texts:
I'm migrating passwords from one system (bcrypt) to another (also bcrypt) differing only in their salting. I noticed that encrypting the same plaintext password on one system generates a different string than encrypting the same plaintext password on the other. However, hashing and copying the resulting encrypted pw from system A into system B still results in successful authentication on system B.

It would appear I can simply migrate the hashed passwords from one system to the other, but I wonder if this is a potential security concern because the salting is different.


texts: Can I make a PRNG that is secure even when state can be modified by user?

texts:
I am interested in making a PRNG which, after being initially seeded, can accept and incorporate client data as the only ongoing source of "entropy".  It is not directly for a cryptographic purpose, but I wish to get a sense of how much the resulting system might compromise the integrity of the generator.

A simplified design based on SHA1, might be:

Internal state is 160 bits, initially set from a source of good entropy (assume this source cannot be attacked), and hidden from all client systems.
Generator is a SHA1 of the internal state - let's call it
Foo.rand():

a. The return value sent to client is 80 bits, A xor B, where A is
first 80 bits and B second 80 bits of the original digest.

b. The internal state changed by xor-ing it with the original 160-bit
digest.
The client system can at any time send a 160-bit string and it will be xor-ed with the current internal state. Let's call this Foo.alter_state( data ). In reality there might be some transformations, and access to the whole state at once is not likely either. But I think this captures the essence of what I am doing in a worst-case scenario.

figlesquidge helpfully commented more formal notation for the above:
\begin{align}    \mathbf{Init}_s(k):& s\leftarrow k            &\text{where secret key $k$ has full ($2n$-bit) entropy} \\ \mathbf{Update}_s(v):& s \leftarrow s\oplus v            &\text{Add to digest state} \\ \mathbf{Read}_s:& h \leftarrow H(s)            &\text{for some secure hash function $H$} \\ & \mathrm{Update}_s(h) \\ & d \leftarrow \mathrm{MSB}_n(h) \oplus \mathrm{LSB}_n(h) \\ & \mathrm{Return} \ d \end{align}

The end user might turn "attacker" (in essence they have agreed to use the PRNG as a source of randomness, but have a vested interest in controlling the values output by Foo.rand()). Such an attacker has full knowledge of the above, and can call Foo.rand() and Foo.alter_state( data ) completely freely, but cannot peek at the internal state directly. Is there any way that they could discover the internal state via these methods more efficiently than brute-forcing the initial or current value?

If there is an attack better than brute-forcing the state, is it predictably constrained (e.g. it is equivalent to brute-forcing something with half or quarter the number of state bits,so I could increase the size of initial state and maintain an attitude of "not as secure as a cryptographic PRNG with the same size of internal state, but still not hackable for practical purposes")?

I tried to think through some attacks on this system, but am not anywhere near experienced enough to judge whether I have missed something obvious.

I think one key aspect of the system is folding the digest in step 2a - it ensures that an attacker cannot use Foo.alter_state( data ) to repeatedly set the state back to an unknown but identical original, and probe the effects of changing each bit. But is it enough? Does this still leak too much state?

The choice of SHA1 is for simplicity, and any cryptographic hash would do (in theory). I could also consider an HMAC variant if that helped in any way. E.g. instead of simply folding the digest in step 2a, the return value was the HMAC of the original digest, and the secret for the HMAC would be set using a good entropy source, kept hidden and not altered. I feel this would probably mean even if the initial system was easily compromised, the worst-case scenario
would resolve to brute-forcing the secret. However, I'd like to know that I was doing this for a reason, and not just cryptalchemy.


texts: Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that strength depend on anything (for example, the curve used and so forth)?


texts:
Can file-versioning, which is available for instance in Dropdox, weaken the security of encrypted files if someone is able to see two or more snapshots of the ciphertext at different times?

To be specific, the files are encrypted by PGP on the file level (each file, making extension: important.doc.pgp ) with asymmetric keys.


texts: Dimension of Encryption of a linearly dependent set of plaintexts

texts:
Suppose I have an encryption scheme of the form $ E(P)=C $ where $P$ is the plaintext and belongs in $\{0,1\}^N$, $C$ the ciphertext which belongs to $\{0,1\}^M$ and the encryption is performed under the key $K$ in $\{0,1\}^R$.

If I pick a subspace of messages $M_0$ and I perform encryption on this set, can I conclude anything about the dimension of $E(M_0)$ as a subspace of $\{0,1\}^M$.


texts: Formal Proof of Shamir's Secret Sharing Scheme Security

texts:
Shamir's Secret Sharing scheme is perfectly secure.

Could you please suggest where I can read a formal proof of Shamir's Secret Sharing scheme being perfectly secure?


texts: I am trying to understand the bootstrapping step in FV12 cipher to obtain the FHE. I know the basic idea of bootstrapping is to homomorphic calculate decryption on ciphertext to obtain new equivalent ciphertext with lower noise, but I am kind of confused in this case, because in the article the homomorphic adding and multiplying are defined on the polynomial ring, but in bootstrapping step the authors are talking about operations on bits and there is no explanation about how we perform homomorphic operations on bits. Could you provide me some directions?


texts: Prove I know a value $v$ in a Pedersen Commitment without revealing it

texts:
Given a Pedersen Commitment:

$P = aG + vH$

Where $G$ and $H$ are points in some group. $a$ is a blinding value/mask and $v$ is the value I wish to commit to.

Is there a way to prove I know $v$ without revealing it?


texts: Partial Homomorphic Schemes that are probabilistic

texts:
As mentioned in wikipedia there are many Partial Homomorphic Encryption(PHE) scheme like RSA, Elgamal, Pailler etc.

Pailler encryption scheme seems to be probabilistic

Are there any other PHE schemes that are probabilistic in nature ?


texts: How to generate a collinear point without revealing one of the existed two points?

texts:
Assume we have point $A(x_A,y_A)$ and point $B(x_B,y_B)$, and now we want to generate a point $C(x_C,y_C)$ so that $A,B,C$ are on the same straight line. All mod $p$.
If $A$ or $B$ could not be revealed, how to do that? Could homomorphic encryption help? I learned about BGN, but I think it is useless because there're two multiply there, that is:
$y_C=\frac{(y_A-y_B)(x_C-x_B)}{x_A-x_B}$


texts: CONIKS Prefix Merkle Tree - is it necessary to change tree-wide constant for each update

texts:
folks!

I'm digging through CONIKS papers and it seems that it is an absolute must to select new tree-wide constant for each update (and to rebuild the whole tree respectively) to prevent parallel attacks through past versions of the same tree structure (like parallel birthday attack for instance).

Can't understand why does it matter and what is the attack scenario?

How practical is this attack?

For instance, Google Trillian developers don't select new Tree Id for each update (for Map using CONIKS hasher).

Papers Im looking at:

1) https://eprint.iacr.org/2014/1004.pdf

2) https://eprint.iacr.org/2016/683.pdf

Many thanks!


texts: What are the differences between ephemeral-static ECDH and static-static ECDH?

texts:
As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH.

What are the differences between these two types?


texts: What is the maximum size of the plaintext message for RSA OAEP?

texts:
OAEP is an important technique used to strengthen RSA. However, using OAEP
(or any technique that adds randomness) reduces the size of plaintexts that can be encrypted.

Assume for instance that OAEP is using a 160-bit seed and a hash function that produces a 256-bit value. In that case, how large a plaintext can be handled when RSA is used with 2048-bit key?


texts: Public key Issue - same key pair as existing one?

texts:
My question is a bit naive, but what if someone generates the same RSA key pair as someone else? This person would have the same private key and so would be able to decrypt messages not intended to him.

I bet that the answer will be: “It is very unlikely”, but I would like a more persuasive answer to realize that it can't happen in practice.

A related question: when someone generates a key pair, how can he/she be sure that nobody has already generated this key pair? Would the answer again be, that it is “very unlikely”?


texts:
I just went through https://tools.ietf.org/html/rfc7539#section-2.6 (sections 2.5 and 2.6). There it is described how to generate one-time Poly1305 keys using the ChaCha20 block function (for this a 96-bit nonce is required).

I am asking myself how this is "better" or "more secure" in comparison to just use the key that is used for the ChaCha20 block function.


texts: Hi folks– new to cryptography. My understanding of the double ratchet algorithm (or even just any ratchet algorithm) is that it uses all of the previous state (in Signal's case, all the previous messages in that thread) to compute the next ephemeral key. Does this mean that message history must be saved in order for


texts: Simple but secure method to share secret (128 bit AES key) though an untrusted relay

texts:
I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will probably happen when someone joins or leaves the chat, and all members of that chat have the public keys (RSA-2048 bit) of all the other members, online or not. The relay should not know, be able to derive this shared key, or be able to manipulate the key exchange process in any way that would allow it to do either of the above. All communication must happen through the relay.

Currently, the relay selects one of the online members of the group (admin if possible) to generate the key, hash it, sign the hash, and encrypt the key with all the other members public keys, which the relay then passes on to them, and if they all accept the new key (e.g hash and signature is correct), the relay issues the key switch command, but this requires five stages, so I was wondering if there was a more efficient way, or if my current way has any security flaws.


texts: Why do we require a CSPRNG's output to be indistinguishable from true random?

texts:
Everywhere I read, indistinguishability of output from true random is stated as a requirement for CSPRNGs. However nobody bothered to give the rationale for such a strong requirement.

Specifically, Yarrow and Fortuna both use a block cipher as the generator, and both limit the amount of output that can be produced by a particular key. The key is changed (aka rekey) once the limit is reached. Their reason is that since the block cipher does not generate duplicate output blocks in their design, the attacker can request for a large amount of output from the PRNG, find that there are no duplicate blocks, and determine that the output is not true random. So what?

The only information the attacker can get from this is the cipher's block size, and this doesn't weaken the security one bit. Furthermore this would have been public knowledge if the implementation was open source. I don't see how the lack of duplicate blocks would weaken our security.


texts: What are the benefits of being able to choose (most of) the public key in a PKC?

texts:
We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue).

However, we have a particular property. Most part of the public key can be chosen by the user. More precisely (in a high level explanation), the public key is $n+n^2$ bytes long where $n^2$ of them are chosen at random and the other $n$ bytes are certain function of these values and the secret key.

I was thinking that maybe we could choose these values not at random, but with certain structure: as we wish. For instance, it could be user's mail address or some function of it (expansion function, since $n^2$ is not small). I think this is close to ID-based encryption, but I don't understand this concept so deeply to state a relation. Moreover, not all the public key can be chosen so I'm not sure whether or not this is useful at all, or meet any requirements.

  Is this property useful in any sense? can we get something good from this?

Having so long public keys is a storage problem, that we would like to balance with a good property from this "free choice" fact.


texts:
I refer to an article https://eprint.iacr.org/2011/501. I focus on (a bit modified) Algorithm 1 which runs as follows (in my understanding):
For given $n, m\in \mathbb N$, $q=2^k$ and a distribution $\mathcal D$, algorithm chooses a uniformly random matrix $\overline {\mathbf A}\in \mathbb Z_q^{n\times m-nk}$ and a matrix $\mathbf R \in \mathbb Z_q^{m-nk \times nk }$ from the $\mathcal D$ and outputs a matrix $\mathbf A=[\overline {\mathbf A}\| \mathbf G - \overline {\mathbf A}\mathbf R] \in \mathbb Z_q^{n\times m}$ and a trapdoor $\mathbf R \in \mathbb Z^{m-nk\times nk}$.

If $\mathbf G$ is public and $\overline {\mathbf A}$ can be derived from $\mathbf A$ since $\mathbf A = [\overline {\mathbf A} \| \mathbf A_1]$, why one can not obtain $\mathbf R$? It is important due to $\mathbf R$ contains all information about short basis of $\mathbf A$, which usually treated as a private key, while $\mathbf A$ is a public key.


texts: Why is 224 bit ecdsa faster than 192 bit ecdsa?

texts:
I ran several benchmarks using openssl on 2 different computers and I got a surprising result.

for the Nist 192 bit curve the benchmark result is

>openssl speed ecdsap192
                              sign    verify    sign/s verify/s
 192 bit ecdsa (nistp192)   0.0001s   0.0003s  11980.6   3481.6

for the Nist 224 bit curve the benchmark result is

>openssl speed ecdsap224
                              sign    verify    sign/s verify/s
 224 bit ecdsa (nistp224)   0.0001s   0.0001s  13740.5   6948.8

So verifying a nistp224 ecdsa signature is twice faster than with nistp192.

I really expected nistp224 to be slower as it handles bigger numbers.
Why isn't it so?


texts: Why does .NET's ECB mode implementation append a constant block to my ciphertext?

texts:
Consider the following code and output:

    public static void Main() {
        DESCryptoServiceProvider symAlg = new DESCryptoServiceProvider();
        symAlg.BlockSize = 64;
        symAlg.GenerateKey();
        symAlg.Mode = CipherMode.ECB;

        testCipher(symAlg, new byte[] {
            0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
            0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08
        });
        testCipher(symAlg, new byte[] {
            0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8,
            0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8,
            0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0x8E,
            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
        });

        Console.ReadKey();
    }

    public static void testCipher(SymmetricAlgorithm symAlg, byte[] plainText) {
        ICryptoTransform xfrm;

        xfrm = symAlg.CreateEncryptor();
        byte[] encrypted = xfrm.TransformFinalBlock(plainText, 0, plainText.Length);
        xfrm = symAlg.CreateDecryptor();
        byte[] decrypted = xfrm.TransformFinalBlock(encrypted, 0, encrypted.Length);

        Console.WriteLine(new string('=', 23));
        writeBlocks(plainText);
        writeBlocks(encrypted);
        writeBlocks(decrypted);
    }

    private static void writeBlocks(byte[] blocks){
        for (int i = 0; i < blocks.Length; i += 8) Console.WriteLine(BitConverter.ToString(blocks, i, 8));
        Console.WriteLine();
    }

Output:

=======================
01-02-03-04-05-06-07-08
01-02-03-04-05-06-07-08

1E-0C-3E-59-93-5C-23-6E
1E-0C-3E-59-93-5C-23-6E
6F-AC-50-69-34-D0-B1-61 // NOTE THIS

01-02-03-04-05-06-07-08
01-02-03-04-05-06-07-08

=======================
C1-C2-C3-C4-C5-C6-C7-C8
D1-D2-D3-D4-D5-D6-D7-D8
E1-E2-E3-E4-E5-E6-E7-8E
00-00-00-00-00-00-00-00

F9-9A-77-30-3B-31-7F-D2
D8-B5-B2-C6-E7-E7-0F-90
0E-90-DF-AF-56-C0-DE-84
65-5D-E0-7D-5A-7A-0F-D9
6F-AC-50-69-34-D0-B1-61 // AND THIS

C1-C2-C3-C4-C5-C6-C7-C8
D1-D2-D3-D4-D5-D6-D7-D8
E1-E2-E3-E4-E5-E6-E7-8E
00-00-00-00-00-00-00-00

I understand the weakness of ECB. What I don't understand, is why on earth would .NET force me to append a final block that is the length of the key and only varies with the key. No matter how weak the encryption was to start with, isn't this worse?

I have a specific reason for using ECB: Encrypt array of int for individual retrieval

However, decrypting just one block (without the constant final block) yields: System.Security.Cryptography.CryptographicException was unhandled  Message=Bad Data.

Now, knowing that it is constant by the key, I can perform a bogus encryption at application initialization and cache the final block, feeding it back in to my decryption operation rather than putting it in the data stream, but why in would .NET encourage me to store this with the data, and is it only .NET that does this?


texts:
Who uses RSA's BSAFE library?  Does anyone know what products use it, or have any statistics on how many end users use something that is built on BSAFE?

Background: BSAFE is one of the oldest cryptography libraries, and among commercially available cryptographic libraries, it is well-respected.  However, recent news suggests that BSAFE uses Dual_EC_DRBG as its default pseudorandom number generator.  Dual_EC_DRBG, of course, is the algorithm that is suspected to contain a NSA backdoor.  Previously, cryptographers had suggested that probably no one uses Dual_EC_DRBG, so the suspected backdoor probably doesn't have much practical impact; however, this news about the BSAFE library suggests we might want to re-examine that conclusion.  In particular, it is possible that any backdoor in Dual_EC_DRBG backdoor might affect any products which use the RSA BSAFE library, so to assess the impact of this suspected backdoor, it would be helpful to better understand which products use BSAFE, and how many products and how many people rely upon BSAFE for their cryptography.

My question: Who uses RSA BSAFE?  Which products are built on top of RSA BSAFE?  How do I tell who might be affected by this issue?  There's a big difference between an issue that affects a few internal enterprise tools, vs something that affects products used by millions of end users every day -- I'm trying to get a better sense for the degree of the impact of this issue, and to be in a better position to explain to others whether BSAFE's use of Dual_EC_DRBG is a big deal or not.


texts:
I am a bit confused about the use of IV, and key hash.

Is the key hash and IV stored inside the headers of the cipher text?

Isn't it a security risk to store this header information?

By key hash I mean the hash of key is stored inside the headers.  It seems that when I use gpg or OpenSSL , the header of cipher text has encoded method and Iv and hash of key (if I am using a pass phrase )


texts: How can i check if a public key match with a private key

texts:
Is there a way to check, (with openssl command for example), if a given public key match with a private key ?

Thanks


texts: How can A pass a message to B, while preventing a third party from sniffing infos?

texts:
$A$ has a message that he wants to send to $B$, without a third party being able to learn the contents of the original message.

$A$ encrypts the message and sends it to a server. The server decrypts the message somehow, and sends it to $B$. This way, no one would know what was the original sender, because the server will send it to the destination.

But if the server encrypts the message again, how will $B$ be able to decrypt the message? If $B$ knows how to decrypt the message, then any third side would also know.

What is the solution?


texts: How to calculate the branch number of a linear mapping?

texts: Is there an efficient algorithm which can be used to determine the branch number of any given linear mapping?


texts: Usability of padding scheme in blinded RSA signature?

texts:
In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following

  This attack works because in this blind signature scheme the signer
  signs the message directly. By contrast, in an unblinded signature
  scheme the signer would typically use a padding scheme (e.g. by
  instead signing the result of a cryptographic hash function applied to
  the message, instead of signing the message itself), however since the
  signer does not know the actual message, any padding scheme would
  produce an incorrect value when unblinded.

Could someone please explain the meaning of the part I emphasized?


texts: Are timing attacks exploitable if each key is used only once?

texts: Suppose that one performs (for example) AES-GCM encryption and decryption using an algorithm that is vulnerable to timing attacks, but each key is used only once. Is it still possible to perform a successful timing attack?


texts:
We consider a $(2, 6)$ Shamir secret sharing scheme over $Z_{11}$. Four players $A,B,C,D$ cooperate to find the secret, but one of them is cheating (so the share he claims to have might not be an actual share). They claim that their shares are;

$$A:(1,2)\quad B:(2,5)\quad C:(3,10)\quad D:(4,3)$$
Who is cheating and what is the secret?

I am using 4 equations:

\begin{aligned}
2 &= s + a & (1)\\
5 &= s + 2a &(2)\\
10 &= s + 3a &(3)\\
3 &= s + 4a &(4)
\end{aligned}

And solving for $s$ and $a$.

I don't seem to know the exact approach? How do I go about solving this problem?


texts: How can I extract randomness from a JPEG file?

texts:
In a previous question I asked if (and why) BlueRand can or cannot be considered as a TRNG.

Established that it's not a TRNG (due to the reasons explained by some users in the previous question), is it possible to create a TRNG that uses JPEG images as entropy source? How can I extract randomness from a JPEG image?


texts: Find some hash function with deliberate collisions

texts:
I guess this should be well known (or trivially desperate), but I couldn't find any reference.

I have a small number (say $k=15$) of messages $m_i$ ,$i=1\cdots k$ (they are fixed length and short, but I think this should be irrelevant).

I'd like to find some hash function such that $h(m_i)=h(m_j)$ (deliberate universal collision, they all give the same hash), but such that the chance of a random collision is reasonably small. I'm not concerned about cryptographic attacks.

The brute force approach (append some random bytes to all messages, hash, retain some bits and hope that the  universal collision happens) doesn't look practical. Too many tries, too high probability of random collisions.

Is there some other way?


texts: Why should CAST5 and 3DES not be used for encrypting files over 4GB?

texts:
On https://www.gnupg.org/faq/gnupg-faq.html#define_cast, it says that

  Like 3DES, its 64-bit block size means it should not be used to encrypt files larger than 4Gb in size…

How and why does the block size affect the security of the cipher?


texts: Are there any applications of Quantum Computation to Cryptography? (besides Cryptanalysis)

texts:
I know that people may be yelling "of course!" at the title of the question, but my concern is not about how to construct quantum-resistant primitives, but rather how to use the power of quantum computers to develop secure and efficient cryptographic primitives and protocols.

For example, in post-quantum Cryptography people are concerned about the power of quantum computing as an adversarial situation, and the main use of such power is to solve problems like factoring or discrete logarithm (whereas the quantum-resilient primitives involve classical algorithms).

Are there primitives that use this power as an advantage (for instance, to improve efficiency)?

If quantum computers are going to become a reality then I agree we should prepare and deploy quantum-resistant schemes, but besides using the quantum power to perform cryptanalysis on certain classical cryptosystems, we could also use it to develop primitives involving quantum algorithms in their implementation (these may not be deployable before we live in a post-quantum world, but they could be used once scalable quantum computers exist).

Have this been studied? are there any proposals? In other words,does having quantum computers improve the Crypto world somehow?


texts: Does the signatures generated by a revoked member before revocation remains valid in VLR group signatures

texts:
Group signatures allow any member of the group sign the message on behalf of the group anonymously using his own secret-key. Only group manager can reveal the identity of the signer.
Verifier Local Revocation (VLR) is an efficient approach of membership revocation.

In VLR group signatures, revocation-token is generated for each user and is placed in Revocation List (RL) whenever the user is revoked. VLR group signature schemes consist of three algorithms: KeyGen, Sign and Verify

KeyGen algorithm outputs public-key, secret-key for each user and revocation-token for each user

Sign algorithm generates the signature on a message using the secret-key of a group member.

Verify algorithm returns 1 if it is a valid signature that is signer is valid group member and he is not revoked. Otherwise, returns 0.

If a group member "i" is revoked then its revocation token in placed RL. Therefore, he cannot generate a valid signature.
But, the verify algorithm returns invalid for all the signatures generated by user "i" before revocation if we verify the signatures using the RL where revocation-token of user "i" is placed. Is my understanding correct?


texts: If you have two inputs of the same length, are there theoretically collissions in both MD5 and SHA-256?

texts:
Can there be two messages M, M' both of the same length such that both MD5(M)=MD5(M') and SHA-256(M)=SHA-256(M')?
Let's compare two files: if they have the same length, they are candidates for having the same content; if they share the MD5 sum they are stronger candidates for having the same content (I understand there are MD5 collisions on same-size inputs so this could lead to a false positive), but then if they also share a SHA-256 sum, can I be certain the files have the same content?


texts: It is possible to prove this in zero knowledge?

texts:
Let $\mathcal{R}_q = \mathbb{Z}_q/\langle x^n + 1 \rangle$, with $n$ a power of $2$. Suppose that we sample $\mathbf{r} \leftarrow \mathcal{R}_q^m$ uniformly at random with the property that $0 < ||\mathbf{r}|| \leq \beta$. Given $(\mathbf{A} \leftarrow \mathcal{R}_q^{n \times m}, \mathbf{s} = \mathbf{Ar})$, find $\mathbf{r}'$ such that $\mathbf{Ar'} = \mathbf{s}$ and $0 < ||\mathbf{r}'|| \leq \beta$. This is problem known as Search Module-LWE problem.
What I want to do is proving in zero knowledge that I have such an $\mathbf{r}'$ without revealing any information about it (assuming that the verifier has access to both $\mathbf{A}$ and $\mathbf{s}$). Is it possible to do that?


texts: how to solve discrete logarithm problem information requested

texts:
I have seen your example about ecdlp solver :The Problem is as follows:

$$E\backslash GF(p):y^2=x^3+17230x+22699$$

where $p=23981$, point $G$ with prime order $|G| = 109$

Alice creates a public key by selecting a private key $d<q$, public key $Q=[d]G = (3141,12767)$

Therefore;

public information : $a,b,p,G,q,Q$
private key : $d$

However, this curve has the following characteristic:

$\Delta= −16( 4a^3+27b^2) \bmod p =0$
That is, the discriminant is 0. and embedding degree is 2

I, however, don't understand where comes out the value  (23796,0) i.e how can I calculate it? and then the following formula equation: after which we obtain the corresponding curve
$$y^2=x^3+23426x^2$$

is it possible for a further explanation of how you determine the point $(27396,0)$?


texts: Format of NONCE in Initialization Vector (IV)

texts: When we talk about a Number used ONCE (NONCE) in Initialization Vector (IV), is it required to use numbers only? Is is possible to use letters or special characters?


texts: What is the rationale design of TinyJambu-LWC?

texts:
My understanding of duplex construction is usually initialized with the key at the beginning of the mode, but  I have noticed that TinyJambu (in addition to key intilization) is using key in each processing call (keyed permutation)  as shown in figure.

my questions :
Is there a particular advantage of keyed permutation in duplex construction than an unkeyed permutation ?


texts: About Elliptic Curve ElGamal, 3 simple problems I have trouble with

texts:
In Elliptic Curve ElGamal, why are a=b=1 always legal for

primes whose lengths are no shorter than 11(2) bits long?

Is there any reason why the Point at Infinity can always be encoded as (0,0)?

Lastly, why unlike basic ElGamal, is (O,O) a legal message, where O is point at infinity?

I'm stuck with proving them. If you have any idea, please let me know it.


texts:
I am curious of the details of how one would go about generating elliptic curve parameters. (I know standardized parameters exist, but I'm trying to understand both how they were generated and the general case.)

Let's also assume we want to work in a prime-order subgroup of size $O(2^n)$.
For simplicity, let's work over a prime-order field $F_p$.

As I understand it, the basic idea is
(1) generate a random elliptic curve $E$ over $F_p$;
(2) use a point-counting algorithm to count the number of points $N = |E(F_p)|$; finally,
(3) check that $N$ is divisible by an $n$-bit prime

I am confused about the 3rd step: how is it implemented efficiently without using a general-purpose factoring algorithm? Also, how many iterations are required (in expectation) before finding a curve $E$ whose order $N$ is divisible by an $n$-bit prime? Finally, given $n$, how should we best choose $p$? (This is related to the question of what co-factor one should be looking for.)


texts:
I had done an example on AES-128 bit.But while doing AES-192 bit,i am facing below problem.
what is the order of the matrix after mixed column step in 192 bit AES?


texts: FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)

texts:
We have a native C++ application that supports Windows XP SP3.

Recently we've decided to change our crypto algorithms to FIPS 140-2 compliant ones. We are planning to use the following algorithms in Enhanced RSA and AES Cryptographic Provider:

AES256 for encryption
SHA1 for hashing
RSA for key exchange with max key size

Is this setup going to work on WinXP SP3? Is it going to be FIPS 140-2 compliant? In my understanding, the answer to both questions in 'yes', but I want to be sure.


texts: Diffie-Hellman + Asymetric encryption kept simple, or alternatives to TLS

texts:
I am working on a system that includes our dear friends Alice, Bob, and a server that is only partially trusted. I have spent the majority of the day reading up on various cryptography methods, but I have concluded that I need some help to decide on the ones that best fit my use case.

For starters, I do not need authentication in the traditional sense. Alice needs to be able to communicate with the server securely, and for this Diffie-Hellman combined with public/private keys should suffice. In this case, the server is of course trusted.

Secondly, Alice needs to be able to communicate with Bob, via the server, and in this case, the server is not trusted. Therefore, another set of DH+keys is generated for that particular line of communications.

Now, the reason why I do not need authentication, is because this is all up to the server. The public key offered by A and B to the server will act as their temporary identity. This identity may or may not be reused later, so it is preferrable to use stored keys. If they are unable to read packets encrypted with this public key, then their ID is not deemed valid by the server, and a new one is istablished. In this case, the server is trusted.

I was considering using TLS, but I am unsure as to how I would programatically get access to the public key used in the OpenSSL session, and rolling my own TLS implementation seems like reinventing the wheel.

So what it then boils down to is this question: Which methods of cryptography should I go for that allows easy implementation of the communication scenarios above?


texts: The parameters included in TLS 1.2 server signature in the ServerKeyExchange

texts:
In TLS 1.2, section 7.4.3 in the standard documentation on Server Key Exchange Message, it says that the parameters covered by the digital signature are as follows:

  dh_p
           The prime modulus used for the Diffie-Hellman operation.

  dh_g
       The generator used for the Diffie-Hellman operation.

  dh_Ys
       The server's Diffie-Hellman public value (g^X mod p).

These parameters are hashed first. My question is: when the hash of these parameters is computed, is it computed over a concatenation of these parameters? or are they combined in any other way?


texts: Are there any many to one encryption frameworks available?

texts:
I am reasonably new to the cryptography. For my use-case I need a method where in I would need a receiver to accept encrypted messages from a range of senders (each having their own, say, public key). My use-case also needs that some of these users only have temporary access which can be revoked externally i.e. without explicitly telling the receiver but ensuring that receiver can no longer honour the encrypted messages from those senders.

Its very similar to the way public wifi hotspots work. Assuming the receiver is the Wifi Router, and each sender has their own passphrase which is short lived for the duration of the subscription.

However in this use-case there is no single receiver, but a network of receivers. All of them talk to each other using a common encryption key. What I am looking for is to have

an encryption key to be a function of multiple sender's public keys.
all of the receivers and the senders can decrypt the messages which were encrypted with that encryption key.
Adding a new sender should be fairly less complex (I guess we need the encryption key to be updated in this case, but if any of the receivers missed the update how can they get attached again?)
Removing a sender should be fairly less complex (Again I guess we need the encryption key to be updated which again comes with the case of how to deal with receivers missing such an update)

Could you please help point such an encryption technique already in place and possibly proven to be secure? Many thanks and please ask if you need further information to answer my query.


texts: How to adapt the equation of Gaussian mechanism noise based on number of executions

texts:
I'm trying to build a differentially private machine learning model. I'm using the Gaussian mechanism to calculate the required noise amount based on pre-defined privacy budget value
The equation to find the noise amount is below
$\sigma = \sqrt{2ln(1.25/)} / \varepsilon $
I'm aware that when the model performs several epochs, say 15, I will need to use either the naive composition or the advanced composition theorem to calculate the new $\varepsilon'$
$$\varepsilon' = \sqrt{2k\log(1/\delta)}\varepsilon + k \varepsilon (e^\varepsilon-1)$$
1. I'm interested to know how to adapt the first equation and use it to compute the total amount of noise to be dded based on the number of executions (epochs)


texts: Find private key from knowing random exponents are an arithmetic series

texts:
Let $p$ be a large prime and $g$ a primitive root modulo $p$, and $h$ a collision-resistant hash function.

Person A chooses a random integer $1 < u< p$ and $y \equiv g^u \pmod p$ is publicly known.

The ElGamal signature scheme using exponent $k$ for a message $m$ is an ordered pair $(r,s)$ satisfying:

$r \equiv g^k \pmod p$

$h(m) \equiv ur + ks \pmod {p-1}$

Suppose now that person A chooses the exponents for the signature scheme to increase by two for every message she sends. For example if she sends messages $m_1, m_2, m_3$ then she uses exponents $k, k+2, k+4$ respectively.

Suppose that she sends a finite number of messages and such has a finite number of exponents, and that she makes her initial choice of $k$ so that all the following keys are coprime to $p-1$.

If we know that she does this, how might we be able to deduce $u$ if we intercept two consecutive signed messages?

If the messages are $m_1, m_2$ then we have signatures $(r_1,s_2),(r_2,s_2)$ such that:

$h(m_1) \equiv ur_1 + ks_1 \pmod{p-1}$

$h(m_2) \equiv ur_2 + (k+2)s_2 \pmod {p-1}$

$\Rightarrow s_1h(m_2) - s_2h(m_1) \equiv u(s_1r_2 - s_2r_1) + 2s_2s_1 \pmod {p-1}$

This is where I get stuck because I'm not sure what I can do here that is really that helpful. We don't know if $s_1r_2 - s_2r_1$ is coprime to $p-1$ so we can't immediately get $u$, but is it true that it would be coprime? If so how could you prove it? What concerns me the most is that this doesn't really seem to use the fact that the exponents used differ by $2$.

Any help would be greatly appreciated, thank you!


texts: 1-digit MAC with error-catching properties?

texts:
The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (different) consecutive digits in the outcome will be caught with certainty.

Can we make a 1-digit Message Authentication Code (depending on a secret key) with the same (or slightly relaxed) error-catching properties, and providing some quantifiable degree of authentication? Say, some upper bound of the probability of forgery for an adversary able to obtain a MAC for $m$ random $d$-digit numbers other than the number targeted (assume it is chosen by the adversary).

Note 1 per comment: The error-catching properties are bound to be a trade-off against a probability of forgery sizably better than 10%. That would be especially true if the adversary was allowed to get MACs for chosen rather than random messages.

Note 2: I now limit the question to the adversary obtaining the MAC for random messages (and only a fraction of these), for the reason in this comment.


texts: Public SRP verifiers or public hash chain "public keys" when secret is low entropy password

texts:
I want to set up the following:

An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's name.
This is accomplished by making all sessions publicly verifiable by making public the information necessary to prove that the client was able to demonstrate their knowledge of a secret.
The secret the client holds is of password-level entropy.

Now, a few things come to mind here. For starters, either SRP or hash chain authentication could be used for this purpose, and would actually work pretty well if the secret was of key-level entropy.

Secondly, a password can be pushed towards key-level entropy by using key derivation.

So my question is this: Is it reckless to use a key derivation algorithm to create a secure password to use with an auth scheme like SRP or hash-chaining in which the untrusted server and the general public will know the resulting verifier or "public" key? Or are KDFs only suited for providing some hope that not all passwords are goners for when a trusted server is broken into by an attacker?

I know PBKDF2 is essentially "useless" against anyone with a GPU rig and I have read that bcrypt is "useless" to anyone with an FPGA setup. Scrypt, the final alternative people discuss is "young" and at the end of it, it seems intuitively like it's very hard to pretend low-entropy can ever truly become high-entropy, except by simply making it a bit harder for attackers of today.

So, is there any solution to this set up or is this ultimately a case where a user must have some key-like password? If so, would this be a good use case for assigned passwords that are actually keys translated through word lists? For example, if you enforce a Diceware password scheme of 10 words, you end up with what the author claims is 12.9 * 10 bits of entropy, or 129 bits of entropy which seems pretty good for being forced into remembering 10 words.

Let's also assume the users are somewhat onboard because they are motivated by the product itself but they also shouldn't have to put up with too much. They aren't lay-users being forced into a system more complicated then they are used to but they also shouldn't have a terrible experience with logins.


texts: How to mutually share values without influencing senders

texts:
Goal

I want Alice and Bob to communicate a message without their answers influencing each other. More formally:

Alice wants to send Bob a message, a.
Bob wants to send Alice a message, b.
But Alice must not know b before sending a
And Bob must not know a before sending b.

Attempt

I was thinking I could have:

Alice sends an encrypted message, f(a, p1) = a', and a hash with the original message and the private key, h(a, p1).
Bob also sends an encrypted message, f(b, p2) = b' and hash, h(b, p2).
Alice and Bob exchange private keys once they have received their messages
They decrypt the received messages and verify the hash matches

Is there any problems with this method? Would it be feasible for Alice to construct a p' that causes the message to be decrypted as something other than a yet still satisfy the hashing function? (assuming cryptographically secure f and h)

Are there more commonly accepted ways to do this?

previously posted in security stack exchange but was told it'd be more appropriate here


texts: Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

texts:
where
$g$ is a group element in bilinear group $G$

$Y = M.e(g,g)^{ab}$

$M$ is a message

Does anyone know the answer or suggest some material for reference?


texts: Is chaos-based cryptography quantum-resistant?

texts: Recently, I have been learning chaos-based cryptography. Is the Chebyshev map-based encryption algorithm quantum-resistant?