texts: The challenge c in Sigma protocol (using Fiat Shamir)

texts:
As is known to all, the following picture depicts a sigma protocol, and to eliminate the interactivity, Prover can generate c by hashing (t, y) using Fiat Shamir transform. My question is:
1). Can c be obtained as hash(0x1234, 0x4321) by the Prover, (where 0x1234, 0x4321 are public parameters at setup)?
2). If above answer is yes, can a same c be used by different Provers at the same time in Fiat Shamir transform?


texts: Design question for a service that signs messages on behalf of a user

texts:
I'm working on a messaging service that lets users author messages and have them signed with an RSA key. The key is used for identity purposes only and can be revoked, so compromising the private key is annoying, but does not expose proprietary information.

Still, in order for a service to sign on behalf of a user, that user must either provide the key's passphrase (or even the key and passphrase) and have it go over the wire on each signing, or the key is stored by the service without the user's passphrase.

In either case the service itself must be trusted since at some point they will have access to the key in an unprotected form.

So the question is, what is the better design (other than "don't do it"): require the passphrase on each signing event, or rely on the service to store the key without the original passphrase and require them to ensure safe keeping (using their own passphrase, encrypt it otherwise, etc). Or is there a third way by which the service can sign on behalf of the user without exposing the private key at all?

Clarification: The idea is that the user maintains portability of their identity, i.e. they could use their key to sign and publish messages themselves or provide the key to a new authoring service they pick instead, i.e. the key follows the user, not the service.


texts: Are there any asymmetric key encryption/decryption algorithms?

texts:
When it comes to encrypting some data (where data being something of a large size),  symmetric key cryptosystem is predominant. Symmetric key algorithms like AES, DES, Blowfish, IDEA etc. are explained in greater lengths, on how they function and work and why is one better then the other.

But the same han't been done in the case of asymmetric cryptosystems. In general asymmetric cryptosystem is referenced, in a hybrid cryptosystem. Where the Symmetric key is used the encrypt the actual data, and then the Symmetric key is encrypted via the public key.

Even in the wikipedia page of RSA the emphasis is only given to the key exchange process of RSA, rather then how the actual data is encrypted/decrypted via it.

The most I know about Asymmetric key Cryptographic algorithms is that:-

They are far slower then symmetric cryptographic algorithms;
They produce cipher texts of sizes larger then the original one.

This is the only thing that is available when it comes to actual encryption / decryption by asymmetric algorithms. And even this hasn't been explained, why do they possess such behavior?

Even though they may not be a good choice, when compared with symmetric key algorithms, but still at least some information about their working should be provided.

EX:- In RSA, this is the description of the encryption process:-

    CT = (PT^E) % N

    # where CT = Cipher Text, PT = Plain Text, N = Product of Two Large Primes, E = Public Key

But it has not be explained what happens in the encryption process.

I would like to get some intel on some asymmetric cryptographic algorithms used for encryption / decryption, so that I can analyze their internal working.


texts: Ideal way to profile/performance-measure cipher implementations

texts:
I have implemented a bit-sliced version of two ciphers (Gibbon-120 and Hanuman-120, both part of the Primates family of ciphers: http://primates.ae/wp-content/uploads/primatesv1.02.pdf )

I now want to measure the increase in effectiveness that my bit-sliced ciphers have given me, compared to the reference implementations. Of course I also want to know my implementations performance/speed in a general context.

What I have tried so far, is to encrypt & decrypt 100byte, 100kbyte and 100mbyte 10 times, and then see what the average wall-clock time for encrypting and decrypting the different amount of data was.
I doubt whether this is the smart way to go about it though. While a bit-sliced implementation is constant in execution time, the reference implementations are another matter. They use lookup-tables and thus can gain in speed after the first encryption, due to cachehits from lookup-tables now being a possibility.
There is also the issue that if it is measured in wall-clock time, then background-processes on my computer could degrade or otherwise cause noise on the results.

On the other hand, I could count instructions in the compiled code (although I do not know how yet). This does not seem like the ideal way to go about it either though, as different instructions has different latency and throughput. If one cipher uses 10 additions and another uses 10 multiplication, then the former might be faster, despite them using the same amount of instructions.
This is the case for some of the AVX instructions I used in my bit-sliced implementation (a permute instruction if I remember correctly takes 3x the time a shuffle instruction takes).

What is the standard way to go about this? What is the defacto standard that cipher-performance is being measured in, when a new up to date cryptographic cipher-design or implementation is being published?

My implementations are written in C for whatever it is worth (and uses Intel Intrinsics for AVX).


texts: Does splitting random data reduce its security?

texts:
Let's say I've got some securely-generated random data I want to encode as words, 32 bits of it.  My wordlist is 2048 words, so each word encodes 11 bits of information.  I write a routine to pack these 32 bits into the lower 11 bits of 3 16-bit types and zero the upper 5 bits of each.  For the last one, I pack in the remaining 10 bits of random data and zero the top 6 instead.  I then look each of these up in my wordlist array to get my words.  I'd like to use these words.

Here's my question: does what I'm doing reduce the amount of secure randomness I'm encoding in these words?  I'd be looking the final word up in a list that's effectively half the size, because the 11th bit is always zero, so is there some "loss of randomness" here?  I know this is a little confusing, but I'd appreciate some guidance.  I suspect there might be some existing guidance on this, but I'm not sure what to search for to find it and none of my googling has yielded results.

Edit: To clarify, my intuitive guess is that this won't pose a problem, but I'm not comfortable going with that.  The closest I've come to rationalizing this is that $2^{11} \times 2^{11} \times 2^{10} = 2^{32}$.


texts:
What is the speed of AES and how to estimate it well? Here:
https://security.stackexchange.com/questions/92074/aes-algorithm-encryption-time
they wrote it could be 700 MB/s. But here:
https://www.cse.wustl.edu/~jain/cse567-06/ftp/encryption_perf/index.html
Abdel-Karima Al Tamima estimated it is about 50 MB/s. Why are there such differences? Is it because of some kind of hardware acceleration? I'm trying to compare it to PCG generators:
https://www.pcg-random.org/paper.html
Just to compare what is faster in generating pseudorandom numbers (I know that PCG is not cryptographically secure and it is not a cipher). For example 128-bit PCG XSL RR RR can proceed about 65 GB/s (it was probably implemented in numpy of Python). Is it comparable to 50 MB/s or 700 MB/s?


texts: Degree of M and Max Sequence Length for LFSR

texts:
For the LFSR  mod 2, determine the degree of m and maximum sequence length
s_(i+3)≡ s_i+s_(i-2)+s_(i-4) mod 2

determine the degree of m and the maximum sequence length.

I can get the degree of $m$ easily by taking $2^{(m -1)}$, but I am confused about getting the degree of $m$. I don't even know what this is referring to here. Any help?


texts: What is the intuition behind AES or SPN?

texts:
I'm new to cryptography and have just encountered AES and SPN. I would like to know how the S-box, permutation step and the MixColumn step help improve security. It seems to me (perhaps mistakenly) that the security is provided solely by the key and that the substitution, permutation and MixColumn steps are redundant.

I know I must be wrong, but can't put my finger on it.

Also, is there a small example of AES which can be implemented by hand?
I think seeing it would help with my understanding of the concept.


texts: Anyone aware of test vectors (preferably with intermediate values) for the XEdDSA algorithm?


texts: How are recovery keys possible if something is encrypted using a password?

texts:
I thought that encryption works as follows - it is about changing the thing we want to secure using an algorithm and using the password to mathematically change the secured content so it is unreadable.
If something is encrypted using a password then doesn’t it mean that the password is the only thing that can be used to mathematically change the encrypted thing so it becomes unecrypted?
I just have no idea how do recovery keys can even work!


texts: In the encryption of MixColumn you use the constants 01, 02 and 03. I don't understand why the inverse of 01 becomes both 0D and 09. I also don't understand how you get 01, 02 and 03 in the first place which is probably why the decryption doesn't make sense to me. I would appreciate any help with understanding how to calculate these values.


texts: Merkle–Damgård padded block concatenated outside the compression function hash?

texts:
I learned that the output of hash function from Merkle Damgard is

H(x) = ZB+1 = h(ZB || L) = h(ZB - 1 || XB || L) where XB = block of padded x and L = XB+1

and it is proven that H(x) is collision resistant.
However, what if I tweak the H(x) by extracting L from the compression function h(x) s.t

H(x) = h(ZB - 1 || XB) || L

I feel like this makes H(x) to be not collision resistant, but I don't know how to design an attack for this hash function. Can someone give me an idea (perhaps hint) to design such attack?

NOTE: Before anyone screams at me about anything, I want to say YES this is a practice question from a cryptography textbook. That is why I asked for a HINT not an answer. Thanks :)


texts: Verilog simulation of Data Encryption Standard

texts: I am interested in developing DES (in verilog) for my college project. Can I get help in understanding the simulation results of DES encryption and decryption?


texts: How is Diffie Helman secure when the exchanged number is a power of the generator less than the modulo

texts:
I'm trying to understand how Diffie Helman is still secure when $A$ ends up being a power of $g$ less than $p$.

I chose $p$, where p is prime, and $g$ is a primitive root modulo $p$.

$g=2$ and $p=29$

Now considering Alice creating her $A$ where  $A=2^a\mod{29}$. If she chooses $a=30$ this results in $2^{30}=4\mod{29}$, which means I can trivially recover an $a$ with the same result $a=log_2{4}=2$ and use that to recover the shared secret.

In general any returned $A$ that is a power of $2$ less than $29$ (ie. $2,4, 8,16$) can be trivially recovered by taking $log_2{A}$ and getting a valid $a$.

How does Diffie Helman resist against this? I'm I missing something else? I know I chose a small $a$ and $p$ but it seems this problem would exist with large $a$ and $p$ too.


texts: comparison of security for identity based signature and Hashing (SHA-1) the identities

texts: I would like to know which method can provide better security: using identity based signature or hashing the identities and message (using SHA-1) for authentication?


texts: Certificate Authority RSA key expiration?

texts:
My understanding about SSL/TLS for HTTPS is that servers send their certificates to browsers and browser attempt to decrypt them using trusted CA public keys that are already presented in their store. Also our certificates are limited to an expiration date (mostly because of security).

Do Certificate Authorities need to renew their RSA keys from time to time due to security considerations?


texts: I got introduced to the ADFGVX cipher, and it seems very tedious to decipher such ciphertexts. If I do not have access to the key square and the keyword, and I am just given the ciphertext and a string of numbers, how do you decipher it? The columnar transposition is another thing that makes it even more difficult to break. (I am assuming that ADFGVX comes with a columnar transposition). I am planning on making a code that can break it. A complete brute force seems possible, just too tiresome.


texts:
What I would like to achieve is the following:

Alice sends to Bob the encryption of a datagram that has the following format:

| 256-bit number | SomeLongArrayOfZeroes |

Bob knows the decryption key.

But before the datagram reaches Bob, there are some intermediaries which I would like to be able to add some additional 256-bit numbers. These third parties should not be able to read the first 256-bit number which was included by Alice. Let's also assume that these third parties know which portions of the ciphertext they have to modify in order to not modify data inserted by other parties.

I was researching homomorphic encryption but it looks like an overkill for this purpose. There's no need for two ciphertexts to interact with each other. I just need to be able to add additional data to already encrypted ciphertext which already contains some information without imposing damage to it. Assuming the other parties will follow some rules so as not to damage the prefix. A third party should not be able to decrypt information added by the other third party.

In the end, Bob should be able to decrypt the message using the key provided by Alice.

Any suggestions? I was thinking about some kind of a stream cipher. What are the possible solutions?


texts:
Is anyone able to cite resources that can be based on choosing a cipher suite?

In my case, for a VPN server (OpenVPN) I chose a set of ciphers:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

It provides 128 bits of security. I have a dilemma regarding the length of the RSA private key. The 2048-bit key provides 112 security bits. If it is necessary to provide 128 bits, I would have to create a key with a length of 3072 bits - but this will have a significant effect on performance. If anyone could be able to direct me how to choose the right solution so that I could reasonably justify the choice would be great.


texts: Is Using Digital Signatures to prove identity a zero knowledge proof?

texts:
Suppose Alice publishes a book with a public key in it, and later wants to prove that she wrote the book. She could sign challenge messages with her private key, and others could verify those signed messages. Alice is proving she knows a private key without revealing anything about it.

Is this an example of an interactive zero knowledge proof?

Or does this example somehow not apply to zero knowledge proofs?


texts: Why doesn't steganography increase the size of an uncompressed image?

texts: So I have this question. I downloaded a .BMP off google due to .BMPs being not compressed. Just a 1024x768 .BMP image which its size os of 2.25Mb. I put the image in a steganography application.. inserted hidden text within it, encrypted and everything. How come the resulting image (Steganographied Image) is still 2.25Mb in size? Isn't it supposed to get bigger?


texts: The magic box puzzle: How to implement a verifiable self-contained secret system?

texts:
Imagine we have a magic box that will open only if we pronounce the secret words. Everybody at the beginning of the game have some verifiable proof of the correct secret words.
During the first phase all contestants will say their guesses for the secret words.
On a second phase the magic box will open if any of the contestants said the secret words. And using the proof provided and the beginning of the game you will be able to verify the secret words are the same, and the box is not trying to trick you. If none of the contestants guessed the secret words the box will tell the secret words and the game will start again resetting the secret words and offering a new proof.

My own guess
Based on my limited cryptography knowledge my implementation will be as follows: The proof provided at the beginning of the game would be a hash of the encrypted secret. When the secret is revealed on the second phase, a key and method to encrypt the secret is also provided, so contestants will be able to encrypt themselves the secret and compared the hash to the proof provided at the beginning. I would use a simple symmetric encryption method and a md5 hash for the proof.

Please let me know of your thoughts and if you get a better approach of the problem.


texts:
I have a need to produce URLs to allow the downloading of a single file, without authentication.  These links will be sent through email, and I understand and accept the risk of a given link being shared by its recipient (or intercepted in transit).

Each file is identified by a UUID, generated in SQL Server using NEWID().  I need to prevent an attacker who knows the link format from brute-force guessing other UUIDs and accessing other files shared this way. Note also that the links have an automatic expiration.

My current link scheme sends the UUID along with an HMAC.  The HMAC is generated using:

a payload composed of system-level salt + a per-file nonce salt + the UUID
a 128-byte system-level key to compute a SHA2-512 HMAC

Is any part of this superfluous or excessive? Does using HMAC gain me any additional security over a simple strong hash in this scenario?

For discussion about T-SQL NEWID(), see SQL Server : does NEWID() always gives a unique ID? on StackOverflow.


texts: AES Decryption followed by Encryption, will it produce the original text?

texts: If a plain text is first decrypted (with the AES decryption algorithm) using Key K1 and then encrypted using same K1, would the final result still be the original plain text?


texts: About converting Leveled FHE to Pure FHE and the Circular Security Assumption

texts:
As it was pointed out in one answer of this question, the BGV paper has a footnote that says

  One can obtain a "pure" FHE scheme (with a constant-size public key) from these leveled FHE schemes by assuming "circular security", namely that it is "safe" to encrypt the leveled FHE secret key under its own public key.

However, I do not understand how the circular security assumption is related to this transformation from a leveled FHE to a pure FHE.

In my understanding, any leveled FHE can be turned in a pure FHE by setting the acceptable multiplicative depth, that is, the parameter $L$, to a value large enough to evaluate homomorphically the decryption circuit plus one operation and then apply the Gentry's blueprint, namely, refresh the ciphertexts after any operation by running the decryption function homomorphically.

So, can anyone explain what authors of BGV mean with that footnote or show what is wrong with my understanding ?


texts:
Why do people say that using hash twice or more is bad? yes there is key derivation that do that job, but in a low bandwidth network countries, the solution i see is to use a simple hashing system on the  server to gain one second or two.

Is rainbow table effective when using more than one hash? because on internet, i only find MD5 or SHA tables, so i guess that the algorithm will work only on hash(str) and will not work on hash(hash(str)) ?


texts:
I have a task to find a the message for which the SHA-1 hash's last 11 symbols in hexadecimal presentation corresponds to an 11-digit number.

I have been given the following example solution:

  For the code 38607310235, a solution is a513b8c4507ea2891fb34cd4612e038607301235, which is the hash of $y$

How can I find $y$?


texts: Are "deterrent" algorithms like NFS and Coppersmith's algorithm actually used in practice?

texts:
It seems like there are a lot of algorithms in number theory which I would classify as "deterrent" algorithms -- for example the various number field sieves for factoring, Coppersmith's algorithm for discrete logarithm -- which effectively serve as a benchmark for the cost of attacking a cryptographic protocol. They have immense value to society by justifying minimum bit sizes needed to make attacks intractable.

But I wonder: do these algorithms actually get used on a regular basis? After all, if there are systems that can be successfully attacked by these
algorithms, then those systems are not properly designed.


texts: Efficiency of chaining AES "groups" of blocks

texts:
From ISO/IEC 23001-7:2012/Amd 1:2012 10.2.2 Creation of Initialization Vector (Informative)

  Decryption efficiency may be improved if subsequent initialization vectors use the value of the last cipher block at the end of the previous sample so that multiple samples may be decrypted as continuous chain.

The algorithm is AES-128-CBC.

My question is: Can this really be true?

My understanding of efficiency is decryption time. For each group of blocks where a new IV would be needed the only reduction in time would be the read time of the IV (assuming the last block is kept in memory to be used as IV). But this reduction would so small in comparison to the read+decryption time of the actual blocks that I wouldn't even mention it.

The size on the other hand would be reduced as many IVs are not needed. But this depends on how many blocks are in each sample.


texts: Signature Generation Time vs Verification Time

texts:
When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature generation the situation is vice versa. I am asking myself whether there are use cases were a fast signature verification is an important requirement and were RSA would be actually the preferred choice?
Remark: I know that these elliptic curve based algorithms are generally more secure and have shorter keys then EC based algorithms. Thus, from these perspectives, EdDSA would be more appealing.


texts:
Say that I define a scheme where the salt is public and is MAC-ed with the message:

$k = KDF(password, salt)$
$tag = MAC_k(salt || message)$

Is it safe to salt the MAC this way? Assume that the salt is public and can be modified by an attacker.


texts: Is there any additively homomorphic schemes that can make range proof?

texts:
I want to know whether there is any additively homomorphic schemes that can make a non-interactive range proof.

For example, I have a pair of public and private key pairs $(K_p,K_v)$ that satisfying a additively homomorphic schemes $E$, and I want to prove that the plaintext of $C=E_{K_p}(m)$ belongs to $[a,b]$, where $m, a$ and $b$ are both positive numbers. Is there any additively homomorphic schemes and non-interactive range proof scheme that I can use to prove the plaintext inside $C$ belongs to $[a,b]$.


texts: What does the〈 〉notation mean in this situation?

texts:
I was looking at solutions for a problem but I noticed it said $\langle2\rangle$ and was unsure of what that meant.

From Homework 5 (PDF)


texts: Encrypting/Decrypting using RSA and AES; standards?

texts:
I'm looking for a standard way of encrypting and signing a message using RSA and AES.  I understand that in pseudo-code the actions taking place are like this:
Alice's actions for sending a secret signed message to Bob:

AES = random()
message' = encrypt(message, AES)
AES' = encrypt(AES, Bob's public RSA)
messageHash = hash(message')
signature = encrypt(messageHash, Alice's private RSA)
send(Bob, AES')
send(Bob, message')
send(Bob, signature)

Bob's actions for receiving a secret, signed message from Alice:

AES', message', signature = split(input)
AES = decrypt(AES', Bob's private RSA)
messageHash = decrypt(signature, Alice's public RSA)
receivedMessageHash = hash(message')
messageHash == receivedMessageHash? --> bail out if unequal
message = decrypt(message', AES)

So, Alice chooses a random AES key, encrypts the message with it, and sends this to Bob, along with an encrypted version of the AES key to decrypt it and a signature to prove her as an originator.
Of course, there are other setups, like sending to multiple people or having no need for a signature or similar, but I'm looking for a kind of setup like this.  Maybe I understand something wrong and my pseudo code above lacks precision or contains a bug.  It just represents my crude understanding of the matter ;-)
I can do all this step by step by myself, using Python libraries like Crypto or Unix shell tools like OpenSSL.
But I'm looking for a standard way to do this, without worrying about how to implement paddings or that split() function used in the pseudo-code when receiving the message.  I guess there must be a library or a toolset or whatever which does this for me and which may be even allowed interoperating with other programs doing similar tasks.
Questions:

Is my setup described above feasible and typical?  Or does it contain any logical errors, flaws, or attackable aspects?
Is there such a library or toolset available as Unix command-line tools or Python libraries that do this for me?

I'd prefer to stick to RSA and AES with an option of exchanging each with any other chosen algorithm, but solutions for a fixed algorithm set would be welcome as well.
As I said, sending from Alice to Bob is my first approach but being able to send to more than one receiver would be a nice bonus.


texts:
I'm reading the Wikipedia entry where we have

  Alice and Bob agrees on a prime number, p, and a base, g, in advance. For our example, let's assume that p=23 and g=5.
  Alice chooses a secret integer a whose value is 6 and computes A = g^a mod p. In this example, A has the value of 8.
  Bob chooses a secret integer b whose value is 15 and computes B = g^b mod p. In this example, B has the value of 19.
  Alice sends A to Bob and Bob sends B to alice.
  To obtain the shared secret, Alice computes s = B^a mod p. In this example, Alice obtains the value of s=2
  To obtain the shared secret, Bob computes s = A^b mod p. In this example, Bob obtains the vlaue of s=2.

Now, I understand that the protocol is not unbreakable but it works because there is no efficient way to figure out the secret number for Eve quickly.

Is it correct that the main task for Eve is to solve for either a from A=g^a mod p or b from B = g^b mod p but that both of these can  only be done by guessing every number from 1 to p-1 (worst case)?

If so, why is this considered more than polynomially hard since the computation is linear in the size of the prime p?


texts: How to find kernel of isogeny from the dual isogeny

texts:
Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$.
Let $R \in E[\ell_A^{e_A}]$ be a point of order $\ell_A^{e_A}$ and suppose $\phi:E \to E' = E/\langle R \rangle$ is an isogeny with kernel $\langle R \rangle$.
Let $\widehat{\phi}:E' \to E$ be the dual isogeny.

My question is: suppose we know the kernel of $\widehat{\phi}$, say $\langle S \rangle$. How can we recover $\langle R \rangle$?


texts: SHA1 collision event probability after n iterations

texts:
There are String1 and String2 - some variables-strings.
The probability of collision for different String1 and String2 is

P{SHA1(`String1`) == SHA1(`String2`)} = p

What's the probability of

P{SHA1(SHA1(`String1`))} == P{SHA1(SHA1(`String2`))} //two times
P{SHA1(...(SHA1(`String1`)))} == P{SHA1(...(SHA1(`String2`)))} //10^9 times


texts: Generally accepted standard(s) for key managment?

texts:
I am using an application of which in its privacy policy it has been stated the they use generally accepted standards to protect data. They encrypt data on their servers.

So, what is/are the "generally accepted standard(s)" for key management?


texts: Feedback requested on a method of posting a message without revealing the author

texts:
So I was thinking about variations on the Dining Cryptographers problem - In some cases, it's useful to be able to post a message without revealing the source, but with the additional constraint of not revealing the entire group to one another.

For instance -
Let's say you have 20 members in a ring.
Each single member knows the person to their left, and the person to their right, but none of them know the entire layout of the party.

An individual in this group wants to share a message, without revealing to the rest of the group that they are the original author.

Suppose each member were to generate a random string of the same length.
This string must be GREATER than the size of the message to be shared.

Starting with one arbitrary member, each member would then talk to their neighbor in turn.
Member1 would share his secret with Member2. [1]
Member2 would then XOR the secrets together, and tell this XORed result to Member3.
Member3 would then XOR his secret against this shared-message, and then pass it to Member4, and so on.

Each Member would XOR their own secret against the shared-message before passing it along.

At some point during this arrangement, the ring would pass to the member who intends to post.
This member would then XOR the shared-message against both his secret, as well as the Message to post.
He would then pass the shared-message as normal.

After the message made it all the way around, Member20 would pass it back to Member1.
Member1 would then XOR by his key again, effectively removing it.
He'd then pass the message to Member2, would would remove his key, then pass Member3, etc.

By the time it returned to Member20, and he removed his key from the set, only the secret message would remain.

There's a simple demonstration in Python

import random

# Create our initial string, and encode it to a series of bits.
# Pad the bits to be at exactly 1K.
initial = "This is the song that never ends - It just goes on and on my friends."
bytestr = initial.encode('utf-8')
intstr = int.from_bytes(bytestr,byteorder='big')
needed_bits = 1024 - intstr.bit_length()
padded_bitstr = intstr << needed_bits

working_str = 0
secret_machine = random.randrange(0,20)

# Create 20 virtual nodes, and give them each a random number.
nodes = []
for i in range(0,20):
    rnd = random.SystemRandom().getrandbits(1024)
    node = {}
    node['randombits'] = rnd
    working_str = working_str ^ rnd
    if i == secret_machine:
        working_str = working_str ^ padded_bitstr
    nodes.append(node)

# Optionally shuffle.
random.shuffle(nodes)

for node in nodes:
    working_str = working_str ^ node['randombits']

# Convert back to string
unpadded_str = working_str >> needed_bits
reformed = unpadded_str.to_bytes(int(unpadded_str.bit_length()/8)+1,byteorder='big').decode('utf-8')

print(reformed)
print(reformed == initial)

[1] - To avoid Member2 checking to see if Member1 was the poster, Member1 should use 2 secret keys, but only share 1.
Essentially treating himself as 2 virtual members. But that's


texts: Is a Diffie-Hellman scheme in which parties always use the same public keys vulnerable?

texts: I have come across a couple of protocols in which the public keys of the parties are static across conversations, even with different users. Something about this makes my hairs stand on end but I can't pin down what the actual weakness is, if there is one. Is a scheme like this OK or is it known to be vulnerable?


texts: How to find the output shares of first-order threshold implementation of cubic degree function?

texts:
Assume $d=abc$ and  to implement first order threshold implementation , the minimum input and output  shares   are 4 (1*3+1) ,  and  4 , calculated using  ${4\choose 3}$ , Theorem 2. The new TI equation is:
$$d_{0,1,2,3}=
(a_0 \oplus a_1 \oplus a_2 \oplus a_3)(b_0 \oplus b_1 \oplus b_2 \oplus b_3)(c_0 \oplus c_1 \oplus c_2 \oplus c_3)$$
breaking out the multiplication results in 64 terms , divinding the terms on 4 output shares , each share will have 16 terms , but how to select the terms for each share?
Q. How do you find  the output shares ($d_0$,$d_1$,$d_2$,$d_3$)  equations that acheive non-complete , uniform and correctness features ?


texts: Are there predictable, yet secure hashes?

texts:
My original problem: I want Alice to be able to promise that at some point in the future she will upload a statement to an address in a hash-table, which is computable/predictable from everyone without knowing her secret key (to be able to look at that address, if the statement is already there). However, the statement should not be predictable for everyone.

One solution path:
Alice has a secret key $S$ and the corresponding public key $P$ (solutions for any (secure) key generation algorithms are appreciated). Is there any combination of (any) functions $f_1, f_2$ and (any) hashing algorithms $h_1, h_2$, s.t. the following holds?

$h_1(f_1(P)) = h_2(f_2(S, P))$

I.e. an algorithm that gives a predictable hash for data generated by the secret key. A hash that can be generated from the public key only, which will be the same for a string generated from the secret (and possibly the public) key.

Important note: $f_1$ may not be aware of $S$, of course, and $f_2$ may not ignore $S$. Otherwise there are of course trivial solutions...

My question: Can my proposed solution be workable or is there a better way to accomplish this?


texts: Single Ciphertext which can decrypt with multiple keys

texts:
Say we have a public key system where we have 2 users, Alice, and Bob each has a public and private key. We also have a publicly available server which stores a message.

I want to encrypt this message (M) for Alice and Bob only once. such that either Alice or Bob can decrypt the message with their private key.

The easy and well-studied way to do this is to generate a random symmetric key and encrypt the message with that key, then I can encrypt a small message (SM) For Alice and Bob with their public keys which gives them the symmetric key, with this they can now both decrypt the Message M available on the server.

However is there any known way that I can encrypt the message M, where both Alice and Bob can decrypt M without needing an additional symmetric key? I have looked briefly into double trapdoor encryption and Broadcast encryption but I don't think these schemes suit the purpose?

TL;DR One Ciphertext that can be decrypted by multiple Public, Private keypairs, without deriving an additional symmetric key


texts: Where can I find test vectors of special mode of block cipher, such as CBCC, PCBC, EPBC, IOBC

texts:
Now, I am learning cryptography about block cipher. I plan to implement the mode of operator about it.
I have know some modes, such as ECB, CBC, OFB, CFB, CTR. These modes are common and I have implemented them by myself.

However, I also find some special mode seldom used, such as CBCC, PCBC, EPBC, IOBC. I want to implement them, But I can't find test vectors about them. Where can I find? Please give me some links or test vectors.

CBCC is short for Cipher Block Chaining with Checksum.

PCBC is short for Propagating Cipher-Block Chaining Mode.

EPBC is short for Efficient Error-Propagating Block Chaining.

IOBC is short for d Input and Output Block Chaining.


texts: cascade encryption - If I encrypt my data using many different encryption algorithms

texts:
If I encrypt my data using many different encryption algorithms (using different passwords)
how will an adversary be able to decipher the message?


texts: Hash function based on block cipher (and proof of security in the PRP model)

texts:
Do there exist proofs of security for primitives like hash functions (based on a block cipher) in the PRP model.

I often see proofs in the random oracle model (for hash function based on compression function) and proofs in the ideal cipher model (for hash function based on block cipher).

Are there proofs of such primitive in a real world model?


texts: how do we calculate set intersection using homomorphic encryption?

texts: I am new to this field. I want to learn how homomorphic encryption can be used for PSI. I am aware of other SMC protocols but I never understood how to use schemes like Paillier for PSI calculation. For example Alice and Bob have two bloom filters(with set cardinalities: |$ B_{Alice} $| and |$B_{Bob}$|they want to compare and see if they match. Alice sends the encrypted (encrypted using paillier) bloom filter to Bob along with the public key. Now, how does Bob build the Binary AND, i.e., how does he calculate E(|$ B_{Alice} $| $  \wedge  $ | $ B_{Bob} $|)?


texts: How to do division using Beaver Multiplication Triples

texts:
It is very straight-forward and intuitively to achieve addition, subtraction and even generalized polynomial using Beaver's Multiplication Triples. However division seems difficult to achieve on two secret-shared values (each with precision $f$).

Assuming the case of secure two-party computation, there are two secret values

$$[a]\leftarrow\{0,1\}^n, [b]\leftarrow\{0,1\}^n$$

And we want to securely compute

$$c= \Bigl\lfloor\dfrac{a}{b}\Bigr\rfloor$$

where $c$ is an integer.

So my question is : How to design a such division protocol, or is there any papers? Thanks a lot.


texts: Searching for a dining cryptographers problem variant

texts:
When I frist read about the famous dining cryptographers problem, in a book years ago I remember the author made a twist on it, demonstrating the generalization of the problem.

Basically the dining cryptographers wanted to know who has the best income. But since they all worked for secret agencies, they were not allowed to tell each other. So they had a system where they would write their income down in some order without giving away information to their sitting neighbors on what their income is.
I'm unable to recall the way that system worked and I can't remember what book it was.

I was hoping somebody recalls this twist on the problem or the book.


texts:
One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves.
This attack is pretty old and there has been a bunch of optimizations. Some of them are listed here on page 8.
My question is: What is the newest/best optimization for the Pollard's Rho attack? Is there a paper, which contains all (significant) optimizations?


texts:
Wikipedia's article on RSA blind signatures says that you need to raise the message $m$ to the secret exponent $d$ modulo the public modulus $N$.

Implicit within that, it seems to me, is that m needs to be less than $N$. Problem with that is that that's not a restriction imposed upon signatures.

So for blind signatures to work as Wikipedia describes them you need to set $m$ to the hash or to the output of EMSA-PKCS1-v1_5-ENCODE or EMSA-PSS-ENCODE instead of setting $m$ to the plaintext. And then you do the modular exponentiation after you've blinded $m$.

IE.: you kinda have to side-step RSASSA-PSS-SIGN or RSASSA-PKCS1-V1_5-SIGN for blind signatures to work correctly.

Is that correct?


texts:
For example, I'm using AES-CTR.

I use fixed (random generated) key and random IV. I know that I have to encrypt key but I don't know about IV.

If I will encrypt 1 block of data with fixed key and first IV then encrypt another block of data with fixed key and second IV - does this violate the security of AES-CTR?


texts: Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

texts:
Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?

All hashes that are nowadays considered 'broken' (such as MD5 and MD4 and older, and to some extent also SHA-1) are only susceptible to collision attacks, i.e. generating two arbitrary chunks of data with the same hash.

I'm wondering if a successful preimage attack has ever been found for any hash algorithm? And I mean either kind of preimage attack:

Regular, i.e. given a hash output H, being able to generate some data X so hash(X) = H
Secondary, i.e. given data X, being able to generate some other data Y so hash(X)=hash(Y)

And with 'feasible' I mean it can be done on a reasonably powerful cluster of fast computers (with fast GPUs) within reasonable time (e.g. 6 months).


texts:
I'm trying to generate a csr with spongyCastle in android that has to be submited to a webservice. My problem is that the webservice always complains that the CSR is not in DER or PEM format. On the other hand, if i use Openssl command line to generate it, the webservice accepts it, so i know the webservice works and the code that submits it also.
So, please can some guru spot the diferences between my generated CSR by code and the one generated by OpenSSL command line, appart from the public key ?

Created by code with spongyCastle in android

-----BEGIN CERTIFICATE REQUEST-----
MIICtTCCAZ8CAQAwcjELMAkGA1UEBhMCSVQxGDAWBgNVBAMMDzM1MjgxNDA5MjAw
NTc3NDEQMA4GA1UEBwwHQ0FUQU5JQTETMBEGA1UECgwKU0lTT0ZUIHNybDEOMAwG
A1UECAwFSVRBTFkxEjAQBgNVBAsMCU1hcmtldGluZzCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAL9zyTyT198QtXPaHvYXfT11MjQo+W9EeU5dBMotqdzl
0OY6Bm4iNAk8PRCvVAMwnGX+ztb2cHHaXPAtoYdxiLIHO26dup1x7w/2RX12CKWV
kvE1pjXsgUFL/lxjco6LNi8NPk0Mne5aJv14sQ/evyr6DbINsWKVjWFew//EvBqk
r0jXu4PfIrZZXUxMiioqnSvAuec+EI52ifgx3stMVhUHSFroqbkOCmc2EKH1eX+k
UtYvdNtz6kkfoXtDRBfm0pg0qZOGBXqc0FhiFkD52ChDaMCz9WvMPhZbDKpmLIrc
ORGhl8A7y3BCL5dhmQVa3BgPZJymqryYs8qQbz+x6EUCAwEAAaAAMAsGCSqGSIb3
DQEBCwOCAQEAi4/5RGZI9VSJcc43bA0pEsKMlQpQv8a51I/PvhEyfL8iKvMg4poA
HuOzcuvin0eaShjXtCVma7NCUg6+Ccl7iZnVJpK1vtJEp8U6lpRt1VyzzpZJXex1
uJTXuWY1u52E1lj4M81x7hqUKml61/Ahy02G3szTn6JfIK3jH76/xeUui9NWqkZE
6meb7AemimgmF9kfuhuEAhSt/+l6Pas1F6YcM54NexPNdGZ+x6l06WiVoh2TlenE
aHABmk32U4BMnAYWsdq1MxpvnEriyf9Z8sYM2Zyf0C9O8Bzz9qnS8ZGMsODbTSas
lEdA+M8UmQ646BB0LO4Vr7RETRX/fEl49w==
-----END CERTIFICATE REQUEST-----

and the one created by OpenSSL command line

-----BEGIN CERTIFICATE REQUEST-----
MIICtTCCAZ0CAQAwcDELMAkGA1UEBhMCSVQxDjAMBgNVBAgMBUlUQUxZMREwDwYDVQQHDAhDQVRBTElOQTETMBEGA1UECgwKSW5mb3JwaXJlczERMA8GA1UECwwIc29mdHdhcmUxFjAUBgNVBAMMDTEyMzQ1Njc4OTAxMjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJuj7e1NRGocLmAmvc95UAAGcEevG8HreSr6V2U16OTyHwIm2THZ5He6BgJwKskFLUdW1/DfLd/52b0nDymjgNRIIlJeYdEty96WRKUuacVnYegEwtyL1fTeFkajTflw0EIy/2ehNXwoDpB5mWzzWt97Cque27umP3W7a3cCz2c9f7XCx5Uq7qHFPUaaH9ys/oRpJCgw5Lfv9duV99KO4yXCfrvfmsN1y9LYKkD4MW1BUQSLvST5BDRnRAGRNFe7V3KzvnRYjH8nhv5Evm+j8n1mzrGK7DdQU6N48yKF0BPPFzhFR2ACxGUjMysHQgobPy0UToBBAxrE7qiS+oaiXLAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAEQZwWzCfUaCgeccDZ47QxBv601E63qwMhFc6bteU6jKPytY7BkojvxYZwkvGJnUqg2PTxAr6YnQHY/agWZAqLE358s32f4j81Ky+aG1pmMZf5Yx+tKoDsJtxzzubdj9gukUkq/tjQRXgGVx53lM26POfsgC5/pYnECqHOKuMxTUHUrOfX0J8bSRu5BoZfr9fEsy/ha/ymmmx9jBDx8wLo7vD78MnzdXDVMONVY7KgnujnEN9xl5EdJGAfQCm+Sf0Fx9z/RUSaUYV/9s/xj4NPhqgj51EKuwg+/7oOpM3Y/x5aT+cqxHUV0J1UEi9T4kRocchi3Rn9Xn5scMN6S7A9w==
-----END CERTIFICATE REQUEST-----

TIA

Nelson

Edit : I wish to thanks everyone that replied. Anyway, i've made two mistakes. The question should be more like why would the first CSR not be accepted and the second yes.

Second mistake was that it's a no problem after all. Just a stupid mistake in the code that builds the xml that missed one byte when the generated-by-hand CSR was used. Debugging 900+ chars strings is a pain.

Again, thank you all.


texts: A method to receive payments at obscured addresses

texts:
The background:

We assume that coin ownership and payments are recorded on a public ledger.
Suppose Alice wants to publish some information to let her receive coins from anyone.
But she does not want to receive coins at a publicly known fixed address.
Instead, she wants the payer to generate a unique destination address each time.
The payer must not know the private key for the address; only Alice will know it.

I want to know if the following algorithm will achieve these goals. This combines Diffie-Hellman key exchange plus any digital signature algorithm. Are there subtle flaws that I am missing?

Suppose we use an elliptic curve for Diffie-Hellman, and $G$ is a publicly agreed base point.
Alice chooses a secret integer $a$.
Alice computes the public point. $A = a×G$
Alice publishes the statement "Alice will receive payments derived from the number $A$".
Alice will not change this statement for a long time (years, many payments).
Bob wants to pay Alice, so he retrieves Alice's value $A$ and will derive a new public key.
Bob chooses a secret integer $b$.
Bob computes the public point $B = b×G$.
Bob computes the shared secret integer $s = \text{hash}(b × A) = \text{hash}(b × a × G)$.
Bob computes the public key $K = A + s×G = a×G + s×G = (a + s) × G$.
Bob sends his payment to the address $K$, and also mentions the point $B$ within the payment message (recorded on the public ledger).
Bob tells Alice out of band, without using the public ledger, about the payment info $(K, B)$. This step doesn't need to be secure, but should be kept off the permanent public record.
Alice computes the shared secret integer $s = \text{hash}(a × B) = \text{hash}(a × b × G)$.
Alice computes the private key $k = a + s$, which corresponds to the public key $K$.
Now Alice can spend the payment she received from Bob, by creating a signature using $k$.


texts: Is there a way to do single key-pair asymmetric encryption?

texts:
All of the information on asymmetric encryption I can find uses key-exchanging to get a mutual symmetric key.

What I am trying to do is encrypt a message with a public key and have it only readable by someone with the private key.  I don't even want the sender to be able to read it after it's been encrypted.  I don't care about the identity of the sender, only that if someone compromises the sender's computer, they can't derive a symmetric key and decrypt what was previously sent.

Is this possible?


texts: How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?

texts:
I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, implementation is another story).
The block cipher mode of operation is CTR. The implementation supports AES-128, AES-192, and AES-256 (default).
The AES key and HMAC key are generated from a user password using hashlib's pbkdf2_hmac with SHA-256, and a random 16-byte salt (I create a 64-byte key and split it in half for each key; for AES-128, I create a 32-byte key and split it in half).
The CTR IV is created by a random 8 byte nonce and an 8 byte counter that starts at 0. The salt is written as the first block of the ciphertext, followed by the CTR IV as the second block.
Lastly, a 32-byte HMAC value of the ciphertext is created using the HMAC key and SHA-256 and written as the last two blocks of the ciphertext (32 bytes).
When decrypting, the HMAC value is checked against the rest of the ciphertext before decrypting.
Is there any issues with this logic? From a cryptographical point, where are the weak points?
Thank you!


texts: AES: Given two deterministic plaintexts, compute two keys let the ciphertext is the same, is it possible?

texts:
Given two plaintexts $p_1$ and $p_2$, is it possible to find two keys for AES(-CBC) so that $$E_{k_1}(p_1) = E_{k_2}(p_2) $$

I want to make sure that will never happen, or is there any way to prevent that from happening? Because that will make my system unreliable.


texts: if we believe 256bit keys are secure in AES against any brute force attack, is that possible we use a KDF (convert user's weak entered password in truecrypt into a fixed AES key) with too much round and cycle to make a weak password (with All ASCII printable characters) secure as a true binary 256bit random key ? assume we want KDF proccesing don't take more than a few seconds on general today computers, how to compute relation btw KDF cycles and key's Entropy ? (what's possible length of an KDFed ASCII password which is secure as a 256 bit key ?)


texts: Determining number of required plaintext pairs for differential cryptanalysis

texts: When carrying differential analysis of a SPN network, how can one determine the number of required plaintext for the attack to be successful with high probability?


texts: Does Shannon perfect secrecy imply a deterministic encryption algorithm?

texts:
Consider an encryption scheme $(Gen,Enc,Dec)$ where $Gen$ is the key generation algorithm, $Enc$ is the encryption algorithm, where $c \leftarrow Enc_{k}(m) $ is taken to mean that the message $m$ in some message space $M$ encrypted with a key $k$ generated from some keyspace $K$ using $Gen$ produces the ciphertext $c$ which belongs to some cipherspace $C$, and where $Dec_{k}(c) = m$ is the decryption algorithm which is always deterministic.

In Shannon perfect secrecy, it is assumed that $|K| = |M| = |C|$. Does this imply that $Enc$ is deterministic?

i.e. is it impossible that there exist two different ciphertexts $c_{1},c_{2} \in C$ that are both produced by encrypting the same (message, key) pair? It seems once you restrict the three spaces to have equal cardinality, the encryption algorithm must be deterministic, but I cannot seem to prove this formally.


texts: Multiple rounds of (Committed) Oblivious Transfer

texts:
I would like to know a protocol which computes the following functionality:

Alice chooses a bit b.
For i = 1 to n, Bob chooses $x^i_0$ and $x^i_1$.
For i = 1 to n, Alice and Bob run $F_{OT}$ with Alice, acting as a receiver, inputting b and Bob, acting as a sender, inputting $x^i_0$ and $x^i_1$, resulting in Alice receiving $x^1_b, x^2_b, ..., x^n_b$.
(optional functionality) For any i in 1 to n, Bob can decide to reveal $x^i_0$ and $x^i_1$ at a later point.

It is important that Alice cannot change the chosen bit b between $F_{OT}$ interactions. Is that possible? Do Commited Oblivious Transfer help? If so, why?


texts: Public-private algorithm where it is not possible to recover public key from private key?

texts: Is there an asymmetric algorithm where it is not possible to extract a public key from private key? So far any algorithms I tried (dsa, rsa, ecdsa, ed25519) successfully recover their public keys from private ones with 'ssh-keygen -y -f private.key'.


texts: Is there a secure source of entropy on a typical microcontroller?

texts:
On a device that does not have a hardware RNG, what is the best source for entropy?

Some options and pitfalls floating around:

Use the ADC to read something analog: can become deterministic if there is access to power supply or some ADCs are just too stable even at LSB.
Use un-init SRAM: power supply brownout attack?
Use crystal jitter:  idea here is to sample the variance between the RTC and MCU crystals and use LSB.


texts: is forward secrecy irrelevant for non-streaming applications?

texts:
I asked a question yesterday about the Keybase key model and got no answers, unfortunately. Let me rephrase the question to make it clearer: in the case, if 2 users just want to send each other low-frequency e2e encrypted messages (e.g. files) via a 3rd party semi-trusted server over a secure channel i.e. TLS,  using curve25519 key pairs and do x25519 and AEAD(e.g. poly1305chacha20 like in libsodium's crypto_box_*()). Note that this is not a public web server or a VPN where messages have a streaming nature and you can have thousands if not millions of ciphertexts messages in a short period of time.

Is being concerned about forward-secrecy in such case irrelevant and somewhat overkill and static-static DH is enough?
Also, can ephemeral-static DH mitigate the forward-secrecy problem, at least for one party (aka the receiver) since static-static DH still suffers that if one of the parties got compromised all the messages are then compromised regardless of whether the other party is keeping his private key secure?


texts: Can we use more than one irreducible polynomial in AES?

texts:
I understand that the irr. poly is used to form the s-box (and inv. s-box), the key schedule and the mix columns. But could we use a different irr. poly for the mix columns and another for the key schedule (using, of course, a different s-box)?

Thanks...


texts: Is the tag in a MAC scheme a fixed size?

texts:
I've been reading up on MAC schemes. But I cannot seem to find out whether the tag's that are output by running MAC(m) is of a fixed size?
I can find a lot of stuff talking about the tag space being a specific size, which would indicate that the tag must have a specific length, but I could not find whether there are any rules for it.


texts: Is an AEAD the recommended method to add encryption + HMAC to a protocol?

texts:
Assuming you are dealing with a competent developer/team, and you are advising on adding security to their protocol. Also for the time being lets not worry about the key establishment and validating the other end aspects of the protocol.

Would you recommend AEAD, specifically AES-GCM over AES 256 + HMAC with SHA2?

I ask because there are implementation/usage caveats with AES-GCM as mentioned here.


texts:
I am having some problems, cryptographically speaking, digesting this information. There is a table that seems to say that tokens provide "end to end security" (I suppose we understand different things by that).

But my main issue is with this:

  Tokenization also helps protect your online shopping activities. You buy a coffee table on Ikea.com, for example. If IKEA has tokenized the card numbers that it keeps on file, your information is safe even if it gets hacked (which it hasn’t). The retailer may never actually see or store the credit card number, so if someone weasels into the system (like in the Home Depot breach, for example), all the criminal can see is the randomly generated tokens.

I understand the benefits of tokens, because they are pseudo-random, they can be changed periodically (so the old ones will not work) and they do not disclose identifiable information. However, it seems to me that whoever owns the token can perform the same activities as the legitimate owner. So it is an "anomisation" of PANs, not a security measure against forbidden use. If someone hacks Ikea.com and gets the tokens, he/she could use them to buy a coffe from somewhere else in the same conditions as the actual PAN could be used. In this case, the benefit is that the token can be easily renovated without having to change the PAN.

(1) Am I missing something? What is the real security provided by tokens in this case?

(2) Are tokens generated by PRFs? If a PRP is considered "secure" (so it cannot be distinguised from a "secure" PRF and its outputs look like random strings) can PRPs be used to create PRFs to generate tokens? For example, a cipher block with random keys used to generate tokens.

(3) Additionally, tokens that are 128 bits long and are never changed will operate correctly (in probability) up to $2^{64}$ generated tokens, after which we can expect the system to fail? (due to collisions)


texts: What security guarantees do blockchains provide for data storage?

texts:
When it's considered, like here

a project where a user needs to store a (small piece of data) on a blockchain

what does that really mean from a cryptographer's perspective? What security guarantees does it give? Things like availability (to which entity, under what condition and delay, with selection according to what criteria/tag), proof of origin (for one who finds that data), non-repudiation.
Is there a formal definition of a blockchain's expected properties, like we have for e.g. PRG, or a key exchange protocol?
Update: Emmanuelle Anceaume, Antonella del Pozzo,  Romaric Ludinard, Maria Potop-Butucaru, Sara Tucci-Piergiovanni's Blockchain Abstract Data Type attempt that. But it flies too high above my head. In retrospect I should have first asked: what's a blockchain, with a simple example?

Update: these NIST slides give a visual illustration of a minimalist blockchain:

They also make a basic but essential distinction between

Permissionless Blockchains, decentralized and often tied to cryptocurrencies.
Permissioned Blockchains, involving trusted participants or perhaps an authority.


texts: Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

texts:
I would like to implement a deterministic encryption scheme within .NET.  From the following post it is established using AES-SIV mode is appropriate.  As AES-SIV mode is not implemented within the System.Security.Cryptography .NET namespace an alternative is to use AES-CTR[k1, nonce, message] where nonce = HMAC[ k2, message] given certain constraints are met.  However, AES-CTR is also not implemented within the .NET Framework.

BouncyCastle has a C# API which implements AES-CTR [also known as AES-SIC] mode and is FIPS validated.  Documentation is scarce.  There are two books written by David Hook and Jon Eaves, two of the original developers.  BC Fips in 100 Examples and Java Cryptography: Tools and Techniques are the books.  This is the solution I will pursue.

My question is:

Given AES-GCM mode is similar to AES-CTR mode Link 1 Link 2 Link 3
does AES-GCM[ k1, nonce, message] where nonce = HMAC[ k2, message] allow me to safely create a deterministic encryption scheme?  Is this also misuse-resistant authenticated encryption MRAE?


texts: Right usage of PBKDF2 and login system questions

texts:
I'm developing the login part of my application and I was asking myself how to do it right. My application stores some users' data server-side that must be inaccessible from us, so all the content must be encrypted using AES-256 with a password derived from the user's login password and this key would never leave the user's device.
What I thought to implement is PBKDF2-SHA512 and use the first 32 bytes of output as the AES key of the user and the last 32 bytes as the hash to login.

My questions are:
How many interactions should I use given that my software will have to work on iPhone and Smartphones in general? (Note that I will force the user to use a password that is 8-char minimum in length, that has at least one uppercase char and a number)
What should I use as salt? I was thinking of using the username (that actually is the user's email address) combined with some string that uniquely identifies my application but... What's the best way to do so?
Is it useful to do it using a combination of crypto algorithm? For example making a little hash function based on AES so an attacker who has the ability to make custom hardware will have to implement more than one algorithm.
How should I save the login hash (the last 32 bytes of PBKDF2-SHA512) in the server's database? I think a simple salted hash (without stretching) would be enough given that the original password is already stretched client-side. If yes, should I use SHA-256 or SHA-512?

EDIT:
PBKDF2-SHA512 means PBKDF2 using HMAC using SHA512 (so it doesn't mean SHA512(PBKDF2).

I can't "generate" any random salt. All that I can do is to "derive" it from the login information. I thought something like HMAC-SHA512(email || password, str) where email || password is the string to be hashed and str is a string that uniquely identifies my application being used as HMAC Key. What do you thing about that? Is there a better way to to it?

Thank you!


texts: What's an entropy measure for the sequence $0, 1, 0, 1, 0, 1, ...$?

texts:
I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$.  Shouldn't $E(S)$ measure the quantity of information?  The sequence that just repeats $1$ after $0$ seems to me to convey very little information --- contained in this very phrase.

Where am I wrong in my understanding of entropy and of $E(S)$?


texts: Can you help me to understand the mode XCBC of authenticated-encryption?

texts:
I read: "$Z_0$ serves as an initial vector for CBC-like encryption, R is used to post-whitening each ciphertext block $C_i$ by $i ∗ R$".

but I don't understand what is the "post-whitening". Can you help me to solve this problem?


texts: What is the difference between KDFs for key derivation vs password stretching?

texts:
This was mentioned in the comments to another question:

  To clarify: This is about key-stretching KDFs. Not the kind for
  diversifying keys (eg. HKDF)

and

  There are two kinds of KDF, the slow, strengthening kind fed by a
  password(e.g. PBKDF2), and a fast one that only derives secondary keys
  from a master key(e.g. HMAC). The second one obviously shouldn't be
  used for password hashing.

Now Wikipedia on HKDF seems to think that it is exactly suitable for things like stretching keys:

  2./ To "expand" the generated output or an already reasonably random input such as an existing shared key into a larger cryptographically
  independent output, thereby producing multiple keys deterministicly
  from that initial shared key, so that the same process may produce
  those same secret keys safely on multiple devices as long as the same
  inputs are utilised.

Basically, what I would like to know is where exactly the differences between these two classes of KDFs lie. They both need to produce random looking output and cannot be invertible.


texts: Generating AES-256 Private Key from user string

texts:
So I wish to encrypt a string using AES-256 and want to provide the user to specify the password for unlocking the string. I plan to use sha-256 to hash to users entered password and use this as the key. Is this secure? and is their a better way of doing this?

Edit: it would be nice if people left a comment about why they down-voted it.


texts: Using chi square for distinguishing between compressed and random data

texts:
I am trying to find some measurement for identifying and distinguishing between compressed and random data. I tried this first by computing the entropy of such data, the entropy value is extremely high (almost maximum) in both cases, so that way does not seem to work as a distinguisher.

I read about the chi square algorithm but I've never used it (actually I still have some problems with interpreting the results). Does anybody know if this algorithm can lead to better results?


texts: Rijndael: explanation of Rcon on Wikipedia?

texts:
I stumbled onto the explanation of Rijndael Rcon on Wikipedia, and I can't follow it.

The example for Rcon indicates that Rcon(9) is 0x1b.
That could make sense… rcon(9) = (2 ^ (9 - 1) mod (256)) + 16 + 8 + 2 + 1

But I don't understand Rcon(10) or anything past that.

Can someone please explain it to me? Also, why is Rcon(0) = 0x8d?


texts: Need for 3 rounds in Luby Rackoff theorem

texts:
I get that using Feistel network we can create a secure PRP from a secure PRF (in 3 rounds according to theorem).

My question is why not just 2 rounds of Feistel network  is sufficient. Is it that the output is random enough compared to a truly random string before 3 rounds?


texts: What is the logic behind Compress function in iterated hash function

texts:
I am working on cryptographic hash functions theorems. In the iterated hash functions part a specific word started appearing constantly: "Compress" for instance within the "compress function".

I am trying to find out what the logic is behind this "compress function". Many blogs, PDF's & forums didn't give any particular description about the logic behind "Compress". They just used the word "Compress" and solved the theorems.

Can anyone tell me what is the logic behind the word "Compress" in the compress function?


texts: Proving LWE inversion in Micciancio-Peikert-2012 lattice trapdoors

texts:
I'm looking through the lattice trapdoor construction in https://eprint.iacr.org/2011/501.
To summarize, assume we have a matrix $G$ where, on input $b$,  we can efficiently find $(s,e)$ such that $s^TG+e^T=b^T$. Then for an invertible $H$, and a random $\overline{A}$, we produce a matrix $A$ by
$$ A = [\overline{A} | HG - \overline{A}R]$$
for some random $R$. This has the property that $A\begin{pmatrix} R\\ I\end{pmatrix} = HG$.
Then the LWE inversion for $A$ is given as follows: We start with some $b$. We first compute $\hat{b}^T = b^T\begin{pmatrix} R\\ I\end{pmatrix}$. Then we find $(\hat{s},\hat{e})$ such that $\hat{s}^TG+\hat{e}^T=\hat{b}T$. Then we let $s^T = \hat{s}^TH^{-1}$ and $e^T = b^T - s^TA$ be the LWE sample $(s,e)$ satisfying $s^TA+e^T = b^T$ with $e$ small.
It's clear to me that by the definition of $e^T$, $s^TA+e^T=b^T$ holds. In fact that would work for any $s$. So the hard part is to show that $e$ is small, and that's what I can't figure out.
One thing I can show is that
$$\begin{align}
e^T\begin{pmatrix} R \\ I\end{pmatrix} = & b^T\begin{pmatrix} R \\ I \end{pmatrix} - s^TA\begin{pmatrix} R \\ I\end{pmatrix}\\
= & \hat{b}^T - \hat{s}^TH^{-1}HG\\
=& \hat{b}^T - \hat{s}^TG\\
= & \hat{b}^T - \hat{b}^T + \hat{e}^T\\
= & \hat{e}^T
\end{align}$$
So if $R$ were invertible and diagonalizable, I could argue that $e^T$ must be small in terms of the smallest singular value of $R$ and the size of $\hat{e}^T$. However, that doesn't seem to be the approach of the paper, which focuses instead on the largest singular value of $R$. Their proof of Theorem 5.4 doesn't make sense to me: I don't understand what they are trying to prove, and why they are not showing that $e$ is small.


texts: "SHA-256" vs "any 256 bits of SHA-512", which is more secure?

texts:
In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm?

Similarly, what is the security difference between using SHA-224 and using any random 224 bits of the SHA-256 output?


texts: What is the use of segments in Cipher Feedback Mode (CFB)

texts:
In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation
CFB can be used with a parameter s - the size of a data segment in bits - which determines the amount of key stream material that is produced per block.

API's often also have parameters to at least generate a segment 8 of bits or a segment of the same size as an entire block - which is the maximum for s. Usually s is of course limited to multiples of 8 as the input/output is specified in bytes.

Usually OFB can also be parametrized this way, but it doesn't seem that the use of a parameter s (with a different value from the block size) is a recognized mode of operation in the standard.

What is the use of parameter s? Does it just have to do with error propagation?


texts: Security of ECC over finite fields of characteristic $p\approx2^{50\pm10}$?

texts:
What's the security of Elliptic Curve Cryptography over finite fields of word-sized characteristic $p\approx2^{50\pm10}$? We are talking about $\Bbb F_q$ where $q=p^k$ for some suitable $k$.

Furthermore, I would like to know about the possibility of pairings over fields of such word-sized characteristics.

References appreciated.


texts: Successful Cryptanalysis Research/Attacks on Zero-Knowledge Proofs?

texts:
A robust implementation of any cryptosystem (E.g., AES) has a comprehensive cryptanalysis research/attacks on it.

Are there any successful cryptanalysis research/attacks on zero-knowledge proofs?


texts: Why isn't ElGamal a symmetric-key scheme?

texts:
I was asked about this question by a friend.
He considers that Alice and Bob share a secret key s=g^(xy).
So why isn't it considered a symmentric-key scheme?
According to Wikipedia:

  Symmetric-key algorithms[1] are algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext. The keys may be identical or there may be a simple transformation to go between the two keys.

I observe that the shared s is quite easy to compute by Alice and Bob.

I know there's misunderstanding, but I can't convince myself now.


texts: Dieharder input file with a sequence of only binary numbers

texts:
I have a RNG producing sequences of binary numbers, ad I would like to run Dieharder test using them as an ascii txt input file. However I haven't been able to do it properly. Should I use a header like:

type: b

count: 2500000

numbit: 1

1

0

0
...

Thanks.


texts: Automated testing of cipher security for import/export compliance

texts:
What do we know about systems that automatically test and grade cipher security. The application in mind would be for checking for compliance with import/export regulations.

I imagine a system that automatically tests for known plaintext, chosen plaintext and the like, presumably by some kind of cryptanalysis operating on the cipher as a black box function, or subroutines of it.

The OpenSSL export ciphers are "exportable with respect to old US crypto regulations". I want to consider other countries import/export policies.

This question supposes that import and export compliance is still a real concern in the industry, despite many articles claiming otherwise.


texts: Can NORX32-f be used in a Salsa20 style stream cipher?

texts:
#include <std_roll_your_own_crypto_warning.h>

With the third round CAESAR candidates about to be announced, the design[0] of Salsa20/ChaCha + Poly1305 is still looking good in a number of ways, including software performance.  However, LRX algorithms have a major advantage when it comes to (relatively) efficient masking/blinding[1].

https://cr.yp.to/snuffle/design.pdf
http://keccak.noekeon.org/NoteSideChannelAttacks.pdf

NORX[2] is a sponge based design similar to Keccak/SHA-3 and the Keccak-p based Keyak[3] CAESAR candidate but designed with efficient software performance in mind.  However, it is not as efficient as ChaCha20/Poly1305[4] in software, particularly if you want 256-bit keys on 32-bit systems.

https://norx.io/data/norx.pdf
https://competitions.cr.yp.to/round2/keyakv2.pdf
https://tools.ietf.org/html/rfc7539

So the question is, are there any obvious issues to using NORX32-f in a Salsa20 style stream cipher, using the pseudo-addition operation $H()$ to add in the initial state the way Salsa20 does?  What, if any, different security properties are needed for the stream cipher usage vs. the sponge usage?


texts: Semantic Security in Formal Security Proofs

texts:
I have a trivial question, and I hope someone can help me.
I am reading several papers on formal security proofs based on the indistinguishably game. Specifically, the adversary is challenged in an experiment to distinguish between the real key and a random generated string. We flip a coin, say $b$, and if $b=0$ the output of the oracle query is the real key and if $b=1$, the output of the oracle query is a random string. The adversary wins the game upon guessing the correct $b$.
The question is, some papers write the advantage of the adversary as:
$$\mathsf{ADV}_\mathcal{A} = |2 \cdot \Pr[b=b']-1 |$$
or
$$\mathsf{ADV}_\mathcal{A} = | 2\cdot \Pr[\text{sucess}] -1 |$$
while others write it as
$$\mathsf{ADV}_\mathcal{A} = \Pr[\mathcal{A}\text{ wins}] - 1/2$$
Is there any difference between the two expressions?


texts:
According to Wikipedia:

  Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively.

What are the requirements for these attacks (i.e how many related keys, what should the relationship between the keys be)? Optionally, how do the attacks work in summary?


texts:
I am in the design phase of a secure chat application at the moment. I am trying to make this as secure as possible.

The Serverprovider should not have access to the messagedata.
So my idea was the following:

I have two base keys, one AES and one RSA Key.
The AES Key is derived from a password the user enters. The RSA Key is generated randomly and stored on the server. Public key normal, Private key encrypted using the AES Key. This is mainly to allow users to login from everywhere without having to transfer the privatekeyfile.
When a new Chat group is formed, a random AES Key is generated and encrypted using each users public key. Since this encryption happens on the device of the group creator, the provider of the server storing all keys never knows them. These encrypted keys are then uploaded to the server and therefore each Client can decrypt and use it.
When sending a message, a random IV is generated and stored together with the message.

So far so good, what makes me unsure is that the server knows multiple encrypted versions of the same data as well as the corresponding public keys.

Is there any way to recover the chat AES key using the combination of the encrypted keys and the public keys?


texts:
I have a hypothetical encryption scheme where somebody uses the one-time pad in CBC mode. That is, the block cipher is $E(k, m) :=k⊕m$, and that block cipher is used in CBC mode.

Now, I am assuming that a message $m=m_1||m_2||m_3||m_4$ is used for encryption.

How to compute $m_3⊕m_4$ from the resulting ciphertext (without using the key)?

Also: using this, how can I prove that it is IND_CPA insecure?


texts: Is XORing a random stream of bytes a secure way to obscure a file?

texts:
Long ago I created a very simple program that used the C library's rand method to generate bytes to XOR with the bytes of a file. This was a reversible (just run it through again) method to make a file unreadable.

In my simple implementation, I did not change the seed, so it always created the same "random" stream, but if I had given a seed as a command line argument, would this be a reasonable way to obscure a file?

This question is not about the merits of any particular pseudo-random number generator, just assume a good one. The point is: does it provide a sound obscuration using a very simple algorithm?


texts: Why is a Feistel network not a type of substitution-permutation network?

texts: I understand what substitution-permutation networks look like. I understand what Feistel networks and Feistel-like networks look like. A Feistel network or a Feistel-like network features substitution and permutations, so why is it considered distinct from an SP-network?


texts: How calculation over $GF(2^2)$ is executed?

texts:
I was unable to understand the calculation procedure given for $GF(2^m)^2$ in the follwing pdf: http://faculty.washington.edu/manisoma/ee540/EE540finite.pdf

In page 21 of the pdf, "Inversion over Composite Field $GF((2^m)^2)$" is introduced using irreducible polynomial "$x^2+x+\phi$".
(The "$\phi$" represents a constant binary {10}.)

However, I can not understand some calculation procedures such as "$a_0\ \texttt{&}\ (a_0+a_1)$" and "$\phi\ \texttt{&}\ a_1$".

What is the calculation procedure in concrete digits ?


texts: Is there an upper bound to the private exponent in RSA?

texts:
In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$.

Then we calculate $d:=e^{-1}\bmod\varphi(pq)$.

My question is: What could be the maximum value of $d$? Is there an upper bound to it?


texts:
I'm new to cryptography and I have a doubt: I read some pages a bit different definition for the RSA private key:

In 1 - (n, d)

In 2 - (d)

In 3 - (n, p, q)

Should I consider all these answers as correct? I know that if you have d and the public key, you have n (and e), and I know pq = n too.


texts: Database sharing in Private Information Retrieval (PIR)

texts:
Private information retrieval (PIR) protocols assume multiple parties have copies of a search database. How practical is this in real world?
(In more details the 'practical' term is: Will Google be ready to allow other independent search tools copy its database for such PIR? If Google allows, then I assume that there should be no loss in its business)


texts:
I am studying SHA3 in order to create a hardware implementation, preferably in verilog. I have downloaded VHDL reference implementation from https://keccak.team/hardware.html.

The code is great, and the reference document really detailed. However I cannot find any way to understand how the VHDL reference implementation receives the rate r and the capacity c parameters. I have understood the VHDL implementation is common for any Keccak-f[1600] transformation, but I do not understand how the code manages SHA3-256(M) or SHA3-512(M) executions.

In addition, is anyone aware of any additional complete Verilog or VHDL implementation?


texts: Computational Binding of Pedersen Commitment

texts:
Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen from $\{0,1\}$ to Alice. Finally, Alice opens this commitment to Bob. If Alice's value is equal to Bob's, then Alice wins. Otherwise, Bob wins. We assume that there is no abortion during the procedure.

A malicious Alice may try to open the commitment to the same value as Bob. But the intuition is that Pedersen commitment scheme is computational binding, and thus Alice cannot equivocate the committed value.

However, I am wondering whether we could provide a formal security proof via reduction. I.e., whether we could use malicious Alice to break the binding property of the commitment scheme. If we cannot do this, I am wondering how to formally show that the protocol is secure.


texts: Computationally indistinguishably vs Perfect Indistinguishably

texts:
I know that perfect security means absolutely no information about the plaintext is leaked to the adversary while computational secrecy is okay with a tiny amount of leak.

But, what is the difference between Computationally indistinguishably and Perfect Indistinguishably?


texts: Ethereum RLPx protocol for inter-node communication - flaws in the encryption

texts:
Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref)

Under Known-Issues I found this paragraph:

  The RLPx handshake is considered 'broken crypto' because aes-secret and mac-secret are reused for both reading and writing. The two sides of a RLPx connection generate two CTR streams from the same key, nonce and IV. If an attacker knows one plaintext, they can decrypt unknown plaintexts of the reused keystream.

Q: Can someone please Explain what this means and how this can be exploited by a third party who is able to observe the encrypted communication between two nodes.

Related to: https://ethereum.stackexchange.com/questions/59549/geth-inter-node-communication-devp2p-rlpx-encryption


texts: Is Encrypt(m||k2, k1) secure authenticated encryption?

texts:
I don't fully understand the need for MAC algorithms to authenticate encrypted messages. As I understand, the standard is to send something like
$\mathrm{E}(m,k) \| \mathrm{MAC}(m,k)$ where $E$ is an error-propagating block cipher, $k$ is an encryption key.

Would it not be easier simply to send
$\mathrm{E}(m\|s,k)$ where $s$ is a salt shared across the system? After decryption, the receiving user can simply check that the last $\mathrm{len}(s)$ bytes of the message match $s$ to check its authenticity.


texts: Can the TLS 1.3 PSK-DHE handshake be turned into a PAKE?

texts:
Recently, we had the question whether there's a PAKE that uses more standard, higher-level primitives than what SRP offers.

Now this made me think and ask myself: TLS does have a PSK mode, can't we leverage that? This shall be the theme of this question.

What I would imagine is the following exchange:

Client -> Server: "Hi, I'm potato@po.ta.to"
Server -> Client: "Here are your key derivation parameters: ..." and the server also sends his regular key exchange message assuming the client is who he claims to be
Client -> Server: sends his key exchange part

The idea is that we basically do standard TLS-PSK using the hashed password, so the server can store this hashed version and the client can re-calculate the hashed password (the PSK) on-the-fly.

Now at least for TLS 1.2 this is impossible if you don't have a custom ClientHello extension, because the ClientKeyExchange is sent after the ServerKeyExchange.

For TLS 1.3 (draft 18) things are more intriguing. It appears that Client can send a list of key labels and the server picks one. I don't exactly understand whether there is another message from the client with his key exchange part.

So now very concretely my question:

Can we somehow fit the above flow of log-in into the TLS 1.3 handshake, without defining our own custom extension?


texts: Please help me understand this k-out-of-n oblivious transfer protocol

texts:
I'm having the following protocol specification of a k-out-of-n oblivious transfer (as part of some E-Voting protocol) and it's bugging me that I fail to understand it with my basic knowledge of cryptography.

This particular implementation looks totally different from the usual 1-out-of-n "the receiver generates multiple public keys but only one is valid" examples I can find in the Internet.

Is this OT somehow based on the ElGamal encryption scheme? Especially the exponentiation within a prime order group remind me of it, but I don't see what the PK and SK are?
In order for it to be working, and according to the the final equation $m_{sj} = c_{sj} \oplus k_j$ I'm expecting to get $m_j$ from simplyfing $c_{sj} \oplus k_j$.

$m_j = k\oplus c\\
m_j = H(b\cdot g^{-sr}) \oplus c\\
m_j = H((\Gamma(s_j)\cdot g^{r})^s \cdot g^{-sr}) \oplus c\\
m_j = H(\Gamma(s_j)^s \cdot g^{sr} \cdot g^{-sr}) \oplus c\\
m_j = H(\Gamma(s_j)^s) \oplus c\\
m_j = H(\Gamma(s_j)^s) \oplus (m\oplus k)\\
m_j = H(\Gamma(s_j)^s) \oplus (m\oplus H(\Gamma(i)^s))$

So, $H(\Gamma(s_j)^s)$ must be equal to $H(\Gamma(i)^s)$

How can that be? How can some counter $i$ be equal to the senders query $s_j$? Is the selection $s$ basically the index of $m$ that he wants to receive.


texts: Can you really insert the text you want in one-time pad?

texts:
The Wikipedia article "One-time pad ~ Authentication" says :

  For example, an attacker who knows that the message contains "meet jane and me tomorrow at three thirty pm" at a particular point can replace that content by any other content of exactly the same length, such as "three thirty meeting is cancelled, stay home", without having access to the one-time pad, a property of all stream ciphers known as malleability.

I don't quite understand how it's possible.

Let's say the string is encrypted using one-pad time. Hacker somehow gets that encrypted text and he knows that the last word contains 6 chars. So, he removes last 6 chars from the ciphertext and he wants to add his own 6 character word. How he can do that?

If he just inserts that word, after the decryption that inserted word becomes most likely just gibberish. Or am I wrong?


texts:
Suppose you want to store information in, say, safe container for  a certain time, after which you want information to be accessible.

Let's assume simple idea and fill details by yourself. Take some space of strings (for example 10 characters in size, containing capital and ordinary letters) and encrypt a container with randomly generated password that is never stored - for example by asking other person to type the password without revealing it, or by closing your eyes and enter random characters).

Then start breaking by brute force. It doesn't guarantee perfect timing, but in the average You may estimate how long it would take to break the password and open stored content. By clever manipulation of string's space [ed: of the password] you may probably scale it from seconds to epochs.

You may assume some cascade/ hierarchy system: simple random input ( say: 3 chars of low dimensional space) is used as a seed for cascade of the systems you have to break. As breaking password from 3 char space is deterministic in fraction of seconds, such cascade may give you a loosely speaking, a way of measuring a time range of second with not so big error. So cascade of such cryptography systems may work as a clock, implemented on non safe scheduling system.

Questions:

Are there known any protocols or algorithms with precisely narrowed time estimate above?
Is it possible to design such brute force breaking scheme it guarantee that it will be successful after t_min but before t_max?

For given system working on isolated ( this one) problem it provides a method of measuring time without use of values from internal clock ( which is controlled by user, hackers etc). Using such multiple systems of cascades method we may in probabilistic way guarantee that box is open not earlier than certain amount of processor cycles is used. That's the goal of such idea.

Processor cycle count measurement by brute force breaking scheme :)


texts: Decrypting a blowfish cipher with three keys

texts:
Disclaimer: I'm pretty new to cryptography and I don't have a strong mathematical background. I apologize in advance if I missed something blatantly obvious.

I participated  in a security CTF this weekend and I was unable to solve one of the problems. It's been three days now and I still take a crack at it whenever I have some free time, it's driving me crazy. It just seemed so simple at first.

The title was "triple Schneier, no Rivest" and it gave an apparently encrypted file and three qr codes which contained this data:

# First QR
key=5EBE2294ECD0E0F08EAB7690D2A6EE69
iv=26AE5CC854E36B6B
# Second QR
key=3FDD884B0F6491110CE7A27CD9C670E2
iv=2384D24993B7A941
# Third QR
key=5A1F31323B5F3E79DF1A1A2ABC89B85F
iv=B9B9F5320FDD8706

This is the file encoded in base64:

ewx68DgfNLMEabX/dl62gVO4zki0vaZHWv6E+WCK8i0BH/rsKtIIV0ZlB8Z+fCFWwPQ04ZAi5Np6
s9lG4KnxUyVSAW/E1ccQ9QcOVxTTwduGdZ5+/ypgRIDKbx9B3mE8cZu0KBQ5k+Y1TfhlqYLwzs9E
Xld9C3IMIrzBChFFoVmGEOZT/I/idBoE++ZDDlMGZMsZO37l2/Th/73y5qNn6Ezp1uuqAPoeZbAB
ZSOaGnkKYnMPcjqoJR47NP4L3j0Wt39nZtbvHjQfIAyefqliklsChbTEGeRavqJX8zOg1W5zi3Q/
qKWilBOT5eLhtH9WxOa7aY8gxjcPQWzzXhSUtlZeCXUt2DW+

It's 264 bytes long, the IV in each key is 8 bytes long and each key is 16 bytes long. Plus the mention of Schneier in the title, I'd say it's a pretty safe bet we have a blowfish cipher.

I've tried decrypting the file with the first key, then with the second, and then with the third. I also tried different libraries/implementations of the algorithm.

I even wrote a python program to try all possible permutations of the three keys, but none gave me a plaintext.

I'm obviously missing something big.

Here's my last attempt at it, which I think condenses most of the other things I've tried:

for kr in key_permutations:
    out_name = ''.join( [ str(k['id']) for k in kr ] )
    output = [ first_input ]
    for k in kr:
        cipher = blowfish.Cipher(k['key'])
        i = b''.join(output)
        sys.stdout.buffer.write(i)
        output = cipher.decrypt_cbc(i,k['iv'])

    open(out_name,'wb').write(b''.join(output))

key_permutations is a list of 3-uples where each element is a dictionary with a key, its corresponding iv and an arbitrary ID. I'm using this blowfish library.

So I guess the questions are three:

Is there a way to make sure this is indeed a blowfish cipher?
What methods are available, given those 3 keys, to try and crack the code
What does Rivest have to do with Blowfish?

Thanks in advance!


texts: Is there any area where AES-CBC cannot be used ? If so, why?

texts: I would like to know the domains or specific applications where using AES-CBC is not advised due to any drawbacks like sequential encryption of AES-CBC ?


texts: Is it secure to transmit a short plaintext with its MAC?

texts:
I have a short (32-bit) message that needs to be authenticated.  Due to the constraints of my platform, I would like to use Speck32/64 (32-bit block, 64-bit key) with a Matyas-Meyer-Oseas one-way compression function (due to its ease of implementation and because the input sizes match what Speck generates).

(Here, $E$ is Speck32/64, $g$ is a no-op, $m_i$ is the entire short message, $H_i$ is the tag, and $H_{i-1}=H_0$ is secret.)

However, my message is short enough that there won't be more than one iteration of the compression function; essentially, I would merely be XORing the output of the cipher with the plaintext.  (Obviously, $H_0$ should remain secret!)  I also don't care about the secrecy of the message, only its unforgability.  Therefore, I would transmit the message in plaintext along with its equally-sized MAC.

Is it secure to give a third party the plain text that goes with a MAC?  In other words, does the fact that the third party always knows the plaintext to a given tag weaken the security of the tag?  If so, what needs to be changed to secure the message?


texts: Is there a standard format for compact 56-bit DES keys?

texts:
DES keys are traditionally stored as 8-byte blobs, with only the high 7 bits of each byte being meaningful to the algorithm; the low bit of each byte is set so that the population count of the byte is odd.  This makes DES have a key size of 56 bits, rather than 64 bits.

Is there a standard format for storing a 56-bit representation of a DES key?  I was going to store them that way because it means random keys have all their bits used.

For now, I'm just concatenating the 7 bit chunks together, left to right (big-endian sense).

This is for interfacing with a legacy system that uses 3DES; thus, the parity-less format would have 168 bits = 21 bytes.


texts:
What's the computational complexity or RSA? One can assume it's O(prime length^2) it you consider multiplication by column, but speed tests slightly differ on slow operations with private key and differ a lot on public key. Why?

> openssl speed rsa1024 rsa2048 rsa4096

                  sign    verify    sign/s verify/s
rsa 1024 bits 0.002544s 0.000124s    393.1   8049.2
rsa 2048 bits 0.017023s 0.000467s     58.7   2140.7
rsa 4096 bits 0.121189s 0.001824s      8.3    548.2


texts: Is it possible to work out the hash algorithm from a list of known message-hash pairs?

texts:
For example, in my situation I know hash(20) = 486e9638177faf1f34e49910491b77af.
I also know the hashes for all values from 0 to 20.

Is it possible to work out the algorithm used to hash these values?


texts: Clarification of Proof: Proving perfect secrecy for One Time Pads

texts:
I came across a version of a proof that One Time Pads have perfect secrecy and have a few questions with this version of the proof. The proof is attributed to Dan Boneh (the proof starts on slide 10),

  Definition: A cipher (E,D) over (K,M,C) has perfect secrecy if
  $\forall m_{0}, m_{1} \in$ M,      $(\left\vert{m_{0}}\right\vert)$ =
  $(\left\vert{m_{1}}\right\vert)$ and $\forall$c $\in$ C,  such that:
     Pr[E(k,$m_{0}$)=c] = Pr[E(k,$m_{1}$)=c] where k is a random variable that is uniformly sampled in the keyspace K.

My understanding of the Proof is as below,

  Lemma: OTP has perfect secrecy

Proof:

For every message m and every ciphertext c:

Pr[E(k,m)=c] = ${\dfrac{\text{ #keys k in K s.t. E(k,m)=c}}{\text{Total number of Keys}}}$

Suppose that we have a cipher for all m,c: k in K: E(k,m)=c is equal to some constant.

If that is the case then for all $m_{0}, m_{1}$ the probability of E(k,m)=c is the same and Dan states the the denominator (total number of keys) is the same as the number of keys k in K such that: E(k,m)=c.

If this probability is true then the cipher has perfect secrecy.

Let m in M and c in C, then the number of OTP keys that map m to c is 1.

If E(k,m)=c => k $\oplus$ m = c => k= m $\oplus$ c

What this says is that the number of keys k in K: E(k,m)=c = 1 which completes the proof that OTP has perfect secrecy.

Questions:

Why does Pr[E(k,m)=c] = ${\dfrac{\text{ #keys k in K s.t. E(k,m)=c}}{\text{Total number of Keys}}}$
Why is the #keys k in K s.t. E(k,m)=c equal to the total number of keys? Is it because of the following condition: $\forall m_{0}, m_{1} \in$ M,      $(\left\vert{m_{0}}\right\vert)$ = $(\left\vert{m_{1}}\right\vert)$ -- which means one of the requirements for perfect secrecy is that every message m has to be the same length, hence meaning that every key k also has to be the same length, and for each unique message m there must be a unique key k that encrypt its. So the total number of keys is equal to the total number of messages.

But this line of reasoning still doesn't make sense to me. Say there are 5 messages: $m_{1},m_{2}, m_{3}, m_{4}, m_{5}$ and 5 keys that encrypt those messages: $k_{1},k_{2}, k_{3}, k_{4}, k_{5}$ -- then the total number of keys is 5 and the total number of keys that uniquely map $m_{1},m_{2}, m_{3}, m_{4}, m_{5}$ to $c_{1},c_{2}, c_{3}, c_{4}, c_{5}$ is 1, namely: E($m_{n}, k_{n})=c_{n}$ for each m,k, c, as you have a 1-1 pair for messages to keys, so the ratio is 1/5 and not 1. What is wrong with this? Or is it counting the total number of such keys that make (k,m) to c? If it counts the total number of such keys, then that answer is 5 in this example. I'm confused.

How does showing Pr[E(k,m)=c] = ${\dfrac{\text{ #keys k in K s.t. E(k,m)=c}}{\text{Total number of Keys}}}$ = 1 prove OTP have perfect secrecy. This doesn't make any sense to me given the statement of the theorem.

I need help understanding this proof, breaking down what the proof is saying.

Thanks!


texts: Security of RSA signature using PKCS 1.5

texts:
I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output.

I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS scheme, but some googling around left me feeling 1.5 is unbroken and 2.1 is just for a proof.

Consistent signatures a great for testing, and anything that RELIES on good entropy for security is a huge risk in my mind. So if someone can confirm my common sense isn't broken I'd much appreciated it.


texts: What cryptographic primitives use AES or its Round function?

texts:
I have found the following two block/stream ciphers or Hash Construction that make use of AES or its round functions

A New 128-bit Key Stream Cipher LEX
3D: A Three-Dimensional Block Cipher
ALE
ASC-1

Which other constructions make direct use of AES round function?


texts: What is the probability of a SHA-512 hash containing both digits (0-9) and alphabets (a-f) all the time?

texts: Quite curious to know if ever a SHA-512 hash will contain only digits or only alphabets. Thanks in advance.


texts: Calculate the security of a cascade cipher

texts:
I’m reading “The Security of Multiple Encryption in the Ideal Cipher Model” and I’m having a hard time understanding something. How do I calculate the bounds of cascade cipher from  the following formula (where $k$ determines keysize and $n$ is the blocksize)?

  $\exp\left(k+\min\left\{\frac{k(ℓ′−2)}{2}, \frac{n(ℓ′−2)}{ℓ′}\right\}\right)$   where $ℓ$ is the cascade length and $ℓ > 1$

If there is a cascade of AES, Blowfish and DES then what will be the value of $k$? and what will be the value of $n$? is this just addition of the key size used by these block ciphers for determining the value $k$ and addition of the blocksizes for determining the value of $n$?

If the case is AES $\to$ DES $\to$ AES $\to$ DES $\to$ Blowfish, then is this just five times addition to determine $k$ and $n$?


texts: How can fully homomorphic encryption ever be secure?

texts:
Perhaps I am misunderstanding FHE, but from my knowledge, an FHE system is theoretically capable of arbitrary computation. Since this is theoretical talk, let's forget the practicality of actually implementing that today.

A common use case of FHE is secure cloud computation:

1. Encrypt M, call this E(M)
2. Send E(M) to cloud to compute f(E(M)), where f is some arbitrary computation
3. Cloud sends back result and we decrypt to get f(M)

In principle, the cloud never knew M or f(M) as it only operated on ciphertext.

Now my question is: Since this is a FHE scheme that allows arbitrary computation, the cloud service builds a full-text search function on the ciphertext and starts querying E(M) to check for partial matches or even full equality of M. What part of FHE prevents the cloud service from doing this?


texts: Generating secure hash using iPhone Secure Enclave

texts:
I need to turn a password plus salt into a 256 bit hash. The hash is used as a key to encrypt / decrypt a database on an iPhone, so it need never be generated outside the phone. It also need not be moved to a different iPhone. Currently we use a standard hash function with lots of rounds, to make a brute force attack hard.

I would like to involve the iPhone's secure enclave into the process, in the hope to make it more secure. However, functionality is very limited: I can generate an elliptic curve private / public key pair, I can encrypt / decrypt, and I can generate or verify an ECC signature.

My idea to generate a hash is: Generate an ECC private / public key pair; ignore the public key. Take password and salt, then use the ECC key to calculate a signature of the data repeatedly for 100 ms (the number of iterations would be quite low, because the Secure Enclave is slow). Then use some standard cryptographically secure hash function to turn the result into the hash that I need.

PS. Comment said that a signature wouldn't necessarily be unique. I suppose it could be filled with random data, for example. Since all I want is a random looking, but deterministic bit pattern, it might be better to fill the password + salt with deterministic padding and then encrypt. Still not sure if that would be deterministic.

Do you think this is safe?

The biggest question is whether repeatedly calculating a signature loses entropy. It shouldn't, but then what I'm doing is not a typical use case, and the designer of the signature algorithm might be fine with losing 2 bits of entropy every round. The normal use case would still have 254 bit entropy. Do you think this method will generate 2^256 possible keys or fewer?

Another objection is that an attacker might get hold of the public keys and use them somehow to undo signature calculation. Of course just because public keys are called "public", they are not publically known unless someone makes them public.

(If there are no objections, then this method should be quite secure. A reference to the private key is stored in the keychain; to get it an attacker would have to unlock the phone and install an app with a forged or stolen signature from my company. Then they would have to brute force the key on the iPhone, since the private key cannot be removed from the secure enclave, losing the ability to use powerful hardware).

PS. It had never occurred to me, but generating 10 signatures for the string "abcdef", using the same key in the iPhone Secure Enclave, did in fact produce 10 different signatures :-( So whether my idea was good or not, it doesn't work.