texts: Optimized Random-OT Security in Standard Model

texts:
I was going through the paper - " Efficient Oblivious Transfer and
Extensions for Faster Secure Computation" by Asharov et al. where the authors propose an optimized OT protocol along with a Random-OT (needed for finding multiplication triples) and a Correlated-OT (needed for Yao GC) protocol for specific applications.

On the footnote on Page 14  (which also continues on the footnote on Page 15), it is written that "That is, in addition to receiving their input and output from the random OT functionality, the parties receive the “discrete log” of the pertinent values."
I am not able to understand why the sender's ( $S$ ) output from ideal functionality got changed from ($x^{0}_i = KDF(g^{\beta^{0}_i})$) and ($x^{1}_i = KDF(g^{\beta^{1}_i})$) to ($\beta^{0}_i$, $x^{0}_i = KDF(g^{\beta^{0}_i})$) and ($\beta^{1}_i$, $x^{1}_i = KDF(g^{\beta^{1}_i})$) and also the reciever's ( $R$ ) output was also expanded by adding $\beta^{\sigma_i}_i$.

How does including the discrete logs of the values in the output help in proving the security of R-OT protocol specified, in the standard model (i.e., without random oracle)?
The protocol 51 in the paper, which is the proposed $n$x$OT_l$ protocol, the author says that the protocol is secure in standard model based on DDH assumption. In the last paragraph on page 13, a proof is also given backing this claim.
Can anyone please clear it to me if this proof is actually based on Random Oracle Model? Nowhere in the proof is the hardness of DDH used, and rather the $KDF$'s output being indistinguishable from a random $l$-bit string is used (though this also follows from hardness of DDH). Is $KDF$ being modeled as a Random Oracle here?


texts: How should a string be converted to a number for use by a hash function?

texts:
After reading this question/answer I thought I'd try and implement the SHA-256 for my own education. My initial thought for converting the input into a number was to use a line of code like sum([ord(character) for character in input_string]), I quickly realized this is a terrible idea because I'm greatly reducing the entropy of the input by mapping a lot of highly varied strings to a relatively small number of integers. My second though was to get a hex representation of the string then get the base 16 integer representation of that hex string

import binascii
input_integer = int(binascii.hexlify('hello world'), 16)

However since I'm not an expert in hashing algorithms there may be something wrong with my second implementation that I'm not aware of.

How do you convert a string to a number to be used in a hash algorithm?

My code is written in python, for reference


texts:
Suppose you have a string AAA that was hashed with SHA1 to produce 606ec6e9bd8a8ff2ad14e5fade3f264471e82251.

If I rehash 606ec6e9bd8a8ff2ad14e5fade3f264471e82251 10x times with the same SHA1 algorithm, would the entropy keep on decreasing?

If so, would it ever reach a dangerous level to a point where AAA could be recovered?

P.S: SHA1 was just an example. Ideally, I'd use BLAKE2b or a SHA3 candidate.


texts: How does the size of the prime affect Elliptic Curve Bit Security?

texts:
I am using the MIRACL Library to implement an Elliptic Curve Diffie Hellman based Key Exchange according to ECDH-Scheme-Wikipedia.

Referring to the Miracl Docs they suggest a few curves.
Each curve is with respect to a prime p which is n bits in length Miracl Docs EC suggestions.
How does the n bit length of the prime e.g. from the ssc-192 suggestions refer to the provided bit-security?


texts:
I don't know mucho about Cryptography, I try to understand, It's for homework.

Why the standard DH is not suﬃcient to ensure the security of the Diﬃe-Hellman key exchange?

My answer was:

In the standard Diﬃe-Hellman key exchange protocol, both parties compute the secret value gαβ for two privately chosen values $\alpha$ (by Alice) and $\beta$ (by Bob). An eavesdropper can publicly see the pair ($g^{\alpha},g^{\beta}$). So, if checking whether, for some $g^{\gamma}$, it is the case that $\gamma = \alpha \beta$, were computationally easy —i.e., the DDH assumption fails—, then the eavesdropper would have found $g^{\gamma} = g^{\alpha\beta}$ without disclosing $\alpha$ nor $\beta$ explicitly, even if the DH assumption is true. This is why the CDH/DDH are the assumptions that really matter in the key exchange.


texts:
Quite strange question, but here goes:

I don't quite understand how asymmetric encryption works. Take SSH for an example: The server will always be listening for commands, so anyone who has the public key (easily obtained as I understand (I might be wrong)) can send commands to the server and it would appear as if the correct client had sent them? I know there must be a catch but I can't seem to figure it out. Even if SSH used symmetric keys, the exchange of those keys uses asymmetric keys so a man-in-the-middle could tell the server it's password instead of the real one?

Sorry if this is a little rambley, it's quite hard for me to explain.

Thanks in advance.


texts:
Which HMAC scheme is more secure? Or are they of the same level of security?
Scheme One

Compute a HMAC on the data to encrypt (cleartext/plaintext)

Encrypt the data with AES_CTR_256, and append above HMAC to end of ciphertext

Scheme Two

Compute a HMAC on the data to encrypt (cleartext/plaintext)

Encrypt the data with AES_CTR_256, and append above HMAC to end of ciphertext

Compute another HMAC on the ciphertext_HMAC combo and append it; ciphertext_HMAC_HMAC

And also, would using the same HMAC key be secure for scheme two?


texts: Is there any inbuilt functionality in sage to check if any S-Box satisfies Strict Avalanche Criterion or not?


texts: Does hash_df use binary or an ASCII hexadecimal representation for numbers to be passed to the hash function?

texts:
I'm implementing the HASH_DRBG algorithm.
As per NIST-SP800 90 document for HASH DRBG Generation, section 10.4.1 "Derivation Function Using a Hash Function (Hash_df)", the Hash_df algorithm contains this step 4.1:

  temp = temp || Hash (counter || no_of_bits_to_return || input_string).

I believe || here represents "append" operation. According to the algorithm, do I have to make the append operation and hashing on an ASCII hex string or a binary string?

Example, I can do
Hash  ("000102030405060708090A0B0C0D0E0F101112131415161718191A1B1") where the input is ASCII string characters. Or I can do Hash(&bytearray) where bytearray stores the non-ASCII numbers in binary?

Which one is expected as per the algorithm? I am planning to use SHA-1 or SHA-256 as Hash here.


texts:
I have blinded $m = 16$ with $r= 13$, $e = 7$ and $n = 209$.
This resulted in $m' = 464$, which led to a $s' = 8$.

Now, I want to unblind this $s'$ by using $s = s' \times r^{-1}$ but im stuck at filling in the $r^{-1}$?


texts: Question regarding of the ECC test vector format

texts:
I am trying to find some ECC test vector for using.
I just find some post (like this) and github resource (like this )
They are good reference to my C test code but I'd like to get some more advice...

Most of the test vector given looks like such format:

k (or m):m = 20
X = 0x83A01A9378395BAB9BCD6A0AD03CC56D56E6B19250465A94A234DC4C6B28DA9A
Y = 0x76E49B6DE2F73234AE6A5EB9D612B75C9F2202BB6923F54FF8240AAA86F640B8

which by my understanding, k (or m) is the private key and (X，Y) are the public key--so (X,Y)=(m dot G), G is the base point defined by NIST or BP curve as “standard”.
Q1：Is such understanding correct?

It is meaningful to see the X/Y are both 32Byte for curve sepc256k1--so expect the key length would be 256b(32byte);

my question is about the privite key (denote as m or k).
for some test vector, m(or k) is given as:

m = AA5E28D6A97A2479A65527F7290311A3624D4CC0FA1578598EE3C2613BF99522

some other test vector m(or k), however, would be like below:

k = 112233445566778899
k = 10
k = 57896044618658097711785492504343953926418782139537452191302581570759080747168

These are all pure number, so
Q2: Does that mean we need convert them to hex--and by doing that I can get exactly 32byte test vector?


texts:
I am reading the TPM Design Principles v1.2 §17 and do not feel I fully understand the example they give on how the counters would work.
Apparently monotonic counters are used to prevent replay attacks. I wonder if there is content somewhere, which would explain how a counter like the internal base counter would work with more than one external counter. The example in the spec uses two external counters and seems to save the difference.
I read the section again, and it says "...IB drives all external counters on the machine." The example shows how IB is used to return the value of the external counter, while it leverages the difference value. Does this seem to suggest that IB is used to keep the external counters honest? To validate that external counters are not manipulated since the last save?
I have searched online for monotonic counters; perhaps I need to look for some other term? I do not see any content, which explains how the Internal Base counter would interact with more than one counter; I am looking for an example that shows the counters in action and justifies the Internal Base counter implementation vs. the external counters. I see the definition in the spec; I do not see how the different counter would be used to perhaps provide different functions or services?
I think the problem is that the example in the spec is written in pseudo-code format; I need a little more explanation about what is actually happening to the Internal Base Counter when there are two or more external counters, and how the "difference" value is saved and used later to return the value of an external counter.
For instance, is there a different value associated with each counter?


texts: A patched SHA1 attempt for password verification

texts:
This is a classical scenario: For our web based authentication platform we have a username and a password field. User enters these values and presses Log In. The browser gathers the user data, calculates a digest of the password and sends everything to the server side. We don't want to send the password over the network, it might not be safe.

On the server side we have the database which stores the hashes for passwords in a table (among other stuff).

Initially we were using MD5 for this purpose but after a while we threw out the idea as being the most over hacked message digest with large available rainbow tables, so once someone captures the packet they easily can guess the password (if it's a weak one).

Now we have switched to SHA1 for calculating the digest... There remains only one problem. The initial database layout was to use 32 characters for the message digest of the password (the length of the MD5 hex string) ... however the SHA1 is 40 characters long (when transformed to hex bytes). The bigger problem is that we don't want to increase the length of the message digest table's column (nor the length of the used message digest itself) since the digest value is used at some stages in a few algorithms and it relies on the fact that it has 32 characters.

So someone from the architecture team came up with the idea: Let's add an extra validation step to the login procedure and ask a 4 digit long pin from the user. And when we have this PIN we simply remove two times the characters found at the given PIN position from the SHA1 digest of the password (from the beginning and from the end), and this way we end up with a 32 character long digest, which cannot be traced back to the password since it hasn't got all the required information.

There is just only one thing which bothers us: what are the theoretical chances that two different passwords which give two different hashes after applying two different character removal algorithms (based on two different PINs) will give the same result.

And since we have no cryptanalyst nor cryptographer in our team we have to turn to the community :) Thank you for helping.


texts: Applying differential cryptanalysis to ciphers with addition mod $2^{32}$

texts:
I am studying differential analysis and have a question.

Consider the following simple cipher:
$$c_1 = S(m_1 \oplus k_1) \oplus k_2$$
(Plaintext $m_1$ xor with key $K_1$, then result goes into an S-BOX, the output of which is xor'd with $K_2$). This case is very simple. Using the main property of XOR we can get differential that independent from KEY.

How do we can get such differential if instead of XOR we use addition modulo $2^{32}$? When using XOR, we have  $(m_1 \oplus k_1) \oplus ( m_2 \oplus k_1 ) = m_1 \oplus m_2$. What operation need apply to get rid of the key when using addition modulo $2^{32}$?


texts: A (current or soon-to-be) NIST-recommended alternative to ECC?

texts:
So this comes from the professional rumor-mill, and I'm wondering if anyone might either debunk or shed light on this.

My understanding is ECC is generally now preferred over RSA simply due to how much more efficiently it operates.  After a 2048 key length, RSA simply doesn't return as much value for a longer key length. whereas ECC can offer greater levels of protection for much less processing overhead.

Is there discussion about a more efficient/powerful alternative to ECC which NIST is preparing to favor (if not already) ahead of ECC?  And if so, what might that be?


texts: Does CPA-secure means security against differential cryptanalysis?

texts:
I've read on differential cryptanalysis where it traces the differences on the changes of ciphertexts of the same plaintext, except for some bits.

However, I wonder is the differential cryptanalysis is applicable to CPA secure cryptos like El-Gamal?

Thanks in advance.


texts: C# equivalent of openssl ecparam -name prime256v1 -genkey -noout -out

texts:
I am having some issues generating a proper private key,I need it to be an  Elliptic Curve private key suitable for use with NIST P-256 which i than need to  convert to Base64-encoded private key in PKCS #8, for some reason when I generate the key and than base64 encode the bytes I end up with a string of 108 characters. but I need it to be in the range of 184 characters. The following is what I am doing with bouncy castle, I am aware that this is more of a crypto section but also just knowing the steps of what it is I need to properly do would be appreciated from a non programming level

       // Curve Cryptography (ECC) key pair.
        DerObjectIdentifier ecParam = new
        DerObjectIdentifier("1.2.840.10045.3.1.7");
        ECKeyPairGenerator keyGen = new ECKeyPairGenerator();
        keyGen.Init(new ECKeyGenerationParameters(ecParam, new
        SecureRandom()));
        AsymmetricCipherKeyPair keyPairServer = keyGen.GenerateKeyPair();

        //Grab private key from key pair
        // for storing.
        PrivateKeyInfo pkInfo =
        PrivateKeyInfoFactory.CreatePrivateKeyInfo(keyPairServer.Private);
        String privateKey = Convert.ToBase64String(pkInfo.GetDerEncoded());


texts: relationship between equivalent ways of computing RSA private key

texts:
I have found two ways to compute the RSA private key, but i have trouble understanding why they are equivalent.

$1) D={k \phi(N)+1 \over E}$

$2) E* D=1 \mod \phi(N)$

$1)$ AFAIK comes from taking the relationship between eulers theorem and a modular identity such that.
$$
M^{1+ \phi(N)} \equiv M \mod N \qquad \land \qquad M^{E*D} \equiv M \mod N
\\
\qquad \text{ Euler}  \qquad  \qquad  \qquad  \qquad \qquad \qquad \text{ Identity}$$

So we can see that the exponents must be the same, and that exponentiating by an integer $K$ should make no difference in modular arithmethic

$k \phi(N)+1 = E*D$

so

$D={k \phi(N)+1 \over E}\\$

The origin of $2)$ eludes me, why is it equivalent to $1)$?


texts: Encrypted files in an encrypted partition or folder

texts:
Recently I started wondering about multiple encryption and found pages upon pages of posts and debates about the security of cascades.

Now, don’t worry – I'm not looking for someone to discuss a homebrew cascade encryption scheme. What I do wonder about is the dangers of multiple layers of encryption.

I keep most of my sensitive files on a LUKS encrypted USB stick – and most of the files are encrypted themselves. There are AES encrypted password wallets, password protected LibreOffice documents (using AES if I have understood the documentation correctly) and lately I have been developing a growing folder of Camellia encrypted files (thanks to a colleague that discovered that GPG now included the cipher).

In short: does storing these encrypted files in an encrypted partition/folder create the same potential weaknesses as cascade encryption? If not, what about encrypting a .tar of encrypted documents?

Pardon my ignorance, and thank you in advance.


texts:
On a high level the question is: how does one cryptographically sign streaming data?

Here is the context:

a number of people are continuously streaming data to me
the data is public and does not necessarily need to be encrypted
I would like to confirm that it is indeed them sending the data
I would like to compensate them (perhaps a payment on a blockchain to a public address)

What is the general strategy (or is there a standard?) to achieve this?  Here are some rough thoughts:

Alice signs contiguous chunks of data with her private key, I confirm it comes from her with her public key and can encode some rules to pay her (as identified by her public key).

Are there papers or further reading or I'm I on the wrong track?


texts: Multiple attributes under shuffled differential privacy

texts:
Notation: eps_c (epsilon central), eps_l (epsilon local), n (number of users), d (number of attributes). A single attribute A_i may have |A_i|=r different values for i in [1,d].
Let's suppose each user holds d discrete attributes (e.g., A_1 = Gender with 2 values, A_2 = Age ranges with r_2 values, ..., A_d = Hours online with 24 values).
Some papers like [1], provide amplification for the generalized randomized response model (a.k.a. k-RR) if eps_c <=1. That is, the central privacy must be equal or less to 1 such that eps_l (local) to be amplified.
If we want to collect many attributes (d>1):

Can we set eps_split = eps_c / d <= 1? This would imply a 'total' central privacy greater than 1 depending on the values of eps_split and d.

Or, is it strictly necessary that for a population n, that eps_c = d*eps_split <=1? This would imply that no matter how many attributes you want to collect, the amplification only holds if the central privacy guarantee remains below or equal to 1.

In the same sense, if only (2) holds, if instead of splitting eps_c/d for each attribute, we randomly sample a single attribute per user and spend the whole eps_c on it. Does the amplification use n (the total number of users assuming a totally random sampling technique) or n/d (the number of users answering each attribute)?
[1] Balle, B., Bell, J., Gascón, A. and Nissim, K., 2019, August. The privacy blanket of the shuffle model. In Annual International Cryptology Conference (pp. 638-667). Springer, Cham.
Thank you for your time and help on this subject.


texts: Why is Triple DES not vulnerable to meet in the middle attacks?

texts:
Consider the Triple DES encryption calculated as:

$$C=  E_{K_1}(D_{K_2}(E_{K_1}(P))).$$

For a chosen plaintext attack, given plaintext $P$, we compute the result of $D_{K_2}(E_{K_1}(P))$ and store it as a table of length $2^{112}$, then decrypt the cipertext $C$ using $2^{56}$ possible $K_1$. I think we also have a meet-in-the-middle attack here; and the computation complexity is also $2^{56}$ as in DES. Is this right? But then why does the literature say that 3DES is more secure than DES?


texts: Why not send the identity in the encrypted message?

texts:
I've recently started reading the book "Applied Cryptography" written by Bruce Schneier.

Quite a few times I stumbled across protocols who send the identity outside of the encrypted message (see step 4).

Is there a certain reason to do so? What does speak against sending the identity within the encrypted message?


texts: Is there need for message authentication if a public key is transmitted and then used to encrypt a symmetric key?

texts:
First I'd like to note that I'm really a beginner at cryptography, and while this interests me and while I have researched it in the past few months, there is still a lot of things that simply aren't clear to me, and I would like to have them clarified so I can move on.

Let's say (because this scenario is what I have pondered and have thought about it for a while) that a client has generated a temporary RSA key pair, knows a server's public RSA key beforehand and needs to transmit its own public key securely to the server, in order to agree on a mutual, secret symmetric key, resistant to both eavesdropping and MITM. (I'm not aware of another, better way of negotiating a key when a client has a server certificate beforehand, but that would have more to do with my crypto incompetence.)

So the client encodes its (n, e) in a series of bytes and encrypts the data using the server's public key taking care of proper padding (using, say, OAEP). The server receives this data, decrypts it, and then wants to send its part of the symmetric key to the client. So it chooses this random key, hashes it using a secure hash algorithm (say, SHA-2), encrypts it using the client's public RSA key and fires it off into the network along with the hash.

The client now receives a hash and RSA-encrypted data. It decrypts it using its private key, checking the padding, hashes it, and compares to see if the hashes match.

My question is, is there even need for the hash in the server response so the client knows it hasn't been MITM'd (because the server has proved it decrypted the client's public key)? Can an adversary which doesn't know the server's private key ever change the RSA ciphertext so it passes the OAEP check routines? Even if this happens in some way, the client will end up using a garbage symmetric key—is this dangerous i.e. could be exploited in some way? And if there is legitimate need for the client to know at this stage absolutely no one has tampered with the message, is my simple plaintext hash-based authentication secure? I feel it is pretty obvious but I haven't stumbled upon its use so far, so there may be a good reason. I've heard that MACs are a good, secure solution, but obviously there is no shared secret at this point in the negotiation so I don't see how they can be utilized.

Am I missing something painfully obvious?


texts: What is the state of the art in fast implementation techniques for modular exponentiation?

texts:
I want to calculate ($m^{e} \pmod{N}$) in C or C++. I want to use 2048 bits long modulus $N$ and thus the above process of exponentiation will use a huge amount of calculations and time. I want to know the possible optimizations I can use.

I particularly came across this :

Converting the exponent to its binary bit pattern and then looping from MSB to LSB, calculating the square of the result at each step mod N and if the present bit of exponent is 1, multiplying the result by m.

Also, I can compute the square of the result using the Karatsuba algorithm.

What other optimizations, if possible, exists in this regard?

Is there any already implemented and optimized library for C or C++ for such type of modular arithmetic?


texts: Error-correcting Code VS Lattice-based Crypto

texts:
I'm not an expert in PQ-crypto, but as I understand error-correcting code and lattice-based crypto, the cryptographic assumptions are very similar. The key difference for me is the nature of the noise. In one case, the noise is inspired by the "physical noise," in the other, it's more mathematical and considers a more complex distance (Euclidean distance instead of Hamming distance).
Intuitively, this reason makes sense because every application I know involving lattice-based crypto is more efficient than those based on
error-correcting crypto.

Does my intuition seem correct to you?

If yes, is there a theorem that certifies that every cryptographic protocol based on an error-correcting-code assumption could be transformed into a more efficient lattice-based protocol (i.e., with the same level of security and based on a weaker lattice assumption)?

If no, is there a more informal claim of available research which considers this question? Or it just doesn't make sense to compare these two families of assumptions?


texts: What are the advantages of neural cryptography over Diffie-Hellman algorithm?

texts:
I am not sure whether such a question is accepted here, or if this is the correct place to ask.

I have done some research on this topic, however most of the information was way too complex for me to understand. I know that the most used protocol for key exchange between two parties A and B, in practice is Diffie-Hellman protocol.

I have read here, and understood the basic working protocol for neural cryptography but do not see any clear advantages over the Diffie-Helman algorithm.

What are the advantages (if any) of neural cryptography over the Diffie-Hellman algorithm?


texts: Unlinkability of Merkle-Damgård hash function results

texts:
Question: Are multiple outputs of a Merkle-Damgård hash function (or specifically SHA-256, if this can only be said for a specific algorithm) on unknown data unlinkable? If yes: Can this be formally proven or only said "from experience" / on a basis of "no attack has been found yet"?

Bonus question: Does anything change if we use a sponge-based hash function like SHA-3 / Keccak instead?

Example: $x$ and $y$ are initiated with random values and kept secret.

Let:
$r_0 = h(x||y)$,
$r_1 = h(x||y+1)$,
 ...
$r_n = h(x||y+n)$.

If $h$ is a Merkle-Damgård hash function like SHA-256, are any two $r_a$ and $r_b$ (for $a,b \in [0,n]$) unlinkable, using the definition by Pfitzmann et al.:

  Unlinkability of two or more items of interest [...] from an attacker’s perspective means that within the system (comprising these and possibly other items), the attacker cannot sufficiently distinguish whether these IOIs are related or not.

Background:
I've been reading up on random oracles and found a proof in the random oracle model for a system I am building for my master thesis. One of the first things you learn about the random oracle model is that you cannot instantiate the random oracle with a Merkle-Damgård hash function due to the length extension attack.

Assume the system I am building is not susceptible to length extension attacks (the inputs are constant-length and hashed twice), and the property I am interested in is not "the output looks like perfectly random data" but only "the output of multiple iterations of my algorithm is unlinkable". I am currently wondering if I can instantiate the random oracle with a Merkle-Damgård hash function like SHA-256 in this case without loosing the security proof for the unlinkability, or if I have to fall back to the uncomfortable position of "rel[ying] on the fervent hope that the parts where the actual function is not a random oracle do not impact security".

My current intuition would be that, from experience, the output should be unlinkable, but there is no way to formally prove it. However, any input (ideally with citable sources) would be appreciated.

Edit: This is related to this question, and an alternative way to formulate the unlinkability goal would be correlated-input secure, or more accurately selective correlated-input indistinguishable and -pseudorandom, as defined in the linked paper. So, this may be more of an open research question than I had initially assumed. Still, if someone has an answer I missed, feel free to add it.


texts: Do Partially Homomorphic Encryption schemes also suffer from noise overflow?

texts: Do PHE schemes in general also suffer from noise overflow problem?


texts: Leading 00 in RSA public/private key file

texts:
I found these following values ALWAYS have the leading 00 in public/private key,

  public key: modulus

  private key: modulus, p,q, d mod (p-1), d mod (q-1), coefficient

e.g., modulus

0007:    02 81 81                               ; INTEGER (81 Bytes)
000a:    |  00   <= the leading 00
000b:    |  da ff 24 57 07 8a 4c b8  63 79 79 ff 55 27 10 15
001b:    |  0f 6c ab 0e 17 dc 05 1a  d3 4f 85 77 6c a6 89 37
002b:    |  8c 83 11 3d 5e 11 15 4b  34 5e 5c dd fd 3f a6 dc
003b:    |  6e 3e ff 97 be 5b 49 2a  78 10 f1 bf 80 d6 09 36
004b:    |  34 bd 99 5f 40 d6 1c 41  8d 3a d8 75 b9 53 b2 40
005b:    |  fb e6 97 72 31 f7 bf 81  5e 75 04 e7 35 0d 98 3b
006b:    |  54 83 3f 9d e8 66 3b e6  2f c9 63 98 63 9f d7 88
007b:    |  99 85 75 d1 21 24 e9 1a  9e 3c da 41 7e 92 5f f1

Could someone tell me why RSA public/private key need the leading 00 ?


texts: Reverse Shamir's Secret Sharing Algorithm?

texts:
Shamir's Secret Sharing algorithm works by breaking a single secret to multiple parts. While it is trivial to implement the reverse in a $n$-out-of-$n$ scheme, how would one implement an $m$-out-of-$n$ scheme were $k$ predefined shares $(k < m)$ are included in the share pool?

It is obvious that the resulting secret will be random but deterministic-ally derived.


texts: What is the key derivation function used in GnuPG, and how long may its input be?

texts:
I am currently working with GnuPG on a new project of mine. It would be very useful to know two things for that, which are not described in the manual:

What is the maximum input size of a symmetric key in GnuPG?
What key derivation function does GnuPG use?


texts: Can the attack against SHA-1 be parallelized?

texts:
Can this attack be parallelized?  It is a $2^{57}$ complexity collision attack on SHA-1 based on disturbance vectors.

If it is practical it is easy on a GPU ($\approx1.1$ GPU-days).  If it is completely sequential it is much more tedious but still possible ($\approx556$ days on a 3GHz CPU).

Both numbers are small enough to beg the question "Why has nobody done it already?".

Reference: Classification and Generation of Disturbance Vectors
for Collision Attacks against SHA-1


texts: At what modulus size does the logjam reduction stage become impractical?

texts:
Attacking a Diffie-Hellman exchange with logjam involves a massive precomputation effort once for the group, and then a comparatively simple reduction stage that is necessary to break each individual handshake. At what DH size does the reduction step, which isn't precomputed, become impractical?

For example, if the reduction stage on an 1024-bit DH group is possible to perform in real-time and the precomputation stage takes one year and \$10 million in hardware (estimates from the original logjam paper), how large would the DH group need to be for the reduction stage to demand the same cost of \$10 million in hardware and a single year (effectively negating the advantage of the precomputation)?


texts: Original NTRU : How to calculate the size of private key?

texts:
In the original NTRU paper：NTRU: A Ring-Based Public Key Cryptosystem,1996, the author proposes 3 choices of implementation parameters: moderate, high and highest. Let's take moderate security level as an example:

I understand the calculation of the public key size: $len_{pk} = N\cdot \log(q)=107 \cdot 6=642$ bits, but why is the private key size 340 bits?


texts: Comprehension question on a signature protocol based on the RSA assumption

texts:
We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R \mathbb{Z}_n^*$ and
$a_1 = \left( G \cdot H^{-v_1} \cdot K^{-m_1} \right)^{1/x}\ \bmod\ n$

$a_2 = \left( G \cdot H^{-v_2} \cdot K^{-m_2} \right)^{1/x}\ \bmod\ n$

...

$x$ is a prime and all values are public. Only $1/x$ is known by Bob because Bob knows the factorization of $n$. It is $a_i, G, H, K \in \mathbb{Z}_n^*$

Is is possible that...

(1) Alice can get $(1/x)$ or the factorization of $n$ by sending lots of messages $m_1, m_2, \ldots$ to Bob and analyse the pairs $(a_i, v_i, m_i)$?

(2) Alice can contruct her own pair $(a_i, v_i, m_i)$ without knowing the factorization of $n$.

I have found this algorithm in a paper and they choose $x$ randomly for each signing process. I ask myself, if it is really necessary to choose $x$ randomly, because finding a big prime number is relatively time-consuming. $v_i$ is under the control of Bob so the signed part between the brackets is always different. Is this enough or should the exponent $1/x$ also be different?


texts: Establish more secure symmetric crypto system given A and B have small initial secret

texts:
Alice and Bob have a secret number X that is known only to them. However, the number is only 14 bits, and Trudy knows they share such a secret and can intercept messages between them. Instead of using X right of the bat for their symmetric key, Alice and Bob want a more secure system because Trudy can brute force X. How can Alice and Bob have establish a more secure system?

My textbook points at Diffe-Hellman as a hint.

I am not sure how to go about this, this is something I came up with:

Alice and Bob enact DH as normal. After Alice receives $g^b$ mod $p$ and Bob receives $g^a$ mod $p$ instead of just computing $g^{ab}$ mod $p$ as their shared key, they add X as well, for $g^{abX}$ mod $p$.

Since $p$ will be much larger than $X$ the whole key can't be brute forced easily. A MiM attack Trudy can try in normal DH is to establish $g^{at}$ mod $p$ with Alice and $g^{bt}$ mod $p$ with Bob. My understanding is $x$ or $g^{atx}$ mod or $g^{btx}$ mod $p$ would be expensive to find for Trudy, thus Alice and Bob retain confidentiality.

I'm not sure if I'm overthinking the problem or if what I came up with adds that much more security that couldn't be achieved in a simpler way. Is my method OK? What could a more secure system be?


texts: What are the steps to decrypt a TLS 1.1 record?

texts:
My question is related to another question in Cryptography about TLS 1.1 and 1.2. I have read both RFC 2246 The TLS Protocol Version 1.0 and RFC 4346 The TLS Protocol Version 1.1. What I know is that one of their differences is TLS 1.0 uses implicit initialization IV (from the key_block) and TLS 1.1 uses explicit IV, which can be generated with either of the three ways specified in Section 6.2.3.2 of RFC 4346. In the same section, it is stated that

  The decryption operation for all three alternatives is the same.
  The receiver decrypts the entire GenericBlockCipher structure and
  then discards the first cipher block, corresponding to the IV
  component.

The above statement is not clear to me. For example, if I have an encrypted message consisting of blocks [Encrypted Block 1], [Encrypted Block 2], ..., [Encrypted Block n], does that mean that when decrypting, I should discard [Encrypted Block 1] from the other blocks and decrypt [Encrypted Block 2], ..., [Encrypted Block n] using [Encrypted Block 1] as IV?

Is the above example correct? If not, how can the IV to be used for decryption be determined?
Is the decryption for TLS 1.1 the same as TLS 1.2?


texts: Probability that rank of a square matrix, whose each element is uniformly random from a ring of integers modulo prime p, is not full

texts:
I am currently reading a paper from CRYPTO, which is a top conference in cryptology. In the paper, the authors use a thereom like the one given below without a rigorous proof:

the probability that $Rank(A)\neq n$ is upper bounded by $1/p$, where $p$ is a prime, $n$ is an integer, $\mathbb{Z}_p$ is a ring of integers modulo $p$, and $A$ is a square matrix which is chosen from $\mathbb{Z}_p^{n\times n}$ uniformly at random.

I am curious how to rigorously prove the thereom. I would appreciate it if anyone could teach me how.


texts: Which are the current solutions to the illegal values in the homomorphic secret sharing?

texts:
There is a usual example about homomorphic secret sharing, focused on e-voting. Supposing we use Shamir's scheme for the Secret Sharing system, a participant generates a polynomial whose a0 is +1 (yes), 0 (abstention), or -1 (no), and then distributes the calculated n points to the tellers. Each teller will calculate the sum of every point, and publish the result. Everyone is able to calculate the resulting polynomial, which is equal to the sum of all the generated polynomials by the voters. The secret revealed then, is the sum of every +1, 0, or -1.
One of the vulnerabilities this system has, is that a malicious player could generate a polynomial with a0 = 7893. If the a0 value is out of the {-1,+1} range, it will corrupt the final outcome. Which are the current solutions to this problem? In other words... How is it possible to ensure that the a0 is between a and b, without revealing its value?


texts:
I decided to use TweetNaCl in my project and did some tests. For some reason, its Ed25519 signing mechanism gives me very short public and private keys, as opposed to RSA, though RSA, as I it explained to me, is not secure.

So can I trust this implementation, experts, please?


texts: What security properties were required by NIST on the SHA3 project?

texts:
From this link, NIST claims that:

  A cryptographic hash algorithm (alternatively, hash "function") is designed to provide a random mapping from a string of binary data to a fixed-size “message digest” and achieve certain security properties. (...) As a result of these workshops, NIST decided to develop a new cryptographic hash algorithm for standardization through a public competition.

What security properties were the participants of the competition required to prove about their constructions? Could you point to the right link?


texts:
What is the order and cofactor of a base point?
Is it possible to deduct the order and cofactor, given just the basepoint.
What about the other way around from order and cofactor to basepoint?


texts:
I am reading page 39 in this "Post Quantum Cryptography" book. Why does equation 15 hold? There is no further knowledge about f and you definitely cannot use any power laws. So, why is $f^{2^w-1-b_i}(f^{b_i}(x_i)) = f^{2^w-1} $ valid?

I have my doubts, because $f(x) = x+1$ is already a counterexample.


texts: How can I visually explain M of N encryption (Shamir Key Sharing)?

texts:
I'm trying to find a simple way to explain M of N keys to end users, where 2 keys would unlock something.

So far, all I found was this complex example where the key threshold was 1 (just one key of any lock will unlock this):

Larger version here.

Lacking any commonly accepted illustration, or image, is there any visual way to express M of N keys (Shamir Secret Sharing)?


texts: Are there any tools for expressing the cipher operations as a system of equations?

texts: The first step In Algebraic-attack is expressing the cipher operations as a system of equations. Is there an automated tool to do this?


texts: If TDP exist then CCA-secure PKES exist?

texts:
My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following:

  If trapdoor permutations exist then CCA-secure public key encryption schemes exist.

How is this justified?

The slides cite this article. I was wondering if there is a short explanation for this.


texts: Small subgroup confinement attack on Diffie-Hellman

texts:
I am trying to understand the small subgroup confinement attack on the Diffie-Hellman algorithm. I will present the attack and try to explain why it works.
Small subgroup confinement attack on the Diffie-Hellman algorithm
Let be a group $\mathbb{Z}_p^*$ where $p$ is a large prime and $\alpha$ a primitive root modulo $p$. Let's consider that Alice and Bob want to do a key agreement on the whole cyclic group $\mathbb{Z}^*_p$ using the Diffie-Hellman algorithm. The following sequence diagram illustrates how Eve can perform a small subgroup confinement attack:

By doing this, if $k$ is well chosen, the secret $S$ can be found by exhaustive search.
How to choose the $k$-value
As $p$ is a prime number, the order of $\mathbb{Z}^*_p$ is a composite, so there exist subgroups. Say $\mathbb{G}_w$ is one small subgroup of prime order $w$. So by picking $k = \frac{p-1}{w}$, the secret value $S \in \mathbb{G}_w$ and as it is a small subgroup, $S$ can be found by exhaustive search efficiently.
Why does it work?
In this section I will try to prove that $S \in \mathbb{G}_w$.
We know that $w\text{ | } (p-1)$ so $\exists k$ as $p-1 = w \times k $. Plus we know that $ord(\alpha) = p - 1$ because it is a primitive root modulo $p$ and a consequence of the Cauchy's theorem is that given an element $x$, $ord(x^k) = \frac{ord(x)}{(ord(x) \wedge k)}$.
So in our case we have:
$ord(\alpha^{ab(p-1)/w}) = ord(\alpha^{abk}) = \frac{ord(\alpha)}{(ord(\alpha) \wedge abk)} = \frac{(p-1)}{((p-1) \wedge abk)} = \frac{wk}{ (wk \wedge abk)}$ and we know that $(wk \wedge abk) = k$ because $w$ is a prime number. So we obtain that $ord(\alpha^{ab(p-1)/w}) = \frac{wk}{k} = w$ so we can conclude that $S \in \mathbb{G}_w$.
Could someone approve or disapprove my demo?


texts: Short Integer Solution Problem with ||z||<=B

texts:
Why following constraints on $||z||$ are required
$||z||<=B, B<q$


texts:
I've been asked to write some course materials on cryptography and included in the objectives are some vulnerabilities/attacks. Most of these I have nailed but there are three that I don't seem to be able to find any info on:

Version spoofing attack (possibly the same as version rollback attack which I have written about)
Backtrack attack
Reverse protocol attack (I found one website that mentions this but not what it actually is)

Can anyone shed any light on them?


texts: Linear AES : expression of K in AES(P) = AP+K

texts: I am currently trying to attack a modified AES with an identity S-box. I found this topic which explains that we have the equation $AES(P) = AP + K$, with $A$ a 128x128 matrix that is not key-dependent and can easily be computed, and $K$ a key-dependent constant. However, I fail to understand where this $K$ comes from exactly. Also, would knowing its value and its expression be enough to retrieve the master key ?


texts: Finding where I am in a linear recurrence relation

texts:
Suppose I have a linear recurrence relation
$$a(n) = c_1 a(n-1) + \dots + c_k a(n-k) + d,$$
where the constants $c_1,\dots,c_k,d$ are given and the initial values $a(0),\dots,a(k-1)$ are given as well.  Assume that all arithmetic is done over some finite field, say $GF(p)$ where $p$ is a large prime (i.e., everything is done modulo $p$).

Suppose I am given the value of $a(n)$, where $n$ is unknown.  Can I efficiently recover $n$?  Or, more precisely, suppose I am given $b$, with the promise that there exists some $n$ such that $b=a(n)$.  Can I efficiently find some positive integer $n$ such that $b=a(n)$?  (Any integer will do.)

Effectively, if you're given a value from somewhere in the sequence given by this recurrence relation, is there an efficient algorithm to recover the index of that element in the sequence?  By efficient, you can substitute "polynomial time" or "feasible in practice" or something like that.

How does the complexity of this problem relate to the complexity of the discrete log problem?  Are they of equivalent hardness?  Can I use an algorithm for the discrete log problem to solve this problem, or might this problem be harder?

I know the answer will depend upon the particular recurrence chosen: for some it will be easy, for others it will be hard.  Is there any way to characterize or classify for which recurrences this problem is hard?  Maybe some criterion on $c_1,\dots,c_k,d$?

Note that the discrete log problem is a special case of this recurrence relation problem.  In the discrete log problem, we are given $x,y$ where $y=x^n$, and the problem is to find $n$.  This is an instance of the above recurrence relation problem, where the recurrence is $a(n)=x \cdot a(n-1)$, $a(0)=1$.  Given $y$, asking for an index $n$ such that $y=a(n)$ is equivalent to asking for an integer $n$ such that $y=x^n$.  So, the recurrence relation problem I'm asking about is in some sense a generalization of the discrete log problem.  (Also, this implies that there exist recurrences where this problem is as hard as the discrete log, but it does not immediately suggest criteria for when that happens, nor whether there might be any case where this problem is harder than the standard discrete log.)


texts: have a question in the book "introduction to modern cryptography"

texts:
"introduction to modern cryptography. 2ed" in page 254

"By obtaining sufficiently many estimates and letting $x_{i}$ be the majority value, $A{'}$can ensure that $x_{i}$ is equal to $gl(x, e^{i})$ with probability at least $1-\frac{1}{2n}$.

Why is the probability $1-\frac{1}{2n}$?


texts: Is there a hash algorithm that is slow to calculate but relatively fast to check?

texts: Or more generally, is there a function or algorithm that is slow to calculate/execute, has a reliable execution time, and has a result that can be tested much more quickly than the calculation took?


texts: Cocks IBE Scheme: why is -a a quadratic residue mod n?

texts:
In the Cocks IBE scheme it is required for the hash function, that the Jacobi symbol of its output and the universally available moduls $n = p*q$ is $+1$, so:

$\Big(\frac{H(ID)}{n}\Big) = \Big(\frac{a}{n}\Big) = \Big(\frac{a}{p}\Big) * \Big(\frac{a}{q}\Big) = +1$

So, either both Jacobi symbols $\Big(\frac{a}{p}\Big)$ and $\Big(\frac{a}{q}\Big)$ are $+1$ or $-1$. In the frist case, $+a$ is a quadratic residue modulo $n$, because its the product of two numbers that are quadratic residue mod $n$. So far its clear to me. However, in the latter case, why is $-a$ a quadratic residue?

In Cocks paper [1] it says: The latter case arises because by construction $p$ and $q$ are both congruent to 3 mod 4, and so $\Big(\frac{-1}{p}\Big) = \Big(\frac{-1}{q}\Big) = -1$

If I try solve it for the case that $-a$ is a quadratic residue mod $n$, and that both $\Big(\frac{a}{p}\Big) = \Big(\frac{a}{q}\Big) = -1$,

I come to the following result:

$\Big(\frac{-a}{n}\Big) = \Big(\frac{-a}{p}\Big) * \Big(\frac{-a}{q}\Big) = \Big(\frac{a}{p}\Big) * \Big(\frac{-1}{p}\Big) * \Big(\frac{a}{q}\Big) * \Big(\frac{-1}{q}\Big)$

$ = \Big(\frac{a}{p}\Big) * (-1) * \Big(\frac{a}{q}\Big) * (-1) = \Big(\frac{a}{p}\Big) * \Big(\frac{a}{q}\Big) = (-1) * (-1) = +1$

However, in the last step both Jacobi symbols are $-1$, and thus $-a$ cannot be a quadratic residue mod $n$, because it is the product of two quadratic nonresidues?

I must have made a mistake somewhere, but I don't see it.

[1] Clifford Cocks: An Identity Based Encryption Scheme based on Quadratic Residues, 2001.


texts: AES reverse Rijndael key schedule with decryption round keys

texts:
I want to get the original encryption key (32 byte) of AES 256 (CBC) implementation.
The implementation has the values of the inversed round keys values hard coded into the decryption function.
I have the 15 rounds*32 byte decryption keys
Is there an algorithm that I can use to get the original generating key?
I know that I can reverse the expansion of the encryption key, but the round keys for decryption has the addition "inversion" generated by this:

// inverse-cipher-ify the decryption round key (fips-197 section 5.3)
    for (var r = 1; r < rounds; r++) {
        for (var c = 0; c < 4; c++) {
            tt = this._Kd[r][c];
            this._Kd[r][c] = (U1[(tt >> 24) & 0xFF] ^
                              U2[(tt >> 16) & 0xFF] ^
                              U3[(tt >>  8) & 0xFF] ^
                              U4[ tt        & 0xFF]);
        }
    }

Can this be reverted too?
Thank you


texts: Looking to verify my understanding of RSA math

texts:
I want to explain RSA to a programming audience with no cryptography background and I want to be sure my explanation is correct. The goal is to help them understand how RSA works under the hood. You can assume the audience knows modular arithmetic at this point. Could you please let me know if this explanation is clear or if I've missed anything critical for a lay audience? Do you think I should cover more number theory? The actual delivery will be refined later and I'll cover OAEP further along. I just want to be sure I haven't made a mistake here.

---EXPLANATION BEGINS---

RSA's security is based on factoring primes. A problem which is considered hard though there's no formal proof of that.

We start by selecting two large primes, p and q. Each should be 2048 bits. We multiple p and q to yield n.

$n = p\times q$

n is referred to as the modulus and will be 4096 bits long, which is the recommended number of bits to achieve ~128-bit security.

Our plaintext, p, is then represented as a number less than n. We also have a public key (e) and a private key (d).

RSA works as follows. The ciphertext, c,  is generated by raising p to the power e modulo n:

$c = p^e mod\ n$

The plaintext is recovered by raising c to the power of d modulo n:

$p = c^d mod\ n$

So encryption then is a matter of multiplying p by itself a certain number of times modulo n. And d is a matter of multiplying the ciphertext by itself a certain number of times modulo n to arrive back at the plaintext. Another way of looking at it is that encryption involves mapping the plaintext to another number (the ciphertext) in the finite set n. And decryption is about mapping the ciphertext back to the plaintext. You can look at it mathematically like this:

$c^d mod\ n = (p^e)^d mod\ n = p^{ed} mod\ n = p$

RSA's security comes from it being easy to map the plaintext to ciphertext, but being computationally infeasible (when the keys are sufficiently large) to do the reverse unless you know the decryption key (d).

So we need to generate keys e and d such that this scheme is possible. Specifically, d needs to be the inverse of e. To do this, we can use something called the totient of n, represented by $\Phi(n)$. The totient of n is the number of elements from 1 to n - 1 that are coprime to n. Two numbers are coprime if their only common divisor is 1. Finding $\Phi(n)$ when p and q are both prime is easy. It's:
$\Phi(n) = (p-1)(q-1)$

So to take a toy example, let's say p = 3 and q = 11, in that case:

$n = 3 \times 11 = 33$

$\Phi(n) = (3-1)(11-1) = 20$

So there are twenty numbers from 1 to 33-1 inclusive which are coprime with 33.

To generate the public key (e), find a value of e such that the following is true:

$gcd(e, \Phi(n)) = 1$

In other words, e should be coprime to $\Phi(n)$. By doing this, we're guaranteed to be able to find an inverse (d) to serve as our private key.

From our toy example above, e could be 3. To find the corresponding private key, we need to find a value of d such that the following is true:

$d \times e \equiv 1 \ mod \ \Phi(n)$

$d \times 3 \equiv 1 \ mod \ 20$

We can find d using the Extended Euclidean Algorithm. In this case, that would be 7.

So now that we've generated our public (e) and private (d) pair, let's encrypt a piece of plaintext encoded as the value 29. Our ciphertext is then:

$c = p^e mod\ n = 29^3 mod\ 33 = 2$

Recovering the plaintext is then:

$p = c^d mod\ n = 2^7 mod\ 33 = 29$

Some additional notes:

Common keys for e are {3, 5, 17, 257 or 65537}.
Notice that when we generate the private and public keys we mod against $\Phi(n)$, and when encrypting and decrypting, we mod against n

---EXPLANATION ENDS---


texts:
I keep seeing the term "Cryptographic Agility" referenced. What does it mean?

For instance:

https://msdn.microsoft.com/en-us/library/windows/desktop/bb204775(v=vs.85).aspx

  One of the key value propositions of CNG is cryptographic agility, sometimes called cryptographic agnosticism.

http://research.microsoft.com/apps/pubs/default.aspx?id=121045

https://media.blackhat.com/bh-us-10/whitepapers/Sullivan/BlackHat-USA-2010-Sullivan-Cryptographic-Agility-wp.pdf

The second source suggests that it means multiple encryption algorithms can use the same key. Is this true?


texts:
I'm looking for Test Vectors to test my implementation of PICCOLO. I would like to test a different input from the usual where the key and the plaintext are either 000..000 or FFF...FFF.

I wrote algorithm in C, like described one in paper http://www.iacr.org/archive/ches2011/69170343/69170343.pdf    but i did not get the same results like test results. I just want to compare my middle steps like in post  Test vectors for PRESENT algorithm?


texts: On the current memory retain limits for the coldboot attack (2020)

texts:
ColdBoot attack is introduced by Halderman et. al in 2009

Lest we remember: cold-boot attacks on encryption keys

In their articles, they represent experimented that

We found that the dimensions of the decay curves varied considerably between machines, with the fastest exhibiting complete data loss in approximately 2.5 seconds and the slowest taking an
average of 35 seconds.

Currently, Wikipedia on the Cold Boot attack article states that

Depending on temperature and environmental conditions, memory modules can potentially retain, at least, some data for up to 90 minutes after power loss

and give a reference to this article!;

Cold Boot Attack on Cell Phones by Bali in July 2018

A quick look at the article means that this is not a reliable source for this claim.

Does this claim true? Since it is huge jumping from seconds to hours.
Are there any reliable sources for the actual timings?


texts:
I'm using Shamir's secret sharing in a 2:3 system.
Thus a secret Key is split in 3 subkeys (KeyS:KeyC:KeyT)

I've 3 entities at play here, Srv, Client, Tag, each one storing one subkey.

In my protocol, Client reads KeyT from the Tag and combine it with its own KeyC or query KeyS from Srv over a secure channel.

I assume I trust the Client since its code is verified and I trust the Srv as well. I don't trust the Tag and the communication between Client and Tag is not encrypted.

However, the Tag can be programmed with the Key so that some sort of 3 step authentication between the Client and the Tag must be run before a secret area can be read from the Tag (this authentication does not reveal the secret Key on the wire).

So, do I need verifiable share here ?

As far as I understand it, if the Tag is under attacker control, and it provides a wrong KeyT then the wrong derived Key computed in the Client will not be known to the attacker, since it never leaves the Client (even during authentication). Later authentication will then fail, since the Tag can not know the KeyC from the Client then the wrong computed Key.

Also, if an attacker is able to copy the Tag (without the secure area, since she can't know the Key beforehand to access it), the Client will compute a correct Key but this will fail at the authentication step with the Tag not knowing this Key and thus, unable to provide a proof it does.

The only drawback here would be for the attacker to record the complete Tag programming where the Client is programming the Key in the tag.
I don't think I can do anything against this but the advantage gained by the hacker is kind of useless since such Key is random and specific for this Tag only.


texts: Why is XOR preferred over XNOR in cryptography?

texts:
The advantages and properties exhibited by XOR are also exhibited by XNOR, like the ones mentioned in many answers like this one

Information is preserved. $c = a \oplus b$. One may recover $a = c \oplus b$ (and $b = a \oplus c$).
Information is hidden. One cannot know anything about the inputs from the outputs.

I found this answer which talks about the efficient implementations present in the instruction sets, and programming language, but this sounds like a "who came first, chicken or the egg" problem.

Is it that the efficient implementations exist because XOR was chosen over XNOR?

There are mentions of some architectures which have XNOR support.


texts:
Mastercard, Visa, and several other organizations use 3DES to encrypt and decrypt credit card data. The sweet32 attack placed 3DES in the spotlight, but how fragile is 3DES for a very small amount of info, like 16 digit string (the card number) + 3 digit string (the CVV) + 4 digit string (month/year of expiration)?
How susceptible is it to brute force, dictionary or collision attacks?


texts: RSA: Private key calculated from public key?

texts: The wiki article on RSA (https://en.wikipedia.org/wiki/RSA_(cryptosystem)) says that d is "the modular multiplicative inverse of e (mod φ(n))" , where d is the private key and e and n make up the public key. How come an interceptor cannot calculate the d in the exact same manor as the encrypter does, if the interceptor has knowledge of e and n?


texts: Is Base64(SHA1(GUID)) still unique like the original GUID?

texts: Basically what the title is; GUIDs are unique by design. If you run the GUID through SHA1 and then Base64 the hash, will the resulting string have the same guaranteed uniqueness as the GUID, or not?


texts: two-to-one hash in libsnark, what is it "exactly"?

texts:
I'm reviewing this test which prepares a zero knowledge proof of the preimage of an hash:
https://github.com/mariogemoll/libsnark-tutorial/blob/sha256/src/test-knowledge-of-preimage.cpp
In my (wrong) understanding, the left-bits and the right-bits are referring to leaves of a Merkle tree from which you obtain the hash. So the left-bits and right-bits should be your private information, while the final hash, the top of the Merkle tree, is the public information you want to prove knowledge of.
I tried to obtain the same hash as given in the example, combining the right-bits and left-bits in a merkle tree. I tried to add padding as discussed here: https://gitter.im/ZoKrates/Lobby?at=5b829201ac25fd11b597e159 (look for "padding" in the page), but the resulting hash is never the one given in the example.
So what are they referring to with "sha256_two_to_one_hash" exactly?
Thank you very much!


texts: Since it gives negative power, how is rcon(0) calculated in AES?

texts:
I'm trying to calculate Rijndael key schedule "Rcon" values manually. I know how to calculate each value with the equation rcon(i) = x^(i-1) mod x^8 + x^4 + x^3 + x^1 + 1, for example:

recon(10) = x^(10-1) mod x^8 + x^4 + x^3 + x^1 + 1
x^(9) mod (x^8 + x^4 + x^3 + x^1 + 1)
=> x^5 + x^4 + x^2 + x
=> 0011 0110
=> 0x36 (10th number in RCON Table)

But if i equals to 0 then

rcon(0) = x^(-1) mod x^8 + x^4 + x^3 + x^1 + 1

According to "Wikipedia: Rijndael key schedule ~ Rcon", the first value in Rcon table is 0x8d, which most probably is the value for rcon[0]. I would like to know how it is calculated.

I know how to calculate the mod on paper and this is exactly how I calculated the 0x36 above. But since the power of x is -1 in this case, I am stuck with it. How is rcon[0] calculated in AES?


texts: Algorithm for factoring knowing RSA private key

texts:
According to this and this paper from Alexander May is possible to factor given the knowledge of the RSA private key.
This is possible via Coppersmith and LLL reduction.
Now I am trying to implement the code using the reduction in 2 (I prefer this to 1 given the fact []1] uses bivariate
integer polynomials).

Now I struggle to understand the parameter of the reduction in section 4.6 of 2. In particular it refers to and M to be applied to Theorem 1.
Giving a look to Theorem 1 though it doesn't mention M.
The problem is that M is the only place where d (the secret exponent d is mentioned) hence why I am lost....


texts:
Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks?

Is it even true, that a branchless code can mitigate a timing attack? Are there any other side-channel attacks that are prevented in this way?


texts: Imagine that your lecturer and the undergraduate office have conducted a key exchange protocol after which both of them hold the string $X$. Yet, it is possible that a curious student sitting next to the lecturer in the bus may have gained some information $E$ about $X$. (Un)fortunately, the student eavesdropper Eve has gained only $1000$ bits of information $E$ about $X$ from the quick glance. If $X$ contains 1 million bits and was chosen randomly beforehand, describe how the lecturer and the undergraduate office can produce a fully secure key $K$ from $X$ to encrypt the final exam for electronic transmission, such that student eavesdropper Eve knows essentially nothing about the key $K$.


texts: Decrypting data on client side for use inside program

texts:
So I am developing a python program and encrypting the trained machine learning models which need to be decrypted when loading them on client side. My program will deployed on the client's machine with no internet access and I need to protect my models.

Now I'd like to ask the following

Whether using symmetric key encryption and then hiding the key inside my code is the right way to go about it or there is a better way?
If this is the only way then how to what is the best way to hide the key?

I am already obfuscating the code by compiling cythonized python code so should I just hide the key inside that?


texts: collision resistance of a composed hash function

texts:
Given a collision-resistant hash function $H(x)$, say SHA256, and I devise another hash function by $H'(x)=\sum^{m}_{1}H(x||i) \mod p$. The summation is defined on finite field of prime order $p$.

Is the new hash function $H'(x)$ still collision resistant? How hard is it to find a collision? Any advice would be greatly appreciated!


texts: Can "(input * X) mod Y" with N iterations be computed in less than N operations?

texts:
I think a simple question but here it goes (and sorry for my lack of math notation skills):
Given input I, a fixed factor X and fixed modulo Y and N iterations, does the process need to be performed consecutively in N steps, or can it be sped up?
I=12345
X=655573
Y=54321
for N=0; N < 10000; N++ {
    I=(I*Y)%X
}


texts: How to find irreducible polynomial for Barreto-Naehrig curves?

texts: As described in this paper(section 3) to implement pairing on Barreto-Naehrig curves. The prime in their case is $p=82434016654300679721217353503190038836571781811386228921167322412819029493183$ and to implement the pairing it is important to find an irreducible polynomial of the form $ W^6-\xi$ in $\mathbb{F}_{P^{2}}$ where $\xi \in \mathbb{F}_{P^{2}}$. However, I can not understand how to find such $\xi$. I have written some scripts in Magma to find such $\xi$ but not successful.Also in that paper they have mentioned that there are some properties of the prime $p$ which is useful in finding such $\xi$ but I can't understand how to use them? Can someone please tell me how to find such irreducible polynomials?


texts: Why does orthogonal basises makes it easier to solve SVP in lattices?

texts:
I've been looking through https://courses.maths.ox.ac.uk/node/view_material/12662 and it mentions that:
Some bases make SVP easier:

A “good” basis has shorter vector norms
A “good” basis has nearly orthogonal vectors

I assume the reason for shorter vector norms being helpful is that there if we use an algorithm such as LLL, we will have a better starting point and that there will be less to reduce?
However, I'm unsure exactly why nearly orthogonal basis vectors makes SVP easier. Is it only because it somehow makes it easier for algorithms such as LLL(-BKZ) to reduce the basis vectors?


texts:
Is there something special about the AES key expansion algorithm that makes it secure, or it is a compromise between security and speed? For example, say with a key I expand it by taking pbkdf2(key) or scrypt(key) as the next round, and scrypt(scrypt(key)) as the round after that, until I have all of my subkeys. Would this be more or less secure than the standing key-generation method, and preferred in the case of having a machine which can perform them both in the same amount of time (impossible I know, but it's hypothetical).

Often I hear the key expansion is the weakest part of AES, but conflictingly that it was designed to prevent the use of "weak keys" which its predecessor suffered from.


texts:
Given a root hash

root = H(plaintext)

and two (or more) derived hashes

h1 = H(salt1 + root)
h2 = H(salt2 + root)

would the knowledge of h1 and h2 alone increase the chances of finding the root hash or even the plaintext?
I'm using SHA256.


texts: A confusion on the proof of Yao's theorem (Yao 82)

texts:
I'm reading the proof of Yao's theorem on Boaz Barak's lecture, the main part of the proof is the following claim:

My question is:

  How can we say "without loss of generality" here? Since $H^i$ and $H^{i-1}$ are probability ensembles, hence for a fixed $D$, whether $\mathrm{Pr}[D(H^i_n)=1]\ge \mathrm{Pr}[D(H^{i-1}_n)=1]$ or not may not necessary the same for all $n$, where $H^i_n$ is the $n$th distribution in that ensemble. So, when one wants to design the algorithm $P$, one need to encode these relation information, how can we do this?


texts: Proving simulation-based security with unreliable real-world channels

texts:
An ideal functionality considers reliable communication channels, whereas a real functionality must consider unreliable communication channels (e.g., channels controlled by the adversary). Thus, it seems that no real functionality (that is reliant on message delivery over an unreliable channel) can be proven equivalent to its corresponding ideal functionality, because a message can be dropped in a manner that causes a distinction.

This isn't a problem for simulation-based security of cryptographic primitives (e.g., encryption schemes), because the communication channel needn't be considered. But it seems to be a problem for cryptographic protocols (built from such primitives), because interfering with communication (e.g., dropping messages) may be detrimental to security.

This seems rather limiting.

Have I misunderstood simulation-based security? Or is there a workaround to prove simulation-based security with unreliable real-world channels?


texts: HMACSHA256 2.5 times faster than HMACSHA512

texts:
According to the answers to a previous question,  the 512 version should be faster on x64 devices. And even if it were executed on an x86 (32 bit) device - there shouldn't be such a big difference.

Is there some explanation for this difference? (Or must it be an implementation issue.)

The following code returns almost 5 seconds for the HMACSHA512, and almost 2 seconds for HMACSHA256: (It's run on a Samsung J5 (2015) which has a Snapdragon 410 Processor  with "CPU Bit Architecture 64-bit". Using Xamarin.Forms PCL, the Droid project.):

private void Button_Clicked(object sender, EventArgs e)
{
    ICrypto crypto = DependencyService.Get<ICrypto>();
    Stopwatch watch = new Stopwatch();

    byte[] b = new byte[64];
    watch.Start();
    for (int i = 0; i < 10000; i++)
    {
        b = crypto.CalculateHmac512(b);
    }
    watch.Stop();
    label.Text = watch.ElapsedMilliseconds.ToString();
}

And

class Crypto : ICrypto
{
    //HMACSHA256 hmac = new HMACSHA256();
    HMACSHA512 hmac = new HMACSHA512();

    public byte[] CalculateHmac512(byte[] m)
    {
        return hmac.ComputeHash(m);
    }
}

(On a 64 bit PC for 100,000 iterations I get around 200ms for 512, and around 130ms for 256. So I guess that Xamarin itself is 32 bit. But that still doesn't explain the x2.5 difference on Android.)


texts: What are the differences between the elliptic curve equations?

texts:
I think we're all aware of the "classical" Weierstrass (short?) elliptic curve equation: $y^2\equiv x^3 + ax +b \pmod p$. Well known examples of these curves include the NIST's and Brainpool ones.

Now there's also the "Montgomery" representation: $by^2\equiv x^3 + ax^2 + x \pmod p$ where the famous Curve25519 is an example for.

To get things even more complicated there are "Edwards" and "Twisted Edwards" curves (of which I don't even have the general equations). A well-known sample would be Ed25519 I think.

Now what are the equations of these curves ([twisted] edwards only)?
Can they be converted into each other?
What are the computational advantages over using a given curve equation over another?
Are there any security implications (including side-channels) in choosing a specific equation?


texts: Stuck on finding M2 knowing M1 in One Time Pad

texts: Lets say I have a plaintext M1 and a plaintext M2, I know both the ciphers C1 and C2 from these M1 and M2. But from M1 I also know a piece of M1 or maybe even the whole text. And I also know C1 XOR C2 = M1 XOR M2. But how can you get M2 if you know M1. So is it possible to do 'something ' to M1 XOR M2 knowing M1 to get M2?


texts: Partial decryption of large file in AES-GCM (or other modes)?

texts:
Lets assume

a 4gig file that is internally made of 1 million pages of 4k bytes each (page).
the file was originally AES-GCM encrypted
these pages (or entire file) lives across the internet i.e. individual page reads are expensive/slow. (network IO operations are at page level by the way)

Is there any way to decrypt the 1,000,000th page without first fetching the 999,999 pages? I think not because the mac in GCM needs to 'digest' all the data that was encrypted, right.

The only other scheme I can think of is performing encryption/decryption at a page level but then we'd have to store 28 bytes extra (128 bits IV + 96 bits tag) for every page. One could argue 28MB overhead for a 4GB file isn't much but I'm trying to minimize overheads.

I would love to see if someone has a better design proposal for this situation.


texts:
I understand black-box obfuscation at some intuitive level as- "an adversary can learn nothing more from an obfuscated program/circuit/function than he or she can from a black-box access to the same program/circuit/function." But I am failing at grasping it formally.
I got the following description from this site:

Black-box obfuscation: For every adversary $A$, there is a simulator $S$ such that for every program $f$ and distinguisher $D$:
$$Pr(D(A(O(f)))) ≈ Pr(D(S^{f}(|f|)))$$

I understand most of it, but I don't get what a/the simulator $S$ is and what it is for in the definition. In other words, what has the existence of the simulator to do with?


texts: How to generate a bilinear group of prime order p for key generation

texts:
I am trying to implement an IEEE Paper In Cryptography. I read many reference regarding an RSA key generation. But i am confused with above statement. Please someone explain me What it says with example.

EDIT *

I am trying to implement key generation from the paper Key-Aggregate Cryptosystem for Scalable Data Sharing in Cloud Storage. In the paper, the first step in key generation is a setup phase state as follows
SETUP(1^λ) : Randomly pick a bilinear group G of prime order p where
, a generator gϵG ...

In the definition I understand what is meant by bilinear, prime order and generator. But what is that parameter λ and what should its value be?

*Edit was added for clarification purposes (copy-and-paste from this dupe by same user).


texts: Combining secure hashes with insecure hashes?

texts:
Assuming I'm a bank which seeks for secure hash functions to use in the process of  signing on digital contents.

I'd like to explain / prove why using each one of the following hash functions might be less secure than using SHA-1 (yes, I know SHA-1 no longer considered secure, but the question does consider it as one, or at least states "do not be less secure than sha-1").

$h_{666}(m) = $ some new hash function with 666 bit long output.
$h_{ib}(m)=h_{sha-1}(h_{md5}(m))$
$h_{hm}(m)=h_{md5}(m) \oplus h_{sha-1}(m) \oplus h_{ib}(m) \oplus h_{666}(m)$, while the XORing operation here xors the matching bits between two outputs, padding with 0s the smaller ones.

I would say…

I can tell that using new hash function is a bad idea since no one has yet to research and attack it, aside from the fact that more bits is less efficient. Apart from this explanation, I don't see other reason to disqualify this answer.
md5 is broken and collisions can be made quite easy, so two different inputs to this function can collide and have the same input to the sha-1 function, which will result in collision between the final outputs.
I have no clue how to disqualify this one. The intuition says 'xoring with bad hash functions is not a good idea', but I can't really justify my answer.
I also think the padding doesn't actually affect anything, becuase if SHA-1 result is secure then padding 0s to it won't make it collide with other inputs suddenly.

Am I correct, or did I miss something obvious somewhere?

Edit

This is different from “Guarding against cryptanalytic breakthroughs: combining multiple hash functions” since here the idea is to combine unsecure hash with a secure one. This is not about just combining hashes.


texts:
On this website, we have a lot of questions and answers devoted to Shamir secret sharing. We make it clear that Shamir secret sharing does not guarantee integrity. When we want integrity, we need to use a verifiable threshold scheme. But it is never explained how a malicious secret is actually forged.

Consider an easy setup of the scheme with 2 shares and threshold $k = 2$. Assume the adversary knows the secret message $m$ and share 1 (but not share 2). The shares are evaluated at $x_1 = 1, x_2 = 2$.

How does the adversary forge a chosen secret $m'$?


texts:
Alice would like to make public a proof that she is friends with Bob that has the following characteristics:

Creation of the proof requires the agreement of both Alice and Bob
Anyone who is also friends with Bob can identify Alice as a mutual friend of Bob
Anyone who is not friends with Bob learns nothing from the proof (other than the total number of proofs Alice has published)
Evaluating a proof to determine mutual friendship does not require interactive communication with either Alice or Bob

Is there any existing cryptographic construct which achieves these properties? I haven't been able to find anything that does this but maybe I haven't been searching for the right keywords.


texts: Interleaving bytes to make an effectively larger block size

texts:
Will applying a 16 byte bit block cipher such as AES over a 256 byte block to in the following way result in a much stronger cipher:-

Apply block cipher with first key digest to each 16 byte group.
Then interleave the bytes.  I.E. Place the bytes horizontally into a 2D (16 times 16) byte array and then remove the bytes vertically so that each new 16 byte group now has one byte of each of the old 16 byte groups.
Then apply block cipher with second key digest.
Then interleave.
Then apply block cipher with third key digest.


texts: Does stronger cryptographic hashes also imply being better at verifying integrity?

texts:
What I know so far
Fact 1) I know that all cryptographic hash functions have the following properties

They are many-to-one in nature

They produce fixed size outputs

Given an output x it is infeasible to find the original message m such that H(m) = x

Fact 2) I know that certain cryptographic hash functions are "stronger", but more "expensive" to compute than others - in the sense that trying to overcome their (Property 3) is a lot harder and time consuming/resource intensive.

sha512(m) is harder to crack than sha256(m) which is in turn harder to crack than sha224(m)

Fact 3) I also know that certain cryptographic hash functions perform worse on verifying a message's integrity than a simple CRC checksum. (According to the following stackexchange post)

A cryptographic hash truncated to 32 bits can easily collide with two inputs that differ in only one or two bits, whereas a CRC won't. The CRC is geared towards reliably detecting error patterns that commonly occur in transit, so it will do better on those kinds of errors and worse on others. The short hash does optimally over all inputs, and as a result does worse than CRC on the inputs CRC is good at dealing with.

What I want to know
Question 1) What common hash functions are worse than CRC checksums, and which are better than them in verifying integrity? (e.g. file corruption/changes).
Question 2) Is it the case that the stronger the cryptographic hash function, the better it is at verifying integrity? (e.g. sha512 will be able to detect file changes better than sha256).


texts: Cryptography Pseudo Random Generator example question - proof

texts:
For ii) G2 was proven to be a PRG, and it seems the solution for G5 uses G2.

Can someone try and explain to me the solution that I was given? I specially do not understand how to calculate the given probability:

Also, I understand that to proof something wrong you can just give a counterexample. However is there a more formal way of proving it?


texts: What is the purpose of calculating the N modulus in the encryption phase of asymmetric cryptography?

texts:
I was reading a paper entitled : "Mathematical Underpinnings of Asymmetric Cryptography". I came across this

If $N$ is the product of two large prime numbers $p$ and $q$, say 300 digits each, and $e$ is just coprime with $(p-1)(q-1)$ so it can be a relatively smaller number, my problem is that if I am to raise a certain numerical representation of my text, say $M$, to the power of $e$, it will still be smaller than $N$, therefore $M^e \bmod N = M^e$. So the modulus is not doing anything. I realize that you can just add $kN$ ($k$ being an relative integer), but that's missing the whole point.

What am I missing?


texts: Encrypting using "Cryptography.HMACSHA1", how to decrypt (VBA)

texts:
I have an encryption routine that works very well in VBA. But now I need to program the decryption routine, and I'm stuck. For encryption I'm using HMACSHA1 and transferring the encrypted byte to base 64. I can decode the base 64 and get the same byte array back, but any suggestion on how to use the HMACSHA1 to decrypt? Here's what I have so far (sorry if this is not the right place to ask these kinds of questions):

Private Function fDecrypto(sText As String, sPass As String) As String

Dim encoder As Object
Dim crypto As Object
Dim bEncrypted() As Byte
Dim i As Integer

' base64 to encrypted byte array

Dim objXML As MSXML2.DOMDocument
Dim objNode As MSXML2.IXMLDOMElement
Set objXML = New MSXML2.DOMDocument
Set objNode = objXML.createElement("b64")

objNode.DataType = "bin.base64"
objNode.Text = sText
bEncrypted = objNode.nodeTypedValue

Set objNode = Nothing
Set objXML = Nothing

' decrypt using HMACSHA1

Set encoder = CreateObject("System.Text.UTF8Encoding")
Set crypto = CreateObject("System.Security.Cryptography.HMACSHA1")

' **TODO - decrypt here**

Set encoder = Nothing
Set crypto = Nothing

End Function

Private Function fEncrypto(sText As String, sPass As String) As String

Dim encoder  As Object
Dim crypto As Object
Dim i As Integer
Dim bPass() As Byte
Dim bText() As Byte
Dim bEncrypted() As Byte

Set encoder = CreateObject("System.Text.UTF8Encoding")
Set crypto = CreateObject("System.Security.Cryptography.HMACSHA1")

bText = encoder.Getbytes_4(sText)
bPass = encoder.Getbytes_4(sPass)
crypto.key = bPass

bEncrypted = crypto.ComputeHash_2(bText)

Set encoder = Nothing
Set crypto = Nothing

' encrypted byte array to base64

Dim objXML As MSXML2.DOMDocument
Dim objNode As MSXML2.IXMLDOMElement
Set objXML = New MSXML2.DOMDocument
Set objNode = objXML.createElement("b64")

objNode.DataType = "bin.base64"
objNode.nodeTypedValue = bEncrypted
EncodeBase64 = objNode.Text

Set objNode = Nothing
Set objXML = Nothing

End Function


texts: HMAC based challenge-response authentication

texts:
Would a challenge response HMAC authentication be secure?

i.e.

Client sends id
Server sends a challenge(32byte value)
Client calculates hmac_sha256 of the challenge value with its key and sends the reply
Server verifies the reply


texts: RSA group/ring signatures, how are they calculated?


texts: Integrity or Confidentiality or Authenticity

texts:
If a sender creates a hash H of message M and encrypts it using receiver's public key, what do we ensure of the above three at the receiver's end.

PS : I know this is not the right way to send messages but I'm just trying to learn how do things work in such cases.


texts: Relationship between exponent and modulus in RSA (as RSA properties as listed in X.509)

texts:
In one of my assignments, I had the following question (Please read on. Not a homework assignment :) ):

  X.509 (1998 version) lists properties that RSA keys must satisfy to be
  secure. One such requirement is that the public exponent  $e > \log_2(n)$ where n is the modulus. Consider the
  following justifications for this:

  We require $e > \log_2(n)$ in order to prevent an attack to disclose the plaintext by taking the eth root modulus
  n.
  We require $e > \log_2(n)$ in order to prevent an attack to disclose the plaintext by taking the eth integer root.

  Which of these two is the correct justification of the above
  requirement? For the incorrect justification, explain why is it
  incorrect.

My question here is: Where is the X.509 certificate listed mentioning the above requirement? I tried googling a lot but could not find any such requirement listed in any  online available material unfortunately.
Also, if any such requirement does exist, what is the justification for the same?


texts: I'm sure I've missed something super trivial, but why are WOTS-type schemes one-time? I've been looking into hash-based schemes, and I feel like I understand WOTS quite well (specifically I have looked at WOTS+), but I cannot figure out why WOTS would not be safe to use just a few times as an FTS such as HORS(T) for example?


texts: Is the following PAKE protocol UC secure?

texts:
Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it to Bob. Bob samples a nonce $r'$ and sends it to Alice. The session key is $k = \mathcal{O}(pw,r,r')$, where $\mathcal{O}$ is a random oracle.
It seems that the simulator can easily extract the input of corrupted Alice (or Bob) by simulating the random oracle and proceed with the simulation without much problems. However, this can't be a secure PAKE protocol (right?) because it would allow for offline dictionary attacks: once eavesdropping on both nonces ($r$ and $r'$) the adversary can just query the oracle on all possible passwords on the dictionary (that is poly size) and the session key will be among the oracle answers. This will be a problem once the session key is used for anything.
So my question is, is the protocol above UC secure wrt to the $\mathcal{F}_{\mathsf{pwKE}}$ functionality of this paper (my guess is probably not for the reason above), and if not, where does the simulation actually fails?


texts: Why is a PGP signed message structured the way it is? Historical background or standard?

texts:
I am pretty sure there's a good reason for this, but it just occurred to me I've been just taking for granted that all PGP signed messages look something like this:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

This is a signed message
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEQ7t0aKbAXBpExRIVL7dAkK3uCCAFAl3lDRgACgkQL7dAkK3u
CCA0CAgA1JVYkkRun9xxIUX4WSr373r+UYIqCPHVymz8t3FDlR4LrQxkS8KNH+i+
d//5V8s+TSqKhJDZhka3PUFZl2d/pyftCzP+6Ir0gTaQ8oLsjYfyNUt95C2gH0Un
kWUjluKRThiM/yyvYU4M8Y2jb/8rnymiYAh1JCUGmgxJ0jdCvspYF6/Go5OFkLTA
1m0/Y+1AARJ7cIW3V8bERxJ4aiXuC/ZvhzE2Sq/Pd8rK00tFGjDRl8Lz2gs9DzBw
rT9AKvhDM5sdTf/8zOgGaMchzLKG9xuEBeUXlhQz/fDspOm0CzjM0F+vycqRFsss
v8thLRmduEK1mMU3bZt2XmkT1gPbRQ==
=UH5v
-----END PGP SIGNATURE-----

Is there a reason why it looks this way? For example, isn't it also possible to represent the message and the signature in JSON?
Also, is there some rule, protocol, or standard that says all crypto messages and signatures must follow this format?
Or is this just how PGP handles things, and you could come up with your own representation if you're not dealing with PGP?


texts: Security of traditional ORAMs if write accesses are revealed

texts:
I was reading about path ORAM, and I have few questions

I was wondering if an adversary knows all write accesses will be performed and has a view of the tree of which path being accessed. Can he infer anything about the system?


texts:
Let's say you want to break down a message, for simplicity it is just a bit $0$ or $1$, $m$ into two messages $(m_1, m_2)$ as follows:

If $m =0$, then $(m_1, m_2) = (0, 0)$ with probability $1/2$ and $(m_1, m_2) = (1,1)$ with probability $1/2$. Similarly, if $m=1$, then $(m_1, m_2) = (0,1)$ or $(1,0)$ each with probability $1/2$.

It's clear how the message can be retrieved from the two messages, and that nothing can be know from a single daughter message (each will be 0 or 1 with equal probability regardless of the mother message), unless the random number generator has a bias of sorts.

What is this system called?

(I don't do cryptography by trade, don't know which tags to use.)


texts:
I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way:

a unique 128-bit key is used;
the plaintext is first encrypted in classical counter mode with AES, with counter = fixedData1 | nonce | blockCounter;
a MAC is then computed with CMAC AES, on the following message: B0 | ciphertext, where B0 is a block: B0 = fixedData2 | nonce | messageLength; the MAC is truncated an appended to the ciphertext.

I am unable to find any reference to this mode of operation. It seems to be a variation of EAX, but I could not find anything.

Does someone know this mode of operation?


texts:
Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). Taking the abstract at face value, it is a blow (pun intended) to Argon2, the winner of the (first) password hashing competition, in particular as Balloon hashing boasts

  the first practical cryptographic hash function that:
  (i) has proven memory-hardness properties in the random-oracle model,
  (ii) uses a password-independent access pattern, and
  (iii) meets or exceeds the performance of the best heuristically secure password-hashing algorithms.

and further claims

  a practical attack against Argon2i that successfully evaluates the function with less space than was previously claimed possible

Is Balloon hashing, or any of the contenders with properties (i) and (ii), ready for practical use (possibly including some Argon2 variant)? With what parametrization (underlying hash, etc..)?

Can we roughly guestimate the security improvement (at equal computing effort, for some definition of that) compared to competitors like the still very ubiquitous PBKDF2-HMAC-SHAx? Bcrypt, which has some traction in servers? Scrypt, which better leverages multiple CPUs and ample memory, but does not exhibit property (ii) and is seldom used?

Note: After Luis Casillas's comment, I have expanded the scope of this question beyond Balloon Hashing.


texts: Affine cipher : Why it is required to have GCD(a, m) equals to 1

texts:
In the Affine cipher, the key $k = (a, b)$ should have the following property, i.e. GCD of $a$ and the modulus should be 1:

  $\gcd (a, m) = 1$, where $m$ is the set of possible moduli

My question is, why it is required that $a$ should have the above property? What is the significance of this? And why is $b$ excluded from this condition?


texts: Key distribution and computation for homomorphic encryption

texts:
How can a system where the party performing a computation also possess the private key and still not know the answer of computation be designed ? Also the other party who does not have the private key know the correct result ?

Involving a trusted third part seems a possible solution. But are there other ways to design such a system ?

Consider the following scenario: A has an input $x_1$, the public key and private key. B comes in with another input $x_2$. A sends the public key to B. B sends the encrypted value $enc(x_2)$ for A to perform a computation $C(enc(x_1), enc(x_2))$. A performs the computation and sends the result to B. A should not know the correct value of result. But here if A is performing the computation and also has the private key, then A can decipher the answer.


texts: What's the truth about this "absolutely unbreakable" cipher?

texts:
A story appeared on Forbes today claiming that we now have an absolutely unbreakable cipher. It cites a paper published in Nature Communications. However, I'm skeptical:

  But what if there were a method of enabling data to be sent using an "absolutely unbreakable" one-time communication technique? What if that technique could achieve perfect secrecy cryptography via correlated mixing of chaotic waves in an irreversible time-varying silicon chip?

That seems like a lot of buzzwords and doesn't sound convincing.

  With no software or code to manipulate, traditional methods of cracking computer encryption are irrelevant

  Again, Dr. Cruz reiterated that there is no code to manipulate, and the limited software is ROM based, so traditional methods of hacking encryption are irrelevant.

Don't ciphers and their weaknesses exist independent of software and code? Solitaire has neither software nor code, but has weaknesses.

  The cryptographic keys generated by the chip, which are used to unlock each message, are never stored

You need the keys to decrypt the message, so even if they're never stored, something good enough to reconstruct them must necessarily be stored.

  It is claimed that even facing an attacker with "unlimited" technological power, even if they could access the system and copy the chips, would be unable to break the encryption because it is protected by the second law of thermodynamics and the "exponential sensitivity of chaos."

I really don't like the sound of this.

  Professor Andrea di Falco of the School of Physics and Astronomy at the University of St. Andrews, another author of the study, said that "this new technique is absolutely unbreakable, as we rigorously demonstrated in our article."

A really extraordinary claim.

  The second law of thermodynamics prevents this attack. Every time Alice and Bob change the chip with an irreversible process, they increase the total entropy of the system and the environment, creating new chaotic structures exponentially different from the ones used in the communication (conditions 3 and 4). If Eve accesses the system, it is impossible to recreate the initial chips and to perform any search, as this requires reverting the transformation of Alice and Bob with an entropy decrease, thus violating the second law.

This is contrary to my understanding of the second law of thermodynamics. Can't you easily decrease entropy in systems that aren't closed (such as the chips), just by increasing it more outside the system (exhaust heat somewhere)?

So is this new cryptosystem legit, or is it just more snake oil? If it's legit, then what are the explanations for my above concerns? If it's snake oil, how did it manage to dupe both Nature Communications and Forbes?


texts: Would modifying the key of an arbitrary ARX cipher make it harder to break?

texts:
Consider a simple ARX block cipher in which after each block is encrypted, the key is rotated and/or XORed by some variable value. Would this make the key any more secure, or just be a waste of time? Could it somehow make the key less secure?

For example, if the key is 0101 and after a block is encrypted the key is rotated left by the last 2 bits (in this case 01). So the key for the next block encrypted will be 1010.
Alternatively, the latter 2 bits are used to seed a pseudo-random number generator, and the key is XORed with the result.

Sorry if this is a dumb question, I am very new to cryptography as a whole, and this question came to mind while going over some resources for a course I will be taking this fall.


texts:
I read this article on Wikipedia: Hard-core predicate.

Still I don't understand what exactly is a hard-core predicate. Is it possible to put this in simple English terminology, and perhaps with a simple example?


texts: Using Pollard's lambda in a key-recovery attack on DH

texts:
I've become interested in writing an exploit for the OpenSSL vulnerability here (CVE-2016-0701). Running through the bullets describing the attack, I can follow up to the last bullet point.

Reviewing the referenced paper, Key Recovery Attack on DH Small subgroups, I find myself in a similar position.

The Chinese Remainder Theorem, according to Wikipedia, will return me an 'x'. If I have read the reference paper correctly, this will either be the whole of the secret 'x' if x is short enough, or it will be 'bits of x'.

Both the blog and paper seem to hand wave through "and then you can use Pollard's Lambda to recover the rest". The Wikipedia for Pollards Lambda describes it as finding the x in g^x = y, with a given g and y.

I've eventually researched this down to a further paper, as per page 338 of "On Diffie Hellman Key Agreement with Short Exponents", image below:

I can somewhat see the 'g' value required based on this, but it simply tells a user to "calculate y*", a calculation which itself appears to require several unknown values.

This could well be an issue of how I'm reading things, as I'm much better notation seen in code than in maths.

If someone could assist with what values are meant to come out of CRT and be be fed into the Pollard's Lambda function (of which there are several implementations floating around), it would be appreciated.


texts: Encrypting current time using 3DES as a signature

texts:
I came across a peculiar system for generating "signatures" ("signatures" is within quotes because this is a bad use of 3DES) in the wild.

It works as follows: a symmetric key is generated and used to encrypt the current time using 3DES, in CBC mode with 8 zero valued bytes as an IV. The resulting signature is used like a session token - the server will decrypt the signature and check if the time is within some bound.

Is it possible to forge a signature?


texts: Looking for a way to enlarge a message so that any modification to the "enlarged" message makes recovering the original message impossible

texts:
Let's say we have a message m of small size.
I am looking for a system $S$ so that $S(m)$ is arbitrarily large, we can easily compute the inverse $I(S(m)) = m$, and any modification to $S(m)$ makes it impossible to recover any part of the initial message $m$.
Let's say my initial message is $m$ = "Hello world!" (12 characters long), and I want $S(m) = c$ to be larger (let's say, 1000 characters long, so 8000 bits). Let's say that $c'$ is the same as $c$, but with at least one error (one bit changed). I know $I(c) = m$. I want $I(c') \neq m$, so that it is impossible to obtain $m$ from $I(c')$.
Initially, I thought I could do this with some kind of symmetric private key encryption, with padding on the message and the "private" key public (anyone should be able to get $m$ from $c$; but no one should be able to get $m$ from $c'$).
I tried AES in CBC mode, with padding to increase the original message's length, but it didn't do what I wanted. Introducing an error in $c$ would see this error propagate to the latter blocks, but not the preceding blocks, and so the original message $m$ was often still legible.
Is there a system that could achieve the specific behavior that I'm looking for?
Thanks in advance!


texts: Elliptic curve with non-prime generator?

texts:
Suppose we need a special Elliptic curve on prime field $Fp$, for some reason, that the order of the generator must be $6*q$, where q could be a big prime, does this weak the ECC encryption? What's the possible attack vector towards this kind of curves?

I'm just a beginner in ECC, so hope this is not a silly question.


texts:
I have only about 2 weeks of cryptography experience mostly in the form of questions on bitcoin.se.

Is Curve25519-java up to date with current Curve25519 standards?

Is Curve25519 itself secure?

In other words, is it safe to use as it a cryptocurrency key-generation and transaction signing & verification algorithm?


texts:
I'm trying to create an algorithm to find the public exponent e given a plain (non-CRT) private key that doesn't include the public exponent, i.e. I've only got $n$ and $d$.

A question has already been asked how easy it would be to find the public key given a private key. The answer was that it was likely to be easier, but none of the answers specify a good algorithm for RSA.

What would be the most efficient algorithm for finding the public exponent for RSA given the private key?


texts: Why can't ransomware practically use RSA to encrypt all files?

texts:
I understand that a few ransomware have used an RSA public key to encrypt all files belonging to the victim. This is a bullet-proof system in terms of its security because the private key is always safe with the hackers.

But most ransomware use the hybrid encryption approach and during that they make mistakes allowing security researchers to build decryptors. The attractiveness of this hybrid approach lies in the speed of symmetric encryption. But because the hackers makes implementation mistakes in this approach, why don't all hackers switch to asymmetric-only encryption? It seems easier to implement programmatically than the hybrid approach. Is slow speed of RSA the only factor the limits the hackers? How slow is RSA when compared to AES for, let's say, 500 MB of data on an average i5 processor?

I have searched the Internet looking for a comparison between speeds of RSA versus AES for bulk data encryption in modern computers but found nothing. I understand that criminals cannot be reached for comment on why they don't use asymmetric-only approach for bulk encryption but I am looking to understand what could be the practical reason behind why bulk encryption with RSA is so undesirable.


texts: Computing discrete logarithms in the subgroup generated by 1 + N

texts: When I read about DLP, I found that there are groups where the computation is easy. I found that it is known that computing discrete logarithms in the subgroup generated by 1 + N is easy. For example : $ (1+N)^{x} = 1+ xN  $. Is this correct? And what is the mathematical foundation of this computation?  Why is considered as easy compared to the other groups?