texts: Is that possible to use encryption higher than 256-bit?

texts: When browsing websites with Chrome sometimes I can see a green lock and encryption info inside. It says the connection with this website is 128-bit or 256-bit encrypted with TLS1.2. So I'm wondering that is that possible to use 512-bit or higher encryption on websites?


texts: How does the PRESENT cipher's permutation affect all rounds when it repeats after every three rounds?

texts:
I heard that the permutation in PRESENT affects all bits after only a few rounds. However, when I looked at it the bits return to their original position after only three rounds. For example, in round-1 bit b1 ---> b16, in round-2 b16 ---> b4, and in round-3 b4 ---> b1; thereafter the cycle repeats. This is the same for all bits, except b0, b21, b42 and b63 which do not move at all.

So my question is: this being the case, how does the permutation cause each bit to affect every other bit?

I am sure I have missed the point, so a simple 'numerical' example would be much appreciated.


texts: Generating an RSA public key certificate (.pem) from only a modulus


texts: How can comparision like (>=,==) be done using homomorphic encryption?

texts:
Since we know that Homomorphic encryption allow computation on encrypted data. Let two n-bit integers $(x,y)$ are encrypted using some LWE public key cryptography. For example - if $x'= HEnc(x,pk)$ and $y'= HEnc(y,pk)$, Finding $Max(x',y')$ or $Min(x',y')$ or $Equal(x',y')$ the above comparison is necessary.

Now, we need to perform comparison (>=,==) operation homomorphically. How can we do this? Can anyone describe this with example?


texts:
I'm reading through the XEX mode spec, and I want to make sure I've understood the $\alpha^j$ step correctly:

$X = E_K(I) \oplus \alpha^j$

$C = E_K(M \oplus X) \oplus X$

where:

$M$ is the plaintext message
$I$ is the number of the sector
$\alpha$ is the polynomial $2^n$ over the finite field $GF(2^{128})$
$j$ is the block index within the sector

So, to compute $\alpha^j$, assuming that my language has native 128-bit int support, I envision something like this:

UInt128 a_j = 1 << (j % 128);

Is this literally it, or am I missing a key point here?


texts: Is it possible to make use of a pseudo-random permutation to construct a one-way compression function?

texts:
Let $f_k(B)$ denote the underlying function (a pseudo-random permutation) of a block cipher: it uses an $x$-bit key $k$ to encrypt an $y$-bit block $B$.
The question: is it possible to make use of $f_k(B)$ to construct a cryptographically secure One-way compression function that transforms any sequence of $y$ bits to a sequence of $y/2$ bits? If yes, then what is an example of how to do it? If no, then why?
For example, consider the following construction. Let $V$ denote a sequence of $x$ zero bits: $$V = 0^x.$$ Then $W$ denotes the inverse of $V$: $$W = 1^x.$$ Consider a function that outputs the first half of a bitstring $T$, where
$$T = f_V(b) \oplus f_W(B),$$ assuming that $B$ denotes the input, $b$ denotes the inverse of $B$ and $\oplus$ denotes a standard XOR.
Can we use such function as a compression function?


texts:
If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.
How about Finding a flaw in cryptographic protocol?!

How can you report it or flag an issue?
If you can fix it, is it possible to contribute?


texts: Do the keys in AES determine the S and P boxes?

texts: I once read somewhere that the keys determine the S and P boxes. If so, how does that work?


texts: Attacking a hardware AES implementation if it leaks the intermediate round states

texts:
Let's say that we have a hardware AES implementation that, on request, will encrypt or decrypt a 16-byte block of data in ECB mode using a fixed key, but refuses to reveal its fixed key.  In other words, an oracle.

This oracle has a flaw: if you read the hardware's output registers before the device says that its output is ready, it will return the result of the intermediate rounds rather than only the 10th (final) round.

Is it possible to attack this system to go after the embedded key?  I suppose that this means my question is about chosen-plaintext attacks against reduced-round variants of Rijndael-128.


texts: Finding all polynomials up to a given degree to generate a bit sequence

texts:
Consider the following bit sequence:

00100000110

Using Berlekamp-Massey algorithm we can find the following minimal degree polynomial:

$P(x)=x^6 + x^5 + x^4 + 1$

Now, is there a way to find all polynomials up to a given degree 8 that can generate the same bit sequence?


texts: Why is "key-rotation" called key-rotation?

texts:
The word "rotate" in respect to "key-rotation" has connotations of looping/repeating variable values like a rotor, but as far as I can tell there isn't a single definition available for "key-rotation" that involves re-using a key that was previously replaced.

So why don't we call it key-replacement or something else like that? i.e., why did the cryptography communities decide the more ambiguous word "rotation" was the more appropriate term to describe the act of changing keys?

It just seems a strange phrase to use, especially if you're not a native English speaker.

The only thing I could think of was some sort of an anachronism in reference to oldschool cryptographic key-generators, like the Enigma Machine, or your typical multi-rotor-combo-locks popular for use with bikes & storage lockers.


texts: Can i use Babai algorithm in q-ary lattice

texts:
Let's assume we have the q-ary lattice

$$ \mathcal{L}_q({\bf A})=\{ {\bf z}\in \mathbb{Z}^{n} : \exists {\bf s}\in \mathbb{Z}^{n}_{q} \ , \ {\bf z}={\bf A s}^{T} \mod q   \},$$

where ${\bf A}\in \mathbb{Z}^{n\times n}_{q}$.

My question is, can I use the Babai's algorithm with input the matrix ${\bf A}$ and a target vector ${\bf t}\in \mathbb{Z}_{q}^{n}$,  to find a close lattice vector to ${\bf t}$ ?


texts:
HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work.

Is there some other obvious attack?


texts: Encrypt than MAC scheme for Home Security system

texts:
Developing a wireless home security system based on STM32M0 µcontroller, I'm currently looking for the best way to manage encryption/authentication.
For information, the STM32M0 has an AES hardware acceleration module with main modes.

So , I looked first for AES-GCM as AEAD, but there's too much overhead: my data is about 16 bytes , maybe 4 of additional data, and there's 12 bytes IV, and 16 bytes Tag.
I want to avoid that IV / Nonce to reduce frame size.

So here's the intended scheme:

Encrypt plaintext (that contains a UNIQUE 32bits counter for frames) using AES.
Append additional data without encrypt it
Use a MAC without IV/nonce (like CHASKEY, optimized for embedded)

This way I have to use 2 keys , one for AES and one for the MAC. I guess the second can be derivated from the first.

Is this scheme is secure enough for the purpose ?


texts: Security issues for integrating AAA and OTP services

texts: What are the main security issues for integrating AAA and OTP services. In our organization with about 1000 clients, we want to integrate the services. What are the main security issues about the protocols used? In fact, we must choose between a number of suggested proposals.


texts: Is this hypothetical key-exchange secure?

texts:
I've thought about the following (generic) key-agreement protocol.
The only weaknesses I could have found are missing freshness guaranteees.

As for the notions:
$E^1_K(P)$ is the symmetric encryption of plaintext $P$ using key $K$. This is AES-GCM for example.
$E^2_A(P)$ can either denote symmetric encryption (e.g. AES-GCM) of $P$ using the (pre-shared) key of $A$ or it can denote asymmetric encryption of $P$ using the public key of $A$, the scheme is for example ECIES or RSA-OAEP. Certificates must be provided in the first two steps if asymmetric encryption is used.
$k$ is a random 128/256 bit AES key which is chosen by A prior to the first message and not disclosed until message 3.

$A\rightarrow B:E_k^1(R)$
$B\rightarrow A:E_A^2(S)$
$A\rightarrow B:E_B^2(k)$

The derived key is $MS=H(R||S)$ with $H$ being a KBKDF. $R$ and $S$ are 128 to 256 bit secure random values, generated by a CSPRNG.

Now for the aims of the protocol:

Provide mutual authentication of both entities
Provide a new secure shared key, unknown to any third party
Disable any party to manipulate the derived key to have some special property

A quick design rationale:
The first message ensures that assumption (3) is hold, B can't choose his random value dependant on As and A can't change it. The symmetric / asymmetric encryption should ensure (2). The usage of IND-CCA2 / AEAD primitives should ensure (3) as well. The usage of the PSK / certificates should ensure (1), as only they can successfully authenticate the messages.

I know, nothing is secure without a formal proof.

So my question:
Is the above protocol likely to be secure?

By the way: The protocol won't be deployed. This is a question about (general) protocol design.


texts: Where can I find the standard definition for GPG ECDSA signature?

texts:
I am playing around with GPG which I'd like to use to sign an integer and use the resulting signature binary in another piece of code.
So far I have created a simple PGP packet parser with which I think I can successfully extract the elliptic curve point representing the public key.

Comes then signature parsing from the PGP message and which I haven't been able to interpret so far, finding no hints in RFC4880 or 5480 which define all bytes up to the last 68, the signature representation.
But how should this 68 bytes be parsed exactly? Which RFC would be the one to look at?


texts: Do any (non-hardware) RNGs exist which could be used to create an OTP for crypto purposes?

texts:
I've stumbled (jobwise) over a system where small messages (512 Bytes or less) are encrypted and decrypted using a simple XOR using a OTP. That OTP is created using a seed based on the individual user passwords and a simple PRNG.

I'm currently seeing the following problem: Alice always keeps her password absolutely secret and it is never shared or transmitted. But the crypto-message may be intercepted by Eve, who may be smart enough to detect the pattern used to XOR the message (as the PRNG functionality is widely used as simple C-lib rand() functionality and therefore publicly available).

The reason why "they" used the OPT approach is to ensure "speedy encryption" (before transmission via SSL, secured storage, etc.).

My counter-argument is that it may be speedy, but because the seed is generated using a simple byte-addition (which results in a seed between 0 and 255), Eve has pretty good chances to quickly find the used seed and thereby the PRNG offset... which will allow her to decrypt the complete crypto-message(s) within 256 trail-and-error approaches.

Personally, I am about to advise them to use an acknowledged crypto-scheme (like AES) and make them drop their weak and insecure OTP-based crypto thing.

For as long as I can remember, I have been reading and have been told that an OTP may be regarded to be theoretically secure — but for that, the OTPs must be absolutely and truly random. From my point of view, a PRNG (cryptographically secure or not) does not seem to be a secure way to generate an OTP for crypto-purposes (using simple XOR).

But this got me thinking — maybe I am missing something in the big sea of crypto-schemes, functions, and implementations.

To avoid I'm missing something, I would embrace any feedback on the question:

Do any (non-hardware) RNGs exist which could be used (or securely abused) to create an OTP for crypto purposes?


texts: Will ANY prior knowledge assist in determining contents of a SHA1 hash?

texts:
I am working on a project testing a hash that protects some data, and I've already eliminated hash length extension attacks as a possible point of compromise, and I'm trying to educate myself on all the variables.

Say I have some data that is hashed via SHA1 - will knowing parts of that hash (the end piece - basically a known value with an unknown prepended salt) help in breaking the hash/finding the salt at all, other than speeding up a brute force?

By knowing a portion of the hashed data, and the hashed output, would that help in finding the missing, unknown portion of the hashed data? Would it matter if this was hashed using a nonce, and you have multiple versions of the partial data and ending hash? (For example, two hundred hashes, all with the same salt, same known data, changing nonce)

From everything I've read, I BELIEVE the answer to all of the above is "No, it's of no help, you still need to spend years brute forcing it", correct? I just want to cover all my bases before I put faith, and my I'm-no-expert-why-are-you-asking-me seal of approval on/in a security setup I don't have direct control over (If it were up to me I'd HMAC it - but it's not - and I cannot).


texts:
Disclaimer: I'm new to cryptography.

Background: From Applied Cryptography (Bruce Schneier), page 30 of 2nd edition

  A trapdoor one-way function is a special type of one-way function, one with a secret trapdoor. It is easy to compute in one direction and hard to compute in the other direction. But, if you know the secret, you can easily compute the function in the other direction. That is, it is easy to compute $f(x)$
  given $x$, and hard to compute $x$ given $f(x)$. However, there is some secret information, $y$, such that given $f(x)$ and $y$ it is easy to compute $x$.

Question: From a high level (i.e., more formally), is the following correct?

m = message
i = input (e.g., public key)
t = trapdoor (e.g., private key)
h = one-way hash
f(m,i) = h
f(h,t) = m

Edit: Please see Schneier's use of a "one-way hash" on page 38 of the same reference:

  (..) Alice signs the hash of the document. In this protocol, both the one-way hash function and the digital signature algorithm are agreed upon beforehand.

  Alice produces a one-way hash of a document.
  Alice encrypts the hash with her private key, thereby signing the document.
  Alice sends the document and the signed hash to Bob.
  Bob produces a one-way hash of the document that Alice sent. He then,
  using the digital signature algorithm, decrypts the signed hash with Alice’s
  public key. If the signed hash matches the hash he generated, the signature
  is valid.

Edit 2: Update, based on suggested answers:

x = message
i = input (e.g., public key)
t = trapdoor (e.g., private key)
h = one-way hash
f(x) = h
g(h,t) = x


texts: Homomorphic cryptosystem with respect to concatenation

texts:
Are there cryptosystems that are homomorphic with respect to the  concatenation operation? those. there are data q1 and q2, where q3 = q1q2. then the encrypted data f(q1) = c1 and f(q2) = c2 and f(q3) = g(c1, c2) ?
And are there cryptosystems that are homomorphic with respect to data fetch, i.e. reverse operation, with respect to  concatenation?


texts: Pseudorandom number generator for which it is impossible to deduce the seed

texts:
I'm looking for an RNG that in the case that an attacker would get all or part (most likely part) of the pseudorandom data, there will be no way for them to deduce the original seed more efficiently than brute force.

Which RNG's would comply with my requirements?


texts: Proving an encrypted message contains (but does not 100% consist of) a plain-text message?

texts:
I have keypair (u,r), and two pieces of data, X and Y.

I reveal X publicly but keep Y secret. Y has high entropy.

I then concatenate X and Y, into Z.

I encrypt Z, into "encrypt(Z,u) = Q". r is needed to decrypt Q back into Z.

Later, (when it doesn't matter), r will be revealed and everyone will decrypt Q into Z. At that point, everyone will know that, all along, Q "contained" X. Can I prove that Q contains X before r is revealed (including interactive zero-knowledge proofs)?


texts: What is the probability of un-authenticated messages to go through CCM because of channel errors?

texts:
Consider having the worst possible communications channel, where bits are flipped with probability 0.5.

Is there any probability that channel errors make the change in a frame go un-detected through CBC-MAC?


texts: The security of adding random noise many time pad

texts: In may application, I have a series of real number $\{v_1, v_2, \ldots, v_N\}, v_i\in\mathbb{R}$. To protect them, I add a random noise $r\in\mathbb{R}$ to each themselves like one-time-pad encryption scheme. But due to some more requirements of optimization we only want to generate and use a random noise $r$ instead of generating one time pad. Is this model is secure and which level of security can I obtain?


texts: Two parties looking to share data anonymously

texts:
I've been struggling to find good info on how to do the following:

A(lice) and B(ob) each have a table of data (a and b respectively).  Each table has an id column that is consistent between the parties.  id is a numeric with largeish but limited range.  Otherwise the tables contain different data.

The tables have been deidentified apart from the id.  So it's impossible for A or B to derive what record they are looking at if they have a or b without the id column.  This goes both for their own data and the other's data.

The parties wish to find the records that exist both in a and b without revealing which ones matched.

Essentially, they need the result of select * from a inner join b on a.id=b.id; with the id removed.

A & B may need to find a shared environment to do this, but the data must not leave A or B without it being anonymised.

I've got some amateur hour ideas, but I'm hoping experts here can help or point me in the right direction.  I also hope that this is an appropriate question for this forum.


texts:
I know it should be impossible (or at least infeasible hard) to extract a ECDSA Private Key from a given Public Key (discrete logarithm problem). But I'm not deep enough into ECC to find an answer to this question:
is it possible/easier to find the private key if the corresponding public key is Zero? (like "0x000...000")?
Of course the curve details (base point, finite field etc) is given too.

Thanks alot!


texts: Symmetric vs. Asymmetric cryptographic approaches to data security

texts:
I know the basic differences between Symmetric vs. Asymmetric cryptography, but I'd love to know more details:

Exactly why is the asymmetric approach slower than the symmetric?
Why does it make use of longer keys?
Why does it require more processing power, etc, etc?
In what ways does it trump the symmetric approach?

Thanks, in anticipation, for your answers - I'm writing a BSC project on this issue.


texts: Help, Feedback and Solutions to a problem on a PoC CSPRNG

texts:
Background

I do not recommend trying to roll your own crypto. This is just a for-fun PoC, which won't be used in any public or private scenario.

I am creating a PoC nearly-true random number generator, but this won't be used in real applications. I know the rule of "Don't roll your own crypto", but this is just a fun PoC for nearly-true random numbers. Also, time and convenience do not matter in this case. Also also, I did use the web cryptography API combined with a lot of other CSPRNGs for entropy. Read below...

How it works

The "point" of this is to generate true random numbers without a hardware TRNG in the browser/site with JavaScript.

Of course, if an attacker can break a (CS)PRNG, they can break SSL. (TLS)

The mitigation would be to generate billions of bits of entropy locally, while mixing that with several "randomness beacons"

The (CS/T)PRNG works like this: generate as much local entropy, (into arrays), then get a bunch of numbers from randomness beacons, then hash them together. This is where things get baaaaadddd.

Problem

First, if the values aren't uniform, the values can be somewhat predictable.

Second, the hash function can make the random number lose entropy. A primitive caveman mitigation would be to just add a lot more entropy, but I want to fix this correctly.

So my solution for now is to take the hash (which is several thousand bits long; shake256 is used), re-hash it with sha512, and remove all the letters, and pass that massive number through a library which manages large integers, and then pass it through a uniformity function.
This is a modified version of another function I found on SO here:

function uniform(SCKE) { //SCKE must be a string of a hash without a-z
    function uniform32 () {
        if (SCKE.length <= 23) {
             return SCKE;
        } else {
             return bigInt(SCKE).divide(10**(SCKE.length - 24)).toJSNumber();
        };
    }
    // sample e from geometric(1/2) by counting zeros in uniform bits
    // but stop if we have too many zeros to be sensible
    let e = 0, x
    while ((x = uniform32()) == 0) {
        if ((e += 32) >= 1075) {
            return 0
        }
    }
    // count the remaining leading zeros in x
    e += Math.clz32(x)

    // sample s' = sl + sh*2^32 from odd integers in (2^63, 2^64)
    // (beware javascript signedness)
    let sl = (uniform32() | 0x00000001) >>> 0
    let sh = (uniform32() | 0x80000000) >>> 0

    // round s' to floating-point number
    let s = sl + sh*Math.pow(2, 32)

    // scale into [1/2, 1]
    let u = s * Math.pow(2, -64)

    var srt = Math.trunc(u);
    return Math.abs(srt - (u * Math.pow(2, -e))); //MUST RETURN A FLOAT
};

Question(s)

That is my best mitigation against entropy loss and skewing, but it probably is skewed and has many holes. How can I fix this while keeping uniformity and entropy?
Is there anything else that could be a problem?


texts: Is it better to encrypt before compression or vice versa?

texts: Is it better to encrypt a plain text file before compression, or vice versa?


texts: Given textbook RSA encryption, if an attacker obtains the ciphertext and has the public key that was used, can he or she decrypt said ciphertext without calculating the private key?


texts:
I've found this explanation regarding signature verification but I still confused

In the example in the picture, the sender sign the hash using his secret key. The output of signing produces a signature.

The receiver takes as input the signature and with the public key (sent with the message) verify it using verification algorithm and produce the hash as output. According to what I understand, the receiver performs the revere action, which is equivalent to encryption /decryption, using private/public key instead of the same private key.

Any clarification, please?


texts:
I find myself implementing Speck in an industrial controller that only does signed math.

What cryptographic ramifications would there be if the Speck algorithm was implemented using signed math?


texts: finding sha256 preimage or secp256k1 private key, which is harder?

texts: Is finding a public key that matches hash of pre-commited public key (second layer security) more computationally hard than finding private key to a known public key (attacking secp256k1)?


texts: Estimating the probability of sucess of Pollard's p-1

texts:
I'm trying to estimate the probability that Pollard's p-1 factorization in its two-stages variant finds a factor of an RSA modulus product of $k$ random $b$-bit primes, as a function of the bounds $B_1$ and $B_2$ used.

That's about $1-(1-P)^k$, or about $k\,P$ for low $P$, where $P$ is the probability that a $b$-bit prime $p$ has $p-1$ with its largest prime factor less than $B_2$ and its second-largest prime factor less than $B_1$.
My (incorrect) idea was that we must have $P\ge\rho\Bigl(\frac{b-1}{\log_2(B_2)}\Bigr)\rho\Bigl(\frac{\log_2(B_2)}{\log_2(B_1)}\Bigr)$ where $\rho$ is Dickman's function [*], on the assumption that $p-1$ behaves like a random even integer, that the probability of the largest prime factor $q$ being less than $B_2$ is about $\rho\Bigl(\frac{b-1}{\log_2(B_2)}\Bigr)$; and then the conditional probability of the second-largest prime factor being less than $B_1$ is about $\rho\Bigl(\frac{\log_2(q)}{\log_2(B_1)}\Bigr)$, which is at least $\rho\Bigl(\frac{\log_2(B_2)}{\log_2(B_1)}\Bigr)$.

Problem is, my estimate is much larger than the one given by gmp-ecm with option -pm1 15e9 [#] which estimates its own probability of success as:

Using B1=15000000000, B2=19849281594647716 (..)
Probability of finding a factor of n digits (assuming one exists):
20      25      30      35      40      45      50      55      60      65
0.84    0.58    0.32    0.15    0.063   0.023   0.0078  0.0024  0.00068 0.00018

For $n=65$ decimal digits, that is $b=216$, I get $P$ at least $0.0028$, which is over 15 times more than ECM's estimate $0.00018$.

What's the cause of that discrepancy?

[*] Dickman's function $\rho$ is defined for $u\in\mathbb R^+$ by
$$\begin{cases}
\rho(u)=1 & \text{if }0\le u\le1\\
\rho(u)=1-\int_1^u\rho(t-1)/t\;dt& \text{if }u>1
\end{cases}$$
As $B$ grows, the probability that a random integer about $B^u$ has all its prime factors less than $B$ converges to $\rho(u)$. Sometime it is considered Dickman's function $F$ defined by $F(\alpha)=\rho(1/\alpha)$. In particular, Richard P. Brent's Some Integer Factorization Algorithms using Elliptic Curves uses $\rho$ for that $F$.

[#] gmp-ecm with option -pm1 implements Peter L. Montgomery and Alexander Kruppa's Improved Stage 2 to P±1 Factoring Algorithms, in proceedings of ANTS 2008. The first parameter is $B_1$. $B_2$ is chosen automatically if not specified as second parameter.


texts: Sboxes provide confusion in cipher. Non Linearity measures the strength of sbox layer. In order to measure non linearity of sbox, a table is computed to measure distances with its affine functions. If the dimensions of sbox are huge say eg 64 bits input to 64 bit output, how to determine it's non linearity as table construction is not computationally possible?


texts: Can I determine if a user has the wrong symmetric encryption key?

texts:
We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to be able to provide some guidance to users if they enter the "wrong" shared encryption key (as in "I think you mistyped the encryption key. Please try again"). My first thought would be to use authenticated encryption to verify the decrypted data, but...

Because of constraints imposed by Objectivity/DB's storage manager, our encrypted data must be the same size as the unencrypted data, preventing us form using an authenticated encryption scheme. So, if the user supplies an incorrect shared key, the decrypted data is "gargabe", but is the right size and object references etc. point off to (often) segfault land. Thus, the user experience is a hard crash instead of a "oops, please retype your password". Not ideal.

Our current thinking is to store the HMAC of a known string (e.g. "This should decrypt"), encrypted using the shared secret key. We can test this hmac against the one produced with the users' key to verify the key is "correct" before continuing with deserialization of the unencrypted data from the database. Obviously this HMAC would have to be visible to anyone, before they make use of their secret key.

I'm concerned that this scheme exposes something that shouldn't be. Does using an HMAC in this way expose our encryption scheme (or worse, information about the shared key)?


texts: What are ZK and Fusion algorithms in image steganography

texts: in the literature I have found some algorithms mentioned as ZK and Fusion in image steganography. But I couldn't find any detailed information about these algorithms. Could someone please help to resolve this?


texts: Definition of cryptographic advantage vs. probability of success

texts:
In game-based security definitions, like for example the one defining IND-CPA security, a given cryptosystem is said to be secure if any probabilistic polynomial time adversary has only a negligible advantage of winning the game, where the advantage is defined to be

$|Pr[b^{\prime}=b] - \frac{1}{2}|$,

being $b$ the attacker guess, and $b^{\prime}$ the challenger flipped coin.

However, sometimes I run into papers, like for example this one, where they write something like this (see page 30):

$Adv^{CPA}(B) \geq \frac{1}{2} Adv^{CCA1}(A)-Adv^P(A).$

Clearly, they seem to be treating the adversary advantage as if it was just a probability, and not as the advantage that follows from the definition I just wrote (and it's also given at the beginning of the paper). Is it correct to mix the terms of advantage and probability in this way? Can you just divide the advantage by $2$, like if it was a probability?

I just mentioned this paper as an example, but I have found many others where the same thing seems to be happening.


texts: modified substitution permutation networks

texts:
I have a model of substitution permutation networks, modified as follows:

instead of iterating $n$ times a round(each of which is composed of the key mixing phase,
substitution S-BOX) and permutation), I apply the key mixing phase to the input $n$ times, followed by $n$ substitution, followed by $n$ permutation.
What can I say about the security of this model?


texts:
I am writing a password generator in Go, but I want to make sure I am avoiding modulo bias.

My solution is to get a random number from crypto/rand in the range [0, len(alphabet) ** passwordLength),
and then encode that into the alphabet by dividing by len(alphabet), and using the remainder as an index into the alphabet.

if length == 0 {
    return "", nil
}
if len(alphabet) == 0 {
    return "", errors.New("Alphabet has length 0")
}

// Reading from rand.Reader once for each character would read more bits than necessary.
base := big.NewInt(int64(len(alphabet)))
max := big.NewInt(0).Exp(base, big.NewInt(int64(length)), nil)
num, err := rand.Int(rand.Reader, max)
if err != nil {
    return "", errors.Wrap(err, "Cannot get random data")
}

m := big.NewInt(0)
password := make([]rune, length)
// Add characters in reverse, so that the encoded characters
// follow the same order as the bytes read from rand.Reader.
for i := length-1; i >= 0; i-- {
    // Divmod sets num = num / base,
    // and m = num % base.
    num.DivMod(num, base, m)
    password[i] = alphabet[int(m.Int64())]
}

return string(password), nil


texts: Compute discrete logarithm mod $n=p \times q$ knowing factorisation

texts:
I read in a document that for a given $n = p\times q$ ($p$, $q$ primes), if you know $p$ and $q$ then you can easily solve the discrete logarithm problem, i.e. for fixed $a,b$, you can find $x$ such that
$$a^x = b \bmod n$$
But I don't see how this can be done... I tried to check if the Chinese reminder theorem could help me, and this reduces to find the discrete logarithm modulo $p$ and modulo $q$, but I still don't see how we can get this new discrete logarithm without bruteforcing (which is still exponential, even if you get a square root improvement over the naive bruteforce).

Thank you!


texts: Is an implementation of blinded encryption/decryption mechanism exists?

texts:
I want to use 2 semi trusted servers, to decrypt a secret for a user but I don't want those servers to have access to the plain text.

Those server need to be able to "partially" decrypt and let the user finish the decryption.

One way could be :
User crypt a secret with server A
User crypt result with server B

User decrypt result with server B
User crypt (?) result with one time key
User decrypt result with Server A
User decrypt (?) result with one time key => User got plain text

Thanks !


texts: Antshares (NEO) algorithm (dbft) - Vulnerability to attacks - Game theory

texts:
This is more a game theory question, I think that this Forum is the best for this question.

Please also correct me at the following text if I write something wrong. I understand the consensus algorythm (delegated byzantine fault tolerance (dbft)) of Antshares or NEO like this:

Nodes have a voting power and they can vote for one or more Bookkeeper nodes. Bookkepper nodes are involved in the consensus process. A node is not involved in the consensus process. One bookkepper node is selected by the system to broadcast it's version of the blockchain. Bookkeeper nodes need to agree with 66% on a version of the blockchain. If 66% is not reached then the next bookkeeper node broadcasts it's version and so on.

Now my questions:

1) What happens if no consensus is reached? Endlessloop and nothing happens?

2) Can a node also be a virtual machine? I mean if so it would be much easier to attack the system and elect malicious bookkeeper nodes.

3) If 33% of elected bookkepper nodes are malicious, is the system then destroyed?


texts: What happens in the MonkeyWrap-Algorithm of KetjeV2 if the input is a single block?

texts:
I am currently implementing KetjeV2 in VHDL. I have a question concerning the MonkeyWrap-Algorithm that is used in KetjeV2.

The function $wrap(A, B, l)$ is supposed to work as shown below, where $A$ is the associated data and $B$ the plaintext. $A$ and $B$ are then separated into blocks of the size $\rho$, where the block with index $i$ is written as $A_i$ and $B_i$.

Now what happens if $A$ and $B$ have the size of exactly one block, i.e. $\rho$? The first for-loop in the algorithm description below suggests that you need to have at least two blocks. However, a stream cipher works with arbitrary input length, so it should not be a problem to have input data of length $<= \rho$.

The reason I would use an input size of exactly $\rho$ is convenience, i.e. I don't need to do any padding or separating input data into blocks if the input itself already has the correct length. For real world usage this of course is not the case, but let's not worry about this for now.


texts:
I am trying to understand the Fiat-Shamir identification protocol, but have a problem with understanding how this protocol is supposed to be save, even if you repeat it several times. I am using algorithm's description from http://www.cs.rit.edu/~jjk8346/paper.pdf.

If I do the maths, A can always convince B without knowing s. The problem here is step 4. A just has to calculate $y=(x*v^e)^{\frac{1}{2}}$ and send it to B. Because now B will always accept this, since his condition is $y^2 = x*v^e \operatorname{mod} n \Longleftrightarrow (x*v^e)^{\frac{1}{2}*2} = x*v^e \operatorname{mod} n \Longleftrightarrow x*v^e = x*v^e \operatorname{mod} n$, which is always going to be true.

The problem is that on the right side of the equation $y^2 = x*v^e \operatorname{mod} n$ there are only values A knows, so for A it is no problem to put in something for $y$ so that the equation will always be correct.


texts: What does $\text{PK}=\text{pk}\oplus\text{H}(\text{opk})$ represent in this paper?

texts:
In Lu, Au and Zhang's 2019 paper (Linkable) Ring Signature from Hash-Then-One-Way Signature, they

…extend [M. Abe, M. Ohkubo, and K. Suzuki's 2019 1-out-of-n signatures from a variety of keys] framework to its linkable variant. Borrowing the idea from [our previous lattice-based linkable ring signature scheme, Raptor], we adopt [some] one-time signature scheme ($\Pi^{OTS}$). We build a generic method of constructing linkable ring signature based on $\Pi^{OTS}$ and $\text{Type-H}$ signature with uniform distributed public key. During the key generation procedure, in addition to the public key and secret key pair $(\text{pk},\text{sk})$, each signer also generates a pair of public key and secret key $(\text{opk},\text{osk})$ of a one-time signature. The signer then computes $\text{PK}=\text{pk}\oplus\text{H}(\text{opk})$ for some appropriate hash function $\text{H}(\cdot)$. The new public key is $\text{PK}$ and the secret key is $\text{SK}=(\text{sk},\text{opk},\text{osk})$.

I take it (perhaps incorrectly in this case) that this symbol, $\oplus$, in that second-to-last equation represents exclusive-or, but how is that implemented here?
They explicitly list RSA as a supported $\text{Type-H}$ signature scheme to underly this linkable ring signature scheme, but this leaves two large questions:

how does one use an RSA public key $\text{pk}$, which is an ordered sequence of two integers, one of which is at least 1024 bits, as an argument to XOR with the output of a hash function such as SHA256, which is merely 256 bits?

How would you interpret the (identically random) result of an XOR with a cryptographic hash digest back into such a particularly constrained sequence of integers as RSA public key $\text{PK}$? (i.e. the first one must be the product of exactly two primes; the second should be less than around 1024 bits) -- and then how would you ensure that $\text{SK}$ comprised its factors?

$\text{PK}_\text{RSA}=\text{pk}_\text{RSA}\oplus\text{SHA-2}_{256}\left(\_\right)$
^ This seems so impossible and ridiculous (despite the authors of this paper listing RSA explicitly as a supported algorithm, and SHA256 being practically "the" standard cryptographic hash) that I am sure I'm misinterpreting something — probably the $\oplus$ symbol, though I cannot fathom what it might mean instead — so, what is represented in that line? Am I misinterpreting what $\text{PK}$ represents?
For instance, how would I, "mechanically", (in, say, pycryptodome) enact or implement this line, if we take SHA256 as $\text{H}$, RSA as the $\text{Type-H}$ signature scheme, and (say) Lamport signatures as $\Pi^{OTS}$?


texts:
I have an embedded project that requires AES, I seem to have found an AES implementation that fits the bill here: http://www.literatecode.com/aes256, but it does not include an IV.

Are there any documents detailing the standard way to implement an IV? I looked up the FIPS 197 spec and there is no mention of an IV.


texts: Where does the $\varphi(n)$ part of RSA come from?

texts:
$e d \equiv 1 \pmod{\varphi(n)}$

Where does the $\varphi(n)$ part come from? How did the inventors of RSA arrive at $\varphi(n)$?


texts:
I don't understand why Q keeping pairs of  instead of m like mac-forge solves the problem of generating a new tag on a previously authenticated message. Say, a previously authenticated message for "Cat" is tag 90, Adversary can retrieve (Cat, 90) from the query. However, if Adversary is able to successfully forge a new tag (Cat, 138), I almost feel as if sforge weakens the definition. Q has Cat, but it doesn't have 138 as the tag, so this will pass mac-sforge, but not pass mac-forge. Could someone clarify my confusion?

Relevant passage From Katz and Lindell:

"As defined, a secure MAC ensures that an adversary cannot generate a valid tag on a new message that was never previously authenticated. But it does not rule out the possibility that an attacker might be able to generate a new tag on a previously authenticated message. That is, a MAC guarantees that if an attacker learns tags t1, . . . on messages m1, . . ., then it will not be able to forge a valid tag t on any message m ̸∈ {m1, . . .}. However, it may be possible for an adversary to ”forge” a different valid tag t′1 ̸= t1 on the message m1. In general, this type of adversarial behavior is not a concern. Nevertheless, in some settings it is useful to consider a stronger definition of security for MACs where such behavior is ruled out.

Formally, we consider a modified experiment Mac-sforge that is defined in exactly the same way as Mac-forge, except that now the set Q contains pairs of oracle queries and their associated responses. (That is, (m, t) ∈ Q if A queried Mack(m) and received in response the tag t.) The adversary A succeeds (and experiment Mac-sforge evaluates to 1) if and only if A outputs (m,t) such that Vrfyk(m, t) = 1 and (m, t) ∈/ Q.

DEFINITION 4.3 A message authentication code Π = (Gen,Mac,Vrfy) is strongly secure, or a strong MAC, if for all probabilistic polynomial-time adversaries A, there is a negligible function negl such that:
Pr[Mac-sforgeA,Π(n) = 1] ≤ negl(n)."


texts: Zero knowledge proof for opening of Pedersen commit and discrete logarithm

texts:
I am looking for a proof of knowledge as such:

$PK\{ (x,r) : C = g^xh^r \land V = g^x\}$

Where $C, V, g$ and $h$ are public information and $x$ and $r$ is known only to the prover.

I.e. I have a Pedersen commit and a public key and I want to prove in zero knowledge that the committed value is the private key. Is there such a construct available?


texts: Interpolation in the Exponent (Shamir Shared PRF)

texts:
Trying to implement the Diffie-Hellman distributed PRF mentioned by Cachin : https://cachin.com/cc/papers/abba.pdf.

It makes sense to me... just use the same Lagrange coefficient I'm using to combine shamir shares, but instead use exponentiation and multiplication ... so the interpolation is happening in the exponent.

But something isn't working out.

Right now I'm simply doing this for each share:

shares[i].data = pow(gen, shares[i].data, prime)

Then (essentially) this to combine:

comb = 1
for share in shares:
   comb *= pow(share.data, lagrange[share.index], prime)

I'm using pycryptodome's implementation of SSS and pulling out the coefficient calculations.   I know that when I do this on the unmodified secrets they recombine just fine, so the L vals are OK:

comb = 0
for share in shares:
   comb += share.dat * lagrange[share.index] % prime

I think the issue is doing all this exponentiation in a prime field breaks things... maybe I need to choose the generator (base) more carefully... but it doesn't seem to matter what I choose.

I tried using ECC instead instead of g^secret (which is probably better anyway, since some generators could fail to explore the prime field properly and need to be chosen correctly)... I'm using the secp256k1 field prime.   Shares are modified (Gen * share) and combined via:

comb = [None,None]
for share in shares:
   comb = curve.add(comb, curve.mult(curve.import(share.data), lagrange[share.index])

But I get the same issue (nondeterministic results).

Does anyone know of a library in any language that does this sort of  "combination of modified secrets"?   The Cachin paper seems to address it as a pretty trivial solution to the distributed PRF problem.   I'm fine with the random oracle model assumptions.

(If I could see a working example of any version, it would probably be obvious what I'm doing wrong.)


texts: In SRP, is the client protected from server impersonation?

texts:
Assume use of SRP over an otherwise insecure unauthenticated channel where

the user running the client side has chosen a password,
the user only uses that password with a trusted SRP client software, and with the intention to login to the legitimate server (then communicate securely with that server using the SRP-negotiated session key),
there was no attack at enrollment time,
the server keeps the enrollment data confidential,
the password is good enough that odds are negligible that it could be guessed in a thousand attempts, and neither the server nor user would tolerate that many unsuccessful login attempts.

Does that protect the user from logging to another server?

Motivation: see that question.

So far, I have determined that such protection is not in SRP's advertised features:

  It solves the problem of authenticating clients to servers securely, in cases where the user of the client software must memorize a small secret (like a password) and carries no other secret information, and where the server carries a verifier for each user, which allows it to authenticate the client but which, if compromised, would not allow the attacker to impersonate the client. In addition, SRP exchanges a cryptographically-strong secret as a byproduct of successful authentication, which enables the two parties to communicate securely.


texts: Use exported certificate with private key to logon using Kerberos

texts:
First I just would like to mention, that my knowledge in windows authentification methods are very limited. So my question:

Is it possible to use custom credential provider in windows to log on, that accepts certificate, which I export from certificate store with private key.

As far as I know, Kerberos accepts username/password format and although certificate from smart card.

So my question is, how can I feed my exported certificate into Kerberos?


texts: Why is the GHASH output in GCM mode encrypted to calculate the tag?

texts:
To calculate the authentication tag in the Galois/Counter mode (GCM), first a MAC is calculated using GHASH over the cipher text and the additional data. After that, this MAC is encrypted using GCTR (using the first counter).

My question is: Why is this last encryption step neccesary? What would the security problem be, if I just used the output of GHASH directly as the authentication tag?


texts: Prove that the given scheme is CPA secure or not

texts:
Given:

F is a length preserving PRP.
Encryption scheme $\Pi$ for messages of n/2 bits where:
$m\in\{0,1\}^{n/2}$
$k\in\{0,1\}^n$
Enc: Select a random string $r\in\{0,1\}^{n/2}$ and output  $c\leftarrow F_k(r||m)$

Prove:
If this scheme is CPA secure or not.

My approach so far has been to Prove this using reduction by designing an Attacker $A$ who can break this scheme with non negligible probability, Using that attacker I am trying to break PRP with non negligible probability but that would give a contradiction and hence this scheme is CPA Secure. Am I going wrong somewhere?

Also can we ever say with 100% certainty that a scheme is secure by this approach?

Also, my understanding to prove these kind of things is :
 To prove that a give scheme is insecure design an attacker for the given scheme
 To prove that a given scheme is COA/CPA secure design an attacker who can break the scheme with non negligible probability and reach a contradiction somewhere
Am I missing something here?

Is the above scheme CPA secure? How to prove it?


texts: Elliptic Curve vs RSA key length comparison

texts:
I'm new to ECC.
From this website (GlobalSign Elliptic Curve Cryptography) a 256 elliptic curve key pair provides as much security as a 3072 bit RSA key pair.

My question is: how do experts come to this conclusion? Is there an algorithm that can check or compare the key strengths of both algorithms?
Which parameter of the elliptic curve (a, b, G, P, N, H) determines the most the strength of the elliptic curve?


texts: How was AES Encryption cracked on my app?

texts:
I built an app that used AES encryption with 16 characters Key and IV.  It seems it could easily be hacked, as someone did it in a day.
I feel that I made a few mistakes

Used key & IV which was only plain text length of 16
Key not hashed with SHA-256
It was an Android app ( Xamarin Forms) and I did not obfuscate the app

Can anyone guide me on what went wrong?
[Updates]

The app needs to operate in offline mode. That's why I hardcode keys in the application.
This app is reading information from QR Code encrypted content. An attacker able to create a QR Code with fake information that becomes a valid QR code


texts: Show that $\text{FACTORING} \le_P \text{SQROOT}$

texts:
I tried to prove that $\text{FACTORING} \le_P \text{SQROOT}$ in a general setting, so $n = p_1^{\alpha_1} \cdot p_2^{\alpha_2} \cdot \ldots \cdot p_k^{\alpha_k}$.

  THEOREM:Let $n$ be a composite number and let $x$ and $y$ be integers such that $x^2 \equiv y^2 \pmod n$ and $x \not \equiv \pm y \pmod n$ holds. Then $\gcd(x+y, n)$ and $\gcd(x-y, n)$ are non-trivial divisors of $n$.

My attempt:

  $\text{FACTORING} \le_P \text{SQROOT}$: Suppose we have an algorithm $\mathcal{A}$ that solves $\text{SQROOT}$. We show that we can then factor $n$ with prime factorisation $n = p_1^{\alpha_1} \cdot p_2^{\alpha_2} \cdot \ldots \cdot p_k^{\alpha_k}$. Select a random $x \in Z/nZ$ with $\gcd(x,n) = 1$. Compute $a = x^2 \pmod n$ and use $\mathcal{A}$ to find a square root $y$ of $a$ modulo $n$. If $y \equiv \pm x \pmod n$ choose another $x$ and repeat this process until a $y$ with $y \not \equiv \pm x \pmod n$ is found. Since there are $2^k$ distinct square roots of $a$ modulo $n$ the chance that said procedure needs to be repeated is $\frac{1}{2^{k-1}}$. So by the theorem above we can find two non-trivial divisors of $n$ in expected polynomial time. Repeating this procedure for the thus found factors of $n$ we can find the prime factorisation of $n$ in expected polynomial time.

I am a bit unsure about the whole "expected polynomial time" thing. I have only heard informal definitions of it until now. Could you please have a look at my proof?

EDIT: I initially accepted the answer of Meir Maor below, but there was a gap in it as I just realised:

  $k=2$ is the worst case. But this implies only that $n=p_1^{\alpha_1}p_2^{\alpha_2}$, not $n=p_1 p_2$. So we still have to find some non-trivial divisors of the thus found factors of $n$ to get $p_1$ and $p_2$. I would like to keep the rigour of Meir Maor's answer, but I do not know how to determine the runtime of this procedure. Could you help me?


texts:
Imagine we have 5 different parties, all of these parties test if a particular thing is true or false over the course of 24 hours. The network needs to come to a consensus about the majority outcome of these parties votes.

The 5 different parties need to submit their votes onto a blockchain, however if within the 24 hour time-frame one of the parties submits their vote early there comes potential for one of the other party members to look at the early submitted vote and copy that vote skewing the real result.

What is the way to prevent copying in this situation, can a hash time locked contract be opened that collects the encrypted votes from each party and then after the 24 hours reveal the result to the network?

Or is there something simple im missing, the basic idea is I want to cryptographicaly hide something and then reveal it at a certain block height?


texts: What information is signed by a Certification Authority?

texts:
What data does a CA sign?
I know that in a certificate there is plenty of information such a the serial number of the certificate itself, the X.509 version number, the user public key, the asymmetric algorithm to which the key belongs and its size, the user ID, the validity of the cert (both beginning and expiration day), CA ID and finally the digital signature and the algorithm used to generate it..
What information is signed with the CA private key? Is it just the (user ID || user public key) or something else?
I don't know if I need to specify that, but I man concatenation with the || symbol, but I don't know if the data is simply appended in sequence.


texts: Is it possible to translate a piece of language into your own without knowing the language?

texts:
I understand the the texts within the Voynich Manuscript are of an unknown language, and yet cryptographers are still working on it and still trying to decipher it. Does that mean that it is possible to crack any piece of writing even if it's in a language you don't know, and assuming you have no access to any tools that can translate the language?
For example, let's say I see a piece of writing in Arabic, which obviously has no cohesion to English. Is it possible to translate it just by working on that piece of writing alone without nothing else? If so how would I go about this?


texts: ECDSA public key recovery is discovered by whom?

texts: I'm looking for the history of the method (ECDSA public key recovery from signature). Where did this implementation first appear in (is it bitcoin?) and who discovered this method?


texts: Text encrypted with key1, key1 encrypted with key2, meaningful?

texts:
Simplified Question
Does it make sense from a security / cryptographic standpoint to encrypt a text in the following way:

create only one AES key K_Azure
create new random key K_Text1
encrypt Text1 with K_Text1
encrypt K_Text1 with K_Azure
store [ E(K_Text1), E(Text1) ] in the same storage
store K_Auzre somewhere else

Context
The DataProtection in asp.net core provides a mechanism to encrypt and decrypt some data.
The keys are stored in a key-value-pair format of (KeyId, XML), where XML provides some metadata and the actual encryption key itself.
The part of the XML where the key is stored can be encrypted using various providers, my question is about the ProtectKeysWithAzureKeyVault (link) implemented here.
Protecting the keys
With ProtectKeysWithAzureKeyVault a data encyption key (let's call it TEXT, because in our case this will be just a text) is encrypted using a random new generated key (let's call it K_Text). K_Text will be encrypted using a single key in the AzureKeyVault (let's call it K_Azure).
The encrypted TEXT and encrypted  K_Text are saved in the same store (in the same XML which is saved in in a SQL or file or we...).
To summarize
+------------------------------------ --------+          +---------+
| Database                                    |          | Azure   |
| ----------------------------------- --------|          | --------|
| Id1, E(K_Azure, K_Text1), E(K_Text1, TEXT1) |          | K_Azure |
| Id2, E(K_Azure, K_Text2), E(K_Text2, TEXT2) |          + --------+
+ ------------------------------------ -------+

E (KEY, TEXT) = encript TEXT with KEY

My question
Is there any reason why it does not encrypt the TEXT directly with K_Auzre?
Notes

AES is used to encrypt everything as far as I know in this context

Update
I think Elias is right, K_Azure is kept in separate hardware and you can not get it.


texts: What is the bound for the probability distribution for ATV-FHE scheme?

texts:
I try to implement the ATV-FHE scheme as described in this paper https://eprint.iacr.org/2014/039.pdf.

How do I choose the bound for the probability distribution chi?

How do I choose standard deviation for this distribution?


texts: Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

texts:
Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 bits, but where do the other 1888 bits from the 2048-bit output come from?

Are they another a hash value or are they just padding?

Can someone briefly answer this question. If you also can provide me a source or a website to read more about it since I've been trying to find an answer of this one but I haven't gotten a good resource to explain this issue.


texts: Are there any known problems or attacks for using SHA1(AES_key) as the HMAC key?

texts:
See this answer that explains the following sequence of operations:

CipherText = IV|| AES(key1,iv,message)
tag = hmac(key2,ciphertext)

That answer says,

  You should use a different key for the HMAC. In practice tacking the sha1 sum of your encryption key is good enough.

Is it really okay to use SHA1(key1) as key2? Most advice I have says that key1 and key2 must be independent but with key2 = SHA1(key), key2 depends on key1.

Are there any theoretical or practical problems or attacks known for using key2 = SHA1(key) as the HMAC key?


texts: Decrypting LFSR, knowing the beginning of the cyphertext, and nothing else

texts:
I have a cipher-text in binary, I know the beginning of the plain-text. I know that it is encrypted using LFSR, and I know nothing else.
How can I attack, and decrypt it?
What I have tried;
I converted the beginning of my plain-text to binary, which had a length of 84. My ciphertext's length is 952. I've got the first 84 bits of my cipher-text, XOR'd it with the known part of plain-text in binary, assuming that this would give me the first 84 bits of my key-stream, which was not periodic.
After that, I have used the Berlekamp-Massey algorithm with that 84 bits of the key-stream, to find the smallest possible connection polynomial that could be used to get it. (I don't know if it was definitely the connection polynomial for my key-stream, knowing that the long gap is huge and the known keystream is not periodic, it probably is not)
I then tried some shenanigans but nothing worked, I couldn't take any further steps. I've tried using the known cipher-text as the initial sequence and the polynomial I've got from the BM algorithm as the connection polynomial to generate another key, but that neither worked for my known plain-text or the rest, therefore assuming this was not a correct method to continue.
What further steps can be taken to decrypt this cipher?


texts:
I was reading 'Pinocchio Coin' paper by Danezis et al. where they have said,

"If we use the efficient pairing groups of Pinocchio, computing discrete logarithms in the exponent field $\mathbb{F}_p$ with p ≈ 256 is easy. We could switch to non-standard and larger pairing groups, but this seems undesirable as it would bring down the overall performance of the proof system. Instead we propose to compute C in an extension field $\mathbb{F}_{p^\mu}$ of size $p^\mu$ > 2048."

Here C is just a Pedersen commitment. My question is, to achieve 128 bits of security, what should be the size of $p^\mu$? Is there any source where I can find the relevant specifications?


texts:
I have been reading around protocol specification and there is either too much technical detail or too bad articles on various sites.

I need you to explain in simple words how encryption in bitmessage works and what are main security flaws of bitmessage and why?

To be more detailed with with my question I want to understand how asymetric encryption works in bitmessage and why there are collisions with addresses? how is private key stored(or not).

an example of ie. Bob and Alice exchanging a message over bitmessage (with encryption details) would be great!

BTW. Can somebody please create "bitmessage" tag...


texts: How to use salt when there is only one user

texts:
I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files.
I am using AES in CBC mode with PKCS5 padding, and the key is created from a single passphrase using PBKDF2.

Question: Would it increase security if I used a different salt for encrypting each file, or would that only make sense if I also used a different passphrase for each file?

The posts I could find deal with a multi-user scenario, where of course you need per-user salts. But I have only 1 user and 1 passphrase, so creating a new key for each file feels wrong to me.


texts: Is the key safe if attacker know the encrypted and decrypted message?

texts: Given an attacker know both the encrypted message (+ an iv) and the equivalent decrypted message, is it possible for him to craft a new encrypted message that could result in a desired decrypted message? I'm using aes-256-gcm algorithm specifically.


texts: Can Add and Multiply On Cipher Text achieve all operations?

texts:
A Fully homomorphic encryption scheme needs to support an evaluate function that can do add and multiply operations on cipher text.

Can we do all kinds of complex operations on cipher text like search, sort etc using just add and multiply ?


texts: How can rainbow tables be used for a dictionary attack?

texts:
I'm putting together a password policy for my company.  I very much want to avoid requiring complex passwords, and would much rather require length.

The maximum length I can enforce is 14 characters.  I can calculate that 14 random lower case characters is stronger than 8 characters using anything on the keyboard.  However I'm suggesting that people use phrases, song titles, things like that.

I don't think I need to protect against someone guessing passwords since our system will lock you out after 5 failures.  I imagine I'm protecting against someone stealing the hashes of our passwords.
Thus I imagine the mode of attack, if there was one, would be via rainbow tables.

I think 14 random lower case characters is reasonably safe against rainbow tables (we have Windows Server 2008 which I understand eliminates the LM compatibility weakness).  However if phrases are used, there are many less possibilities than random characters would have.

Does anyone know if rainbow tables can be designed in conjunction with dictionary words, say by tokenizing them?

Along with this, I believe that NTLM passwords are hashed but not salted - does anyone know if that is true?  If it turns out that they're salted, then I think I have little to worry about.


texts: Trying to better understand the failure of the Index Calculus for ECDLP

texts:
So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong).

So basically the index calculus for the discrete log problem over $\mathbb{Z}_p$ takes advantage of the fact that even though we don't know the structure of $\mathbb{Z}_p^*$, we still have the homomorphism $\mathbb{Z}\rightarrow\mathbb{Z}_p^*$.  And thus we can still unambiguously write elements mod $p-1$ in terms of their prime factorizations.

And so since small primes occur the most frequently in these factorizations, then if we find enough elements of $\mathbb{Z}_p^*$ which can be written in terms of powers of some collection of small primes, then we can take the $\log_{\alpha}$ of both sides and form enough linear congruences to find the value of $\log_{\alpha}$ for each one of these small primes (this is the pre-computation part).  And then we finish by doing a similar procedure again but for an equation involving $\beta$.

The point wasn't to go into all the technicalities of this algorithm but to observe that the failure in the elliptic curve setting seems to boil down to the fact that there is no clear analogue of this trick when we shift settings from groups where the operation was to either add or multiply, followed by modding out, to a setting where the group operation involves the geometrically motived application of algebraic equations to relate points on a curve.  Since in this case there is no well understood UFD like the integers hanging around in the background to provide homomorphisms into any $\mathbb{Z}_p$ we want.

My understanding is that attempts to extend the Index Calculus to elliptic curves basically involve attempts to get $E(\mathbb{Q})$ to play the role of the integers.  But that these attempts have been met with at best marginal success and only for certain special families of elliptic curves.  While the problems encountered when trying to extend to the general case currently appear insurmountable.

I also want to clarify that being able to find in polynomial time the isomorphisms $\mathbb{Z}_p^*\rightarrow \mathbb{Z}_{p-1}$ in the finite field setting or $E(\mathbb{F}_p)\rightarrow \mathbb{Z}_{n_1}\times\mathbb{Z}_{n_2}$ in the elliptic curve setting would essentially crack the discrete log problem, correct?  And so it is the apparently random structure of these groups which lies at the heart of the difficulty of these problems.


texts: Cross, Benes and Butterfly permutation. How make it?

texts:
I'm not a math professional and researching an algorithm to provide a good permutation, I found references for Butterfly, Benes and Cross permutations.

But all papers I found are in fact discussing some enhancements and/or CPU mnemonics to these algorithms. I saw a lot of images like this, for BENES:

Since I'm not familiar with some aspects of that kind of image, I would like to understand somethings based on the following image:

1- I can understand the Control-Byte against the Data-Byte to provide a way to swap bits accordingly.

2- YELLOW bit can be ZERO or ONE (it depends of the corresponding Control-Bit). If zeroed, it affects the RED circle; but if ONE, it goes straight to the PURPLE.

3- But CYAN bit also may affect the same bits!

It's weird and confuse!

Let's suppose my CONTROL-BYTE is 0x00001111 or even 11110000. In these cases, I will see YELLOW or CYAN affecting the same result bit (PURPLE or RED).

I tried to research some "basic" math to understand it but I really got no sucess at all!

I would like to make a C# routine (I'm not worried about performance) to provide same schema on BITS, BYTES and even INTEGERS...

Thank you in advance for the patience in explain this to me.

UPDATE

Some links where I found the information above:

Fast Subword Permutation Instructions Using Omega and Flip Network Stages

Efficient Permutation Insctructions for Fast Software Cryptography

Bit Permutations

Pipeline and SIMD Parallel Processing Principles


texts: Is gfcombinefs - a filesystem for n-of-m Shamir secret sharing - fundamentally read-only?

texts:
With a view on using a tool similar to fgcombinefs in cloud situations, I would need a writable n-of-m Shamir secret sharing filesystem.

As a matter of routine security, I do not want the cloud provider to be able to reconstruct real data from what I store on his hardware.

If the data stored on his hardware is fundamentally random, because it is just one share in a Shamir shared secret, there is no point for anybody to try to look for a key, because there isn't one. The attacker would simply need find the other n-1 shares, stored at other cloud providers elsewhere on the globe.

fgcombinefs seems to implement 99% of the job, but unfortunately, its Shamir filesystem is read-only.

When looking at the fuse operations behind fgcombinefs, you can see that both read and write are actually supported :

int(*   write_buf )(const char *, struct fuse_bufvec *buf,
   off_t off, struct fuse_file_info *)

int(*   read_buf )(const char *, struct fuse_bufvec **bufp,
   size_t size, off_t off, struct fuse_file_info *)

You can see that in the case of writing a block, fuse will ask you to effectively perform a write to the file named as in the first string argument const char *, at offset off_t off.  In the case of a read of a block in a file at a particular offset and a particular size, fuse will ask you to allocate a block, if needed, and return its address in bufp.

I would think that writing a Shamir block, amounts to first producing the m Shamir secret shares, and then writing them to the m underlying filesystems, while reading a Shamir block amounts to picking n filesystems from the m available, ask them to send the block, recombine the n secrets on the fly, and return the reconstituted block to the caller.

In these circumstances, I do not really understand why writing to a Shamir filesystem would fundamentally be unsupported?

However, if I overlooked an impossibility somewhere, I would be most grateful if someone pointed it out, because it would spare me the time wasted in trying to program something that would in fact be impossible. Is there fundamentally a reason why the author has made fgcombinefs read-only?


texts:
Is there some provably secure hash function to prime numbers?
Say, a function $H: \{0, 1\}^* \rightarrow \{e: e \in \{0, 1\}^\lambda \land e$ is prime$\}$

I'm asking because there are some constructions to be used only on prime numbers (for example CL02 Strong-RSA Dynamic Accumulators).


texts: How to recover small messages from textbook RSA?

texts:
In the answer to the question Random unique key per message, safe to use key as IV? it was claimed that one can recover a random 128-bit textbook-RSA encrypted value using about $2^{64}$ steps.

How and why does this attack work?


texts: How to generate an RSASSA-PSS signature with MGF1-SHA256?

texts:
As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created.  I can choose any 32-byte key; moreover, I am provided with a default key, namely

49db67e9a6f198be22b03e84dedd69b834ba67d42e017d2f1ef08f0203010001

However, I have no clue what those terms mean (e.g. mask function???).  The rooting guide refers to a specification sheet online, that details how these encryption algorithms work.  Would I have to follow all the steps in that file one by one, or has this algorithm already been programmed somewhere, in a way that I can provide the file and the key, and it can give me the 256-byte hash?

I apologize in advance if this is not the type of questions that are typically asked on the crypto site; but I asked on the meta, and did not get a response about where I can ask this; and, this is the last step of a day-long root, so I really wish to get this done.


texts:
What means when pgpdump shows this kind of algorithm in the Public-Key Encrypted Session Key Packet?

New: Public-Key Encrypted Session Key Packet(tag 1)(126 bytes)
    New version(3)
    Key ID - 0xEC661A345473
    Pub alg - Reserved for Elliptic Curve(pub 18)
        unknown(pub 18)
        -> m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02

What means m = sym alg(1 byte) + checksum(2 bytes) + PKCS-1 block type 02?

Which Elliptic-Curve-based operation was made from the sender software?


texts: Symetric key encryption is not Authentication?

texts:
Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption?

I know you can create a setup that isn't authentication, but how will you go about it?


texts:
I enjoy cryptography, and like encrypting stuff hands on, for fun. I often send encrypted messages to friends. Trouble is, the easiest ciphers are also very insecure (for example, the Vigénère cipher and the Playfair cipher) and the most secure ones are plain impossible to use with just pen and paper (for example, RSA and AES)! I once even tried to encrypt a message using RSA (using just a calculator, obviously), but, even with some assistance, I gave up halfway through (my message was something like "Hello there!").
                                                  Could someoneone suggest a cipher that strikes a reasonable balance between security and feasibility? I just want to have fun, so it's very important that I must be able to do the required calculations by hand, or at most, with the help of a calculator.
I have the VIC cipher and a personally modified version of the ADFGVX cipher on mind, but I look forward to suggestions from more experienced cryptographers.
                                                 P.S.: I was not sure what tags to add, so I hope my choice is relevant. My choice would have been "Recreational Cryptography"!


texts: Can you help me find a cryptanalytic way to attack a simple monoalphabetic substitution cipher algorithm?

texts:
I have decided to make a project at uni that requires me to crack a monoalphabetic substitution cipher. The text is an english text with spaces. The key is a permutation of the alphabet. This isn’t some big project and it should be fairly simple to do. So, I am looking for an algorithm (doesnt have to be really fast) that is fairly simple.

I googled a bit and all the proposed algorithms like this answer to “Strategy to crack a presumed substitution cipher” are some genetic ones (i dont want to get into that) or some advanced (I mean not really basic) statistics (like here http://practicalcryptography.com/cryptanalysis/text-characterisation/quadgrams/#a-python-implementation and you need some other files).

Is there some reliable (I assume not so fast way) to crack the cipher with only the knowledge and use of the letter frequences and some list of the most lets say 10k or more english words?

I thought about it for a while and I cannot come up with a good way to make the function to rate the ciphertext (as is used in most of the algorithms). What would be a well-vetted cryptanalytic way to attack a simple monoalphabetic substitution cipher algorithm?


texts: How can I show that the DDH problem is self-reducible?

texts:
I have trouble to understand how I can show that the Decisional Diffie-Hellman problem (DDH) is self-reducible.

I found this as a description of a random self-reducible problem.

Given an instance I1, it can be solved as follows:
(a) transform I1 into a uniformly random instance I2
(b) solve I2 and
(c) transform the solution for I2 into a solution for I1

Can someone (try) to explain me how I can show that the Decisional Diffie-Hellman problem (DDH) is random self-reducible based on these 3 steps ?


texts: Is it possible to crack a LFSR encrypted file without using bruteforce?

texts:
Let's say I was given a file from which I know that it is encrypted using a 5 bit LFSR with a given poly.

I already know that it is possible to deduce the state of an LFSR and thus all future outputs if you're given a certain length of the LFSR's output. But if that output is xored with a file, I would assume you can't, because of course you don't know the content of the file.

Am I right, or is there a way I havent't thought of?


texts: Rating a steganographic system using Blum Blum Shub to locate hidden bits

texts:
Currently I'm building a toy steganography system based in a web browser. Besides all the obvious issues with building a system requiring extreme privacy into a browser (this is a toy!), I was curious if there were any serious flaws to the basic flow of the system.

The idea is to take a binary buffer of any length as the transport layer, and switch the least significant bits of each byte of the buffer (not the alpha channel in images due to issues with the canvas messing with alpha for better performance) based on the binary of the plaintext. That is the basic part and basically the same as every other system.

Where this differs is that a steganographic key is taken in the form of a large integer which is fed into Blum Blum Shub in order to derive the bit positions of the switched bits. In addition, garbage bits are created so as to allow the plaintext a space to be more thoroughly obfuscated in. (For example, this would result in an image of length 50 bytes [excluding alpha] and a plaintext of length 5 bits having the space between each plaintext bit padded.) The derivation of the garbage bits is via a system that allows for different results to occur from different key/image combinations but remain constant through the same combinations.

The plaintext is, as should be noted, not a plaintext but rather the output of AES with a separate encryption key.

Thanks for the time and this is my first attempt at building something like this so criticism is really appreciated!


texts: How does forking lemma work in regard to Digital signatures produced by GPV hash and sign algorithm based on lattices?

texts:
I am working on understanding the concepts and approach behind digital signatures that are based on lattices specifically the GPV algorithm.

During the security reduction of this method, the forking lemma is used to show that the attacker can generate a correct forged message.

I read about the forking lemme and I am not able to understand it completely and its application here. This is mainly because I am not predominantly from a math background.

I am looking for a simple explanation of how forking lemma works to forge a signature in this scheme.


texts:
I try to understand Pedersen commitment in elliptic curves over finite fields. I could use some clarification.

Let's say we have two generators $G$ and $H$.

Is that required that $G$ and $H$ are two different generators of the same group?

Pedersen Commitment $C$ will look like that.

$$C = aG + bH$$

$C$ is a point on the curve, right?

Now in the situation when $a=0$ we have

$$C = 0G + bH = bH$$

How do I know that $bH$ is generated by $H$ without revealing $b$?
How do I know that $bH$ is not generated by $G$?


texts: Understanding ElGamal encryption for a Mental Poker Case

texts:
I am looking to understand ElGamal encryption as it is used in a specic context described below. I am interested in creating a practical form of Mental Poker for games other than poker developed by Phillip Golle in 2005 found here: http://crypto.stanford.edu/~pgolle/papers/poker.pdf

The paper describes an algo that is modifiable for such other random outcomes (such as non-poker games). Another professor in the field (Green) pointed out some minor issues with Golle's work which included how card collisions are handed in the single deck Poker version (https://blog.cryptographyengineering.com/2012/04/02/poker-is-hard-especially-for/).

I would like to understand a) how to adapt this to other random outcomes b) how a consensus protocol might work to deal with players timing out, leaving or entering in the middle of a game or shuffle (not described by Golle) which includes how the leaving parties keys are managed by the remaining players from the timed-out or leaving players; c) and, understand how you modify the process to remove the issues that are described by Green when card collisions happen in single deck poker or another single deck games.

Further comments:

Its  essentially an infinite deck solution since cards are calculated on the fly,  but what if you wanted to say limit the model simulate a 6 deck game of say baccarat?

I'm guessing the solution is simple. Since this version of mental poker doesn't shuffle any deck but creates cards for deck on the fly: if a player leave, times out or refuses to show his hand he loses the pot and.no one can see their hands - so no damage done. It can be based on some predetermined time limits and adjusted to GMT and even if he/she leaves before providing the key for all other players then new cards are dealt ( I think) to remaining players (sicne no one saw the old ones anyway) or if shown then it doesn't matter
No comments on this tricky point.


texts: How does this solution guarantee authentication of B and privacy?

texts:
The exercise is:
What could be changed on the second message " Kya(Kxb(Ra,Ks)) "  to guarantee B's authenthicity and also privacy?

My teacher's solution was "add a destination" , so it would be something like this
Kya(Kxb(Ra,Ks,A)).

If we have a man in the middle, Trudy pretending to be B, couldn't she just check the contents of the message and send them to A? (I'm not sure if it works that way), but this is my understanding, something like this:

1- A -> A, Kxa(Ra, Ts) ->T -> A, Kxt(Ra, Ts) ->B

2- A <- Kya(Kxb(Ra, Ks, A)) <- T <- Kyt(Kxb(Ra, Ks, A)) <- B

I'm not quite sure how does the "Destination" field solve anything.

Also as indicated in this answer to a related question made by the user Maarten Bodewes, here's the meaning of those operations:

A is the identity of A, which can be used to select the right public key of A;
Kxa() is a signing operation (with message recovery) that signs the random Ra and a tag Ts which is used as proof;
Kya() is an encryption operation with the public key A, so that the session key Ks is kept confidential;
Kxb() is a signing operation (with message recovery) that signs the random Ra together with session key Ks;


texts: What's the reason why CBC-MAC shouldn't use IV or random IV?

texts:
I searched the answer but I'm not sure if I understood exactly, and have some other questions.

I understood that the reason for CBC-MAC not to have random IV is if CBC-MAC has a random IV, the attacker can change the P1 block, making the tag arbitrary, so the CBC-MAC scheme can be insecure. Am I right?

1-1. Attacker can make the tag arbitrary not depending on the IV because of the property of encryption blocks. Then why we should not use IV or should use all-zero IV?
If we use random IV, then a sender and receiver must share a IV before the receiver receives the tag and it is inefficient, so we don't have to use random IV. Did I understand right?
Are there any other attacks that can made if we use random IV?


texts: I want to know difference of calculation cost between SHA(hash) and AES(reversible encryption)

texts:
I want do detect illegal modification of a string by using HMAC-SHA256 or AES/CBC/PKCS5Padding, with low calculation cost.
Which is the best answer?

I plan to save data in a DB with one of the following format

| METHOD                   | original STRING | VALIDATION BY  |
|--------------------------|-----------------|----------------|
| H:= HMAC-SHA256          | org-string      | H(org-string)  |
| A:= AES/CBC/PKCS5Padding | org-string      | A(org-string)  |

IF A(org-string) cannot be decrypted, the original STRING is modified.

FYI:
 This question well explained difference between SHA and AES.


texts: Would the encryption of bigrams and trigrams weaken the code?

texts: Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What better use of these (or any) additional characters would there be?


texts: Simplified AES S-box multiplication - calculation error

texts:
I have a problem to calculate the S-box in S-AES. The affine transformation is defined:

I read that it is a normal matrix multiplication. I chose the bits $0101$ and built the inverse $1011$. $b_0$ is my least significant bit. So I define my inverse $b_0 = 1$, $b_1 = 1$, $b_2 = 0$, $b_3 = 1$.

Then I start to multiply with the first row:

$$(1*b_0) + (0*b_1) + (1*b_2) + (1*b_3) +(1) =\\ (1*1)+(0*1)+(0*0)+(1*1) + (1) =\\ 1+1+1 =\\ 1$$

The second row : $$(1*1)+(1*1)+(0*0)+(1*1) + (0) =\\ 1+1+1 =\\ 1$$ and that is wrong. The result is $0001$.

So where is my mistake?


texts:
As far as I understand secp256k1 is defined over the group p with

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

I don't really understand how out of bounds values are handled in particular with homomorphism of the commitments.
Assume I commit to the value 5 which would be $G + G + G + G + G$ and then commit to the value p + 5 which would be $(p+5)G$ will those be the same commitment?

Based on this assumption I have implemented the following javascript code (using elliptic library ):

it('Test mult property of commitments', () => {
    const T1 = ec.g.mul(secp256k1.p + 5n);
    const T2 = ec.g.mul(Maths.mod(secp256k1.p + 5n, secp256k1.p));
    const T3 = ec.g.mul(5n);
    assert(T1.eq(T2));
    assert(T2.eq(T3));
});

In this example, T2 and T3 are the same, but T1 is different, so it seems like my assumption is incorrect, does this mean I can commit to values greater than p?


texts: Hypothetical encryption technique, is it secure?

texts:
This to me, sounds like a great idea, but with all rosy-tinted ideas it needs some grounding in reality. Here are the steps of the hypothetical system (with the hypothetical part highlighted):

User runs program to encrypt a file.

Prompts for user password.

Hypothetical part (is it secure?):

Program has a list of encryption techniques stored (assume the techniques are publicly known: they can be any level of complexity but how they encrypt is known) and their decryption counterparts.
Each symbol in the password selects a different technique (assume what symbol picks which technique are known: it can be changed but the changes are publicly known).
The program progresses through each symbol in the password encrypting the file with a different algorithm at each stage.
Each encryption technique can take one or all values from the password: the sum of symbols up to the current position (in the password), the sum of the entire password, and the position. These are used to modify the internal encryption process (the sum up to current position used as part of a modulus, for example). Which means if the letter is in the wrong place, it won't decrypt correctly.

Am I correct in assuming that:

A longer password adds more layers of encryption in this hypothetical scenario and thus adds more security and thus encourages longer passwords (a double positive trait)?
Even with the encryption algorithms known, because the password determines what order it's encrypted in, and how many layers, an attacker cannot guess how it was encrypted besides obtaining the password?
That no file (assuming each password is different) will be encrypted the same way twice?
The password is the only major vulnerability?

In short, is it secure?

Are there any flaws people could see with this idea?


texts:
The problem:

When I'm writing or reading information (be it on a screen or a physical medium) the information is vulnerable. So long as I'm not alone, anyone can simply glance at my screen or journal and instantly read what's written there (like addresses, phone numbers, and plaintext passwords/device pins)

My goal:

I want to create/utilize some sort of text-obfuscation system or cipher system that makes it impossible for the casual observer (>99.99% of people) to tell what I'm writing or reading at a glance.

The challenges and conditions:

Reading and writing speeds shouldn't be more than 50% slower with practice (I should be able to type this obfuscated text at 50 wpm and read/skim-read at several hundred)
I'm not a math-savant so any obfuscation/encryption operations need to be doable with minimal math and without a computer
From a security standpoint, the obfuscation/encryption doesn't need to be extremely secure, it only needs to be good enough that your average Joe (again, >99.99% of people) could spend several minutes reading over my shoulder without figuring out what I'm reading or writing

Potential solutions I've thought of:

Teach myself an uncommon written language like Esperanto or Klingon which very few people can read
Replace the symbols I use to write letters with alternatives, like Elian-script

My question:

Surely, this is a problem people have grappled with before. Besides operational-security solutions like making sure nobody's looking at your screen or using a polarizing filter, what solutions are out there?


texts:
I am building on this answer. Essentially I have an initialisation vector $iv$, a ciphetext $c$ and a plaintext $p$. The plaintext was encrypted using AES CBC. The aim is to modify the first 4 characters of the plaintext so that it becomes $p_{target}$.

Ex:

$p$ = 'SEND_DOGGOS_LOVE'

$c$ = 0x63fd039cc488dd7d937677b322a7763c

$iv$ = 0xa9e459b1a2e68cd7db06cf24b7e0bde8

$p_{target}$ = 'CATS_DOGGOS_LOVE'

My understanding was that to achieve that, I can change the $iv$ by simply xoring the first 4 chars of $iv$ with the result of $xor($'CATS','SEND'$)$. This however doesn't seem to work as I get a nonsensical plaintext. What am I missing?


texts: Authentication protocol which detects client impersonation from another machine

texts:
Consider following authentication protocol.

Client ClientA knows some initial secret KeyA shared with server.
Client also knows IP of legitimate server.

Now when client wants to establish connection with server she will send KeyA to server and her ID (for server to know which key to use).

The server generates new random number Key1A and sends back to client. Now following request will only be accepted if Key1A is sent by the client along her ID. When client sends another request with Key1A, server will generate Key2Aand send to client, and etc.

Now if attacker captures say KeyAn - if she uses KeyAn, it means client will not be able to communicate with the server anymore - because the server will have generated KeyAn+1 already. And expect only KeyAn+1 which the client will not know if attacker used KeyAn already. We will detect that one client with ID clientA "died" - because ID is also sent to the server. And disable request from clientA.

Does this provide identification of client in a secure way?
If no how can I improve this protocol such that if attacker steals some secret and tries to authenticate with server instead of some client A (from a different computer though), then at least I can detect it?


texts: What's the difference between AES and earlier block ciphers?

texts:
Is there any difference except speed and key and block size from user's point of view?

Or does AES have something that ideal block cipher doesn't have?


texts: Are there any masking methods for integer multiplication masking?

texts:
I'm interested in lattice type cryptosystem such as Mod-LWR.

But I found that integer multiplication¹ is not safe for side-channel attacks.

I tried to make masking method by own method but it failed in t-test².

Are there any masking methods for integer multiplication?

¹ This is modular multiplication, but modulo is power of 2. So in 8bit multiplication, output is 8bit. I assume the multiplication itself has bitwidth of 13bit, just like a PQC candidate, SABER.

² The test is Welch's t-test. I tested my hardware (hspice converted from verilog) circuit with measuring power traces within constant period. With random input random output vs. fixed input fixed output. Power differs with input random number that used in B2A, A2B masking.


texts: What is the SSL private key file format?

texts:
I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys.

In the phpseclib (RSA in PHP), you can import your private key (private.key format) and in the key file there is text like this:

-----BEGIN RSA PRIVATE KEY-----
MIIBOQIBAAJBAIOLepgdqXrM07O4dV/nJ5gSA12jcjBeBXK5mZO7Gc778HuvhJi+
RvqhSi82EuN9sHPx1iQqaCuXuS1vpuqvYiUCAwEAAQJATRDbCuFd2EbFxGXNxhjL
loj/Fc3a6UE8GeFoeydDUIJjWifbCAQsptSPIT5vhcudZgWEMDSXrIn79nXvyPy5
BQIhAPU+XwrLGy0Hd4Roug+9IRMrlu0gtSvTJRWQ/b7m0fbfAiEAiVB7bUMynZf4
SwVJ8NAF4AikBmYxOJPUxnPjEp8D23sCIA3ZcNqWL7myQ0CZ/W/oGVcQzhwkDbck
3GJEZuAB/vd3AiASmnvOZs9BuKgkCdhlrtlM6/7E+y1p++VU6bh2+mI8ZwIgf4Qh
u+zYCJfIjtJJpH1lHZW+A60iThKtezaCk7FiAC4=
-----END RSA PRIVATE KEY-----

But when I decode this with Base64 and then convert it to decimal it is just one number...
I thought you need both $p$ and $q$! My question:

If I roll a dice (with 0 and 1) 1024 times and find the nearest prime number it would be my $p$ and I would do this process again so I get $q$, but how do I convert those numbers to the private.key format? And what's the difference?


texts: In a group, is it hard to calculate the base $g$ given $g^a$ and $a$?

texts:
Discrete logarithm, that is: calculate $a$ given $g$ and $g^a$, is assumed to be a hard problem in some groups.

Is it also hard to calculate $g$ given $g^a$ and $a$?


texts: Double encryption : what method is the best?

texts:
Given the block-ciphers defined as follows :

$1.$ $C=$ $E_{k1}($$E_{k2}$$(M))$

$2.$  $C=$ $E_{k1{\oplus}k2}$$(M)$

$3.$  $C=$ $(E_{k1}(r),E_{k2}(r$ ${\oplus}$ $M))$

where $C$ is the cipher text, $E$ is the block cipher, $M$ the message to be  encrypted, $k1$ and $k2$ the sender and receiver respective secret keys and $r$ a randomly generated string with a length equals to that of $M$.

Assumptions:

we need to encrypt $M$ so that both keys $k1$ and $k2$ (having a length of $n$ bits) are needed for decryption.
We have access to a particular ciphertext/message pair $(M,C)$.

Questions:

Having that pair $(M,C)$, how would we decrypt some other cipher text $C$ $'$ in each method?
Which method is the easiest ?
Assuming $n$ is sufficiently large, which method is the most efficient to use?

Initial thoughts:

Brute-forcing the keys $k1$ and $k2$ would take $2^{2n}$, and $k1{\oplus}k2$ would reduce it to $2^n$ since the resulting key is of lengh $n$ if use the second method.
The first method keeps the complexity of brute-forcing the keys to $2^{2n}$, so it seems a bit more robust.
The third method seems the most robust since it adds a random string $r$ to the encryption, and therefore raising the complexity of a cipher text decryption, since not only do we need to figure out $k1$ and $k2$, we need to have $r$ as well to retrieve $M$.
For all the methods, and since we need to use both keys in decryption, the sender and the receiver need to share their respective keys, which could be a drawback in some sense.

Any suggestions or guidance from you guys about that matter would be appreciated. I'm not expecting a straight answer but rather some guidance as to how to tackle this kind of problems. Also feel free to correct me as I am relatively new to cryptography.


texts:
At the risk of sounding stupid and being laughed at...I must ask this question. What is required to decrypt an encrypted file? Obviously you need the appropriate key to decrypt, but is any other information needed in order to correctly decrypt the content?

Please forgive me as I am just learning cryptography and this is the first time I've had to handle encrypting/decrypting files in a program.

Here is the scenario. I have a Python program that generates a file. This program also needs to encrypt that file and then send it to someone else. I'm using a library called keyczar for my cryptography tools. And I'm encrypting the file using AES-256.

My concern is that the person receiving the file won't be able to correctly decrypt the file because they'll be using their own system to perform the decryption process. What exactly does the person receiving the file need to correctly decrypt the file? Do they only need the AES key? Or do they need to know details about the encryption process such as the header, initialization vector, and signature?


texts: Using RSA public key as private key and vice-versa

texts:
I am writing an application that involves checking to see if data has been created by me. I do this by encrypting the data with the private key on my server, and then decrypting it using the public key on the client. If the result matches the hashed version of the message then I know it came from me. However, I'm using RSA and so that means I have to flip the keys since I know you can't encrypt with a private key.

Here is how I am generating my keys:

private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
    backend=default_backend()
)

public_key = private_key.public_key()

pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption()
)

with open('private_key.pem', 'wb') as f:
    f.write(pem)

pem = public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)

with open('public_key.pem', 'wb') as f:
    f.write(pem)

However, here private_key is my public key and public_key is my private key. Is there something I need to change? I've heard public keys are generally smaller but I don't understand enough of the settings to tell if they're symmetric or not.

Any advice would be appreciated.

Thanks.

EDIT: They are definitely not symmetric. As suspected, my public key is much shorter. How do I reverse this?

EDIT2: How about signing/verifying instead?

Server:

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import padding
import base64
import uuid
import hashlib

message_id = uuid.uuid1()
with open("private_key.pem", "rb") as key_file:
    private_key = serialization.load_pem_private_key(
        key_file.read(),
        password=None,
        backend=default_backend()
    )
message = bytes(hashlib.sha3_256((str(message_id) + str(valid)).encode("utf-8")).hexdigest(), "utf-8")
encrypted_data = private_key.sign(
    message,
    padding.PSS(
        mgf=padding.MGF1(hashes.SHA3_256()),
        salt_length=padding.PSS.MAX_LENGTH
        ),
    hashes.SHA3_256()
)
encrypted_data = str(base64.b64encode(encrypted_data), "utf-8")

Client:

from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.exceptions import InvalidSignature
import hashlib
import base64

encrypted = response["encrypted"]
message_id = response["message_id"]
valid = response["valid"]
with open("public_key.pem", "rb") as key_file:
    public_key = serialization.load_pem_public_key(
        key_file.read(),
        backend=default_backend()
    )
message = bytes(hashlib.sha3_256((str(message_id) + str(valid)).encode("utf-8")).hexdigest(), "utf-8")
encrypted = base64.b64decode(encrypted)
try:
    public_key.verify(
        encrypted,
        message,
        padding.PSS(
            mgf=padding.MGF1(hashes.SHA3_256()),
            salt_length=padding.PSS.MAX_LENGTH
        ),
        hashes.SHA3_256()
    )
    print("Yes")
except InvalidSignature:
    print("No")


texts: What happens after sharing the secret key in quantum cryptographic schemes to send the message bits?

texts: As a person working on the physics perspective of quantum communication, I understand the process upto which the quantum key is shared securely. What happens after this process to send message bits? The literature that I've come across talk about encryption and decryption algorithms and not anything further in detail. Shouldn't the length of the key be equal to the number of bits to be ultimately sent?


texts: Can stream ciphers (usually) be "run backwards"?

texts:
Is it possible to reconstruct the previous output bits of a stream cipher, e.g. RC4, when only the current state is known, or is that computationally hard, or even impossible (due to ambiguous preceding states)?

For Salsa, it's obviously possible, since that even allows for random access.

Is there a formal name for the presence or absence of that property ("backward secrecy")?


texts: Strength of key derived from a hash function considering the birthday attack

texts:
When a hash function is used to derive a key from a shared secret (either by simply hashing the shared secret or using a more robust construct like HKDF) what's the strength of the derived material?
If, for example, the shared secret is 256-bit, is the security of the derived result also 256-bit or is it $2^{n/2}$ (that is 128-bit in this case) since as per the birthday problem, it "only" takes $2^{n/2}$ guesses to generate a collision. Thus in this case a collision would mean getting the same output and so the same material of the KDF.