texts: Signing with RSA-SHA256 algorithm using EC keys

texts:
Is it practical to sign a data using RSA-SHA256 algorithm with EC keys?
I used a small NodeJS script and crypto module (uses openSSL internally) to test this and I could successfully sign the data and verify the signature.
Pseudo-code:

Sign( data, EC-Key-p256, 'RSA-SHA256')
Verify( data, signature,public-key, 'RSA-SHA256')

Have used openSSL to create EC keys (p256v1) and used it for my testing.
Could you please help me understand whether this is a standard practice?


texts: Is it possible to verify a clearsigned message with a short public key (fingerprints)?

texts: For practical reasons, I'd like people to be able to post clearsigned messages with their public key fingerprints (8E570D9F7F70256595769E49F9BC5BCAD7E18635) for the system to check. However, the libraries I see all seem to require a full public key certificate to do verification. Is there a way to do it with just fingerprints?


texts: Permutation of keys that guarantees different hashes

texts:
Suppose I have two values to be hashed, $x$ and $y$. Is there a hash function $H$ with the following properties?

$H(x) = H(y), \; H(m(x)) \neq H(m(y))$

Where $m$ is a permutation function that may depend on $H$.

Edit: The corrected question is, if $H(x) = H(y)$, them is it possible to make any permutation $m$ so that $H(m(x)) \neq H(m(y))$?


texts: (Non-) Perfect Secrecy of Vernam Cipher Using $E(m) = m \oplus k \oplus \operatorname{rev}(k)$

texts:
Given the cipher
$$E(k, m) = m \oplus k \oplus \operatorname{rev}(k)$$
where $\operatorname{rev}(k)$ is the reversed binary of $k$, how would one prove that the cipher is not perfectly secret.

I know that the definition of perfect secrecy is $P(M = m \mid C = c) = P(M = m)$ for all $m$ and $c$ and that each key is only used once.

Clearly the intuition comes in when the key is symmetric as then $k \oplus \operatorname{rev}(k) = 0$, but given the definition above how can I show this formally using the definition above?

Thank you! This is a homework question.

My work so far is along the lines of $P(M = m) = 1/2^n$ where $n$ is the number of bits and
$$ P(M = m \mid C = c)
\\= P(M = m \text{ and } C = c) / P(C = c)
\\= 2^n \cdot P(M = m \text{ and } C = c)
\\= 2^n \cdot (1/2^n \cdot 1/2^{n/2})
\text, $$
however this doesn't seem very formal.


texts: Are there any multiparty homomorphic encryption schemes?

texts:
Are there any multiparty homomorphic encryption schemes ?
Most of the literature is about two party schemes .
Is there any generalization made for n party ?


texts: XORing a header with SHA512-hash - secure?

texts:
I am writing a application that encrypts text several times and stores the result. The result looks like complete random bytes, therefore I add some random bytes at the end. To let the program know where the real encrypted text ends I put an header at the beginning of the file. The header consists of 8 bytes: If $h$ is the header, then $h_0$ and $h_1$ are the magic numbers 0 and 204 (I have chosen this numbers randomly to check the file), $h_2$, $h_3$, $h_4$ and $h_5$ show the length of the text in as 32-bit integer and $h_6$ and $h_7$ are just completely random just to fill the header up to 8 bytes. To make the header look like random bytes (a program could find such files easily if I don't do that) I XOR the header-bytes with the SHA512-hash of the password. If the hash is $s$, then

$h_i = h_i \oplus s_i \oplus s_{i+8} \oplus s_{i+16} \oplus s_{i+24} \oplus s_{i+32} \oplus s_{i+40} \oplus s_{i+48} \oplus s_{i+56}$

That makes the file look like random bytes, but after all i think that this reveals information about the sha512-hash of the password, since at least 2 bytes of the header are known and 4 others can be predicted by looking at the size of the file. So this could help an attacker to find the password with a rainbow table, because even the magic numbers help the attacker to "eliminate" 65535 out of 65536 password-hashes (since the magic numbers are known, only 1 out of 65536 hashes will XOR the magic numbers to the bytes given in a file).

My question is: Is this way of securing the header really as insecure as I think it is and if so, how can I prevent this (I don't know  why, but I would prefer a method just with XORing and hashing)


texts:
in $GF(2^8)$ the AES affine transformation is defined as
\begin{equation*}
b( x ) = ( x^7 + x^6 + x^2 + x ) + a ( x )( x^7 + x^6 + x^5 + x^4 + 1) mod (x^8 + 1)
\end{equation*}
where the polynom $( x^7 + x^6 + x^2 + x )$ represents the constant term and $( x^7 + x^6 + x^5 + x^4 + 1) mod (x^8 + 1)$ is the matrix, which is multiplied with the inverse a(x). This results in a function
\begin{equation*}
AT(a) = \begin{bmatrix}
       1& 1& 1& 1& 1& 0& 0& 0 \\
       0& 1& 1& 1& 1& 1& 0& 0 \\
       0& 0& 1& 1& 1& 1& 1& 0 \\
       0& 0& 0& 1& 1& 1& 1& 1 \\
       1& 0& 0& 0& 1& 1& 1& 1 \\
       1& 1& 0& 0& 0& 1& 1& 1 \\
       1& 1& 1& 0& 0& 0& 1& 1 \\
       1& 1& 1& 1& 0& 0& 0& 1
      \end{bmatrix}
      \begin{bmatrix}
       a_7\\a_6\\a_5\\a_4\\a_3\\a_2\\a_1\\a_0
      \end{bmatrix}
       \oplus
      \begin{bmatrix}
       0\\1\\1\\0\\0\\0\\1\\1
      \end{bmatrix}
\end{equation*}
where $a_7$ is the most significant bit of the inverse. My Question is now, if I use an isomorphic mapping
\begin{equation*}
\delta = \begin{bmatrix}
  1& 0& 1& 0& 0& 0& 0& 0 \\
  1& 1& 0& 1& 1& 1& 1& 0 \\
  1& 0& 1& 0& 1& 1& 0& 0 \\
  1& 0& 1& 0& 1& 1& 1& 0 \\
  1& 1& 0& 0& 0& 1& 1& 0 \\
  1& 0& 0& 1& 1& 1& 1& 0 \\
  0& 1& 0& 1& 0& 0& 1& 0 \\
  0& 1& 0& 0& 0& 0& 1& 1
      \end{bmatrix}
\end{equation*}
for the input of the AES Subbyte to calculate the inverse in $GF(2^4)$, how would the affine transformation look like or how can I calculate this? After the affine Transformation in $GF(2^4)$ I want to use the inverse isomorphic mapping
\begin{equation*}
\delta^{-1} = \begin{bmatrix}
  1& 1& 1& 0& 0& 0& 1& 0 \\
  0& 1& 0& 0& 0& 1& 0& 0 \\
  0& 1& 1& 0& 0& 0& 1& 0 \\
  0& 1& 1& 1& 0& 1& 1& 0 \\
  0& 0& 1& 1& 1& 1& 1& 0 \\
  1& 0& 0& 1& 1& 1& 1& 0 \\
  0& 0& 1& 1& 0& 0& 0& 0 \\
  0& 1& 1& 1& 0& 1& 0& 1 \\
      \end{bmatrix}
\end{equation*}
to get the result of the S-Box back to $GF(2^8)$.


texts: What prevents the successful use of the Giant-step/Baby-step algorithm solving a discrete log problem implemented with modulo arithmetic?

texts: Does the size of base, exponent, and modulus thwart the Giant-step/Baby-step algorithm in solving DLP using modular arithmetic or is it the use of a property of a particular prime as the modulus, or something else?


texts:
I have a message (UUID) in this form 406a5830-2a6a-11e6-bdf4-0800200c9a66. I also use a secret key for example 0987YGN.?NBVFRTY876JOPOIUHJ$$bvcfghjKFDFGH876TH$. Every 3 seconds I use the java function below to crypt the UUID+Time with the secret key using the SHA 256 function. I publish the new result on the internet. As I have a new hash every 3 second, it's easy for everyone to collect a big numbers of hash.And as the difference between every UUID is always 3000 ms, maybe this could make it easier for the hacker to crack the key. My question is: Would it be possible for a person to guess the secret key or the message I am using? Is it possible to calculate the probability that this system get hacked ?

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Base64;

public class ApiSecurityExample {
  public static void main(String[] args) {
    try {
     String secret = "0987YGN.?NBVFRTY876JOPOIUHJ$$bvcfghjKFDFGH876TH$";
     String message = "406a5830-2a6a-11e6-bdf4-0800200c9a66"+System.currentTimeMillis();

     Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
     SecretKeySpec secret_key = new SecretKeySpec(secret.getBytes(), "HmacSHA256");
     sha256_HMAC.init(secret_key);

     String hash = Base64.encodeBase64String(sha256_HMAC.doFinal(message.getBytes()));
     System.out.println(hash);
    }
    catch (Exception e){
     System.out.println("Error");
    }
   }
}


texts:
Assume the following:

You have to encrypt a file (ZIP-file) containing import information. This file should be password-protected and you want to leave yourself the password encrypted (on paper, maybe bury it somewhere in your yard, hide it behind the walls, you name it). How could you encrypt it so that you might be able to recover it? You might as well assume extreme situations like suffering a stroke (and recovering) or becoming enemy of the state and thus being pursued by government agencies. Apart from a secure physical location (six feet under) it should also be logically secured.

Some thoughts:

tabula recta might work -> how long could passwords be (more than 24 characters?)
the information to decrypt the password should be self-containing -> hinting to things only you yourself know or something similar
or does it make no difference if I buried a flash drive somewhere?

Thank you for your thoughts on this one.

Update 2017/12/31:

I checked the key sharing schemes article on Wikipedia. Actually this is slightly beyond the scope of my question - although I like the idea of splitting the key!

I am more concerned about proper encryption. I would really like to find a way to create a proper key and encrypt a password.


texts:
Considering a scenario of anonymous data transfer between seller and buyer using proxies. If we consider that there are three proxies that are being selected by the buyer to obtain data from different sellers (like in emule), how can we make sure that these proxies do not collude with each other to obtain the copy that is being requested by buyer?

For example, if we use onion routing, then in this case, each of three proxies will have plain-text data at the end, and this plain-text data would be transferred to the buyer. What mechanism should we employ that will prevent the three proxies to collude? If they combine the files, they will get the copy of the same file being requested by buyer.

Thus as a solution, if we use end-to-end encryption, will the buyer and seller remain anonymous to each other?


texts:
I am getting to grips with cryptography as a total newbie, and am struggling with encryption "keys" and how to visualize them.  From http://computer.howstuffworks.com/encryption.htm/printable:

Symmetric-key encryption is essentially the same as a secret code that each of the two computers must know in order to decode the information. The code provides the key to decoding the message.
Think of it like this: You create a coded message to send to a friend in which each letter is substituted with the letter that is two down from it in the alphabet. So "A" becomes "C," and "B" becomes "D". You have already told a trusted friend that the code is "Shift by 2". Your friend gets the message and decodes it. Anyone else who sees the message will see only nonsense.
The same goes for computers, but, of course, the keys are usually much longer. [...] The DES uses a 56-bit key.

This doesn't make sense to me because the process of "shifting by 2" sounds like the algorithm that is being used, yet it is referred to as a "key"?  If this is the key, then what is the algorithm?
I also don't completely understand what it means the key is "56 bit" in length.  The linked article mentions

56-bit key offers more than 70 quadrillion possible combinations

Now, this huge number is just under $2^{56}$, so each of those $56$ bits can be either a $1$ or a $0$, but I don't see how this fits into it all.
Can someone please clarify this for me?


texts: Factoring RSA-129 with a personal computer today

texts: I have read the history of the RSA-129 challenge, and now I would like to know if it would be possible to factor RSA-129 with a single "average" personal computer, today. Has someone tried to do this particular factoring?


texts: How to encrypt small pieces of data (2 - 4 bytes) within Beacon advertising packet?

texts:
I'm developing a medical device that operates under extreme low-power constraints and transmits data with BLE, where every unnecessary millisecond of air time matters. I am developing a Beacon advertising protocol where sensor data is encoded directly into the advertising packet. The data I need to transmit is very simple and small, occupying only two to four total bytes. I would like to encrypt these 2-4 bytes before adding them to the advertising packet, to be decrypted by the receiving smartphone after being pulled out of the advertising packet. I'd like to keep the encrypted data as small as possible, whereas I know many algorithms create set length strings (20+ bytes).

I am currently transmitting these 2-4 bytes as hexadecimal values, to be interpreted as integer values by the receiving smartphone application. I am not overly experienced with cryptography or encryption methods, but do know that most algorithms operate on larger pieces of data. Are there any algorithms or protocols that would be appropriate for such small pieces of data?

The data is very primitive, just two - four unsigned 8 bit integers. The main objective is to ensure an unintended observer cannot deduce the integers which are encoded within the advertising packet.

An example of the advertising packet would be:

"0x02-15-01-12-23-34-45-56-67-78-89-AB-BC-CD-DE-EF-F0-00-01-02-03-C3"

where "00-01-02-03" are the 4 hexadecimal values I wish to encrypt. No more information can be shared with the smartphone, so the protocol needs to be mutually understood before advertising packets are transmitted. The device will ship with a unique identifier, entered into the phone during phone <--> device setup, so there I believe this can be accomplished.

I have thought that some kind of simple lookup table might suffice, where the phone and device both know how to encode/decode using the table? The values can of course be encrypted before placement into the advertising string.


texts: Differences between DSA and RSA Algorithms

texts: Despite having learned much related to RSA and DSA, I cannot understand their differences. Can anyone tell me at least 4-5 differences between these algorithms? I have just used them for two-factor authentication (Linux OpenSSL).


texts: Authentication scheme to protect against fake devices

texts:
I want two embedded devices (call them master and slave) to communicate with each other. For intellectual property protection, the master must reject fake slave devices (the other way around is a pre but not a requirement).

I'm having no luck finding a scheme that satisfies the following requirements:

Authenticated: For each message received by the slave, only if the slave is genuine it knows how to interpret the message
Replay-resistant: Can't record a conversation with genuine slaves and replay it later with fake slaves,
Autonomous: No third party involved (trusted or not),
Fast: Slave has a slow processor so any number-field theoretic ciphers are out of the question, even for key-exchange

Also:

No confidentiality required, messages are not secret,
Messages are short; never in excess of 16 bytes,
Slaves have a unique serial number that the master receives in plain,
Only slaves can have a secret embedded in it, not the master (and can be unique for each slave),
Only master can generate entropy / secure random data,
Without secure co-processors, SIM or SAM modules.

Even though the messages are not secret, they must probably be encrypted nonetheless. If the adversary obtains fake slaves and generates fake commands (i.e. fake master) then they might as well buy everything from the competition. We (as a company) thrive on the broad feature set of the master that interlinks many kinds of slaves.

My attempts at thinking of a solution:

Public-key cryptography or Key-exchange schemes: Too computationally heavy for the slave.
Slave is an encryption-oracle and master knows one (or more) legal plain/ciphertext combinations: Replay attack.
A commutative cipher $E_{k1}(E_{k2}(P)) = E_{k2}(E_{k1}(P))$ such that when $E_{k1}(E_{k2}(P))$, $E_{k1}(P)$ and $E_{k2}(P)$ are all known to an evesdropper, $P$ can't feasibly be retrieved. (i.e. CTR mode is out of the question). I have yet to find such a cipher.

I tried to be as thorough as possible, but let me know if I missed some requirements.

[edit] Removed an optional requirement that allowed listen-only fake slaves to co-exist with a real slave.


texts: Why do elliptic curves require fewer bits for the same security level?

texts:
I'm studying the basics of cryptography and I didn't understand why elliptic curves use fewer bits.
For example, finite-field Diffie-Hellman needs at least 1024 bit and it's a DLP, but elliptic curves need at least 256 bit and it's also a DLP.
What is the actual difference? Can you show mathematically why (with some example)?

I know that they aren't the same DLP, but they are part of the class of DLP. Is this part of the explanation?

The DLP of EC is more difficult to solve for how the group laws are defined, but is this the explanation (or part of it) to why EC requires less bit?


texts:
I want to calculate a simple example of the RSA common modulus attack. However, the result is not correct and I do not find my mistake.

p=$29,
q=37,
n=p*q = 1073,
\phi(n) = 1008,
e1 = 5,
e2 = 11$

Let $m = 999$.

$c_1 = m^{e_1} \pmod n = 296$,
$c_2 = m^{e_2} \pmod n = 555$

The extended Euclidean algorithm gives me $y_1$ and $y_2$: $y_1 \cdot e_1 + y_2 \cdot e_2 = 1$

$y_1 = -2, y_2 = 1$ (edited)

$m = c_1^{y_1} * c_2^{y_2} = 296^{-2} \cdot 555^1 \pmod {1073}$

How do I calculate $296^{-2}$? I tried to get the inverse of $296 \pmod {1073}$ and then square it, but $296$ has no inverse. What am I doing wrong?


texts:
After reading through https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-0, I could understand that this option is recommened for use when one has legacy SSL Servers which only support SSLv3.

But could not understand how this option helps even after reading couple of articles.

Can anyone help me in understanding this?


texts: Why if i change some characters of a Public key on authorizedKeys the login still works

texts:
This question is similar to:
[1]
Why does my SSH private key still work after changing some bytes in the file?
But in this case (on Windows) after editing the authorized_keys file and changing some characters in a public key the login still works ?
Is the same reason of [1] ?
Some characters in the public key are irrelevant ?
In this case the correct key is:
ssh-rsa AAAAB3NzaC1....
IF i change it to (replace C1 with C9):
ssh-rsa AAAAB3NzaC9...
The login works, if i change AAAA then it does not work any more.


texts: Known vs. Chosen (plaintext and ciphertext) and RSA

texts:
I want to know whether I can break RSA (textbook) with known plaintext/ciphertext attacks.

Known plain-text

Let $c$ be the ciphertext and $m$ the plaintext.

$$c = m^a \mod n$$

Since all I have is the plain and ciphertext, all I could do here is guess the decryption exponent $a$ until I find one that leads turn $c$ into my known $m$.

Known ciphertext

In this case, I would have to factor $n$ (hard) in order to find $p$ and $q$.

Is the above correct? I would appreciate if someone could point the right direction.


texts: How is this affine function a pair wise independent permutation?

texts:
Can anybody explain how the below is true ?

  $I_n$ denotes the set of all n-bit strings, ${\{0,1\}}^n$.
  (..)
  Let $A$ be a finite field then the permutation $f_{(a,b)}(x) = a \cdot x + b$,
  where $a \ne 0; b \in A$ are uniformly distributed, is pair-wise independent. Thus, there are pair-wise independent permutations over $I_n$ (the permutations $f_{(a,b)}$ with operations over $GF(2^n)$ ).

This is stated in section 2.3 of the below paper, the context is that they use pair wise independent permutation in first and last rounds of Feistel network to get better security guarantees. But they do not mention why the above is true.

[1] Moni Naor and Omer Reingold, "On the Construction of Pseudorandom Permutations: Luby—Rackoff Revisited", in Journal of Cryptology January 1999, Volume 12, Issue 1, pp 29-66.

Addition: The question's quote (at least: also) appears in an apparently earlier version of the paper, made available by the first author (pdf).

By definition, a distribution $F$ of permutations over $A$ is pair-wise independent if for all distinct members $x_1, x_2$ of $A$, the following two distributions are identical:

$\langle f(x_1),f(x_2)\rangle$ where $f$ is distributed according to $F$;
The uniform distribution over sequences of two different elements of $A$.


texts: Difference between fault measurement and fault model

texts: In the context of fault attacks. What is the difference between fault measurement and fault model? I am reading a lecture and I can not understand for what measurement is used? Could you help me please?


texts: decrypt a saml 2.0 response having aes 128 and rsa

texts:
I need to decrypt a saml 2.0 response. But, the response object has reference to aes 128 and rsa algorithms, and I am having hard time in finding a way to decrypt.

Below is the structure of the response (replacing the sensitive data with some random values)

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="" ID="_12345" InResponseTo="" IssueInstant="2015-01-01T10:00:00.000Z" Version="2.0">
<saml:EncryptedAssertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="12333" Type="http://www.w3.org/2001/04/xmlenc#Element">
    <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:RetrievalMethod Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey" URI="#12567"/>
    </ds:KeyInfo>
    <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
        <xenc:CipherValue xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">xxxxxxxxxxx</xenc:CipherValue>
    </xenc:CipherData>
</xenc:EncryptedData>
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="12567">
    <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
        <ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    </xenc:EncryptionMethod>
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:KeyValue>
            <ds:RSAKeyValue>
                <ds:Modulus>xxxxxxxxxx</ds:Modulus>
                <ds:Exponent>xxxxxxxx</ds:Exponent>
            </ds:RSAKeyValue>
        </ds:KeyValue>
    </ds:KeyInfo>
    <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
        <xenc:CipherValue xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">xxxxxxx</xenc:CipherValue>
    </xenc:CipherData>
    <xenc:ReferenceList>
        <xenc:DataReference URI="#12333"/>
    </xenc:ReferenceList>
</xenc:EncryptedKey>
</saml:EncryptedAssertion>
</samlp:Response>

Now, how should I proceed with this response and the private key, I have.

I am able to decrypt the response successfully on a online tool https://www.samltool.com/decrypt.php, but I couldn't get the internals, which I need.


texts: How to provide security against malicious adversary in Ring LWE homomorphic encryption scheme?

texts:
I was reading Ring LWE homomorphic encryption scheme referred in http://www.wisdom.weizmann.ac.il/~zvikab/localpapers/IdealHom.pdf

But this encryption scheme provides security mostly in the semi-honest model.

Consider a scenario of the protocol is in the semi-honest model. Say, Alice has little computation capability who wants to some equality comparison with the party Charlie. But no one wants to disclose their message if they are not equal. So another party Bob is doing blindly the comparison computation using Homomorphic encryption on behalf of them. Alice and Charlie encrypt their message using the public key and sends it to Bob. Bob does the computation of equality which requires using Hamming distance computation which requires one decryption to decide. Bob sends the encrypted result to Alice and Alice decrypts using her secret key and sends the result back to Bob. Bob decides the equality depending on the feedback from Alice.

But the problem of this protocol is not secure against a malicious adversary or some collision attacks between parties.

How can I make the protocol secure against a malicious adversary or prevent some collision attacks?


texts: Can you help me understand Bernstein’s Notes on Diagonal constant of Salsa20?

texts:
Explaining the choice of the Salsa20 constant Bernstein explains:

[...] shifting the entire Salsa20 hash-function input array along the diagonal has exactly the same effect on the output.
The Salsa20 expansion function eliminates this shift structure by limiting the attacker’s control over the hash-function input. In particular, the input diagonal is always 0x61707865, 0x3320646e, 0x79622d32, 0x6b206574, which is different from all its nontrivial shifts. In other words, two distinct arrays with this diagonal are always in distinct orbits under the shift group.

What is the meaning of the terms nontrivial shifts and distinct orbits under the shift group?


texts: Given this protocol, can you find some weakness?

texts:
1) A->B  A||B||{Na}Kab
2) B->A  {Na+1,Nb}Kab
3) A->B  {Nb+1}Kab
4) B->A  {K'ab,N'b}Kab

This protocol is used to refresh a symmetric session key.

EDIT:

A and B are the IDs of users A and B.
Na, Nb, N'b are nonces (pseudorandom values).
Kab is the old session key.
K'ab is the new session key.
|| means concatenation.

An attacker is only able to do man-in-the-middle.
Every message is encrypted with Kab


texts: Username and Password: How does it work?

texts:
Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2.

Alice sends Client Hello with some random number $r_a$.
Bob sends Server Hello with another random number $r_b$.
Suppose they settle on some cipher suite (e.g. RSA, DHE, AES, and SHA1)
Bob sends server certificate
Bob signs and sends server key exchange ($g^b$ in Diffie-Hellman)
(Bob does not request client certificate, and client does not have it.)
Alice sends client key exchange ($g^a$ in Diffie Hellman) (no signing).
Now both share "pre-master secret", namely ($g^{ab}, r_a, r_b$)
Next, for key derivation, they both use pseudorandom function (PRF) to generate from the pre-master secret the following symmetric keys:

client write key
server write key
client MAC key
server MAC key
client write IV (for use in client AES cipher)
server write IV (for use in server AES cipher)

Alice sends Change Cipher Spec and an encrypted Finished containing MAC of all previous client handshake messages.
Bob sends Change Cipher Spec and an encrypted Finished containing MAC of all previous server handshake messages.
They exchange some encrypted application data.

Suppose now Alice starts signing in with her username and password. What will happen next? Will they just scrap all the previously negotiated keys and switch to TLS-PSK with Password-Authenticated Key Agreement or Password-Based Key Derivation?  Could you please describe how client and server use username and password? What are the steps and algorithms used in this?


texts: EC algorithm to derive bits/keys and sign/verify

texts: Looking at the question “ECDSA vs ECIES vs ECDH” it appears that you can either have a tool that can derive keys or bits, or can be used to sign and verify something. Is there an EC way to do both with the same keypair?


texts: Is there an additively homomorphic encryption scheme that supports calculating a square root on the ciphertext?

texts: I need an additively homomorphic encryption scheme that satisfies: $D(\sqrt{E(m)}) \approx  \sqrt{m}$. It seems that the lifted ElGamal satisfies this, but it is hard to do decryption if the message space is large. Is there any other scheme that satisfies this?


texts: RSA security assumptions - does breaking the DLP also break RSA?

texts:
Possible Duplicate:
  Would the ability to efficiently find Discrete Logs have any impact on the security of RSA?

I'm wondering if breaking the DLP, that is the basis for ElGamal and DSA, would automatically break RSA. The way I see it, RSA is based on the following three assumtpions, please correct me if I'm wrong.

The hardness of integer factorization. This is obvious, if this would be possible, we could find p and q from N, calculate phi(N) = (p - 1)(q - 1) and then find d from e in polynomial time using the Extended Euclidian alg.
The hardness of finding e'th rooths mod N. An encrypted message is c = m^e mod N, so knowing c and e (which an attacker does), he could find m by calculating the e'th root mod N.
The hardness of finding The Discrete Logarithm mod N (DLP). After encrypting a message, the attacker knows m and c, and since this relation hold: m = c^d mod N, a solution to the discrete logarithm problem would find d.

When reading different sources, it seems to be the case that solving DLP does not in general break RSA. How is this possible? Does it have to do with the fact that the DLP over a prime order cyclic group (that ElGamal and DSA uses), where all integers less than the group order are members of the set, are concidered to be much easier to solve than over a non-prime group (that (Z_pq, *) is)?

Is it perhaps the case that breaking either 2 or 3 automatically gives a solution to 1 (there already exists polynomial time reduction algorithms), such that the statement "RSA is secure as long as integer factorization is hard" is indeed true.

Thank you in advance for clarifying this!


texts: Why/how is libsodium/nacl's cryptobox repudiable?

texts:
https://nacl.cr.yp.to/box.html see "security model".

As far as I can see, Alice encrypts a message using her private key, Bob's public key and a nonce.  Bob decrypts the message using Alice's public key, his private key and the nonce.

The documentation says "The crypto_box function is not meant to provide non-repudiation."

How can Alice says she didn't encrypt a ciphertext, if Bob can verify its origin and authenticity using her public key?

(Assuming that the message must be in a known language or format to be 'real'.)


texts: Public key cryptography for website access

texts:
I recently stumbled apon a though, is there a way to make a website only available to the people that have a public key, just like SSH key authentication, the private key is stored the server, while the public key is stored on the client. When the client tries to connect, the server looks for the public key to see if it is applicable, if it is then the client will be able to see the page, if it isn't, the client would be declined.

Has this already been put to practice, if so, what is it called?


texts: Is modern encryption needlessly complicated?

texts:
RSA, DES, AES, etc., all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the years. Some even believe that there is a vulnerability in AES known only to the NSA.

On the other hand, the one-time pad is not only ridiculously simple, but also has been shown to be impossible to crack (if used appropriately).

Say you have some message to be encrypted with length n. Simply generate a random string with length m where m is at least as large as n, and perform modular addition of the random string onto the message.

As long as the random string is generated with a high-enough-quality random number generator, and as long as the same one-time pad isn't reused, it should be impossible to crack.

If this is true, all we would need to perfect are fast, cryptographically secure deterministic random number generators. Use the key as a starting seed for the RNG and you have a powerful uncrackable encryption scheme which is simple to understand and implement.

Blum-Blum-Shub is a fast, cryptographically secure PRNG, and there are others too.

I have written a C++ program which uses two 2048-bit primes (which match the necessary criteria) for Blum-Blum-Shub and uses a password which the user enters - converted into a starting seed - to run byte-wise modular addition. The process is fast, deterministic, and if the literature I have read is correct then it should be very secure.

So why is so much time and effort invested in coming up with convoluted encryption cyphers when mathematics shows that the simplest is often the best?


texts: Is an IV useless for encrypting database IDs?

texts:
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. chiperID are created when an unknown plainID is provided. So I have an identities table that grows keeping track of this mapping by storing the couple [plainID-chiperID]. To keep it safe against direct accesses to the db I need to encrypt one of them so I actually store [encryptedPlainID-chiperID]

My app is the only one that needs to encrypt and decrypt IDs so I am going to use a symmetric encryption algorithm like AES-256-* where the key is kept by the application.

Hence:

to obtain the plainID by providing the chiperID the application
needs to query the identities table directly by chiperID and then
decrypt the encryptedPlainID.
Vice-versa, to obtain the chiperID by providing the plainID the
application firstly needs to encrypt the plainID and then query
the identities table by the encryptedPlainID

I know that not using an IV make the algorithm insecure but I have some doubt that storing the IV for later decryption along with the encrypted ID make the whole system secure. To be clear I wonder if I need to store in the identities table the triple [encryptedPlainID-IV-chiperID]

But with this schema I cannot do the point 2 because I don't know a priori the IV used to encrypt the plainID

What can I do? Does the block cipher mode of operation matter?


texts: Does threshold crypto (m-of-n) guarantee that m peers discover the plain text?

texts:
In a threshold cryptosystem, is there any guarantee that all $m$ peers participating in retrieving a plain-text will all retrieve it? If not, is it possible to provide such a guarantee?

For instance if the $m$ peers are hostile to each other, is there a way to either have none of them get the plain text, or all of them?


texts: Rationale for NORX/Ketje/Keyak not being chosen for the CAESAR final portfolio

texts: Was any specific rationale given on why none of the sponge-based AEAD algorithms (specifically NORX, Keyak, and Ketje) of the 3rd round candidates of the CAESAR competition made it to the final portfolio? If so, where can I find additional details?


texts:
I want to do a completely serverless p2p chat application on web browsers, so it won't even have a database to store accounts, but I still want to have some kind of identity system on it (an user can have a username on this chat that only they can use). To achieve this, I began to work on an authentication system a bit reminiscent of tripcodes, used on various imageboards (I don't know if this is really the way to go, I'm open for new suggestions):

the user types a password,
the application generates a public information (e.g. a hash or a public key) from this password using a one-way function,
this public information is then converted to a human-meaningful identifier using systems like tripphrases, proquint or identicons.

Examples:
"MyPassword" --(CRC32)--> "7d586a02" --(proquint)--> "hotig-muhig-donig-fubag"
"MyPassword" --(MD5)--> "48503dfd58720bd5ff35c102065a52d7" --(tripphrase)--> "interleave my calcifugous ghost"

The problem with using hashes as identifiers in a p2p system (i.e. with zero trust and no central source of truth) is that nothing prevents some user to write messages using whichever identifier they want while pretending that they obtained this identifier by hashing their password locally, like the protocol says. Thus, what I want is a way to prove the ownership of an identity without revealing the password. I can only think of one way to solve this problem:

Alice types a password,
the application derives a private/public key pair from this password,
the public key is used to generate the human-meaningful identifier of Alice,
Bob wants to verify the identity of Alice:

Bob sends a challenge (i.e. a random number) to Alice,
Alice encrypts the random number with her private key,
Alice sends the result back to Bob,
Bob decrypts the result using the public key of Alice (it can be obtained by converting Alice's identifier back to a public key),
if the decrypted number is the same than the one previously sent, then Alice indeed owns the password, otherwise Alice is lying on her identity.

But I would like to know if there is a simpler protocol than that to solve my problem. Preferably, I would like to avoid public-key cryptography altogether. As I'm doing this project just for fun, I don't really care about the following points:

the strength of the passwords,
if two users use the same password and hence get the same identifier,
if other people know the hash or associated public key of a password, which clearly gives out information on the secret password, so a zero-knowledge proof is not necessary.

Any idea?

Thank you for your help.


texts: Is it possible to derive the recipient's public key from libsodium's crypto_box?

texts:
Libsodium has "crypto_box_seal" which according to the documentation is used to "anonymously send messages to a recipient given its public key.", which hides the sender.

But Is it possible for Eve to know/confirm the exact public key of the recipient from a message made from crypto_box/crypto_box_seal, assuming that Eve already has a list of public keys that it could be?


texts: Is there a way of having a "temporary" decoding key?

texts:
I am pretty sure that what I am asking for is impossible, but on the off chance it might be possible, here is my question/problem statement :
Is there any known algorithm/protocol or does it even sound possible that such a thing can be devised, such as it allows you to encode data using a "private" key and then issuing "public" keys on demand that can be invalidated, let's say with a built-in expiration date (or any other invalidation process you can think of)
It has to be stateless and work without assuming that the cypher is secured as it may be public and everybody can access it but there must be no way of decoding it using a key that "somehow" has been invalidated.
I realise for something like this to even be remotely possible, the cypher must not be created using only a private key but also other parameters, the invalidation process must somehow be embedded in the cypher, so there is no constraint really on the encryption parameters as long as it doesn't require predetermination of the decryption keys.
I can see several applications to this kind of encryption, for example, you can give someone temporary access to some encrypted data on a public blockchain.
Am I crazy?


texts:
I am trying to derive a symmetric key based on a master key, combined with a simple string. Based on my limited knowledge, it seems that something like PBKDF2 would do that for me in a well-defined way:

DK = PBKDF2(PRF, Password, Salt, c, 256)

Password = master key
Salt = simple string
c = number of iterations
DK is the 256 bit derived key

However, I am working in a very constrained embedded environment, so a high number for 'c' is not an option. Now for my question:

Would I improve security if I used a low value for 'c', but I did some kind of table lookup as a final step, such that

DK_final = table[F(DK,i) MOD size]

Assume DK is twice is large as DF_final, so 256 bits and 128 bits respectively
table = a large table of randomly chosen bytes (more than 4000 elements)
F(DK,i) = a simple function that takes the i'th 2 byte pair from the string DK
size = the number of elements in the table
DK_final = the final derived key, 128 bits in this example

I could not find any published material on such a method, besides a vague reference here. However, no indication of cryptanalysis was given.

Any help on such a scheme would be appreciated, if only to warn against it: It seems that the general rule of thumb is never invent you own clever idea with it comes to cryptography.


texts:
It's fairly well known that Shor's algorithm kills RSA, DSA, ECDSA, DH, ... and that symmetric ciphers (AES and 3DES) and hashes (SHA-2, SHA-3) are safe as long as you double your key size / output size against a Grover search. (See slide 3 in this NIST presentation.)

My question is: nobody has mentioned random number generators either way, safe or unsafe. (As evidence, the NIST Draft Report on Post-Quantum Crypto has 0 hits for "RNG"). Is this because it's obvious to the experts, or because the research has not been done yet?

My understanding is that CSPRNGs are built on top of hashes and block ciphers, which are quantum-resistant themselves, but I would really like a definitive statement that CSPRNGs are OK, or if not, then some issues that I should be aware of / concerned about.


texts: Is TOTP or a timestamp encryption a better timestamp-based authentication token system?

texts: Are there advantages to using TOTP over encrypting a timestamp with a shared secret, in cases where the readability or ease of typing the token are not important?


texts: Are there any hand ciphers not obsoleted by computer cryptanalysis?

texts: Computerized cryptanalysis has obviously made formerly "secure" hand ciphers like Playfair, Four Square, and the Hill Cipher obsolete because they can be defeated in seconds. But is there a hand cipher where a modern computer attack does not have an advantage over a cryptanalysis done by hand? There are certainly tasks that are more quickly done by humans, rather than computers. I'm wondering if there is a hand cipher that takes advantage of this.


texts: Proof of a key agreement protocol based on bilinear pairings

texts:
I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key
Agreement Protocols from Pairings". You can find a copy here.

In particular, it is a key agreement protocol which makes use of the bilinear maps. The protocol is the one described in the page 6 of the paper. The protocol is not very complex. It considers two users Alice, and Bob. Both choose at random their ephemeral private keys $a,b\in \mathbb{Z}_n^*$. Then both interchange the ephemeral keys $W_A=aQ_A$ and $W_B=bQ_B$ where $Q_A=H(ID_A)$ and $Q_B=H(ID_B)$. Then the established key can be computed by using a bilinear map as $K_{AB}=\hat{e}(S_A, W_A+aQ_B)$ and $K_{BA}=\hat{e}(W_A+bQ_A, S_B)$, where $S_A=sQ_A$ and $S_B=sQ_B$ (generated by the KGC).

The protocol is proven secure under the Bellare and Rogaway model. However there is a particular step that I don not understand which is associated with Theorem 1 of the paper. In particular, when they say (at top page 7):

Now call $A_k$ the event that $H_2$ has been queried on $\hat{e}(Q_I, Q_J)^{s(i + j)}$  by $E$ or some oracle other than $\Pi_{IJ}^n$ or $\Pi_{J,I}^t$. Then

Following, they say:

$Pr[E\text{ succeeds}] = Pr[E\text{ succeeds}|A_k]Pr[A_k] + Pr[E\text{ succeeds}|Ā_k]Pr[Ā_k]$.

Are they considering the case $Pr[E\text{ success} \cap A_k]$ and $Pr[E\text{ success} \cap Ā_k]$ for the first and second part of the previous expression?

Later, they assume $Pr[E\text{ succeeds}|Ā_k] = \frac{1}{2}$ which I understand. However, later they consider:

$\frac{1}{2}+ η(k) ≤ Pr[E\text{ succeeds}|A_k]Pr[A_k] + \frac{1}{2}$

and say "Thus $Pr[A_k] ≥ η(k)$". How they conclude this last expression from the previous one? I can understand that:

$η(k) ≤ Pr[E\text{ succeeds}|A_k]Pr[A_k]$

however... I can't see how they deduce $Pr[A_k] ≥ η(k)$ from the last expression.

I guess that it is something related with probabilities, but I suppose that I'm missing something...

Thank you in advance


texts: Generation of a symmetric encryption key in TPM

texts:
I know that keys in a TPM key hierarchy are encrypted with their parent keys. And I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption.

Is it mandatory to encrypt child keys with a symmetric key or can I use the asymmetric keys as well?
And if I can only use the symmetric ones, how are they generated? In the official specification, it is stated, that a symmetric key is "derived from a seed value in the sensitive area of the Storage Key". But what does that mean? Where exactly is that seed value stored? Is it the private key of the parent? Or is it another attribute entirely?


texts: Does the security of RSA come from just the carries in multiplication?

texts:
Although it's hard for me to find a reference, it's my understanding that if you calculate $N = pq$ using $GF(2)$ polynomial multiplication rather than ordinary multiplication, it is easy to factor $N$ under this type of multiplication.
I might have the terminology wrong when I say "$GF(2)$ polynomial multiplication".  I mean carryless or "XOR" multiplication done in base 2.
Is this true, and if so, does it mean that the security of RSA comes entirely from the addition carries that happen during ordinary multiplication?


texts: Linear combination IOP for SNARK registers

texts:
The STARK paper says

  Our ZK-STARK uses a separate Reed-Solomon codeword for each register, leading to w many codewords, each of lower degree n · c. At first glance this tradeoff may seem wasteful, because we now have to solve an RPT problem for each of these w codewords. However, the interaction and use of randomness allowed by the IOP model once again come to our aid: it suffices to solve a single RPT problem, applied to a random linear combination of all w codewords.

My understanding is that

The prover sends an oracle containing a trace of each register, purportedly encoded as a codeword.
The verifier picks a random coefficient for each register.
The prover sends an oracle which purportedly contains the linear combination of these register traces, using the coefficients from #2.
The verifier somehow tests for consistency between the two oracles.

And then there's an IOPP to convince the verifier that the linear combination is close to a codeword. If so, then each register's trace is close to a codeword with high probability.

My question is, how does the consistency test (#4) work? If the verifier was already convinced that each register trace was a codeword, then the verifier would know that either the linear combination was correct, or it was incorrect at many indices. So they could test for consistency at a small number of indices, and if those were correct, the entire linear combination must be correct with high probability.

But in this context, it seems like the above technique wouldn't help, since the verifier is not yet convinced that each register trace is close to a codeword. So how does the verifier test that the purported linear combination is correct?


texts: Is it secure to use TOTP with same key and different time-counters?

texts: If I use TOTP to generate codes with different "expiration" time, using the same key for HMAC, will I create some kind of weakness?


texts: Sign a plaintext accepted by a secure function without revealing private key

texts:
Imagine the following scenario: Alice is a well-respected chef. She is famous for reviewing recipes. Anyone can send her a recipe. If she likes it she'll add her famous line of approval to the end: "This is delicious, y'all". Cryptographically signed with her public key of course. Alice-approved recipes are universally delicious.

But let's be honest, cooking isn't that hard. Tasty food is pretty much just making adding a ton of salt, sugar, oil and MSG. Alice's seal of approval can be replicated by a computer program that makes sure the above are present in sufficient concentrations. Alice would like to kick-back and let the program do the hard work.

So, she hires an untrustworthy middleman, Bob. She hands Bob the computer program. Bob pretends to be Alice. Someone sends her a recipe, which gets forwarded to Bob. Bob runs the computer program, if the recipe passes, he adds her trademark seal and cryptographically signs it with her keys. However Alice only wants Bob to be able to sign recipes that pass. She wants to avoid a scenario where she has to trust Bob with access to her private keys.

Is there anyway to practically accomplish the above? As I understand, homographic encryption, garbled circuits and blind Turing machines can evaluate arbitrary computations. But current implementations are extremely inefficient for complex programs. The logic of the program itself doesn't need to be encrypted. The only thing Alice cares about is protecting her private keys, and restricting Bob to signing inputs that pass the function. Any ideas about whether this is feasible and what the best approach might be?


texts: Is there a flaw in this ring signature scheme?

texts:
Having read some papers about RSA accumulators applied to ring signatures schemes, I ended up thinking why would we need to accumulate all the members public keys for our specific use case.

So I came up with a scheme, but have the feeling that there is either an obvious flaw that I cannot see or it is (a variant of) something well known, or there is a obvious simpler way of achieving the same.

The hypothesis is that this a valid ring signature (with no member revocation: we either add a new member, or invalidate whole the group and force members to join a new one):

User cannot create valid signatures without being registered in the group.
Server cannot identify the specific user who sent the message nor link together messages sent by the same user (the latter with some exceptions in bonus).

Assume we work in the group of quadratic residues modulus $n$ (RSA accumulator).

The modulus $n$ and generator $g$ are chosen by the server (non-trusted) and are unique per group. AFAIK the server can provide a NIZKP that modulus $n$ is a product of two big enough safe primes, and user can check that $g$ is indeed a generator of QR mod $n$ cyclic group.

Join a group: user chooses a random prime $e$ and sends it to the server. Server returns a witness $w = g^d$ such that $w^e = g$ (so $e \cdot d = 1$ mod hidden QR group order).
Sign a message: user performs a NIZKP (http://www.cs.nyu.edu/~dodis/ps/subring.pdf) that she knows a value $w$ such that $w^e = g$ (without revealing anything about w or e, nor showing any value that the server can use to link different messages from her together).

Bonus (if the previous scheme is correct): assume prime $e$ chosen by the user has the form $(e - 1)/2 = e_1 \cdot e_2$, with $e_1, e_2$ big enough, far enough from each other primes. We can extend the NIZKP to show that we know $e_1$, $e_2$ such that $e = 2 \cdot e1 \cdot e2 + 1$ and provide $digest(M)^{e_1 + e_2}$ (https://eprint.iacr.org/2004/281.pdf), where $digest(M)$ is some mapping from the message to a generator of the quadratic residues modulus $n$. We can specify this mapping in such a way that we can identify two messages sent by the same user under some circumstances (e.g. repeated message in a given time span), because $digest(M)^{e_1 + e_2}$ will be the same for those messages.

Are there any obvious flaws in the scheme? Is it known (any references)?


texts: DSA: If signature is accepted then signature is correct

texts:
In one my classes, I have the following exercise:

  Prove that, in the DSA signature scheme, if a DSA signature is accepted, it is also correct.

How would I go about proving this? In cryptography, what is one usually referring to when saying a signature is correct? Does it mean that if the verifier accepts the signature, then it was signed with the correct private key?


texts: I actually don't know if this is the right place where ask, but I try. The side channel attacks aren't a negligible problem. There are several ways to protect from these attacks its own IP inside the FPGA. My problem/curiosity it's focused on the AES engine inside the FPGA. The most important FPGA companies have an AES engine on silicon to decrypt the bitstream during the programmation of the device. In your knowledge, are there FPGAs more secure than others ? Is it possible to perform a side channel attack to the AES decrypter inside the FPGA ?


texts: What are the differences between curve NIST P-521 and Edwards E-521 for signature?

texts:
I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long.
It seems that Edwards E-521 is safer but I did not investigated very deeper.

What is its signature length ?

How is it better ?


texts: Fixed point of the SHA-256 compression function


texts: Why are vectors approximately orthogonal after Gaussian lattice reduction?

texts:
In "An Introduction to Mathematical Cryptography"'s section on lattice reduction algorithms, the authors describe Gaussian lattice reduction and claim:

  ... the angle $\theta$ between $v1$ and $v2$ satisfies $\left| cos \theta \right| \leq \frac{\lvert v1 \rvert}{2\lvert v2 \rvert}$, so in particular $ \frac{\pi}{3} \leq \theta \leq \frac{2\pi}{3}$.

Where $v1$ and $v2$ are the output of the Gaussian lattice reduction algorithm and $\lvert v1 \rvert \leq \lvert v2 \rvert $. This result seems very close to a few trigonometric identities but I don't see why this is true in every case. Can someone shine some light on why this guarantees the reduced vectors share an angle in that range?


texts: Is there a standard one way function that does not produce collision

texts:
Is there any standard or accepted one way function that does not produce collisions? I'm not looking for hash functions.

Does that make sense at all? for example given string with length n, the function will always output same obfuscated string that is not possible to reverse engineer. something that is mathematically one way function but also doesn't produce collision.

So I don't want to store the actual input, but just a successor of input that cant be decrypted at all, this will be used only to see if duplicate input is received or not.


texts: Concatenation of two strong hashes may have striking weakness

texts:
For any hash functions $H_0$ and $H_1$, it is easily proved that their concatenation $H_0\|H_1$, defined by $(H_0\|H_1)(X)=H_0(X)\|H_1(X)$, is at least as resistant as the strongest of $H_0$ and $H_1$ with respect to collision-resistance, first preimage resistance, and second-preimage-resistance. Here we study another commonly assumed notion of preimage resistance, possessed by common hash functions, that (I believe) could be totally lost by concatenation for uncommon hash functions.

For a hash function $H$, define $m$-bit preimage resistance as: given $m$ and $h=H(M)$ for a random unknown $m$-bit message $M$, it is computationally hard to find a message $X$ with $H(X)=h$. For an ideal $n$-bit hash (random oracle), breaking $m$-bit preimage resistance requires about $2^{\min(m-1,n)}$ hashes (queries to the oracle). Common hashes are expected to reach that security level. $m$-bit preimage resistance is desirable e.g. when hashing an $m$-bit password (+salt).

From an $n$-bit hash $H$ secure in the Random Oracle Model, can we construct two $n$-bit hashes $H_0$ and $H_1$ such that:

$H_0$ and $H_1$ each are secure in the ROM, to near the theoretical optimum;
for any $m\le n$, $H_0\|H_1$ has no $m$-bit preimage resistance (there's a fast algorithm to solve the problem defining $m$-bit preimage resistance)?

My guess is yes. A simpler construction than what I had in mind shows just that.

What's the best level of $m$-bit preimage resistance that we can demonstrate for $H_0\|H_1$?


texts: Do all attacks against PKCS1 v1.5 encryption require an oracle

texts:
As far as I know, all attacks against RSA PKCS1 v1.5 require an oracle; is that true? Or are there any other attacks against it which are able to break it without an oracle?

Background: I need to support PKCS1 v1.5 because most crypto-devices sadly don't support OAEP. However, the software is only used for manual file en-/decryption, so there is not an oracle available.


texts: Breaking Insecure Elliptic Curve Cryptography

texts:
If you knew the entire equation of an elliptic curve $$y^2 = x^3 + ax + b~( mod ~~m)$$ given $a, b$ and $m$ which are all more than 70 digits in length, as well as a point $P$ and the point $t P$, with different orders, would it be possible to calculate $t$? What would be the fastest way to do this?

(I'm aware that $tP$ and $P$ not sharing the same order makes this less secure but I'm wondering how exactly to exploit it).


texts: How can two (or more) parties share and agree upon a common random seed?

texts:
I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each party can be sure that the seed is really random.

My idea is as follows:

Each party generates a random value $x_i$,
sends its hash $h(x_i)$ to everyone else,
and waits for hashes from all other parties.
Then each party sends its original value $x_i$ to everyone else,
waits for all the values,
and verifies them.
Finally, each party computes the seed as $\mathop\oplus\limits_i x_i$

I know that inventing protocols should be left to experts, however, I'm curious if this could work and what's needed for the this. I see that the generated values must be long enough to avoid brute-forcing and that $h$ must be collision-resistant.


texts: mbed tls DTLS v1.2 system with -ECDHE-ECDSA, mutual auth and pre-installed public/private keys, no unnecessary messages or ASN.1/X.509 decoding

texts:
I am designing an IoT system based on Silicon Labs EFR32 MCUs with hardware accelerated support for SHA-256, AES-128-CBC and ECC (m255) computation. The system will communicate over a proprietary radio communication protocol in an untrusted environment, and both flash and ram footprint and the number of exchanged messages is vital to be kept low.

The DTLS functionality described in https://tools.ietf.org/html/rfc6347 is massively overweight for my application, which has the following features and needs:

micro-controller to micro-controller communication using proprietary radio (not LoRa, Zigbee or similar) in a hostile environment, radio is slow and costly in terms of battery life
non-blocking SW model with callbacks and timer hooks
physical channel: unreliable delivery, active attacker/listener, reordering and replay; similar to UDP.
client/server model with client verification similar to HelloVerifyRequest/ClientHello in DTLS to avoid DOS attacks on the other radio devices
exclusive use of TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 (m255) known at production time
known maximum MTU size for radio channel
pre-installed public/private key-pair in both peers in compact binary form (no ASN.1 or X.509 code), identical to both peers having each other's certificates without negotiation, with eternal validity
no IP, not be reachable online, communication between two micro-controllers that use a proprietary protocol for communication
pause/start the tunnel without it closing when no traffic comes in the paused state. Shouldn't renegotiate when in paused state, but keep using the session keys until either age-limit or data-limit hit. Needs to be possible to wake up by an unencrypted agent
one bi-directional secure, mutually authenticated application-layer traffic tunnel using ECDHE/ECDSA, no port-numbers needed.
client knows unique serial number of server, server knows only it's own serial number
keep-alive signaling; successful payload message transfer should be seen as keep-alive equivalent to reduce message volume
renegotiate session keys when either age-limit or data-limit hit
client knows the unique serial number of the server, needs to do server device discovery among potentially many devices both after and before session establishment. That a device has been seen is not considered secret information

When I look at what already finished functionality mbed DTLS has, it looks like I can't get it to not exchange certificates between peers or negotiate the cipher suite (despite knowing the only valid setting in production). I want to cut out all the unnecessary, already known flights of messages to reduce both setup time and battery consumption.

I want to have two interfaces towards my L1 radio layer where only a rough selection of incoming traffic has been performed: send() and receive(), which should be asynchronous and non-blocking.

The code and RAM size for ASN.1 decoding and parsing is massive for my application, so I want only the 256+256 bits of the public/private key-pair, and the known unique serial number of the peer to be stored instead of doing ASN.1 and X.509 parsing.

Is there any way to obtain the features that I want, or do I need to write this code myself, implementing heartbeat signaling, session establishment/renegotiation, application layer tunnel traffic encryption/authentication/decryption, etc based on mbed tls DTLS primitive functions?

Is there any known example of a similar scenario that I can look at? Any list of good advices to follow in order to avoid creating exploitable weaknesses in my implementation?

Thankful for any helpful input
/Daniel Nilsson


texts: If a hash function like Whirlpool or Sha512 would take a byte array of 1 MB in size filled with the output of a Secure RNG as its input message, would this be considered a strong input message, a strong key, or neither ?


texts: How does APE: Authenticated Permutation-Based Encryption work?

texts:
I am trying to understand the encryption and decryption process of the APE: APE: Authenticated Permutation-Based Encryption for Lightweight Cryptography
Full paper
The Encryption

what is exactly the Vc and the Vr here? Example instead of the permutation p, what if I decide to replace it with a block cipher? Will the Vc be the key for the block cipher? What will the Vr then be which is xor'ed with the Plaintext?
A simple human-readble pseudo code will be helpful. I started trying to rewrite the pseudo code
but there soo many unanswered questions.
[CipherText, Tag] function Encrypt(Key, A, Plaintext):
begin
  u = len(A)
  w = total number of blocks in the plaintext// eg. 1 block 64 bit block size
  V = [0,....K]
  if(A not zero) then
    A = {A[1] .... A[u]}
     for i = 1 to u do
         V = p(A[i] xor Vr, Vc) // can replace this with block cipher eg bcp(plaintext,key)
     end
  endif

  V = V xor [0,1] // What is (0,1)?
  M = {Plaintext[1],.......Plaintext[w]} // devide into blocks eg. 64 bits each.
  for i = 1 to w do
     V = p(M[i] xor Vr, Vc) // what is the Vr and Vc here?
     C[i] = Vr
  end

 CipherText = {C[1],.......C[w]}
 Tag = Vc Xor Key // what is the Vc here from?
end


texts: I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security notions involved?


texts:
I've recently understood the difference between Interactive Proofs and Arguments, but even if several standard variations of IP are well known and thoroughly described in textbooks (Goldreich for instance) Arguments are not so well documented.
In particular I'm having a hard time to find a well established definition for the notion of argument of knowledge (I understand that intuitively the extractor has access to a PPT prover with auxiliary input) that could also possibly be cited
thank in advance


texts: MTI/A0: modular arithmetic or elliptic curves?

texts:
In the Handbook of Applied Cryptography (Menezes, A. J.; van Oorschot, P. C. & Vanstone, S. A.) Protocol MTI/A0 key agreement (algorithm 12.53) described as $\mod p$-protocol. The survey Overview of Key Agreement Protocols
(Ratna Dutta and Rana Barua) describes MTI/A0 as elliptic curve-protocol.

Unfortunately I have no access to original MTI article. How MTI-protocols were described originally?


texts: Is this simple proposed scheme semantically secure?

texts:
Suppose we have two parties, including $P_1$ and $P_2$ using a type of symmetric encryption algorithm, say, AES256. Let's assume the shared key is: $K$.

Encryption:
Each party generate a key such that:

Initialization: $c=1$

Key generation: $K_{new} =  K + c$ and $c = c + 1$.

For encryption: For every message do: $Enc_{K_{new}}(message)$

Decryption: The same rule applies to it.

For decryption: $Dec_{K_{new}}(message)$

Would this proposed scheme secure if we make use of the last bits of the generated key, say the last 16 bits?


texts:
Is there any standard algorithm where I can create a hash H(x,k) where x being the data and k being the private key. And verify on other end with H(x,l) where l being the public key?

How it can be achieved?


texts:
So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc.

What implementation attacks are there against hashes or hashed based functions (e.g. MACs, DRBGs, etc.)?


texts: Can I use my own implementation of a widely used, supposedly secure cryptographic algorithm for securing data at rest?

texts:
I know you shouldn't roll your own crypto and generally its not a good idea to implement (and then deploy) any extensively tested and recommended algorithms by yourself either.
I have already seen this question, and as far as I understand, the main problem with implementing things yourself is that you will probably remain vulnerable to a host of side-channel attacks.
But suppose I have already implemented AES (just for fun and as a learning experience). What if I now use that implementation for simply encrypting files locally (and then perhaps back them up on the cloud or on removable media)? Since nobody other than me would be using the implementation, most of the side channel attacks would not apply. For instance, since no attacker can request an encryption/decryption (the way it works with a server), no timing attack can be carried out. Would this be as secure as using an extensively tested implementation?
In other words would using my own implementation of AES provide security for data at rest equivalent to the security provided by extensively tested implementations or will using it still be a stupid idea?


texts: Is it possible to create a Bilinear Function with Already Assigned "Multiplicative" Input Groups?

texts:
Assume that we have an already assigned Multiplicative Cyclic Group $\mathbb Z_p^*$ with order $q=p-1$, and $p$ is a prime number, is it possible to create a bilinear function $\hat{e}: \mathbb Z_p^* \times \mathbb Z_p^* \rightarrow \mathbb G_2$ with the property that follows:

$$\hat{e}(g^{a},g^{sb})=\hat{e}(g^{b},g^{sa})$$

$g$ is a generator for $\mathbb Z_p^*$, and $\mathbb G_2$ is also a Multiplicative Cyclic Group with order $q$

it seems that if the creation of this function is practical in polynomial time then there should be new attacks on some cryptographic protocols with security property of anonymity.


texts: RSA Decryption with Private Key but no public exponent

texts:
I manually set the RSA private key, given the private exponent and modulus. When I use this key to decrypt a message encrypted using a public key (also set with public exponent and modulus) seems to fail with a: "Need public exponent" message in OpenSSL.

Should RSA private key also require the public exponent for decryption, or is this specific to OpenSSL?


texts: Most efficient conceivable padding mode, and with no padding oracle

texts:
When plaintext padding is required, there are various commonly-used padding techniques.  It seems the two most used approaches are :

Always add at least one byte of padding, and have every byte of padding represent the number of bytes of padding added; or else
Always add at least one byte of padding, and have the last byte of padding represent the number of bytes of padding added, whilst the other padding bytes are zero;

The very concept of a padding oracle relies on there being byte arrangements that are invalid based on the padding scheme used.

Another padding scheme seems extremely obvious to me, has no potential for oracle padding exploits (as all byte arrangements are valid), and results in approximately 6% fewer padding bytes being added to messages on average (assuming random distribution of message lengths and random message contents).

I describe the padding scheme below, but my question is simple : since this padding scheme is so obvious, and simple to implement, and eradicates all possibility of padding oracle attacks, and saves a smidgeon of storage space and bandwidth, why am I unable to find anyone else promoting this obvious scheme?  Am I overlooking an obvious flaw?  Has it been proposed before but widely rejected, and if so, why?

This is not a question about using MACs to prevent padding oracle exploits, nor am I suggesting not using MACs just because this padding scheme is impervious to padding oracle exploits, but I am a big fan of eliminating unnecessary weaknesses in individual components of a system even if the careful layering of components can mitigate the weaknesses.  Padding oracles are so easy to have designed to be impossible, if the following scheme works, that I don't understand why we have the padding schemes we do.

The scheme :

If final block is less than full, add zeros until (exclusive) the final byte, then add a byte representing the number of padding bytes added.  (So far, identical to one of the common schemes, EXCEPT that on receipt, we ignore the meant-to-be-zero bytes, and thus if they are corrupted in transit, it will not cause a padding validation failure.)

Assuming block size of 16 bytes, if final block is full, and final byte of final block has numeric value between 1 and 16 inclusive, add an entire padding block, filled with zeros except for the final byte, the which holds the number of padding bytes added (16 in this case).  (Again, at this point, no different to one of the padding schemes already in common use, except that again, on receipt of a padded message, we entirely ignore padding bytes that we expect to be zero, and thus a corruption in transit will not cause a padding validation failure.)

Assuming block size of 16 bytes, if final block is full, and final byte of final block has numeric value of 0, or >= 17, no padding is required.  (This is the one point of difference from the otherwise-identical common scheme.)

In this scheme, all byte sequences are valid, eliminating padding oracle problems.

And compared to the mainstream padding approaches, we save a smidgeon of storage space and bandwidth, because 1/16th of the time (assuming random distribution of message lengths, and random message contents), we have only 16/256ths (i.e. 1/16th) probability of needing to add a full block of padding bytes, meaning 15/16ths probability of saving ourselves the 16 padding bytes, as compared to always requiring a full block of padding as occurs in the equivalent situation with the mainstream padding schemes.

What am I missing, or else why do we live with padding schemes that need extremely careful use to prevent leaking sensitive data?

Thanks in advance for your answers!


texts: Blowfish ECB mode: Tools for known-plaintext attack?

texts:
I'm currently dealing with multiple blowfish-encrypted files that share the same key. All are encrypted using ECB mode judging from their appearance:

I don't know what the key is but I know 64 byte (or 6 blocks) of consecutive plaintext. The key length used is most certainly 448 bit.

Now, I just recently started to read up on this topic and I haven't been involved into cryptography before either. However I stumbled across this post on this site and it talks about precomputed tables to bruteforce the used key. I understand that the post is talking about a 40bit key so it eventually means that there is no way to use this in my situation.

But if it is, are there any tools to use for this scenario? I'm sadly lacking the skills to write them. I just want to be able to decrypt and re-encrypt the files.

Thank you very much for any reply.


texts: Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

texts:
This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward.
(1) I'm curious whether the following 10 different DH Groups are the only groups that TLS 1.3 supports, (2) and as such, are they the only ones that we should be using?
https://tools.ietf.org/html/rfc8446#section-4.2.7
      /* Elliptic Curve Groups (ECDHE) */
      secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
      x25519(0x001D), x448(0x001E),

      /* Finite Field Groups (DHE) */
      ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
      ffdhe6144(0x0103), ffdhe8192(0x0104),

Some discussion into what curves should be used has already taken place here, which mentions that secp256r1 and secp384r1 are best.

I've read over the RFCs and this post and understand that there are only 5 ciphersuites that TLS 1.3 supports, 3 of which are mandated for compliance with the standard (there are also 3 mandated Signature Algorithms). I also understand that the Signature Algorithms and the Supported Groups are communicated in other Extensions
(2) To elaborate on my second query: Given that TLS 1.3 was developed over years by experts, and that it only supports certain cypher mechanisms - can we take that to mean that these are the only mechanisms that should be used?
Basically, should we configure any TLS 1.1 and TLS 1.2 connections (web servers, SSL-VPN servers and IKE/IPSEC tunnels) to use/prefer the mechanisms listed in the TLS 1.3 RFC if the software/hardware supports it?


texts: A "one time pad" can be thought of a Vigenere cipher with

texts:
A "One Time Pad" can be thought of a Vigenere cipher with...

An infinitely long key
A secure symmetric key
Multiple ciphertext alphabets
A columnar transposition

I had this question come up today in one of my mid-terms and to be honest it caught me off guard a little, I chose (2) but I'm having doubts and now thinking its (3). I'm pretty sure i'll get a quick response to this because its quite a basic question, this is from an initial test on intro to cryptography and I felt I did pretty well on the rest of the test but this is bugging me.

I know one time pad can have infinite period and can be truly unbreakable but that doesn't mean it has an infinitely long key! (does it). (4) is surely a null consideration which leads me to think its (2) or (3)!


texts: So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical cryptanalysis and theoretical attacks complexity?


texts: How can Hashed Value be same in length extension attack?

texts:
Let's say we had the following information:

Secret = "Hello"
Message = "Attack at Dawn"
H(s,m) = ABC

Alice is sending a message to Bob but there is a person in the middle, Mallory who intercepts the message.
A ------(s,m)= v ----> Mallory ------ (s',m') = v' ---------> Bob

In order to make sure that the message is untampered v=v'. Here is my question: how can Mallory append to the end of the hashed value yet still have the same hash?
How is it that $H(\text{ABC||"jk don't attack"}) = ABC$? Doesn't the extra char in the string change the entire hashed output?


texts: Can you identify the public key used to encrypt something?

texts:
If I encrypt a string with a public key, does the encrypted ciphertext reveal the public key I used to encrypt it? Basically, I don't want anyone to know who the ciphertext is addressed to.

I'm thinking about RSA, but also interested in DSA. The ciphertext is not known.


texts: Does the length of the keyword used for keytable for Playfair matter?

texts:
So for Playfair, we choose a keyword and put that in the keytable with no duplicates. Then, we fill the rest of the table with alphabets in order that are not in the keyword without 'J'.

Does the length of the keyword matter? I am wondering because I wanted to know whether having just a random 25 characters long word for the keytable would be more secure than choosing a word that is less than 25 characters long and filling the rest of the table with the rest of the alphabets in order.


texts: Does DTLS Change_Cipher re-transmission use same epoch as original one or the new one?

texts:
DTLS endpoints are required to re-transmit the entire flight of handshake messages in case there is a timeout. Before timeout event, the transmit epoch can change at record protocol. Which epoch is used for re-transmission of messages? The old one of the new one?

E.g., during initial handshake, client sends a flight comprising of key_exchange, ChangeCipher & FINISHED messages. The key_exchange, CCS are sent with epoch=0 and FINISHED is sent with epoch=1.

Say ChangeCipher gets lost.

Does the retransmission of full flight happen in epoch-1 (which is latest one)? If this is the case, the peer has no way of decoding the flight.

Or

Does the retransmission of records happen in same epoch as original but new record protocol sequence numbers are used? In this case, handshake protocol needs to pass epoch information to record protocol. Also record protocol is required to maintain multiple transmit epochs.


texts: Is RSA key size the size of private key exponent?

texts:
I have implemented a key pair generation scheme for RSA algorithm. I have taken the length of private key exponent as RSA key size, but then I've got to know that RSA key size is the size of the modulus $n$. Is it wrong to take RSA key size as the size of the private key exponent?

To generate a private key of 1024 bits, I increase the size of private key exponent regardless the modulus $n$.


texts: Is it possible to combine two operations rotation and xor?

texts:
I can see many xor and rotation operations in cryptography. I just want to make some algorithms fast. So, I'm looking for a way to combine between xor rotation operations. I don't know if it is possible or not.

R3(A) xor R4(B) = A * B (R3,R4 means left rotate shift by 3 bits and 4 bits)

I'm looking for *. Is there any idea? If you have please, let me know. And if it is impossible, please show me why. Thanks.


texts: AES: Why ShiftRows() before MixColumns()?

texts:
In above picture you can see a AES state array over 2 rounds through the S- and P-Boxes of AES. It's taken from here and intends to show how 2 rounds of transformation are necessary to achieve full diffusion after only the first byte has changed.

If one would MixColumns() before MixRows() diffusion, one would reach diffusion one step earlier. So I wonder what is the reason to ShiftRows() before MixColumns()?


texts: NIZK arguments for QAP GRO16 proof simulation

texts:
I'm studying how zero knowledge for quadratic arithmetic programs works (GRO16 page 17) and try do understand proof simulation part.

If I understood right, if malicious party knows $\alpha , \beta ,\delta$ from setup it will be possible to construct $A,B,C $ that will satisfy verification equation.

Are there are any other combinations of setup parameters that can help to simulate a valid proof?

Also, I would be grateful for a useful link / or research work where proof simulation for QAP this can be described.


texts: What is the difference between Elliptic curves and Hyper-elliptic curves in terms of security?

texts:
What is the difference between Elliptic curves and Hyperelliptic curves in terms of security? I am relatively new to cryptography and have heard a great deal more about Elliptic curves than Hyperelliptic curves.

Why are Hyperelliptic curves not so prevalent in use?


texts:
Is there any implemented solution to agree on a session key in offline way.

I can exchange some keys before being offline but I need both sides to create the session key offline.

I need implemented and secure solutions.


texts: Securing http session id's by appending HMAC hash?

texts:
First, I apologize if this question is off topic as defined here. If so, please let me know and I'll close it.

I'm building a sessions middleware for an http service and thought it might be a good idea to append hmac hashes of session id's, rather then setting bare session id's in cookies, but am a bit of a crypto novice. FYI - the service isn't protecting anything critical, it's just a side project of mine, which is why I'm rolling my own solution.

First, allow me to layout the general sessions design, and I'll follow with some specific questions. Here is an overview of my sessions service:

Generate a random session id using an RFC 4122 version 4 uuid generator. I store this id in redis along with some other info (userID, expiry, etc.).
Hash the byte array of this session id with hmac sha512. My hashing key was generated with openssl $ openssl rand -base64 64
Append the bytes of the hmac hash to the the byte array of the session id. Base64 encode the resulting array, stringify and set as an http only, secure cookie.

Upon receiving a request from a client, verifying the user session is basically the steps above, but in reverse.

My questions are:

Does appending the hmac hash to the session id offer any benefit above and beyond simply setting a version 4 uuid to the cookie? My thought was that I could verify the hmac signature using my key before pinging my db to check if the session id was expired. This would cut down trips to my db if someone were trying to guess at session id's.
Is sha512 overkill for hashing my session id? My understanding is that it should be faster on a 64 bit machine.
Is appending the hashed bytes array to the session id bytes array, base64 encoding and stringifying the result the proper way of storing this information in a cookie?
Is $ openssl rand -base64 64 the proper way of generating a key for my purposes? Based on this discussion, my understanding is that my key length should optimally be between 64 and 128 bytes.
Anything else you want to add? Anything I've overlooked?

Thanks for your input. Cheers!


texts: Are the following asymmetric encryption schemes equivalent?

texts:
Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server.

You'd prefer to not use simply a symmetric key for encryption, because if the machine was compromised then the symmetric key would enable the entire history of backups on the storage server to be decrypted.

Are the following two schemes equivalent?

In all schemes, the storage server only allows uploads, and not downloads or deletions. In all schemes, generate a permanent EC keypair (a,A) (where a is the private key and A is the corresponding public key). Store only A on the machine.

Scheme 1: Generate an ephemeral EC keypair (e, E) for each backup. Encrypt the data using an authenticated cypher (such as AES256-GCM or ChaCha-Poly1305) using the symmetric key H(eA), where H() produces uniformly distributed hashes (such as SHA2-256). The backup is decrypted using the symmetric key H(aE), and E is stored along with the backup. Successful decryption proves that only a machine that knew A could have created the backup. Backups would include timestamps, so it would be detected if the same observed backup was retransmitted by an attacker at a later date.

Scheme 2: In addition to the permanent encryption keypair (a,A), keep a permanent authentication keypair (b,B) on the machine. Then, Scheme 2 is the same as Scheme 1 except that prior to transmission, the encrypted backup is signed with b. On decryption, verify the signature first.

At first glance, it might seem that Scheme 2 is superior, because it prevents backups from being uploaded by an attacker that learns of the public key A. However, the authentication private key b is stored on the same machine, so both b and A are likely to be leaked together. There is no way I can see that anyone compromising the storage server could deduce the public key A that was used on each occasion when sending each backup.

Therefore, scheme 2 does not look superior to me, other than if it is suspected that the machine is compromised, the signing keypair (b,B) can be replaced without also having to replace the keypair (a,A).

Is this correct? Does use of the authentication keypair in scheme 2 have any other advantage? Does knowledge of A effectively authenticate the backup just as well as if the backup was signed with b?


texts: Using weak hash functions to construct a stream cipher

texts:
I am in the awkward position of developing a secure encryption scheme that provides data-at-rest security for a very limited embedded system. The system is only guaranteed to have 4 MiB of memory (some systems have an extra 32 MiB), and they do not even have an MMU. They are running an old version of μClinux. While the resources are not that big an issue (even a cheap 8051 could run a secure cipher), the real issue is that I can only use the utilities that are present on the system. Unfortunately, there are no scripting languages other than a rather limited ash shell, so implementing a real stream cipher is out of the question. However, the md5sum utility is present, as is od which is necessary to combine the keystream with the plaintext of a binary stream.

Because implementing a stream cipher in ash shell would be too slow, I thought of using MD5, where the keystream $H$ at position $i$ is the hash of key $K$, nonce $N$, and counter $i$ concatenated. Encryption of plaintext $P$ and decryption of ciphertext $C$ is done as in any stream cipher.

\begin{align*}
  C_i &= P_i \oplus \operatorname{MD5}(K \mathbin\| N \mathbin\| i) \\
  P_i &= C_i \oplus \operatorname{MD5}(K \mathbin\| N \mathbin\| i)
\end{align*}

I understand that it is possible to design a stream cipher from a hash function, but I would like to know specifically if MD5 is an acceptable hash function in this particular scenario. As far as I am aware, collision attacks are irrelevant for use in a stream cipher, but I want to make sure I missed nothing. Is this scheme appropriate for my unfortunate hardware / software limitations?

I am also aware that designing a cryptographic scheme as an amateur is very bad. Unfortunately, I have little choice as I can't load my own executables onto the device, and thankfully I do not need authentication or any security properties other than data-at-rest security (i.e. it is a situation where unauthenticated AES-CTR would suffice).


texts: Extracting key bits from linear cryptanalysis equation for SDES

texts:
From the linear cryptanalysis of SDES, we get a linear equation consisting the K[1, 3] of the round key 1 and 2. From this how will I retrieve the key bit?

How do we solve the linear equation we get from the linear cryptanalysis to predict the key bits?

The 1 and 3 bits of the round key 1 and 2 are present in the final relation. Form this we apply the algorithm 1, as stated in the paper by Matsui on linear cryptanalysis(The second image)

But from this how do we predict the bits of the actual/original key?


texts: How should I treat a new cipher release like Spritz?

texts:
I have been looking at both the paper as well as the sourcecode of Spritz — a spongy RC4-like stream cipher and hash function by Ronald L. Rivest and
Jacob Schuldt.

The paper states

  We have also performed extensive simulations to look for detectable statistical biases, and selected a candidate with no biases detected in our experiments. Further cryptanalytic review is recommended before this cipher is used in critical applications.

Since this is the first time I am witnessing the birth of a "new" cipher algorithm, I don’t know what to think of Spritz. Mainly, because part of it uses RC4, which seems to be known for its detectable bias, related to the state shuffling. But there’s also the "spongy" functionality in there, which reminds me of what I have read about SHA-3... but can that change be interesting enough to even think about touching it?

I am not much of an analyst, but my simple C timing function tells me Spritz is slower than RC4. Probably even slower than AES too. (I have to admit my AES implementation is not the fastest around.) No one seems to have cryptanalysed Spritz yet. And the distant sound of biased RC4 doesn’t provide comfort either.

This leaves three basic options for me to choose from:

Ignore it completely and wait until someone provides a good reason to use it (good reasons not to use it seem to be: RC4 related, slow,...)
Have fun with it while trying out my first baby-steps trying to apply some basic attacks to learn from the experience without really hoping to actually be able to break anything
Be exited and wait because there might be a dozen of smart people that are already pulling it apart from all sides to find out if it is secure or not.

So, how should I treat a new cipher release like Spritz?

Actually I’m hoping the answer is *"have fun with it". If that’s the case, can you give me a few hints about which analysis/attack/break would be the most appropriate to try on a cipher like Spritz? I have just started learning about linear and differential cryptanalysis, but I am willing and able to expand my knowledge if this is a chance to do so. I don’t need a list, just a hint or two... a gentle push, not a kick. ♥


texts: Must the order of the groups in a bilinear map be the same?

texts:
I've been reading up on bilinear maps and their application to cryptography and one thing I keep seeing hasn't yet clicked.

If $e:G_1\times G_2\to G_n$ is a bilinear map, $G_1,G_2,G_n$ are always defined as having the same order.

It seems to me, however, that $ord(G_n)$ should be $ord(G_1)\cdot ord(G_2)$. Is there a reason that I always see the groups having the same order by definition? Must that be the case?


texts: Public-key format for ECDSA as in FIPS 186-4?

texts:
What is the public-key format for ECDSA as in FIPS 186-4, and where is it formally defined?

In particular, are there variants beyond Cartesian coordinates? Is that a pair of bitstrings, or a pair of integers, and with exactly what ASN.1 decoration (if any)? Would the point at infinity have a valid representation (I know it is not a valid public key)?

I ask because I find various formats around (in an X.509 public key certificate there is typically a bitstring including a header and Cartesian coordinates, but some code use point compression); I'm not even sure ANS X9.62:2005 would address my question; and I can't find the answer in ISO/IEC 14888-3:2016.


texts:
I want to implement threshold homomorphic encryption for my project.
(encrypt a message using one public key, and decrypt a ciphertext using distributed secret keys)

I read a paper "Multiparty computation from threshold homomorphic encryption", which describes the way to build threshold homomorphic encryption.

However, in a case of Paillier cryptosystem, the performance was not good than I expected. (http://cs.utdallas.edu/dspl/cgi-bin/pailliertoolbox/manual.pdf)

I recently read that NTRU based cryptosystem provides homomorphism and the performance is better than others.

So I think that NTRU-based threshold homomorphic system will have better performance.

But I could not find the paper about NTRU-based threshold homomorphic encryption system.

I think it is possible to build the NTRU-based one because there are some references about NTRU-based secret sharing schemes.

Is there any paper that explains NTRU-based threshold homomorphic encryption system?

Or can anyone give me a guide to build the system?


texts: Differential analysis for dummies, how key position impact on tactic?

texts:
Im new to cryptoanalysis and started reading A Tutorial on
Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody help me please? He uses this example of simple spn.

How does removing k1 mixing or k5 mixing affect our attack? As far as I have understood if we dont use k1 we just skip all S1 sboxes and first permutation and start attack at second key mixing, but I just dont understand why. There is still difference with some probability for if we use generated pairs of texts. Or do we generate pair at start of k2 key mixing?
Author says we need to find difference with good probability at start of last round and then just brute force parts of last round subkey on every generated text-pairs. But if we check key on every generated pair and not only right ones, why do we even divide them into right and wrong pairs?
If we attack r-round cipher, we find differential for r-1 round and then undo round by round. But when we go to only 1 round we still got k1 and k2 keys that we dont know. What do we do then?(because for r=1 round we need to find differential for 0 round)
How do we attack test cipher with only 1 round and keys k1 and k2 mixing with S-block between  them?

I know I have a lot of question but would be happy if anyone answered atleast one of them!


texts: Why a bulk encryption key and frequently used key needs to have a shorter lifetime?

texts:
In NIST standard (NIST SP800-57), the bulk data encryption key and other key material that is used frequently have a short lifetime. As quoted from (Sec. 5.3.6, point 6.b.):

The originator-usage period recommended for the encryption of large volumes of data over a short period of time (e.g., for link encryption) is on the order of a day or a week. An encryption key used to encrypt smaller volumes of data might have an originator-usage period of up to two years.

Also, more generically, in Sec. 5.3.1. Factors Affecting Crypto periods, it stated in fifth entry:

The volume of data flow or the number of transactions;

I do understand that, intuitively, the more a key is used for an operation, the more "information" about that key in this operation is revealed. But I can't figure out a more concrete rationale behind it. Since such consideration is for rather generic (does not seems to be based on the property of a specific key type). I wonder if there is any generic / theoretical framework describing how using a key reduces the "reliability" of its secrecy?


texts: Does the Biclique attack on AES pose a credible risk to its security?

texts:
I have heard a lot about the biclique cryptanalysis research on AES, which as far as I know is the closest anyone has got to breaking AES.

Exactly how close did they get? Does this attack propose a credible risk to my using AES today? Exactly how hard would it be to extend their work to fully break AES?


texts: Are applications aware of data records received before and after tls rehandshake?

texts:
It seems that a tls endpoint can pump more data records even when it has received a re-handshake request from peer.

Also in dtls, new data records would get accepted even while rehandshake is in progress since any of the endpoint does not have way to tell whether those records originated after a handshake message. This is because re-transmission of handshake message gets a new record protocol header sequence number. So looking at record protocol header sequence number is not a good way to tell the ordering of events.

Do the endpoints have any way to tell which data they received before re-handshake completed and which one they received after rehandshake?


texts: Why is confusion & diffusion not required PKI encryption schemes like Elgamal encryption?

texts:
The Elgamal encryption scheme is a Multiplicative Mask with the shared key. It doesn't seem to have any confusion or diffusion.
So why is it not necessary here as compared to Block Ciphers?


texts: Reuse of TLS client key/certificate in challenge-response protocol

texts:
The situation: We have a custom PKI with clients communicating with the server over standard SSL/TLS encrypted channel. PKI uses ECC, server certificate supports ECDHE_ECDSA key exchange mechanism and is signed using our custom CA. Clients are authenticated to the server using their client certificates containing ECDSA public keys.

In addition, clients also communicate with each other - this channel is not encrypted and we only use a simple challenge-response protocol for unilateral authentication (only one side needs to be authenticated). The challenge-response protocol is taken from the Handbook of Applied Cryptography (10.3.3(ii)2., PDF) and goes as follows:

$A ← B : r_B$

$A → B : cert_A , r_A , id_B, S_A (r_A, r_B, id_B)$

where:

$r_B$ is a random challenge generated by $B$.
$cert_A$ is $A$'s certificate.
$id_B$ is an identifier of $B$.
$r_A$ is a random number generated by $A$ to prevent chosen-text attacks.
$S_A(r_A, r_B, id_B)$ is a signature computed over concatenated values of $r_A$, $r_B$ and $id_B$ using $A$'s private key corresponding to $cert_A$'s public key.

So, $cert_A$ and corresponding $A$'s private key are reused in SSL/TLS and the challenge-response protocol. Are there any bad consequences of this approach? Any suggestions? Thanks.


texts: bank websites using AES_256_CBC vs AES_128_GCM/CBC

texts:
Hello i have just recently started learning about cryptography, so i was doing some little research on what kind of encryption techniques and modes that were used in bank web pages. I have noticed that some bank uses the AES_256_CBC with HMAC SHA1 and banks that uses AES_128_GCM...I have seen more banks using AES_128_GCM or AES_128_CBC over AES_256_CBC...
So i would like to ask if there are any major advantages of using AES_128_GCM/CBC over AES_256_CBC or they are more or less the same and it is just a preferential


texts:
Focus:
I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know the key.

Protocol Overview:

Both the client and server have a copy of their respective public keys.
Generate session key using ECDH. Parameters will be signed and sent to both parties.
Further communication encrypted with AES in GCM mode. IV and Tag are appended to the ciphertext and sent to the other party.

Side Note:
How can I introduce forward secrecy?


texts:
Is there a known weakness in RSA when the value of modulus (n) is very large?

n = 2466 digits
e = 65537
c = 2466 digits

n cannot be factorized. I checked on factordb.com and no factors were present.

Both, modulus and ciphertext have the same number of digits. Is this not considered secure?

What kind of attacks can be used against such a crypto system?