texts:
I'm making a small python program to encrypt an arbitrary text file.

Currently I have a file to store passwords (hashed values), so nothing stored in plaintext. The user enters the command line arguments of a flag '-e' or '-d' to encrypt or decrypt, and a filename and a password. The password to encrypt is different to the password to decrypt, one cannot be used for the other.

The encryption works although I'm not 100% sure I'm doing it correctly. I take the file and read through it line by line, appending each line to a list. Then making a random 128 bit IV using the hashed password the user entered as a key to encrypt each line. Then I write these lines to a new file and save the file.

I'm not sure I should be using the hashed password the user entered as the key to encrypt, because I'm saving the hashed value of the password the user entered in a password file to check against user input! (if that makes sense).

Anyway my main problem is decryption, because the file was encrypted with PASSWORD_ENCRYPT, and the user wants to decrypt with PASSWORD_DECRYPT, the two are not the same. So I don't have the key to decrypt the file?

Here's some code of my encryption.

backend = default_backend()
key = hashed_password
iv = os.urandom(16)
cipher = Cipher(algorithms.AES(key), modes.CFB(iv), backend=backend)
encryptor = cipher.encryptor()
lines_of_ct = [iv]
for each_line in list_of_incoming_lines:
    b = each_line.encode('utf-8')
    lines_of_ct.append(encryptor.update(b))

try:
    with open(file + ".enc", "w") as enc:
        for each_line in lines_of_ct:
            print(each_line, file=enc)

My question is, how can I decrypt the file with the user entering a different password for read access (decryption). Is there a way to safely append the original encryption password/key to the file so I can retrieve it and use it? Like I have done with the IV, I attached that to the star


texts:
I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation.

When using AES-256-CBC on the two sides, it's important that the client's encrypt context and the server's decrypt context remain in sync. However, my protocol allows for rejection of messages if they fail an HMAC test.

If a message were to fail the HMAC test, then the two contexts fall out of sync because the state of the context was polluted by the garbage ciphertext. All subsequent decrypts will fail. Is there any way to rollback a decryption, i.e. bring it back to the state in which it was before the decrypt happened? Alternatively, is there any way to copy an decrypt context?

The same goes for the client when it receives word of the failure. It's going to want to roll back its encryption.

Should I use something other than CBC mode?


texts:
I try to learn ElGamal re-encrypts scheme and I have a question about the example: How is a re-encryption done with elGamal?.

The $g$ value of Alice must be the same as $g$ value of Bob or not?
And what about of Prime $p$ value for Alice and Bob? Alice.$p$ must be the same as Bob.$p$ or not?

Thanks!


texts: Does SRP reduce to DH key exchange when shared password is not secret?

texts:
I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later.

I would like to do key exchange under the assumption that I've already done mutual authentication (through some out of band user intervention). And I was wondering whether under these conditions I can use SRP with a non-secret password to do key exchange.

I would like to keep the client in JavaScript as simple as possible, and for SRP I only need a BigInt library, a hash function, and a cryptographically appropriate RNG. (DH wouldn't need the hash function, but I'll be needing SRP later for other stuff).

I'm trying to save myself the trouble of finding a good JavaScript implementation for DH or the danger of trying to write it myself.


texts: When would one prefer a proof of knowledge instead of a zero-knowledge proof?

texts:
I've just realized I find it hard to distinguish between these two terms (proof of knowledge, and zero-knowledge proof), specially where only the latter seems to be used in many cryptographic protocols.

Zero-knowledge proofs are usually defined as those methods by which the prover manages to prove to the verifier that a given statement is true, without revealing any additional information apart from the fact that the statement is true. For example, let's say I want to prove knowledge of the plaintext of some ciphertext I've generated, so that everyone can check that the plaintext is of a certain form (a value within a certain range, for instance). It seems clear to me that in this case I'd be interested in using a zero-knowledge proof, because I don't want anyone else learning what my plaintext was, or which random value I used to encrypt it (I'm assuming I used a public key encryption scheme).

On the other hand, proofs of knowledge seem to be just defined as those proofs in which the prover convinces a verifier that he/she knows something (without stating any constraint about what the verifier can or cannot learn from his interaction with the prover). From the definitions, these two terms seem to be pretty different. However, I find it hard to see in which context one would be interested in using just proofs of knowledge, instead of zero-knowledge proofs.


texts: Is Rabin's cryptosystem secure against known-plaintext attacks?

texts: I've bee learning about Rabin's cryptosystem, and I already know that Rabin's cryptosystem  is vulnerable to a chosen-ciphertext attack, but I was wondering, is it also vulnerable against known-plaintext attacks? I think it's not, but I'm not sure. I would appreciate if someone could clear this up for me.


texts: How does changing input size affect The Goldreich-Goldwasser-Micali Construction?

texts:
If we want to construct a PRF that is length preserving, it is easy to show with hybrid proof that the resulting construction is a PRF.

But what happens when we have longer input. Supose that the key and output length are $n$ and the input size is $2n$.

I have been imagining what could happen to the binary tree. I feel like since input is double the size it will go double the depth. But in this case I cant tell if the resulting construction is a PRF.

Any hint would be helpful!


texts: Is there a public key semantically secure cryptosystem for which one can prove in zero knowledge the equivalence of two plaintexts?

texts:
If Alice encrypts two messages $a$ and $b$, such that $x=E(a)$, $y=E(b)$. Can Alice prove (without revealing $a$, $b$ or the private key) that $a = b$?

Obviously the proof must not be too long and it should be practical to compute and verify (either interactively or non-interactively).

This is possible for the Pohlig-Hellman symmetric cipher, even if the ciphertexts are encrypted with different keys. But P-H is not public key.

If such a cryptosystem exists (and it is commutative or provides public re-encryption),  then one of the limitations in Mental Poker protocols could be solved. The problem is the existence (or not) of a protocol that can provide both semantic security and abrupt drop out tolerance (without any threshold scheme).
Edit: It seems that the encryption needs to be deterministic to be able to support drop-out tolerance, and I see no way to overcome this. Without determinism, I was only able to veto the cards of a single player from a new deck.

See What is the theoretical and practical status of mental poker? for a related question.


texts: Is this a valid real-time authentication scheme?

texts:
The scenario in Alice/Bob/Cindy terms:

Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she knows Cindy.

To prove that, Bob calls Cindy, who does know Bob, and asks for half of an asymmetric key pair. Bob then challenges Alice to encrypt a "secret" message (it's not shouted to the world, but it is transmitted in plaintext; it should therefore be cryptographically unpredictable). Alice calls Cindy, who really does know Alice, and Cindy gives Alice the other half of the key pair, which Alice uses to encrypt the secret message. Alice gives Bob the encrypted message, along with a message that she wants Bob to encrypt. Bob decrypts his message, gets the right answer, and is now convinced that Alice knows Cindy and is therefore to be trusted with the secret info. He then encrypts the message Alice gave him with his key, sends it back to Alice, and Alice decrypts it with hers to prove that Bob also really does know Cindy and isn't just taking what Alice says for granted. This happens without Alice or Bob having to tell each other how they know Cindy, and without Cindy having to know what secret messages Bob and Alice exchanged using the key. After this, the keys and secret messages can be discarded, and secure communication for the transfer of the secret information can be negotiated.

An attacker, Denise, impersonating Alice, would have to convince Cindy that she is in fact Alice, by speaking in Alice's voice and knowing things only Alice and Cindy would know. Or, Denise would have to have an accomplice, Emily, who would impersonate Cindy when talking to Bob.

In the real world, this would be an easy way for two programs who have authenticated with a central service to prove they have done so, without any knowledge about how that was done required to be shared.

The question is, is this viable, or is there a fundamental weakness in the scheme?


texts: Proof that MACing a hash of the message is also a secure MAC

texts:
I found a theorem that says:

Let $MAC = (S,V)$ be a MAC for short messages over $(K,M,T)$.
Let $H: M^{big} → M$.
Define $MAC^{big} = (S^{big},V^{big})$ over $(K,M^{big},T)$ as:
$S^{big}(k,m) = S(k,H(m))$ and $V^{big}(k,m,t) = V(k,H(m),t)$.

Theorem: If $MAC$ is a secure mac and $H$ is a collision-resistant hash function then $MAC^{big}$ is a secure MAC.

But I have not found the proof. How can we prove this fact?


texts: How does the round function in this particular Feistel cipher work?

texts:
I have this exercise that I found on the Internet. It is originally in French but it says:

  Exercise 3: (Feistel scheme). We consider a two-round Feistel cipher defined as follows:

  The length of the blocks is 8.
  The key $K = [k_1, ..., k_8]$ is of length 8. The two round keys are $K_1 = [k_1, ..., k_4]$ and $K_2 = [k_5, ..., k_8]$, where the $k_i$ are the bits of the key $K$.
  The function $V = f (U, U ')$ is defined by writing the bits $v_i$ of $V = [v_1, ..., v_4]$ as functions of $U = [u_1, u_2, u_3, u_4]$ and $U '= [u'_1, u'_2, u'_3, u'_4]$ as follows:

  $$\begin{aligned}
v_1 &= u_1 u'_4 ⊕ u_2 u'_3 ⊕ u_4 u'_3, \\
v_2 &= u_1 u'_2 ⊕ u_3 u'_1, \\
v_3 &= u_1 u'_4 ⊕ u_1 u'_3, \\
v_4 &= u_3 u'_3 ⊕ u_1 u'_1.
\end{aligned}$$

  Let the key be $$K = [1,0,1,1,0,0,1,0],$$ and let the message be $$M = [0,1,0,0,0,1,1,1].$$ Calculate the encryption of $M$ using the Feistel scheme above.
  Decrypt the message $C = [0,1,1,1,0,0,1,1]$ which was encrypted with the same key.

So my question is: I understood that $U$ is actually the right half of the plaintext and that $U'$ is actually $K_1$ in the first round and $K_2$ in the second. And I solved the exercise based on this understanding. But my teacher said that my understanding is wrong and that $U$ has to be the left half of the plaintext, while $U'$ is the right half of the plaintext. She means that the Feistel cipher is changed in this case. She added that her understanding is more logical and that mine could not even be considered as a possible one in this context. I think that if her understanding is logical and correct, mine is more so.

What do you think? I know this might seem like a trivial question but I really want to read other people's opinions and be convinced by the more logical understanding and explanation.


texts: Montgomery Ladder with affin/projective Coordinates

texts:
So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is.

With this Post i understood the basic affin arithmetic and Ladder.

So this is not really faster than arithmetic on common weierstrass equations. In the original Paper from Montgomery, he defined the projective arithmetic for adding and doubling.

My first questions are: Is the projective arithmetic faster because of not having a division? Does the ladder have constant time, because there is not division? Does that mean, that the ladder with affine coordinates don't have constant time? ( My idea is, that division in a field is a multiplication with a inverse. For calculating an inverse you need the euklidiean algorithm. This algorithms is not the fastest and can't be computed in constant time)

Then i was looking into the work of Bernstein. In this Paper and in his  Curve25519 he describes a optimized double and add formula. It looks like this:

When i get it right, you can use the montgomery ladder for affine coordinates with the affine arithmetic and for projective coordinates with the projective coordinates. So Bernstein made the shown graph for the projective montgomery ladder in order to give an optimized implementation, where already computed results are used again. So i tried to write the graph into Pseudocode:

R0 = (0,0)
R1 = (x,y)
x1 =
    for i from m downto 0 do:
        if xi = 0 then:
            x,z,x',z' =  R0[0], R0[1], R1[0], R1[1]
            tmp1, tmp2 = x, x'

            x,z,x',z' = (tmp1+z), (tmp1-z), (tmp1+z'), (tmp2-z')

            x',z',x,z = (z * x'), (x * z'), (x * x), (z*z)
            tmp1, tmp2 = x, x'

            x,z,x',z' = (tmp1+z), (tmp1-z), (tmp1+z'), (tmp2-z')

            z = z*( tmp1 + ((A-2)/4)*z )
            x' = x' * x'
            z' = z' * z' * x1

            R0[0], R0[1], R1[0], R1[1] = x, z, x' , z'
        else
            x,z,x',z' =  R1[0], R1[1], R0[0], R0[1]
            tmp1, tmp2 = x, x'

            x,z,x',z' = (tmp1+z), (tmp1-z), (tmp1+z'), (tmp2-z')

            x',z',x,z = (z * x'), (x * z'), (x * x), (z*z)
            tmp1, tmp2 = x, x'

            x,z,x',z' = (tmp1+z), (tmp1-z), (tmp1+z'), (tmp2-z')

            z = z*( tmp1 + ((A-2)/4)*z )
            x' = x' * x'
            z' = z' * z' * x1

            R0[0], R0[1], R1[0], R1[1] = x',z',x, z
return R0

That brings me to my next questions: Where is the x1 comming from, how is it calculated? I saw in his paper, that x1/z1 = X(Q - Q'), but it remains unclear how to substract those points.

Next question is: Is this peudocode logical correct ( at least everything except the x1)?

I hope this are not too many questions!


texts: Can homomorphic encryption be used to exchange keys?

texts:
Fully Homomorphic Encryption (FHE) allows computations be done on ciphertexts. Can this technique be used to exchange keys?

For example, Alice and Bob need to agree on a 4-bit secret key. Alice sends Bob 4 different strings, which are ciphertexts for 0001, 0010, 0100, 1000, respectively. Now Bob chooses the secret key 0101. He performs bitwise-or computation on the ciphertexts corresponding to 0100 and 0001, and sends the result back to Alice. Alice deciphers the result and gets 0101.

Would this scheme be secure? (Aside from the fact that secret keys are usually much longer)


texts:
I'm currently working on a secure open source messaging system (https://github.com/DSMNET/DSMNET). I'm currently using the cryptico.js (https://github.com/wwwtyro/cryptico) library to encrypt all the messages sent.

Now to authenticate users my server will send a random string and the client will encrypt the string and sign it. The server will check if the signature matches the public key stored for the user.
Users will generate their public and private key with their password.

I would like to know if using Javascript RSA and using RSA signatures to authenticate is safe or can people forge RSA signatures.


texts: Re-encryption without knowing the secret

texts:
Which encryption algorithms could be used for the following scenario?

A user stores a file encrypted by someone else
Then the user is asked to re-encrypt the file with a new secret
The user stays unaware about the clear text every moment

To achieve that the user can be provided with a kind of "diff" secret, I suppose. It may be a password based algorithm.


texts:
I am writing a toy1 transport protocol and I am trying to implement a feature whereby:

A 16-bit checksum is included in every packet.
This checksum can be extended to be 48-bit if the data is large, integrity is important, or whatever (creating this mostly for fun).
This checksum is intended to protect against errors, not a determined attacker.

My initial thought was to use a well known algorithm such as MD5/SHA2 and simply take the first/last 16/48 bits. This raises a few questions:

What are the consequences of simply taking a "substring" of a checksum? I assume, perhaps naively, that it would just increase the likelihood of a collision.
Is there any reason to prefer taking the last x bits instead of the first x bits, or vice versa?
When truncating a checksum like this, does SHA actually perform any better than MD5? Keeping in mind I am concerned with errors, not attackers.

[1] That is to say, I'm creating it for the purpose of learning. So "just use UDP" or "just use TCP" does apply, but that's why I'm not.

[2] Maybe use MD5 if it's 16-bit, SHA if it's 48-bit.


texts: Cracking passwords with more than 10 characters in a few hours?

texts:
I came across this article from 2 years ago: http://www.dailymail.co.uk/sciencetech/article-2331984/Think-strong-password-Hackers-crack-16-character-passwords-hour.html

They're describing how a team of "hackers" cracked passwords such as this "qeadzcwrsfxv1331" or this "Qbesancon321" in just a few hours. How is that even possible? I've seen before people describing passwords with 12 characters or more (16 in the above case) to take supposedly thousands of years to crack. What's going on in this case? Ok, so in this case the team had the hashed passwords available, but a 16 character password in a few hours?


texts: Byzantine agreement implies Broadcast channel [Consesus]

texts:
I am not sure if this is the right place to ask but I will give it a try. If not, let me know and I will ask somewhere else :)

We discussed the byzantine agreement and broadcast channel in class. We showed that broadcast implies byzantine agreement if $t < \frac{n}{2}$, where $t$ are dishonest parties and $n$ are the honest parties.

We designed a protocol for the byzantine agreement

All parties send input $p_i$ over broadcast channel
Parties output majority of received values

All parties receive same message $p_i$ via broadcast channel -> Majority is unique.

Now I have to show that byzantine implies broadcast. That means I have to design a broadcast protocol which uses Byzantine agreement as subroutine. At the end we have to explain why it satisfies the security properties of the broadcast channel.

I am stuck with designing the protocol. From what I understood is the byzantine agreement based on point-to-point channels. I had the idea to have it based on a PKI structure. Each sender owns the public key of the other parties, encrypts the message and sends it.

This would simulate a point-to-point channel, but on the other hand it means a lot calculation and time. Not sure if the last point is important to consider in this kind of view but I took it into consideration due to the "Termination" security property.

Would be nice if someone is able to help me.


texts: Lightweight primality certificates for untrusted DH parameters

texts: Are there any light-weight techniques to generate primality certificates for custom Diffie-Hellman parameters that could be sent to the client to allow it to verify primality without needing to run its own expensive rounds of primality testing? By lightweight, I mean not significantly harder than the recommended number of Miller-Rabin rounds on the generation side, and significantly less intensive during verification (after all, there's no point if it doesn't make life easier for the client).


texts: Is there such a thing as shortcutable key stretching?

texts:
I'm curious if there's a cryptographic (or mathematical) technique for key stretching that

allows someone with a secret to quickly derive the final key,
requires a deterministic number of rounds for stretching (ie is not probabilistic) for someone that does not have the secret.

Does such a thing exist?

For context, I think this would be useful for a regular pseudo-atomic information exchange. Two parties would encrypt the information they want to exchange each with a key they derive using a seed and an additional secret, exchange the encrypted info, exchange the seeds, then exchange the additional secret. That way, one party can't simply wait until they've received the other key to send their key - even if they delay the last step, the counter-party can still derive the key (tho it will take more time). And if they delay the second-to-last step, the counter-party will know they're not cooperating.


texts:
I have read that when a user contacts an entity like a bank, it creates a pre-master key and then selects a master key for subsequent communications.

  Can the lack of PFS, create a security flaw if the pre-master key and
  master key are random and different for each session?

  How can the knowledge of the private key help a hacker to decrypt old
  communications? Are the pre-master key and master keys stored on the
  server?

I have also read that just like PFS, it works by using an ephemeral/time-varying key.

  So can any key exchange/encryption algorithm, which ensures keys are
  discarded after each session, be regarded as a PFS system?

I am finding it hard to understand the differences.


texts: FFT multiplication for RLWE key exchange

texts:
I am try to multiply two  polynomial quotient ring of type $R=Z[x]/\phi(x) $ in sage using Fast Fourier Transform.:

a=Rq.random_element()
R. = PolynomialRing(GF(40961))  # Gaussian field of integers
Y. = R.quotient(X^(dimension) + 1)   # Cyclotomic field
ouput=Y(a)*Y(a)

I have found the following code on github to do this job but it is for simple polynomials and when I run this code for quotient polynomial, It give me following Type error


texts:
I am using DTLS 1.2 and my cipher is TLS_ECDHE_WITH_AES_128_GCM_SHA256

According to RFC 5246(RFC 5246 key calculation) i am calculating keys but i can not find the size of these keys in this RFC.

What is the size of following keys.

1- Client_Write_Mac_Key

2- Server_Write_Mac_Key

3- Client_Write_key

4- Server_Write_key

5- Client_Write_IV

6- Server_Write_IV


texts: Searching for a differential characteristic (differential cryptanalysis)

texts:
Currently I am doing some research on differential cryptanalysis. In general I got a good idea about the attack and how it is done.

I am currently talking about ciphers with multiple rounds. It seems that the success of a attack is depending on a good differential characteristic through the cipher. There are way which have good statistical values and some more which have not. In the paper there is often a good differential characteristic shown which works very well. But there is never a talk about how to find them. For sure I read about some heuristics like "look for differential characteristics with small amount of active sboxes" or something like that.

So my Question: How can I find a good differential or lets say, all? I am looking for a algorithm or a good description which I could implement on my own.


texts: I am developing internal standards for IPsec VPN setup on SonicWall firewalls, and I have been learning about IKEv2.  When IKEv2 "mode" is selected, the UI disables the DH Group, Encryption, and Authentication fields, and I can't find what values are used, anywhere in the documentation.  Does IKEv2 have some mechanism by which it negotiates those fields to the "highest common denominator"?  If not, I'll just call tech support on Monday.


texts: Decrypting files with an unknown method but a known result

texts:
I am assuming there is a very simple way of working this out by brute force, but I am not sure if there is a better way.

I have a file of data that I wish to get (my data, generated by a machine). This file is encrypted by some method that I have no details of (and the company has folded).
However, as well as the encrypted file I have an unencrypted file by the same machine for a different date range. Looking at the file it is easy to see that the encryption is in blocks of 8 bytes, as most of the header is zeros, so where the new file says 00 00 00 00 00 00 00 00 the old file says B5 B4 24 EF 45 BC 68 C5.

So I know what 8 0s are like, and 8 ffs and a few other items. I also know it is a block as a an area that is 7 0s and one digit is completely different.

Do I just assume it is RSA or something and make a brute force on the password?


texts: How is the usual way of using PKCS5/7 when a weird data is given?

texts:
PKCS5/7 pads the remaining data elements with a binary representation of how many space requires padding. This is useful and compact but what should I do in the following sample scenario below ?

Example:
Use case scenario is to use AES or any fixed length 128 bit block cipher to encrypt user supplied data where the user can have control over the bytes sent and not limited to any sort of language format (i.e. UTF-8).

The user send the following bytes 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 (16 pieces of 0x05 bytes) to be PKCS5/7 encoded before AES encrypted. The PKCS 5/7 encoder would not do anything since it has all 16 bytes (1 block size required by AES cipher).

When the user wants to decrypt the data, the AES decryption succeed but the PKCS5/7 padding engine see 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 (16 pieces of 0x05 bytes).

If 5 pieces of 0x05 bytes are removed and simply returns 11 pieces of 0x05 bytes, this will mean the original data which is 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 would be corrupted at the PKCS decoder level.

What is the best way to handle data arrays that have all the same elements in a PKCS5/7 padding scheme when decoding data ?


texts: Is it safe to use pairing-based cryptography in a commercial product?

texts: My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a commercial product?


texts:
The code

if(str1 == "abc") {}

can be converted to

if(hash(str1) == 0x8732e) {} // assume hash("abc") == 0x8732e

to obfuscate the code.

But they are not equivalent when hash collision occurs; e.g., another string xyz's hash value is the same as abc.

That is true theoretically. But is it an issue in real-life when the method above is used to obfuscate code? Is it a well accepted obfuscation method?

Edit: after a little research, I guess what I need is a one-way collision-free string transformation function, as I don't care the length of the output. Any suggestions? Any mature implementations?


texts:
I've read the Chapter "Randomness" from the Serious Cryptography book and it raised some questions. Namely:

It is written that Mersenne Twister is proved to be cryptographically irreliable. And that is it used by some languages, especially by Python. I have seen a lot of project with different languages when secure random stuff (like keys, token, sessions and so on) were generated just by taking random bits from a standard library.

I have not seen a situation when someone takes care of entropy level.

How to know that generating (pseudo) random keys is secure? Especially, I don't see implementation of pseudorandom generator that return error (for example when entropy is not sufficient). Could tell me something about my doubts and recommend me any book/article that covers that subject more specifically.


texts: Why a pseudorandom permutation is used in a simulation based proof but pseudorandom function is not?

texts:
In this paper:

https://eprint.iacr.org/2011/272.pdf

the authors use peudorandom permutation in the protocols and proof rather than pseudorandom function. On page 31 (last two lines) they say:

"We also note that for the purposes of the simulation, we need to use a pseudorandom permutation rather than any pseudorandom function."

Question: Why can we use pseudorandom permutation in the simulation but we cannot use pseudorandom function?


texts: Is there a format preserving cryptographically secure hash?

texts:
I want a way to 'scramble' strings (like words, names) in a predictable way but I don't ever want to (myself or anyone else) be able to 'unscramble' the strings.

I found that perhaps what I am looking for is a cryptographically secure hash.

But can it do these things

1 - preserve the length of the original string?

2 - preserve the format (keep numbers as numbers, or characters within certain ranges)

3 - Collision resistant

4 - Reusable for a finite length of time - like over a few minutes to a few months (i need to reuse the algorithm over and over so that a string 'scrambled' today will come out the exact same way in the future using the same algorithm)

EDIT:  The reason why I use the term cryptographically secure hash is that it is supposed to be 'practically impossible' to invert.  It is the impossible to invert feature that I am looking for. I do not care to recover the meaning or content of the original message. i.e. For example using encryption, I do not want someone to be able to determine a 'key' by analyzing the output message, or find patterns in the output message that would enable them to determine the input message.

I think the closest to what I seek is probably Format Preserving Encryption, however, the concern is the fact that the encryption is reversible.  I'm curious if it can be made irreversible. Then a hash came to mind.


texts: Integrity for mixture of encrypted/unencrypted database fields

texts:
I have multiple blobs each (symmetrically) encrypted with its own randomly generated key.

Now I want to encrypt these blob keys with user keys and store them in a database.

A table could have the following columns:

blob_id
user_id (unencrypted)
blob_key (encrypted with user key)
expiry (unencrypted)

Now I would like to ensure integrity and authenthicity of the unencrypted fields (for encrypted fields this is ensured using HMAC). Unencrypted data is quite short (in this case a key id and a date).

The use case is a large-scale E2EE encrypted cloud storage. So it should be massively scalable!

What is the best way to achieve this? Is it a good idea to use the same user key used for encryption also for signing the unencrypted fields? Which algorithm would you suggest for this type of data?


texts: Is there an encryption scheme that provides efficient homomorphic OR operations at the ciphertext space? Of course any fully homomorphic encryption can be used but I do not require or want additional homomorphic operations.


texts: Elliptic curve cryptography attack vector

texts:
I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" and afterwards I am still left wondering what the primary attack vector would be and also what can be done by an implementer to shore-up a weakness.

Is hashing of keys the main weakness or is it in the PRNG? At the end of the day I want to do what I can to prevent "anyone" from reading what Alice or Bob have communicated.

To summarize, what is the weak point in the algorithm and what can be done to minimize the effectiveness of an attack?


texts: Can I connect the hardness of a linear short integer solution problem to that of SIS problem?

texts:
As we know, SIS problem is defined as: for a function $f_A(s)$=$As$, where $A$ is a fixed, randomly-chosen matrix in $\mathbb{Z}_q^{r \times n}$, it is hard to find elements $s \in \mathbb{Z}_q^{n}$ with some bounded norm $||s||\leq B$ s.t. $f_A(s)$=0 for random $A$.

If I modify the above definition as follows: consider a function $f_A(\{s_i\})$=$\sum_{i=1}^{b} a_iAs_i$, where $a_i \in \mathbb{Z}_q$ are random and $b$ is an integer that is no larger than $|q|$, it is hard to find $\{s_i\} \in (\mathbb{Z}_q^{n})^{b}$ with bounded norm $||s_i||\leq B$ s.t. $f_A(\{s_i\})$=0 for random $A$ as chosen in the original SIS problem. Intuitively there seems to be a connection between these two problems. Can I reduce the hardness of this new problem to that of the aforementioned SIS problem? Thank you in advance.


texts:
While practically diving into collision resistance, I am trying to first write a non-cryptographic hash (to learn from it) which is limited to arithmetic operations on 32-bit integers only. It produces two 32-bit results similar to MurmurHash2_x86_64 (aka MurmurHash64B), but each have differing initial states and are mixed together more thoroughly (MurmurHash2_x86_64 only mixes at the end). Essentially I aim to produce a fast, well-distributed and collision-resistant 64-bit hash using two 32-bit states.

Trying to learn some things by looking at MurmurHash2_x86_64, I noticed that at first glance, it produces a 64-bit digest. But the author had this to say on the SMHasher wiki:

  MurmurHash2_x86_64 computes two 32-bit results in parallel and mixes them at the end, which is fast but means that collision resistance is only as good as a 32-bit hash. I suggest avoiding this variant.

Then I saw this exchange on the subject:

  Hacker News comment by martincmartin:
  Computing two 32-bit results in parallel and mixing them at the end does NOT mean collision resistance is only as good as a 32-bit hash. For that, you need to compute ONE 32-bit result, then transform it into a 64-bit result.

  Hacker News comment (reply) by finnw
  Depends whether the two 32-bit hashes are correlated with each other. If there is no correlation then a pair of 32-bit hashes is no more likely to collide than a single 64-bit hash. But this is difficult to achieve, and you should not assume (for example) running the same algorithm twice with different initial states will produce uncorrelated hashes.

This made me naively test MurmurHash2_x86_64 to find collisions in one 32-bit result, and I found that the second result had no collision. This confused me, because that seemed to be the very definition of collision resistance greater than what a 32-bit hash can provide… and it contradicted what Appleby said about his function.

This makes me ask:

How can two 32-bit results of a hash function correlate, or otherwise increase probability of collisions? Can the outputs from multiple functions correlate at all? And if, how could this weaken the collision resistance of their combination?
What can be done to avoid this situation, and to achieve the collision resistance of a 64-bit hash (or more) using multiple 32-bit results? Is there a way one can combine two correlated hash outputs to maximize the collision resistance?


texts: Which attacks can be avoided by the use of OFB instead of ECB?

texts:
For a file encryption program, I was told to use Output Feedback mode (OFB) instead of ECB (Electronic code book) mode.

Which attacks can I avoid by this choice?


texts: Prove that a given signature scheme is secure under random message attacks

texts:
This is a follow up to my previous question.
Consider the following signature scheme:

$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G \times G \rightarrow G_T$ where the common group order of $G$ and $G_T$ is a prime of bitlength $k$. Further, let $g$ generate $G$. Choose $\mathit{sk}$ randomly from $Z_p$ and $\mathit{pk} \leftarrow  g^{\mathit{sk}}$ and return $(\mathit{sk}; \mathit{pk})$.
$\operatorname{Sign} (\mathit{sk};m)$ : On input of a secret key $\mathit{sk}$ and a message $m$, output a signature $\sigma \leftarrow  m^{\mathit{sk}}$.
$\operatorname{Verify} (\mathit{pk}; m; \sigma)$ : On input of a public key $\mathit{pk}$, a message $m$ and a signature $\sigma$, return $1$ if the following holds and $0$ otherwise:
$$e(m; \mathit{pk}) = e(\sigma; g)$$

By the previous question I know that the above scheme is secure under no message attacks but insecure under chosen message attacks. Now I need to show that said scheme is secure under random message attacks or more formally that it has the property of Random Message Unforgeability Under Random Message Attacks (RUF-RMA).
I suppose that a good way to do that would be to do a reduction to the computational Diffie Hellmann assumption in symmetric bilinear groups (CDHSBG)
I am unsure how to do such a proof under random message attacks; the "randomness" that influences such an attack confuses me. Could you help me?


texts: Do hash functions need to "look random"?

texts:
I've noticed that looking random is not often listed as a requirement for a good hash function in the same way that preimage or collision resistance is.

Do we need hash functions to look random?

Specifically, suppose $s$ is a seed, and consider the PRNG that outputs $$H(s \|0)  \| H(s \|1 ) \| H(s \|2) \| ...$$

Do we need this to be indistinguishable from random?
Will any protocols be weakened if it wasn't?


texts:
Use the PBKDF2 output as an HMAC key, hashing two different inputs - once for 20 bytes and once for 12 :

using (var PBKDF2 = new Rfc2898DeriveBytes(passwordBytes, salt, 100000))
{
    HMACSHA1 hmac = new HMACSHA1(PBKDF2.GetBytes(20));
    hmac.Initialize();
    byte[] aesKey = hmac.ComputeHash(new byte[] { 1, 0, 1 })
        .Concat(hmac.ComputeHash(new byte[] { 1, 1, 1 })).Take(12).ToArray();
}

Or perform PBKDF2 twice, splitting the iterations, and using 2 different salts :

byte[] aes2;
using (var PBKDF2 = new Rfc2898DeriveBytes(passwordBytes, salt1, 50000))
    aes2 = PBKDF2.GetBytes(20);
using (var PBKDF2 = new Rfc2898DeriveBytes(passwordBytes, salt2, 50000))
    aes2 = aes2.Concat(PBKDF2.GetBytes(12)).ToArray();

References: Rfc2898DeriveBytes ,  HMACSHA1  .


texts: What is the difference between strong/weak alignment?

texts:
In this answer there is the mention of "weak alignment", followed by an indication that it is related to "resistance to truncated differential cryptanalysis".

What exactly is the difference between strong versus weak alignment?

How does it provide resistance to truncated differential cryptanalysis, and does it influence strength or weakness against any other techniques?

What ways can weak alignment be obtained? For example, is there a way to convert AES to have weak alignment (and would that be a good thing?)


texts:
I am attempting to understand how to use Montgomery multiplication in an RSA private key operation: $X \equiv a^{e} \pmod{n}$ where $a$ is the message, $e$ is the exponent, $n$ is the modulus.
Using the algorithm from Montgomery Reduction (with $r=2^k$, where $k$ is the bit length of modulus $n$):
ModExp(a; e; n) { n is an odd number }
Step 1. Compute n' using the extended Euclid algorithm.
Step 2. a_hat := a*r (mod n)
Step 3. x_hat := 1*r (mod n)
Step 4. for i = k-1 down to 0 do
Step 5.   x_hat := MonPro(x_hat; x_hat)
Step 6.   if e(i) = 1 then x_hat := MonPro(a_hat; x_hat)
Step 7. x := MonPro(x_hat; 1)
Step 8. return x

MonPro(a_hat;b_hat)
Step 1. t := a_hat*b_hat
Step 2. m := t*n' (mod r)
Step 3. u := (t + m*n)/r
Step 4. if u >= n then return u-n else return u

Now, the modulus $n$ will always be odd in RSA since it is generated from primes, which satisfies the first requirement. Also, from what I understand, in order for Montgomery form to be possible, the size of the base $a$ must be $a < n$. Fortunately, in RSA, this also holds true as the message/signature can't be longer than the modulus.
However, here's where I'm getting stuck. I am adding in hardware acceleration to a preexisting RSA library (mbedTLS) by replacing the modular exponentiations with an accelerated version. It's working great, so long as it's not using the Chinese Remainder Theorem. I don't entirely grasp CRT yet, but I understand that it allows us to perform faster decryption by splitting the message up into two operations and shrinking the modulus size:
$$ m_1 = (M^d \bmod N) \bmod p = ((M \bmod p)^{d \bmod p-1}) \bmod p $$
$$ m_2 = (M^d \bmod N) \bmod q = ((M \bmod q)^{d \bmod q-1}) \bmod q $$
Taken from: Chinese Remainder Theorem and RSA
The issue is, the message length is now longer than the modulus $p$ and $q$. So now, it would violate the requirement for Montgomery form that in $(aR)*mod(N)$, $a$ must be $a < N$.
I've searched all over for a method of doing Montgomery modular exponentiation in the case that the $a > N$, but they all state that the input $a$ is smaller than $N$. I can't seem to wrap my head around how you would perform a modexp using the Montgomery form with a larger input size than the modulus.
I was thinking maybe you could chunk $a$ into binary groups of $bitlen(N)$ with some sort of carry into the next group, but I can't figure out how you would mix in the inner loop that does the squaring. Would it be possible to modify it so that it becomes:
modexp(a[0:len(n)], e, n) ... modexp(a[len(n):len(a)], e, n)

And somehow combine those into an output that would be of len(n)? I'm really lost in understanding the mathematics behind it.


texts: Modular exponentiation with Chinese Remainder Theorem

texts:
I'm learning modular exponentiation with Chinese remainder theorem.

I found a great answer from below
How can I use eulers totient and the chinese remainder theorem for modular exponentiation?

But I can't understand the last step of construction from $C_p$ and $C_q$ very well. Can someone explain it to me? Moreover, if I make $N = 55 = 11 \times 5$ instead of $5 \times 11$, that last step fails to give correct answer.

The last step:
$$M^e \bmod{pq}= C_q+q((C_p−C_q) \bmod p)$$


texts: How do you interpret the p-values from the Dieharder testsuite to evaluate an RNG?

texts:
#=============================================================================#
#            dieharder version 3.31.1 Copyright 2003 Robert G. Brown          #
#=============================================================================#
   rng_name    |rands/second|   Seed   |
stdin_input_raw|  3.91e+06  |3556676169|
#=============================================================================#
        test_name   |ntup| tsamples |psamples|  p-value |Assessment
#=============================================================================#
   diehard_birthdays|   0|       100|    1000|0.04228375|  PASSED
      diehard_operm5|   0|   1000000|    1000|0.19715383|  PASSED
  diehard_rank_32x32|   0|     40000|    1000|0.46351097|  PASSED
    diehard_rank_6x8|   0|    100000|    1000|0.95836167|  PASSED
   diehard_bitstream|   0|   2097152|    1000|0.48181370|  PASSED
        diehard_opso|   0|   2097152|    1000|0.30244550|  PASSED
        diehard_oqso|   0|   2097152|    1000|0.94656094|  PASSED
         diehard_dna|   0|   2097152|    1000|0.02404047|  PASSED
diehard_count_1s_str|   0|    256000|    1000|0.45401565|  PASSED
diehard_count_1s_byt|   0|    256000|    1000|0.48456168|  PASSED

Feeding a stream of random numbers to the Dieharder testsuite invokes a list of tests. Each test returns a p-value. As I understand it, the p-value tells you the chance that the stream really is just random noise (or not noise). But I've read that a good RNG will have a range of p-values that follows a uniform distribution; values between 0 and 1 should happen with about equal probability. Why should that be so? Why is a uniform distribution desirable here, what does it mean, and how can you measure the "uniformity" of a distribution?


texts: Fiat-Shamir vs Common Reference String to make NIZK

texts:
I was introduced to NIZK from the notion of CRS: since we have a trusted CRS, then a prover can simulate a challenge by querying the CRS.

Similarly, the prover can simulate the challenge of a verifier by using the Fiat-Shamir heuristic.

Can someone explain if there is any relation between the two?
Are they two different methods or very similar?
Can we replace the oracle with a PRF and a CRS?

Sorry for the confusion, if someone can clarify the two models and also give me pointers would be really appreciated.


texts: What is the difference between PRF and a Random Oracle?

texts:
What is the difference between Pseudo Random Functions and Random Oracles?

Is the difference only about the domain of PRFs and Random Oracles, former having a fixed domain and latter can act on any input as long as it is well formatted?
Having a Random Oracle is a stronger assumption, why is that?


texts:
I can't find anything related on Google. I hope this is the correct site to ask this question.

I have been thinking about Randomness. Basically, generating randomness using a Computer Program. It is impossible without a source of randomness. The entropy of the numbers is limited to what the source provide and its reliability.

So you can't get random numbers out of thin air. Does this mean that randomness requires 'energy'?

Sure energy is not enough to get real random numbers but is it a requirement for getting them?


texts:
Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$.

Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ?


texts: How long does it take to brute force a Wordpress password?

texts:
I'm not a cryptograhpy expert, I am a web developer trying to determine the origin of a Wordpress blog hack, and how likely it is that it was brute forced.

The administrator account username had been changed from the default "admin" and the password was, I believe, 8-10 characters comprising mixed case alphanumeric characters and symbols (the password has since been changed and extended in length).

Out of curiosity, I was looking at sites which supposedly estimate how long it would take to crack passwords. Supposedly:

Example Password: Vr%*zSR7mb

Length: 10 characters
Character Combinations: 77
Calculations Per Second: 4 billion
Possible Combinations: 7 quintillion

58 years to crack

But what does this mean in real world terms?

The site seemed to have been hacked by a rival company with a terrible website and poor English, which I would guess originates from Eastern Europe, Africa or Asia (basically, not even a real rival but someone attempting to make business in the same industry). All they did was post 2 entries of poorly written content promoting their own site.

If it takes 58 years to brute force the password, it's obviously not feasible that the password was hacked with a brute force according to that estimate.

How many calculations can one computer make?
What kind of computing power does the average hacker have access to?
How is a hacker able to leverage the use of multiple machines?

If a rival wanted to hack a website, how easy is it for someone with little experience to download and use tools to brute force a password? How easy is it to pay someone cheap money in a poorer country to perform the hack for you?

The bottom line here is I feel like a brute force attack on what is a fairly useless blog, in order to post fairly useless content which probably won't yield any return at all, is not very likely.

The problem is I don't know enough about the reality of brute force attacks, and how easy they are to perform. If it's something anyone can quickly and simply run, within a short amount of time, then it sounds possible that's what happened. Otherwise, I would like to be able to rule out a brute force attack and look at more likely options such as someone's machine being compromised with a key logger.


texts: Decentralized / Distributed Private Key Generation between Untrusted Parties?

texts:
I found an interesting concept in this paper, page 13, (Link to the paper) called "Decentralized private key generation", as follows:

  "Decentralized private key generation – Multiple Enigma nodes locally
  create a segment of the key, whereas the full key is only ever
  assembled by the user. No trail of evidence is left anywhere."

I want to implement such an approach and I need to know the process step by step.

Assuming:

We have n untrusted parties in a network.
Parties are identified only their public keys.
The target is to generate a single new private key across these parties.
Only one of these parties eventually can access to this private key. We call this party as "winner".
This winner party will be selected by a random process.
This winner party will be selected as a "voter", such that any party holding that private key will be able to vote using this private key and the rest parties will accept this vote.
So, verifying this vote is crucial and the rest of parties will be only related public key of that private key.

Is this process possible using a distributed private key generation ? And if yes, what is the steps?

If you need any more detailed information about the scenario, please let me know.


texts:
Design, Analysis and Application of Embedded Resistive RAM-based Strong Arbiter PUF

Can anyone explain the Global column and Local Column and the fig.5(a) and how MUX logic is related to fig. 5(a) and how the formula for the configurable stage in Table 2 is related to fig.6.


texts:
Protocols that use $\mathbb{Z}_{p}^*$ arithmetic often choose $p$ to be a safe prime ($p = 2q + 1$, for prime $q$) or to have the Schnorr group form ($p = rq + 1$, for prime $q$). I understand that the reason for this is to  prevent the Pohlig–Hellman algorithm.

It appears that both are safe as long as $q$ is big enough. However, from what I've seen, safe primes are commonly used for Diffie-Hellman, while Schnorr group primes are used for DSA. (For example, the dhparam and dsaparam OpenSSL commands).

My question is: what is the reason for that? I see that Schnorr group primes are more efficient, since $q$ is smaller, making exponentiations faster. But if that is the case, why it seems to be avoided in Diffie-Hellman? Is it safe to use Diffie-Hellman with Schnorr group primes, or DSA with safe primes?

(This question is partially included in ElGamal and Schnorr groups, but was not answered there)


texts: What is the motivation behind Key-policy Attribute-based Encryption?

texts:
What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are.

My question is: what is the motivation/analogy behind Key-policy Attribute-based Encryption?

CPABE can be regarded as a variant of Attribute-based Access Control (ABAC) which is a well understood technique. What would be the KPABE equivalent, if there is one?

My take for an example key policy

$$(\text{Student}\wedge\text{Course}_A)\vee\text{Staff}$$

would be that $\text{Student}\wedge\text{Course}_A$ and $\text{Staff}$ can be seen as roles (RBAC) which will be activated through the attributes in the ciphertext. Is this an accurate analogy? Can you come up with a better one?


texts: Given an AES key that is wrapped using another AES key, the second one being generated using PBKDF2, and given that I know the wrapped key: can I derive the passphrase that went into the PBKDF2? (asking for a friend)


texts: Is there a lower cost cryptography than elliptic-curves based cryptography?

texts:
ECC requires less CPU power, less memory and shorter keys than RSA or any other asymmetric cryptography I came across in the literature (correct me if I am wrong).

Is there a lower cost asymmetric cryptography than elliptic-curves based cryptography?


texts: Proper way of encrypting large files with AES-256-GCM

texts:
I would like to encrypt and decrypt files with AES-256-GCM. I need a solution that works with Java, PHP and JavaScript. In practice, users can upload, download files via web browser and/or desktop app and there are files that will be generated by the server itself. (I'm currently using openSSL, but I'm thinking of switching to Sodium). I have a working solution already that works fine using relatively small files (<100MB).
However, I am concerned about memory usage for large files (like videos, disk images).
I found a couple of implementations where file chunks are used. (The resources I found were not specifically security-related sites.)
The concept is:

Read 1MB from the original file
Generate an IV
Encrypt the chunk
Save the IV, ciphertext, and tag to the output file
Repeat until the end of the file

The IV is always 12 byte and the tag is always 16 byte so it is not very difficult to implement it.
The solution works, but the real question is, is this solution good from a security standpoint or should something else be used?


texts: Reference for the Security Analysis of Ring-LWE

texts: Can someone please share a link of any research paper or web-page analyzing the security of Ring-LWE? Essentially, how should I choose my parameters to get security equivalent to 128-bit or 256-bit?


texts: NIST Standard for Advanced Encryption Standard Algorithm

texts:
Possible Duplicate:
  Advantage of AES(Rijndael) over Twofish and Serpent

What is the reason of NIST why Rijndael choose as the Advanced Encryption Standard


texts: How to add ciphered numbers under benaloh's scheme?

texts:
In the answer for Is it possible to subtract/multiply numbers using homomorphic encryption? it says:

To add two encrypted numbers, one could use Benaloh, Damgård–Jurik, or several other known partially homomorphic cryptosystems. (Many of these "addition-only" cryptosystems can also be tweaked to support subtraction.

But I couldn't write down a way to sum two ciphered numbers with Benaloh's scheme neither find the mathematics for this on the forum.
So, how to sum numbers ciphered under benaloh's scheme without decrypting them?


texts: Bleichenbacher RSA1024 signature forgery, closed-form solution

texts: Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of the equation 2^1009 is not a perfect cube. I ended up forging a signature by simply constructing a desired number and taking cube root of it. But I'm curious, is it possible to come up with a clean formula, as in the case of RSA3072?


texts: PKI Validation - Usefulness of the public key with the identity certificate

texts:
I have some understanding of how PKI works, similar to this:
- https://knowledge.digicert.com/solution/SO16297.html
- https://security.stackexchange.com/questions/59566/ssl-certificate-chain-verification
- https://security.stackexchange.com/questions/56389/ssl-certificate-framework-101-how-does-the-browser-actually-verify-the-validity

What isn't obvious to me is how the public key at the end of the chain, or the identity certificate is used. Previously RSA may have been used for encryption, or as the key exchange for a symmetric cipher key, however ECDHE appears to be the modern primitive for key exchange.

My guess is the certificate is also signed by itself, along with the intermediates and roots in the chain. This would make sense to me since in my mind anyone would be able to use the cert in various ways, however if signed with the private key of the identity it's an extra check. Other wise I would see the identity private key as being pretty useless.

Most explanations are very simple with how a chain is evaluated and I'd like some detail.

So my question - is an identity certificate also signed by itself? Does my logic above stand up?


texts: Exchanging encrypted messages, and decrypting without a public key?

texts:
I know very little about encryption, but I was hoping someone could shed light on this cipher text exchange scheme I worked out in my head this morning:

Bob wants to send Alice a message but doesn't want anyone in the middle to discover what the message is.

We'll call the message $p$ and encode it as a number. This is how it goes; Bob chooses a random but secret number $x$. He calculates $p \times x = c$ and sends his cipher text $c$ to Alice.  Alice then chooses a random but secret number $a$. She calculates $a \times c = q$ and then sends $q$ back over to Bob.  Bob does $q / x = f$ and sends it back to Alice.  Alice then does $f / a = p$.

Sorry if it makes no sense, but what kind of encryption is this called when there's no public key yet a message is transferred encrypted and deciphered without any secret passwords being exchanged?


texts: Choosing between hash functions instead of providing a salt for a password hash

texts:
I am working on some programs that require the users to store their passwords in my databases.

However, due to the fact that I am not sure whether salt should be stored in databases due to my approach:

(1. I am able to create a random string with the help of ASCII table)

(2. I am able to create a unique ID like a random string similar to the User's UUID under Google Firebase)

Here's my approach, the users are required to enter a "Security_String".

The allowed format only employs numbers from 1 to 5.

1 represents SHA-1

2 represents SHA-224

3 represents SHA-256

4 represents SHA-384

5 represents SHA-512

After I collect both Security_String and Password from the users, then Password undergoes a series of hashing loops based on the Security_String.

In this case, will the generated hashed password be considered safe enough? Or is it better to generate a hash password with salt by using my approach?

Also, is it better if I add another spicy ingredient called pepper during the hashing process?


texts: If you know the messages, and the results of HMAC(key, message) can you find the key?

texts: If the attacker has 1 billion 4KB (random-noise) messages and sha256-HMACs for those messages (all using the same key), can they calculate the key that was used, before the universe dies?


texts: Why RSA must make sure that $\gcd(e,\varphi(n)) = 1$ instead of $\gcd(e,n) = 1$?

texts: By Euler's theorem, if $\gcd(e,n) = 1$, then $e^{\varphi(n)} \equiv 1 \pmod n$. But why does RSA need to make sure that $\gcd(e,\varphi(n)) = 1$?


texts: Existence of MAC implies existence of OWF

texts:
I'm having trouble understanding how the existence of a MAC implies the existence of an OWF.

If the MAC protocol is $(\operatorname{Gen}, \operatorname{MAC}, \operatorname{Ver})$ such that for any adversary $\mathcal{A}$,

\begin{gather*}
\underset{k \sim \operatorname{Gen}(1^n)}\Pr[\operatorname{Ver}(k, \operatorname{MAC}(k, m)) = m] = 1, \qquad\text{and} \\
\underset{k \sim \operatorname{Gen}(1^n)}\Pr[\mathcal{A}(1^n) = (m,t) \mathrel{\text{such that}} \operatorname{MAC}(k, m) = t] < \text{negligible}.
\end{gather*}

I am imagining the OWF I would construct to look something like $f(x) = \operatorname{MAC}(x, 0)$. If an adversary can invert $f$, then given the 'tag' $t$ of the zero string they are likely to be able to find some key $k$ such that $\operatorname{MAC}(k, 0) = t$. They could then break the security property of the MAC by using $k$ to forge new messages.

The problem I am running into is: just because inverting $f$ gives some key $k$ where $\operatorname{MAC}(k,0) = t$, it isn't necessarily the same with the challenger used, and may just happen to have the same tag at 0. How can I get around this?


texts:
I am writing an application using JSON Web Encryption with ECDH using the X25519 Curve. The RFC says that ECHD-ES derived secret is run through a Concat KDF.
Given that many cryptographers seem to be bashing JWT and the JOSE standard for having too many options to shoot yourself in the foot I want to make sure I am not using an insecure mode of JWE.
RFC 7518 JSON Web Algorithms (JWA) states

Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES)
This section defines the specifics of key agreement with Elliptic
Curve Diffie-Hellman Ephemeral Static [RFC6090], in combination with
the Concat KDF, as defined in Section 5.8.1 of [NIST.800-56A].

Following the reference leads to 152 page NIST PDF that I don't fully understand. I am a developer not a cryptographer. I am using the Nimbus JOSE library in my application and it has an implementation of ContcatKDF.java derive function there.
Questions:

How does Contcat KDF work?
Is it considered secure?

It derive function gets called with SHA-256 as the hash function concatKDF = new ConcatKDF("SHA-256"); from ECDHCryptoProvider.java which computes the number of cycles using this.
Moderator note: crypto-SE is not a code review site. The code was replaced by links to the code. It's still here if needed.


texts: How secure would AES be with all round keys equal?

texts:
In effect the same 128 bit key is XORed at every round and before and after as whitening.

Would it be 2^128?

What are the dangers of such a naive key schedule and does AES suffer from them?

Edit: Fair enough, slide attack is a problem. It doesn't explain however why there is a key schedule instead of round constants.


texts: Implementing Secure multi-party computation for online website

texts:
I need to know if the following is feasible:
I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the two users.

I understand that the private key can be divided into 3 parts such that two of them can generate the full key using "Shamir's Secret Sharing" , however I want to know if it is possible to independently generate and distribute the key parts to each party, so that the users do not need to fear that the website or other user may have the private key.

I think it may be possible using multi-party computation but could not find any such implementation.

Thanks


texts: Why not use an algorithm's code rather than data itself for one time pads?

texts:
Instead of using actual data for one time pads, what would be different if the code for an algorithm was exchanged so that to acquire the pad one would execute the algorithm and use its output?  Why is this not being used?

An algorithm would be much shorter and could generate a significant amount of chaotic information.  There are so many examples of deterministic unpredictability from fractals (discrete maps) to cellular automata to irrational digit sequences (differential equation zeros?) to CPU floating point operations to modular exponentiation.  And many ways of combining these into more feedback loops.

Even if the output is not as cryptographically strong, aren't there deterministic operations that can ensure a certain level of strength?  And couldn't a computer conceivably do the work of trying long and complex combinations of chaotic algorithms and classes of initial values until an algorithm does produce strong pads to settle on the pad you will use?  There would be no point in an attacker guessing at the probability of kinds of initial values if he doesn't even know the combination algorithm used to generate the pad.  It seems that there would even be safety from guessing from the code length and execution time, even if not padded.


texts: Pratical implementation of a Sibling Intractable Function

texts:
I have seen in several places the statement "k-SIFF can be constructed from any one-way function", but I cannot understand how this is realized in practice?

For instance, in
Sibling Intractable Function Families
and Their Applications, Theorem 2.


texts:
I have clients sending data to a server.  The data is not encrypted, but that's OK.  I want to make sure the server only accepts data from authorized clients.

The server knows all of the clients' passwords.  The clients generate a fairly random string (the first 6 characters of a UUID, gotten through the Python uuid.uuid4() function).  They do md5(random_string + password), and send this and the random string along with their data.  The server takes the random string, the password, and does the md5 itself to verify that the client does indeed know the password.

Is this home-made system adequate?  Again, I just want clients to be verified, I'm  not worried about encryption of the data.


texts: Simple question about the branch number of the matrix

texts:
what is the branch number of the binary identity matrix?

For example, $ I $ is 4x4 binary identity matrix,

\begin{pmatrix}
1 & 0 & 0 & 0 \\
0 & 1 & 0 & 0 \\
0 & 0 & 1 & 0 \\
0 & 0 & 0 & 1
\end{pmatrix}

Here, the branch number is $min_x ( wt(x)+wt(Ix))=2 $.
Is that correct?


texts: Is there a type of asymmetric and symmetric encryption that's fairly easy to crack?

texts:
I'm looking for a type of asymmetric and symmetric encryption that I can crack fairly easily for a school project. I'm looking to compare the difference between asymmetric and symmetric encryption. I have a VPS with (I 8GB of RAM and an Intel Xeon if that helps.

Preferably it should take no more than 8-10 hours to crack.


texts: identify PK in ring signatures by using (t,n)-threshold

texts:
Consider a group of $n$ public keys $pk_1,...,pk_n$ with corresponding secret keys $sk_1,...,sk_n$.
I'm looking for a cryptographic primitive with the following properties:

Ring signature property.
It allows the owner of a secret key $sk_i$ to digitally sign a message in anonymous way i.e., any one validating the signature can know it validly signed by one of $pk_1,...,pk_n$ and no additional information is known about the signer.

$(t,n)$-threshold revealing.
Any group of $t$ different secret key holders out of the group of $n$ holders can collaborate and reveal who is the true signer.

No trusted setup.
The third property is not strict and can be relaxed.

Does anyone knows anything that may fit this properties?


texts:
The Stanford license for SRP says:

  Broader use of the SRP authentication technology, such as variants
  incorporating the use of an explicit server secret (SRP-Z), may
  require a license;

Yet I cannot find a succinct description of the SRP-Z protocol and why it might be useful. As a follow up question assuming it is useful and patented when does the patent expire?


texts:
I started a new lecture this year about crypto and I've had a few problems in the first few weeks with the exercises we got.

I would appreciate a "guide" on how to solve problems like the following one because I feel like it will haunt me later in the semester if I don't figure it out now. Please don't simply post a solution, I need to figure this one out myself.

  Let $F : \{0, 1\}^n × \{0, 1\}^n → \{0, 1\}^n$ be a pseudorandom function. Prove or disprove that this is also a secure pseudorandom function:
  $$F'(x) := F(x ⊕ 1^n)$$


texts: ElGamal digital signature. why mod p-1 in delta?

texts:
Im trying to figure out why $\delta$ in the signature part of ElGamal has mod $p-1$ when $\gamma$ has mod $p$?

$\gamma = \alpha^k \mod p$

$\delta = (x-a\gamma)k^{-1} \mod p-1$


texts: How to calculate plaintext from modpower cipher

texts:
Let $a$ be the plaintext message, $e$ be a small prime exponent (such as 11, 13, 17 etc.), $b$ be cipher text and $n$ be a large modulo (non-prime).
Suppose that:
$b \equiv a^e \space mod \space n$
If we know $b$, $e$ and $n$, can we possibly calculate $a$?


texts: How to construct a next bit predictor from a distinguisher

texts:
I read the claim, without proof, that it is possible to construct a next bit predictor for any PRNG given an oracle distinguisher for that PRNG and vice versa. How do I prove that?

A distinguisher takes a bitstring and tells you if it was generated by the PRNG or not.
A next bit predictor takes a bitstring and tells you what the PRNG would output next.

My own idea for distinguisher to predictor is as follows: Let s be the bitstring generated so far by the PRNG. I will ask the distinguisher if s||1 or s||0 (s appended a 0 or 1) is a string generated by the PRNG. I will then take the one where the distinguisher says its coming from the PRNG.

My idea for predictor to distinguisher is: Take s without the last bit and predict the next bit for this. If it matches s came from the PRNG.

If the distinguisher/predictor is only right with some probability, the first case gets an unusable case where the distinguisher outputs the same thing for s||0 and s||1, but that won't always happen. The second case stays the same.

Can I prove the above claim in that way, i.e. is what I am saying correct?
Google doesn't really help here.


texts: How to pick up random number within range using pseudo-random number sequence

texts:
I want to generate PRP using Fisher–Yates shuffle for array  [1,2,3,4,5,6,7,8,9,10,11,12].

I implemented NLFSR_25bit  with specific seed for PRNG. (for picking up pseudo-random number in every iteration of algorithm )

Fisher–Yates takes pseudo-random number from interval(i.e (1,i) in every iteration of algorithm ) How can i pick up pseudo-random number from interval? (while my PRNG generate a sequence but not a number)

Beacuse my numbers are [1 , ..., 12] i want to use 4_bit lsb of  NLFSR_25bit and then compute 4_bit_lsb%12 for getting number between (1,12)

I would also appreciate other solutions.


texts: What is the point of using a cryptographic sequence number if you're not using it as a nonce?

texts:
OSPF features the use of Auth Crypto Sequence Number however, from reading the RFC it would appear the sequence number is not being used as a nonce.

  In addition, a non-decreasing sequence number is included in
  each OSPF protocol packet to protect against replay attacks.
  This provides long term protection; however, it is still
  possible to replay an OSPF packet until the sequence number
  changes. - OSPF MD5 Authentication Draft II

Correct me if I am wrong but isn't the whole point of a cryptographic sequence number to protect against replay attacks? If so, why would you not use a nonce? Is there any benefit to this? Or is this just a weakness which was never improved upon?

I'm also struggling to make the distinction of "in the long term less of an issue" - how does that even make sense?


texts: Does RSA key transmit with OAEP insecure?

texts:
In the Key encapsulation article of Wikipedia, the RSA-KEM is described shortly, as follows;

Generate a random element $1<m<n$ then drive your symmetric key by  $M=\text{KDF}(m)$
Then compute the ciphertext and transmit $c \equiv m^e \pmod{n}$
The reciever decrypts $m \equiv c^d \pmod{n}$ and apply $M=\text{KDF}(m)$ to derive the key.

Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack?

Now at the end the document it says;

  An attacker who somehow recovers $M$ cannot get the plaintext $m$. With the padding approach, he can.

Q2: How can the attacker recover the $M$ while there is formal proof of OAEP.


texts:
I am struggling with these two cipher texts, I cannot identify which king of cipher was used.
First:
otnpeetrnneepeufofutisrtrllohcdmetoeheeatyngonrmrm
And second:
mvevgpwosytaeeisvcgofotbisfnoamtersmeslykuoakaypep


texts: Is message integrity possible without confidentiality? Are there any mainstream protocols?

texts: I understand that many schemes that provide data integrity involve a hash-then-encrypt approach. I was wondering if data integrity is achievable without confidentiality? Are there any mainstream protocols for this?


texts:
I am trying to figure out how the HMAC SHA-256 hashing algorithm works. I know that we have to use the following:

H (K ^ opad)|| H ((K ^ ipad)|| text)).

The problem that I am facing is I think of basic understanding of the above. As far as I know, SHA-256 takes in “character input”. The key that I am using is of 256 bits in size and that leads (K^ipad) to be a 512 bit number. How do I use that to get the desired hash?


texts: Interesting implementation practices in popular crypto library

texts:
So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone learning programming. They took 80 lines of code of what could have been easily done using an array and iteration. Looking up other implementations I found this unofficial one, which does use iteration. Looking at other they all choose to do this portion using a loop. But these are not the official ones. So why doesn't the official one use the more terse, but equivalent way?

My question really is, is there some security benefit to doing things without an extra array and loop? Is it speed? Is there some attack when you have an extra array and loop?


texts:
Let's say that you have a symmetric cipher which takes in an 8 bit plain text value and a key, and generates cipher text which can be decoded using the key to get the original plain text value.

Since this is just an 8 bit plain text value, versus say some text document in english (or other source material where the format is known), if the cipher is based on common modern day crypto techniques, what avenues would likely be available to an attacker to know what the plain text value (or key) was?

As an extension to the above, let's say that the cipher text of that 8 bit plain text value was encrypted such that when using key $k_0$ the cipher text would decrypt to the value $0$, using key $k_1$ the cipher text would decrypt to the value $1$ and so on up to key $k_{255}$ which would cause the cipher text to be decoded to the value $255$.  Since the ACTUAL meaning of the cipher text was completely ambiguous, would this thwart any abilities to analyze what key and plain text value were actually used?

I know that creating such a cipher text would be more time consuming and probably result in a larger cipher text as well as larger key(s).  It may also not seem useful to completely ambiguously encode data this way, but I'm curious if it removes any attack surfaces.  It also seems like it could be useful to semi-ambiguate cipher text for a smaller set than "all possible inputs" to perhaps lessen the above attack surface by having multiple answers to a correct decoding.

Thanks!


texts: What are the differences between collision attack and birthday attack?

texts:
From my understanding both types of attack, collision and birthday, are based on the principle of two randomly/pseudo-randomly chosen plaintext to hash to the same value. I don't want to launch any biased supposition, but aren't they the same?

From Collision attack wikipedia article I learned that  every cryptographic hash function is inherently vulnerable to collisions using a birthday attack but in the Birthday attack article it is stated that the attack depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations, thus birthday attack only has this permutation plus?


texts: Is it insecure using addition instead of multiplication in Elgamal encryption?

texts:
I am wondering why most textbook only explain Elgamal encryption using multiplication operation, i.e. $c = m\cdot g^{ab} \pmod p$ instead of addition modulo $p$, i.e. $c = m + g^{ab} \pmod p$?

Is there any flaws or insecurity for the addition version of ElGamal encryption?


texts:
I've looked in many places (NIST, text books, online resources) and I cannot find an answer to the definition of the term "key" from a semantic point of view.

Is it the "key" to cipher-texts (i.e. like a door key to lock/unlock), or is the the "key" to the algorithm (i.e. a crucial factor to make it work, like a keystone)?

I was taught that it was the latter, but I cannot find proof either way. I can understand if the difference is too minor to discuss, but I was wondering if the original intent of the term is known.

Edit:

To further clarify how I understand the semantics: because the key is required for the algorithm to function at all, the key is 'meant' for the algorithm (e.g. a keystone for an arch or a punch card for a IBM computer) the term 'key' is meant as an enabler for a process, not as a lock/unlocker for a secret. This is especially true because cryptographic keys can be used for algorithms that do not 'hide' or 'protect' data.


texts: Can homomorphic encryption offer program integrity and program obfuscation?

texts:
By program integrity, I mean the (encrypted) result I receive is indeed the expected result and not, say, an intermediate result or a result affected by an adversary. Can homomorphic encryption defend against active attacks?

By program obfuscation, I mean the adversary not being able to infer what operations are performed (data access patterns aside).


texts:
I need an advice:

I found a paper describing an authentication exchange using a PSK done in this way:

A    --->    B

"A" and "B" have a common PSK.

"A" extracts a random number and then send 2 values to "B"

Value1:   hash( "TAG" XOR "PSK|RANDOM NUMBER" )
Value2:         "RANDOM NUMBER" XOR "PSK"

So, V1 is a hash on an XOR between a TAG (identifier known by the two endpoints) and the PSK appended to the random number.
V2 is the XOR between the random number and PSK.

To verify this, "B" extracts the random number from V2 (knowing the PSK) and then compute the same
HASH, with the same TAG. If this matches, the authentication is OK.
Now, I'd like to remove the TAG from the picture here (since I actually don't need this value and probably it
was introduced in the original algorithm to identify the destination of the communication).
So at the end, I'll have a hash on PSK|RANDOM NUMBER, leaving out the TAG.

Do you think that doing this is breaking or weakening the robustness of the algo?

The paper I found is https://www.researchgate.net/publication/328429210_Survey_on_Prominent_RFID_Authentication_Protocols_for_Passive_Tags

Page 10 describes the auth protocol.

Thanks for your help, and sorry if I was not clear enough in my explanation.


texts: If finding a private key from a public key is [co-]NP-complete, does NP=co-NP?

texts:
In a given public key cryptosystem, if the problem of determining the private key from the public key is NP-complete or co-NP-complete, does that imply that NP = co-NP?

Complexity theory is definitely not my specialty.  I ask because from what I read that it seems that this would be the case (informally):

Determining the private key from the public key can be converted to a decision problem by asking whether a given bit of the private key is $1$.  The complement of this problem is then asking whether a given bit is not $1$ (that is, $0$).  For both problems, the entire private key is a certificate.  Clearly they are polynomial-time reducible to each other.

If either decision problem were NP-complete or co-NP-complete, wouldn't that imply NP = co-NP?


texts: How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

texts:
I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original password to the attacker except for the size of password. My solution now is to extend each password to 512 bits using constant pattern.

How secure is this against brute-force attack when attacker has t-1 shares and knows the stretching pattern? Is there any better way to obfuscate the original password size? Would it be better to encrypt the password with symmetric cipher let's say AES256-CTR and random key K and then split that key with SSS algorithm?


texts: How is RSA able to prevent brute forcing using the public key?

texts:
Bob calculates a private and public key.

Bob sends his public key to John.

Jeff is a third party unwanted member and manages to snatch the public key mid-transfer.

John encrypts his message and sends it to Bob.

Jeff again is able to steal this encrypted message for himself.

Bob can decrypt the message with his private key.

But what about Jeff? So he can't decrypt using the one-way key. But what if he brutes it? So for example John's original value was 2 and the encrypted value is now let's say 200. Jeff can now just count upwards from 1 and encrypt all values with the public key until it matches the value of 200. He finds 2 matches that. So now he has the original value.

I know it's not that simple and easy and it might not even work at all on a real RSA standard but I want to know what the procedure is for stopping this sort of attack.


texts: Decryption and Hashing in random order of a file

texts:
I have a requirement where an encrypted file is read in random order of 32k chunks and decrypted and final content hash is computed. This hash should match the original content of file.

I need this as while I am reading file from source I want decryption and hash computation to happen, else I will have to write all the contents and then decrypt and compute hash, which will require two pass/(read/write) of file.

I believe AES stream mode would help in random order decryption, I have to try this though, but I am not sure about which hash function would help here, if its possible to compute any hash reading data in random chunks.

Any pointers would be of great help.
Thanks for time.


texts: Clarification on the state of the art of qubit commitment

texts:
What is the current state of research on quibit commitment?

It seems that the answer is not 2001 but it seems to me that a lot of these pdf are referring to a old protocols of quantum bit commitment 1997, where the impossibility of that scheme has been proved for a unconditionally (or perfect) security of qubit commitment.
Other sources, such ash 2012 propose a practical version of qubit commitment which employs another protocol, and shows that qubit commitment can be indeed practically secure.

I have found 2015 (last update of the page) these sentence that might be what I was definitely looking for:

  Bit commitment can be realized classically in an computationally
  secure sense. More precisely, the protocols are either computationally
  hiding (in which case it is only computationally secure from Alice's
  point of view) or computationally binding (computationally secure from
  Bob's point of view). Moreover, it is not hard to prove that
  information-theoretically secure bit commitment protocols cannot exist
  classically. Interestingly, it could be shown that the same is true if
  we allow Alice and Bob to use quantum mechanics.

And what about string commitment? For what I got, It's a way of committing multiple qubits together in order to achieve a commitment that increases with the number of qubits committed in the strings. But it seems that also string commitment is impossible as well. 2005

So is the research on this topic finished? Is there anything to do on the topic of qubit commitment? Does protocol can commit only z-basis states (such as 0 or 1) or are they able to commit a full qubit (such as any superposition of states).


texts: Why Bulletproofs protocol needs to raise $u$ to power $x$ in Protocol 1?

texts:
The paper on the Bulletproofs Zero-Knowledge proof protocol states in paragraph 3:

  In Protocol 1 the element $u$ is raised to a verifier chosen power $x$ to ensure that the extracted vectors $a, b$ from Protocol 2 satisfy $\langle a, b\rangle =c$.

I can't make sense of this.

I guess it is because the scalar $u$ is not given in the relation, thus the value $P'$ can be computed incorrectly. Am I right?

Also I wonder assuming $u$ is public and given in the corresponding relation, if we can omit this step and directly run Protocol 2?


texts: Msieve & Yafu - RSA Exponents and bruteforcing

texts:
I am a layman in regards to the math behind RSA (and in general, relatively), and my goal is to bruteforce a large quantity of 512-bit RSA keys. Having searched around, I see that msieve, yafu, and an Amazon FaaS (Factoring as a Service) program are the main candidates, however, cracking the keys with Amazon would be impractical cost-wise, and the keys I would like to crack (for a long-shutdown videogame I'll specify, nothing malicious), have an exponent of 17.

In short, I would like to know...

If specifying the exponent alongside the modulus is needed, and if so, how to actually specify the exponent (preferably with msieve, since according to this it's the only algorithm proven to crack a key of this size) as there seems to be no option for that (msieve version 1.53).
Whether having multiple computers/CPU cores would speed this proccess up, and how to use them if possible (this and the msieve readme seem to imply this is the case). I'm also a bit curious as to how it's done in a mere few hours via Amazon despite the above programs being single-threaded.


texts: AES-GCM recommended IV size: Why 12 bytes?

texts:
When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.

Let's assume a shorter IV is bad. Assuming all other constraints for IV generation are still met, would using a longer IV necessarily have a negative security impact, or severe performance impact without adding any security benefit?

For instance, an answer in Ciphertext and tag size and IV transmission with AES in GCM mode specifically states

  For GCM a 12 byte IV is strongly suggested as other IV lengths will require additional calculations.

I'm very interested in this statement, but I'm unable to find an explanation on these "additional operations" or other security implications of when using a longer IV. The NIST Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC did not clarify this for me.

So is there any specific reason for everyone using 12 bytes, or is everyone just following convention?


texts: Constant size commitment to a membership of a fixed size of elements

texts:
Suppose there is a global set of $n$ elements, out of which I want to commit to $2n/3$ elements, i.e., anyone can take my commitment and test what $2n/3$ of the possible $n$ elements I committed to.
Is there any way to do so with a constant size commitment that doesn't require exponential calculations. I had Merkle tree root in mind, but of course that doesn't work without a bit-vector of the elements included in the root.


texts: How should I check the received ephemeral Diffie-Hellman public keys?

texts:
In my application I'm doing a DH key exchange, where both sides generate their
own ephemeral  key. No static keys are used. I am trying to make my
application resistant against an active attack and therefore need to validate
the public key that my counterpart is sending me.

Below I'm using standard DH variable names: DH parameters $g$ and $p$. Party $A$ has
a private key $x_a$ and public key $y_a = g^{x_a} \bmod p$. Party $B$ has a private key $x_b$
and public key $y_b = g^{x_b} \bmod p$. The calculated secret is then $z = g^{x_ax_b} \bmod p$. Also $p$
is a safe prime $p = 2q+1$.

In my application I will authenticate the shared secret $z$ via an out of bounds
way (basically a user verifying a fingerprint).

OpenSSL has a function to validate a DH public key (DH_check_pub_key()) which
does the following check:

$$2 \leq y_b \leq p-2$$

I believe this always excludes the generators that generate the order-2
subgroup. Because $p$ is a safe prime, I think these generators are always $1$
and $p-1$. Is this correct? Is it also correct that all integers in $[2, p-2]$
either generate an order-$q$ or an order-$2q$ subgroup?

Secondly, in NIST SP800-56, section 5.6.2.4, it is mentioned that I should
also check:

$$y_b^q \bmod p = 1$$

I don't understand the background of this check. Is it needed when $p$ is a
safe prime? OpenSSL does not implement this.


texts: Is "6 bit packed ASCII" an effective encoding to obscure text data?

texts:
I wrote a routine for a former employer that took the low six bits of ASCII text and "compressed" by cramming the bits together, so that 4 bytes reduced to 3. This had the advantage of automatically folding lowercase to uppercase (not reversibly) with no computational effort. (Our text data was supposed to be just upper case letters, digits and punctuation. Can you say COBOL? I knew you could.) Note that I also ignored the first 32 ASCII characters as well. (They did not appear in the input data.)

Would this encoding method obfuscate text (where SHOUTING was acceptable) in a way that does not yield readily to simple analysis? The data would be encoded from 4 bytes down to 3 like this - (assume that we are only looking at the low 6 bits of every byte, the high 2 bits are just clipped off):

B1 = all 6 bits of first byte + low 2 bits of 2nd byte
B2 = "upper" 4 bits of 2nd byte + lower 4 bits of 3rd byte
B3 = last 2 bits of 3rd byte + all 6 bits of 4th byte

(Is there a prettier picture to illustrate this?)


texts: How to create the right Blowfish padding?

texts:
I use the OpenSSL library for Blowfish encryption in ecb mode.
The message are encrypted, but with the wrong padding, because of it I have a problems with decryption. What am I doing wrong?

I checked with:

http://sladex.org/blowfish.js/

and java.

It should be:
Kl9SMj1A42I48uWYTeBuD9rERDGhuvbbp07+4QwPhtk=

I get it:
Kl9SMj1A42I48uWYTeBuD9rERDGhuvbbLUwFXarEOq39/f39

#include <iostream>
#include <string>
#include "Base64.h"
#include <openssl/blowfish.h>

int main()
{
    // blowfish key
    const char *key = "topsecret";
    const unsigned char* in = (const unsigned char*)"hello world how are you today";

    BF_KEY bfKey;
    BF_set_key(&bfKey, strlen(key), (const unsigned char*)key);

    size_t InSize = strlen((char*)in) + 1;
    size_t OutSize = ((InSize + 7) / 8) * 8;

    unsigned char *out = (unsigned char *)malloc(OutSize);
    unsigned char *outnext = out;

    //Encryption
    while (InSize >= 8) {
        BF_ecb_encrypt(in, outnext, &bfKey, BF_ENCRYPT);
        in += 8;
        outnext += 8;
        InSize -= 8;
    }
    if (InSize > 0) {  // Cope with non-octal length
        unsigned char buf8[8];
        memcpy(buf8, in, InSize);
        for (int i = InSize; i < 8; i++) {
            buf8[i] = ((int)'0');
        }
        BF_ecb_encrypt(buf8, outnext, &bfKey, BF_ENCRYPT);
    }

    std::cout << Base64::base64_encode(out, strlen((char *)out)) << std::endl;

    std::cin.get();

    return 0;
}

Base64:

http://pastebin.com/DvLt3MPg


texts:
I'm looking for some PRNGs and – as I have been using Java for a long period of time – I thought that the BitInteger class, together with the Random class, could both generate some large pseudo random numbers.

Are the algorithms behind those generations cryptographically secure, or is it just some sort of a + (b - c) mod d or similar operation?


texts:
My question is kinda simple.

I want to use AES-256 encryption to encrypt my backup.
Using a password like this:
7okufZ308@lB$^KTINX1NWbpdw6rkysxv@giMW5jgI#ZaX*#YwloT3Y$*c*2qVCW

This has 64 chars and I wanted to know what is the possible cracking time for a password like this?
The software I will be using has a custom iteration configuration so I set it to 20,000.

(The server running the encryption software has a lot of cpu power)
Running a quad Xeon with 128GB of ram so I am not really worried about the encryption time.

I am more worried about how long will it take to crack a password like that?


texts:
We are making a system where users can share files with other people but nobody should be able to figure out that all these different files belongs to same user on blockchain.

these are the steps we have followed.

bip39 specification for generating master public keys and private keys and their 2**32 -1 child keys.
If a user wants to store this file, A new child key will be generated with a new AES key will be generated. The file will be encrypted with this AES key (GCM) mode,appending nonce and tag with ciphertext.
AES will be encrypted with this child private key.
Now float a contract, with the location of this encrypted data, encrypted AES key and child public key and saved on the address generated from the public key based on some mechanism.
If a user wants to share this file with other user, just generate a key based on the other user public key and users private key, and encrypt the AES with this common key so the other user can decrypt and read it.

My question is, How to encrypt AES key with secp256k1 keys since I couldnt find any implementation of this in either python or golang.
The other question is, Is it safe to encrypt AES keys with child secp256k1 keys.


texts:
Haven't found any clear cut answer in Google so its up to you guys:

DK = PBKDF2(PRF, Password, Salt, c, dkLen)

Here, what is the upper limit of password length? I tried up to 16 characters and it works. How far can I go? I read somewhere that salt has no upper limit! Is it really true?


texts: Understanding a variant of Shamir's cryptosystem with authorization levels

texts:
I am having problems understanding this implementation of Shamir's secret sharing with confidentially levels (in this case 3).

I will give the context and then my problem to make it more clear.

Context:

in some security system, to share a secret S, they use Shamir's secret sharing. the users in the system are divided to 3 levels of authorization: A, B, and C. To recover S, we need:

A) two users from A

OR

B) one user from A in addition to three users from B and 5 users from C

Problem:

Assuming that in level A there are only 2 users, and one of them decided to resign. His part of the secret, X, he shares with all of the participants, except the other user from level A, so to recover X we need 4 participants from B and one participant from C. Describe the new secret sharing cryptosystem. What does each participants hold and how to recover S?

Questions:

I am having a real hard time understanding this cryptosystem variant of Shamir's secret sharing. There are a lot of variants here.

I really don't understand what each participant hold and how to recover the secret S in this complicated scenario.

Could you please elaborate on it to help me understand it better? I feel totally lost.


texts: Is it secure to use the same IV for encrypting a unique private keys?

texts:
I want to store private keys in the database. I will never store the same private keys twice. As I understand the only reasons behind using a unique IV for each encryption, is that attacker can't see that you have the same data twice.

My server is generating the private keys. My server ensures that each private key will be only once in the database. If so, should I use an IV?


texts: Please suggest algorithms to encrypt and decrypt text messages that can be easily performed by human in a considerably short time. It doesn't have to be really secure, but sufficient to fool unskillful third parties.


texts: Playfair Cipher Confusion with one column encryption

texts:
Recently I decided to learn "Playfair Cipher", and I have hit a road block.
what do i substitute the letters for if they are on the same column? Here is an example:

CIADX
BEFGH
KLMNO
PQRST
UVWYZ

With the Key being CIAD  (Random Text)

I want to spell the word "trust" but I do not know what rule to follow for the T & R. I would really appreciate help on this. TIA


texts: Why isn't there a final permutation on SPN-based ciphers?

texts: I am doing some research on differential cryptanalysis. Most people who are familiar with that cryptanalysis technique do know the tutorial from Heys (Heys Tutorial). I came currently to the question, why is the in the final round no permutation, as in the other rounds? Heys says in the tutorial, that there would no purpose for that. I don't understand why there is no purpose, as in the other rounds. Can somebody clarify that to me?


texts: How to calculate key size of a security algorithm?

texts:
There are lots of security algorithms. One of the way to measure security of a cryptography algorithm is to find out its key size. There are many key size of a single algorithm.

ECC (Elliptic Curve Cryptography) has 163, 256, 384, 512 etc.
RSA has 1024, 3072, 7680, 15360. I found this from here

but how can I calculate key size of an algorithm? How a single algorithm has different key size?
I am building an simple cryptographic algorithm but I don't know how to calculate key size of my algorithm.
My algorithm is to change a letter of a plain text by a code suppose
a=2H, b=3C, c=8S ......, z=6D

If the plain text is "cb" then cipher text will be "8S3C". So what will the key size of this algorithm be? How can I calculate it?


texts:
I am trying to verify a Triple DES Key Component generated by PC Crypto.
The key portion is:

E6F1081FEA4C402CC192B65DE367EC3E

and the KCV value that should be returned is:

212CF915

In theory, it should be calculated as: encryption of binary 0's with the key portion with 3DES.

I have been trying the following link, but the calculation doesn't work.
http://tripledes.online-domain-tools.com/

I used the following parametrization on the online tool.

Could anyone confirm that the calculation is performed as I mentioned?


texts: AEAD without explicit authentication tag

texts: I'm trying to understand the purpose of tag in AEAD. As far as I can understand, the resulting ciphertext will be slightly longer than the plaintext due to the authentication tag. Will it reduce the security of AEAD if the authentication tag is embedded to the ciphertext(e.g. by performing XOR/modular addition to the last block of ciphertext)?


texts:
I'm trying to unhide information in a .bmp image using the tools on https://incoherency.co.uk/image-steganography/#unhide
However all I can see when using the tools are at best a black image with a few colored squares at the bottom and at worst a slightly blurry version of the image I'm using.
I've tried to use other tools but they don't appear to like .bmp files.
Are there any other methods to detect this? (that would be as easy as this site is supposed to be)


texts: Any benefit to writing a message as a mix of 2 languages before encryption?

texts:
For example, imagine a message that is a mix of Japanese and English words; Japanese in unicode, English in ASCII. Japanese doesn't use spaces between words.

The sentence structures, anything abstract, and verbs would have to be in Japanese. Anything directly translatable such as colors, transportation machines, proper nouns, etc. would be in English.

Would writing the original message as a mix of 2 languages (especially a Western and non-Western language) contribute to making it more difficult to decrypt?