texts: Is there a theoretical maximum useful keysize given the block-size?

texts:
Consider a block-cipher $F$ with a $N$-bit block-size and a $M$-bit key-size. That is, if  $k$ is a $M$-bit key, $p$ is a $N$-bit block of plain-text and $c$ is a $N$-bit block of cipher-text, then:
$$
F\left(k,p\right) = c
$$

Each plain-text block of $N$ bits must have a 1-to-1 correspondence with a cipher-text block of $N$ bits.

My question is: is there a theoretical maximum number of distinct keys such that in the set of such keys, there are no two keys $k_1$ and $k_2$ for which $F\left( k_1, p \right) = F\left( k_2,p\right)$ for all values of $p$?

For instance, if all we could do was a bit-permutation and an exclusive-OR with masks derived from the key, then  $M \le N + \lfloor\log_2 N!\rfloor$ could be such a maximum. But given for instance the 'MixColumns' and 'SubBytes' steps in AES, many more distinct keys would be possible. But is there a theoretical upper limit?


texts: What if the bitlength of the value evaluated in Barrett reduction is greater than 2k the modulus?

texts: For $c\equiv a \pmod n$, in Barrett Reduction, $\mu = \lfloor{\frac{2^{2k}}{n} \rfloor}$ is precomputed, where $k = \lceil{\log_2{n}} \rceil$ and the bitlength of $a$ is assumed to be less than $2k$. What if the bitlength of $a$ is much greater than $2k$? Is the result of Barrett Reduction still correct?


texts: Ensuring integrity and confidentiality together with symmetric encryption

texts:
I've been required to answer a question:

As usually, we have Alice and Bob.
Suppose Alice wants to send a file F to Bob, ensuring integrity and confidentiality. They share a symmetryc key $K_{ab}$ and use AES. No hash algorithm is available.
Alice sends to Bob: $Enc(K_{ab}, F)$
In this simple scheme, are integrity and confidentiality guaranteed?

My answer:

Confidentiality is guaranteed if we use CBC (cipher block chaining) for example. But this is obvious. If we use a symmetric encryption algorithm as AES we have to use CBC, CFB, OFB or whatever.. right? So this answer seems too simple.

I would say that a computer is not able to tell if the message has been tampered with. So i would use CBC along with a "weak" cryptographic checksum inside CBC. A longer non-cryptographic checksum is suspect and subtle attacks are known if CRC is short.

Use OCB (Offset Codebook Mode). This mode of operation get both encryption and integrity protection while making only a single cryptographic pass over the data.

Are these answers correct? Could you give some background why the are correct or not?

P.S.: I could get privacy of a message with CBC encryption and integrity with CBC residue as long as the two are computed with different keys, but this requires twice the cryptographic power of encryption alone.


texts: Private key not used in a signature scheme

texts:
I'm trying to understand the following signature scheme (Camenisch-Lysanskaya):

Key generation:
$n = pq$ special RSA modulus, $a, b, c \in QR_n$. $PK = (n, a, b, c), SK = p$.

Signing algorithm:

$m$ message.
$e$ random prime number (with some for this question unimportant length restriction).
$s$ random number with very big length (unimportant for my question).
Compute $v^e \equiv a^m b^s c \bmod n$. Output $(e,s,v)$.

Verification algorithm: Check that $v^e \equiv a^m b^s c \bmod n$ and check the length restriction of $e$.

I don't see why this is a valid signing algorithm. The secret key is not used for signing (or calculating $e$ or $s$). So everyone could make a signature like this and not just the one who created the public key.

Edit: If I understand it right, it's all about the hard computation of a $v$ and $e$ if you just have $a^m b^s c$. But how does it help there to know the factorization of $n$?


texts: Using an RSA private key simultanously as an AES encryption key to generate random numbers?

texts:
Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the successor X9.31- standard to implement my PRNG. X9.17 uses DES, but X9.31 uses AES!

Now I need to specify the value of the AES key for X9.31.  I know that at least my AES key must be unpredictable to an adversary. Because of this I want to use the RSA private key of the certificate which belongs to my embedded device. (This value is currently the only one that from my point of view that is unpredictable.)

My idea how to generate the AES key from the RSA private key:

AES_key= SHA1(RSA private key || date)

But is it OK to (ab)use a RSA signing key as a symmetric AES key, to encrypt the seed and finally generate random values? Is there any serious security weakness?


texts: Application of High-level Mathematics to Hashing

texts:
Sorry if this post is a tad unconventional(it's also a reddit repost), but I was recently commissioned by a teacher to write a paper on the application of high-level math to a topic of our choice, and, being familiar with basic cryptography, I chose to explore hash collisions. The prompt was extremely broad and ultimately amounted to "summarize the application of high-level math to a topic of your choice". As of now, I have summarized the equation for determining the likelihood of hash collision given the number of output values. However, I am still well under the word count.

What other topics can you suggest?

Preferably, this would relate to some form of calculus, differential equations, linear algebra, high-level probability, or anything reasonably high-level. Thanks for whatever help you can provide.


texts: Blum Blum Shub Pseudo-Random Generator Requirements

texts:
I am trying to understand the Blum Blum Shub pseudo-random generator originally described in A Simple Unpredictable Pseudo-random Number Generator

As best I can tell the requirements are:

For any $x_i$, only $x_i^2 \bmod 2$ is used (only the least significant bit)
$x_{i+1} = x_i^2 \bmod N$
$N = p\cdot q$
$p \ne q$
$p$ and $q$ are equal length primes
$p \equiv 3 \pmod 4$
$q \equiv 3 \pmod 4$
$\gcd(pq, (p-1)(q-1)) = 1$

I don't plan to roll my own crypto. Just curious.


texts: Is a random oracle controled by the challenger?

texts:
When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger?

What if the Hash is only used by the adversary?


texts: How does generating random numbers "remove entropy from your system"?

texts:
In a previous question, I quoted the --gen-random entry in the GPG Man Pages. At the end it says:

  PLEASE, don’t use this command unless you know what you are doing; it may remove precious entropy from the system!

How does that work? I understand entropy to be the "randomness" of a system (i.e. the amount of information it contains).  How can generating random numbers steal randomness from your computer such that it noticeably hurts the computer's ability to perform cryptologic operations in the future?

I'm no mathematician, so plain english answers would be appreciated.


texts: Available programs that can verify the working of a simple substitution cipher

texts:
Is there any tool available that can test whether a simple substitution cipher is working.
I will put my scenario in detail. Lets say I built a simple substitution cipher that maps 8 bit data to 16 bit encrypted cipher using an 8 bit key. I need to verify whether the substitution cipher is actually unique for all possible permutations of 8 bit data and 8 bit keys with my algorithm.

Before you guys eat me alive with 'You think you can build a superior cipher?' questions, this is not a high security application but a simple app where sending plain data is not preferred. Existing ciphers like columnar transposition and caesar cipher were not an option considering user experience and ease of implementation. You can assume it is just simple XOR.

I just want to verify whether the substitution is happening correctly or not. If I need to manually write a program that can verify this, can anyone give me a brief detail about how I should start?


texts: 8-bit CFB in DES and AES - error propagation

texts:
I have two questions for an assignment that I need to answer in relation to Error Propagation in 8-bit CFB mode for AES and DES encryption. The questions are as follows:

If there is an error in transmitted ciphertext block C1, how many plaintext blocks will be corrupted when the file is decrypted for 8-bit CFB-DES?
If there is an error in transmitted ciphertext block C1, how many corrupted plaintext blocks when 8-bit CFB-AES is used?

For question 1 I know the answer is 9 characters, as P1 will be affected and so will the following 8 characters (Avalanche effect). But why, when using AES, will 17 bits be affected, ie. P1 and the following 16 characters? I tested this encryption using openssl -AES-256-CFB8 and -DES-CFB8 on Linux Ubuntu.


texts:
Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer?

If not, why is AES-256 used to replace AES-128 so frequently?


texts: Is deterministic encryption appropriate for low entropy plaintext when CPA is not a concern?

texts:
We have a trusted application that observes sensitive identifiers, e.g. credit card numbers. We want to send data associated with these identifiers to an untrusted analytics service that will occasionally generate and send alerts back to the trusted application.

We've considered storing a table mapping sensitive identifiers to an opaque ID (e.g. UUID) to pass to the untrusted analytics service. But since there are billions of sensitive identifiers, the application can't store all the mappings due to storage constraints. We need the opaque ID to be stable over time, since the analytics service will be keying off of that to correlate data we send it. We also need the opaque ID to be reversible, so that the trusted application can determine what sensitive identifier was involved in an alert.

What we're planning on instead is to use a deterministic encryption scheme, though we're concerned about how well it fits our use case: often deterministic encryption is discussed in the context of key wrapping schemes, but the identifiers we see are far less random and have structure. On the other hand, we also see that chosen plaintext attack (CPA) is typically a concern, but in this case we aren't going to allow the attacker (i.e. the analytics service) to ask the telemetry service to encrypt arbitrary plaintexts.

We also don't want the untrusted analytics service to be able to figure out plaintexts or the key(s) used in a deterministic encryption scheme, even if it sees a large number of ciphertexts.

Given these constraints, what scheme best satisfies our use case? In particular, is AES-SIV applicable in this case?


texts: Orignal Schnorr Signature vs Discrete logarithmic Schnorr Signature

texts:
I have currently started a course on cryptography and am an absolute beginner. While reading through Schnorr's Protocol I came across several ways in which it was described.

One of the approach is described here: - https://www.youtube.com/watch?v=mV9hXEFUB6A

A second approach using discrete logarithmic is described here - https://asecuritysite.com/encryption/schnorr

The third article had a slightly different mathematics to the discrete log implementation- https://blockgeeks.com/guides/what-is-zksnarks/#The_Schnorr_Identification_Protocol

I apologize if this is completely novice. I just want to know how are they different and which protocol was initially published by Claus Schnorr?

edit:
Thanks for the reply. My main doubt is while learning Schnorr's signature, The implementation on the Asecurity source given and the Blockgeeks source given is different. What is the difference between them?
What Asecurity says:

With Schnorr identification, Peggy (the prover) has a proving public key of (N,g,X)(N,g,X) and a proving secret key of (N,x)(N,x). NN is a prime number for the modulus operation, and xx is the secret, and where:

X←gx(modN)X←gx(modN)

On the registration of the secret, Peggy generates a random value (yy), and then computes YY:

Y←gy(modN)Y←gy(modN)

This value is sent to Victor (who is the verifier). Victor then generates a random value (c)(c) and sends this to Peggy. This is a challenge to Peggy to produce the correct result. Peggy then computes:

z←(y+xc)(modN)z←(y+xc)(modN)

He then sends this to Victor in order to prove that he knows xx. Victor then computes two values:

val1=YXc(modN)val1=YXc(modN)

val2=gz(modN)val2=gz(modN)

If the values are the same (val1≡val2val1≡val2), Peggy has proven that she knows xx.

This works because:

YXc=gygxc=gy+cxYXc=gygxc=gy+cx

gz=gy+cxgz=gy+cx

Blockgeeks

Anna wants to prove to Carl that she knows a value x such that y = g^x to a base g.

Anna picks a random value v from a set of values Z, and computes t = g^v.

Anna computes c = H(g,y,t) where H() is a hash function.

Anna computes r = v – c*x.

Carl or anyone can then check if t = g^r * y^c.


texts: Understanding message reversible mapping function in group G

texts:
In ElGamal encryption, it says that the message M that is about to get encrypted must be mapped to its m counterpart in the group G using a reversible mapping function.

  Map the message M to an element m of G using a reversible mapping function

Can someone help me understand (and point to some explanatory source) exactly what function this could represent? Can any message be mapped in such a way even though the group G is finite?


texts: Collecting entropy: can I use timing of reading as a separate source from the reading itself?

texts:
I'm implementing an entropy gathering program.

For that I collect 2 bits from two gpio-pins connected to a random source.
I whiten this stream of bits using the von Neumann decorrelation algorithm. Now 2 out of 4 cases I can't use the bits because of that whitening algorithm (e.g. when both bits are 0 or both are 1). The timestamp when I have to discard bits is random.

My question now is: I use the value of the two bits, can I now also use that bit-discard-timestamp as an entropy source? Or are these (the values and the timestamps) correlated? I think they are not neccessarily correlated but I'm not entirely sure.


texts: How to use AES correctly in BPS Format Preserving Encryption

texts:
I have several questions on using AES 128bit in the BPS format preserving encryption

Which modes are acceptable?  (Should the block cipher used at each round be deterministic (ECB) or probabilistic (CBC, CTR etc)

What IV to set?  Can I set it to the constant zero?


texts: Mitigating private key loss for the average non-technical user

texts:
I'm developing software that will use public key encryption as part of its user identification, verification and data ownership processes. Assume that I have the user experience side of things worked out and that what I propose will work well within the design of my application; the question I have here is purely about the security side of things.

Private key loss is an awful thing to bear, if it means total loss of access to your data. You can print it out and store it somewhere safely, or put in a USB key and put that in a safe, or whatever, but the average user is not going to do these things. They don't understand security, and they won't usually make the effort to cover their bases. Even if they do, they may forget where they saved or stored their key, or they may lose it for other reasons.

My question is as follows:

Assume there is a network of people who know each other closely enough that they can pick up the phone (or Skype, etc.) and have a voice conversation. Am I missing any glaring security problems with the following?

On my local machine, my private key is divided into 3 parts. The key ABCDEFGHIJKL... becomes ADGJ..., BEHK..., and CFIL....
I select 3 people in my network (preferably each selected from a distinct social group that doesn't really overlap with the others), and encrypt one of the pieces of my private key with their public key.
I send each respective encrypted piece of my private key to the person whose public key I used to encrypt it, and it is stored in their local data store.

Catastrophe strikes! My private key is gone!

I generate a new temporary key pair.
I ask each of my 3 friends to decrypt their piece of my old private key and re-encrypt it using my temporary public key, then send the newly-encrypted version back to me.
I decrypt each of the three pieces and rebuild my private key.

I now have access to my data.

The solution sounds convoluted, sure, but as I said earlier, I have a way to handle the UX for this in a reasonably frictionless way.

The only issue I can think of is that a friend may lose access to their own data and then I'll be out of luck, but to mitigate that as an issue, I'll hedge my bets and perform the same process with different groups of 3 people.

Other things:

"3" is not set in stone, and can be adapted depending on the user's network size.
A user could leverage a service that uses 2-factor authentication as a stand-in for one of their friends. e.g. I could store one of the pieces unencrypted (but obviously useless in isolation) in my 2-factor-secured GMail account.

Can you see any issues with my approach, and if so, what could I do to achieve the same result in a more cryptographically-secure way?


texts:
assume we say 128bit keys are secure so a 16 character long password is safe, but if i even use lower case and upper case letters with numbers and special characters on my keyboard its about 80 different character i can choose, as we have 256 different byte in nature so it look like the 16 character random password i choose is about a 60 bit secure key ... ?!
how to fix it and what is secure length to use ?


texts: Viability of an "Unconventional" Hashing Scheme?

texts:
I am playing around with the following hashing scheme:

Start with a domain string (same for all users),
Allow every user to mutate it in any way defining their own custom replacement rules,
Append the user ID to the result of the above mutation,
Allow the user to choose their own "work factor" for PBKDF2-HMAC-SHA256, and use the above "salt" to hash their secret.

In the worst case, if the replacement scheme is an identity mapping, and if the user ID is empty, the salt will end up the same and this scheme will suffer from "salt clustering". If the user also did not customize their work factor, this would be a weak scheme allowing for a rainbow table attack for all users for a given domain.

However, let us assume that all three elements have sufficient variability:

the replacement scheme is arbitrarily complex,
the user ID exists,
the work factor is variable

In this case, how does the security of the resulting hash database for a given domain stack up against the pedantic case of choosing a salt using a CSPRNG, and hash the secret using a fixed work factor? Are their any obvious "gotchas"?

Edit: The "setup" is intended to be a one-time cost, to be used across domains, i.e., the replacement scheme will be used for multiple domains.

Edit Redux: From the discussion below, it basically boils down to the fact that as long as the input is deterministic and so is the ruleset - which in most cases will be a naive substitution - a precomputation of rainbow tables for an "intelligent" search space on the salt is possible. I will change my design accordingly.


texts: Why the same characteristics cannot be used to recover all FEAL4 keys

texts:
I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher.

  The big gotcha with this process is that you cannot just reuse the above differential path to crack rounds 2 and 3. You must build new differential characteristics that only cover the uncracked rounds.

As I understood you cannot use the same differential for cracking all keys. For each round key, you need to use new differential. Could you explain why?


texts: Symmetric versus asymmetric self encryption

texts:
I can encrypt my files with a symmetric encryption algorithm like AES, or with an asymmetric encryption algorithm like RSA or ECC (I encrypt my files with my own public key). No communication is involved in this scenario. The latter, which one may call asymmetric self encryption, might seem an unusual choice in situations where a key exchange is not required. However, it still does have some advantages: you don't need to type your passphrase for encryption (you need your public key); it works well with keys stored in a hardware token; also, an attacker apparently needs both to have the public key and brute-force the passphrase to decrypt the data. In GnuPG, these two encryptions are achieved via options gpg -c and gpg -e -r USERNAME.

Considering attacks on the asymmetric encryption, does hiding the public key increase the entropy required for a brute force attack? What information does the public key leak to the attacker?

The standard algorithms for symmetric and asymmetric encryption are AES-256, 4098-bit RSA. The answer to the above question helps compare the security level of these algorithms (in terms of the number of bits that needs to be checked).


texts:
Can we use EED with 2 keys $(k_1, k_1, k_3)$ rather than EDE $(k_1, k_2, k_1)$? We measure the strength of DES by the effort (in terms of the number of tries) in finding some $k_1$ & $k_2$ to match a known plaintext and ciphertext pair.

Will EED have the same strength as EDE? Which one is stronger?


texts: How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?

texts: I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also read that it is semantically secure when it meets the DDH assumption. Is there some terminology I'm misunderstanding because that seems contradictory to me.


texts: It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?


texts: As alluded to here (split-key vanity addresses for bitcoin), ECCDSA-keys can be merged such that the sum of two private keys $S=S_1+S_2$ yields a public key which is the sum of the respective public keys $P=P_1+P_2$. Thus, given a key pair it is trivial to construct all public keys that are integer multiples of that public key $P_n \equiv n\cdot P \pmod N$. Does this mean there is a skeleton key with public key $1$ that could derive all keys? Or at least "low numbers" that can be used to crack public keys that are very "composite"? Of course since it is infeasible to obtain the secret key to any given public key that's probably pure theory, but one worth much more to invest in than a single specific target...


texts: Why hash function are used in digital signatures?

texts: In the lectures I see, hash functions are always used when we want to sign a document $d$. My question is why they are used in digital signatures? Maybe, because it is more easy and fast to calculate the signature when is used a "block" signature scheme? Do you know some formal paper or book where this is described? I need that for my thesis.


texts: Reusing one-time-pad with random plaintext

texts:
I understand that by definition one-time-pad keys cannot be reused but I was thinking about the case where it is used to send random data and couldn't find anything on the subject so here is my idea:

Sending y-bits of data using x-bits of random data as a key where y > x.

Step 1: Both parties agree on a x-bits key (With DH or a safe communication).
EDIT: This is only so users can remotely agree on a key, they could also physically share a key.

Step 2: Either agree on a pseudo random data generator before hand or submit an array of random bits to the receiver(The size depends on the algorithm used on Step 4).
EDIT: This data doesn't need to be a secret.

Step 3: I xor the bits generated on Step 2 with the key to get another random array.

Step 4: Use the result of Step 3 on a PRNG or hash function to add more security. Without this step a many-time-pad attack would be possible (Or "easy" at least).

Step 5: xor y with the data to be encrypted to obtain the cipher version.

With this, as long as the algorithm use in Step 4 is random the key can be reused without any worries. The only problem is that one could brute-force it. But since the key doesn't have a size limit all we would need to do is to use a key with a decent size (256 or 512 bits).

Could this be a replacement for AES? If I'm not mistaken only a brute force attack can find the plain-text without the key. Considering that Steps 2 & 4 add enough randomness.


texts:
i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing....  the slave node is also provisioned with the public key of a distinquished master node, at which time the slave can compute a shared secret used during direct communication with the master -- say, to receive an over-the-air firmware update....  assume further that the master node has access to the public keys of any slave nodes it might detect....

in normal operation, the master is doing little more than broadcasting information to the other nodes -- time-of-day, current operating parameters, and so forth....  i would like to add some sort of "mini-signature" to the master's broadcast messages that would give a slave node detecting this broadcast some degree of confidence that the transmitting master is genuine....

i'm using P-256 for my EC, which means i can always append a 64-byte signature to my broadcast packets....  since each slave node has the master's public key, they can verify the encrypted digest in the usual way....

my problem, of course, is that sending a 64-byte signature along with (say) a 10-byte message creates undue strain on my power-budget due to excessive use of the radio....  what i'm looking for is some sort of 4-8 byte "mini MAC" which the master node could encrypt/sign with his private key and which the slave nodes could then decrypt/verify using the master's public key....

obviously, this scheme gives up some of level security that comes from using a full 64-byte signature -- but that's acceptible for this particular application....

any thoughts on how to approach this problem would be much appreciated....


texts:
I'm designing a scheme for management of a small number of cryptographic keys (< 100 at any given time) and I had an idea: rather than storing all the keys, could I just store one master key and use a KDF to derive the particular key I need by varying the salt in a certain way?

For example, if I need the second encryption key for usage X, I'd give something like PBKDF a salt of

$$2||“encryption”||X||<random value>$$

which would uniquely derive the second version of that particular key.


texts: Any weakness when performing SHA-256 repeatedly?

texts:
Is it significantly easier to reverse a SHA-256 hash if you know that the input was a 32 byte output of SHA-256?

I assume for most outputs of SHA-256 there will be zero, one or two possible 32 byte inputs.

Mapping and storing all of the values is infeasible, but I am still worried that constraining the input to being exactly 32 bytes may weaken SHA-256.

Is this a valid concern?


texts: Why is calculating the discrete logarithm harder than calculating the public key?

texts: A noob question, I know, but given n in range [0,q-1], and given an elliptic curve point P, we calculate the public key Q=nP. By doing so, we calculate P+P=2P, 2P+P = 3P, and so we get the values P,2P,3P,...,nP. For the person trying to solve the discrete logarithm, P and Q is known. The brute force way would be to calculate P,2P,... until the result equals Q. Why is this harder than generating the public key? Where is the error here in how I think?


texts: Is this hash function almost XOR universal?

texts:
Consider this hash function:

The key $K$ is $2^n$ bits.  The message $M$ is divided into $2^n$ bit blocks.  Arithmetic is performed modulo $2^{n+1}$. The hash is defined by:

$ H_0 = 1 $.
$H_{i+1} = (2M_i + H_i)\times (2K + 1)$ where K is a (secret) hash key.
Output $H' = \frac{H_{|M|/2^n}}2$

Is this hash (the iterative one) almost-XOR-universal?


texts: What is the purpose of salting when integrating PBKDF2 with AES?

texts:
I'm a bit new to cryptography and I'm trying to wrap my head around PBKDF2 and AES. As a disclaimer, this is not going to be used in an actual application, I'm just testing things locally as a fun side project.

Right now what I'm trying to do is accept a password from someone to encrypt a message, and decrypt it at a later time.

I was doing the following:

    key = InputPassword()
    salt = RandomSalt()
    self.key = PBKDF2(key, salt, 16)

I would then encrypt with AES. At the later time point, I would run:

    key = InputPassword()
    salt = RandomSalt()
    self.key = PBKDF2(key, salt, 16)

again. Of course, my salt is going to be different each time. The problem seems to be that when the salt is different, AES decryption does not work. Am I therefore supposed to include the salt in the encrypted message? For example send something like: "message = message, salt=salt"? If so, what is the purpose of the salt, and what security benefit does including it confer?


texts: Extending key sizes in Salsa20 and ChaCha?

texts:
I've written implementations of Salsa20 and ChaCha that accept 384 and 448 bit keys. It was fairly trivial to implement, the 'sigma' constant is replaced with key material, and the counter, (which was initialized at 0), rotates and can be initialized at any value. So along with the 64 bit vector, the entire 512 bit state can now be initialized via a key/vector.

This does not affect the performance in any way, and if a key is constructed using key + sigma + 0, the output aligns with an implementation that uses a 256 bit key. Provided that the key used is created using a strong PRNG, and the values that replace the constant are sufficiently asymmetric, this should not present a problem, as the constants function seems to be purely to reduce symmetry.

Is there anything incorrect in the description given above?

One other question: I am considering extending max rounds to 24, I have looked at the mathematical model and it seems that this should not do anything other than further diffuse the input. Is that correct?


texts: Why do the signature and ciphertext size increase in post-quantum schemes? And is there any table or comparison as to how much this increase happens for each scheme type (lattice, multivariate, code-based, etc.)


texts: Difference in the key schedule of AES for decryption given different orders of operation

texts:
As per the Stallings book, the normal decryption of AES has different sequence of transformations [method 1 below], which leads to two separate software or firmware modules and that is undesirable.

However, with the interchange of the ISR and IBS operations during decryption (as they are equivalent), the encryption and the decryption can be given the same form. However, this second method needs a change in the key schedule. I can't find what this new key schedule is.

Encryption (method 1) :
ARK
BS, SR, MC, ARK,
…..
BS, SR, MC, ARK,
BS, SR, ARK
Decryption (method 1):
ARK, ISR, IBS
ARK, IMC, ISR, IBS
…..
ARK, IMC, ISR, IBS
ARK

Encryption (method 2):
ARK
BS, SR, MC, ARK,
…..
BS, SR, MC, ARK,
BS, SR, ARK
Decryption (method 2):
ARK,
IBS, ISR, ARK, IMC
…..
IBS, ISR, ARK, IMC
IBS, ISR, ARK


texts: Iterative hashing increases number of security bits?

texts:
Whatsapp uses 5200 iterations of SHA-512 over user's public key and identity
according to WhatsApp Security Whitepaper.

I wonder why?

According to: Why iterate 5200 times when computing Safety Numbers in Signal?  this question on Information Security.SE: It is to increase security bits to 112.

I do understand why 30 digit number has $\approx 99$ bits entropy and so $\approx 99$ security bits.

$$\log_2(10)*30 \approx 99$$

But how does iterative hashing affects security bits? It does not affect entropy as far as I understand.

Math in the post indeed shows:

$\log_2(10^{30} * 5200) \approx 112$. Which is recommended number of security bits at keylength.com

Moreover, Signal source code comments state that too on the source code

Where can I read more on why '5200' iterations of hashing placed into the 'log' as multiplication and why does it affect security bits at all?


texts: Extension of a password hashing algorithm using Fibonacci

texts:
I am right now taking a class named Applied Cryptography and our final project is to create a password hashing method using at least one existing algorithm and then add additional steps to make it harder to decrypt.

I am using SHA1 in a Console Application in c#.

The user input is hashed using SHA-1. For each byte of the resulting hash I compute the Fibonacci series of the byte value as int, and append it to a string, if it is positive. If it is not, I append 0.

The result of the Fibonacci computation is hashed using SHA-1 once more.

This is my code so far

using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

namespace Proyecto
{
    class Program
    {
        static void Main(string[] args)
        {
            string str = Console.ReadLine();
            StringBuilder fibo = new StringBuilder();
            string result1, result2;
            result1 = GetSHA1(str);
            for (int i = 0; i < GetSHA1(str).Length; i++) fibo.Append((Fibonacci(result1[i]) > 0) ? Fibonacci(result1[i]) : 0);
            result2 = GetSHA1(fibo.ToString());
            Console.WriteLine(result1);
            Console.WriteLine(fibo);
            Console.WriteLine(result2);
            Console.ReadLine();
        }

        public static int Fibonacci(int n)
        {
            int a = 0;
            int b = 1;
            // In N steps compute Fibonacci sequence iteratively.
            for (int i = 0; i < n; i++)
            {
                int temp = a;
                a = b;
                b = temp + b;
            }
            return a;
        }

        public static string GetSHA1(string str)
        {
            SHA1 sha1 = SHA1Managed.Create();
            ASCIIEncoding encoding = new ASCIIEncoding();
            byte[] stream = null;
            StringBuilder sb = new StringBuilder();
            stream = sha1.ComputeHash(encoding.GetBytes(str));
            for (int i = 0; i < stream.Length; i++) sb.AppendFormat("{0:x2}", stream[i]);
            return sb.ToString();
        }
    }
}

I want to know if the additional Fibonacci round improves the strength of the function as a password hashing function, and if not, if you can give me some suggestions.


texts: Need to generate new DH keys for every message in OTR

texts: Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it makes the argument for PFS any stronger. Also it does not have anything to do with deniability as well. Am I missing something here?


texts: Why does the Gameboy Advance serial encryption include the destination byte address?

texts:
The Gameboy Advance encrypts data sent over its serial port. It assembles a random number to seed a linear congruential generator. Then, it xors this PRN, the data, a symmetric key, and the byte offset from the file.

Is there a rationale for this? The receiver must know the byte address, because it needed to know how many times to iterate the LCG.

(See here for a description of the algorithm.)

I'm trying to determine whether the algorithm is a stream cipher or some version of a block cipher in CTR mode.


texts:
I proposed an idea of Perfect Deniability of a MAC

I tried to come up with a protocol that satisfies those security requirements as well as the normal security requirements of a MAC

One-Time MAC

Alice and Bob pre-share a $n^2$ OTP bits, $k$ (bits that were generated the same way you would for a OTP with all the requirements met here)
Alice breaks $k$ into $n$ strings of length $n$, lets call them $k_1, k_2, ..., k_n$
For each $k_i$ Alice computes $b_i = \bigoplus_{j=0}^{n}(m \oplus k_i)$

Each $b_i$ is a bit computed from xoring all the bits in $m \oplus k_i$

Alice sends $m||b$ where $b = b_1||b_2||...||b_n$
Alice and Bob destroy k

Proof

One-Time MAC is a MAC since anyone not knowing the key can only modify the stream with negligible probability.  If someone tried to flip bits in the message then they would need to flip some unknown bits in the MAC and visa versa. They would only guess correctly with probability $2^{-n}$.

Now for the perfect deniability part.

If Eve came to Alice with $m$ and MAC($m$) = One-Time MAC($m$) then Alice can just generate $n$ random $n$ bit strings check their $b_i$ values and reorder them so that they create a "valid" key.  (Note she may need to generate more than $n$ keys if the number of $b_i = 0$ doesn't  match the number of $0$'s in MAC($m$), but odds are she will not need to generate more than $2n$ random strings)

Problems and Thoughts

I feel obligated to post issues with this protocol.

Very large key ($n^2$)
Similar issues as OTP (key management, etc..)
Could be used as a MAC for a OTP and give messages perfect secrecy and perfect deniability without the ability to be tampered with

Questions

Does this satisfy the properties of a MAC?
Does this satisfy this definition?
Could this be done with a smaller key?
For long messages can you break it into smaller messages and MAC each individually to use less key?

I would assume you would lose security since $n$ would be smaller


texts: AES plaintext is smaller than 128 bits - how to expand?

texts:
We are currently developing a little AES implementation in a crypto-course at university.

As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into blocks of 128 bits (16 bytes) into a 2d-array (or 1d in implementation) with 4 × 4 fields.

I was wondering and didn't find out what to do if the entered string to encrypt is not 128 bits long? The question is going further by thinking that there will never be exactly n × 128 bits of data to encrypt.

For a smaller key given by the user (e.g. "test") I know there is a key expansion algorithm defined.

But what should be done for data that is less than 128 bits?


texts: Using NIST SP 800 - 90Ar1 Test Vectors for HMAC_DRBG with Reseeding and AdditionalInput

texts:
I'm trying to test my HMAC-DRBG implementation, but I do not understand how the AdditionalInput paramter should be used. From one test case (pr-false):

[SHA-256]
[PredictionResistance = False]
[EntropyInputLen = 256]
[NonceLen = 128]
[PersonalizationStringLen = 0]
[AdditionalInputLen = 256]
[ReturnedBitsLen = 1024]

COUNT = 0
EntropyInput = 05ac9fc4c62a02e3f90840da5616218c6de5743d66b8e0fbf833759c5928b53d
Nonce = 2b89a17904922ed8f017a63044848545
PersonalizationString =
EntropyInputReseed = 2791126b8b52ee1fd9392a0a13e0083bed4186dc649b739607ac70ec8dcecf9b
AdditionalInputReseed = 43bac13bae715092cf7eb280a2e10a962faf7233c41412f69bc74a35a584e54c
AdditionalInput = 3f2fed4b68d506ecefa21f3f5bb907beb0f17dbc30f6ffbba5e5861408c53a1e
AdditionalInput = 529030df50f410985fde068df82b935ec23d839cb4b269414c0ede6cffea5b68
ReturnedBits = 02ddff5173da2fcffa10215b030d660d61179e61ecc22609b1151a75f1cbcbb4363c3a89299b4b63aca5e581e73c860491010aa35de3337cc6c09ebec8c91a6287586f3a74d9694b462d2720ea2e11bbd02af33adefb4a16e6b370fa0effd57d607547bdcfbb7831f54de7073ad2a7da987a0016a82fa958779a168674b56524

So I would basically instantiate my DRBG with EntropyInput and Nonce.

HmacDrbg drbg = new HmacDrbg(new DrbgParameter(macFactory,
                entropyInput,
                nonce,
                new byte[0]));

Then before generating output, I would reseed the DRBG with EntropyInputReseed and AdditionalInputReseed

drbg.requestReseed(entropyInputReseed,additionalInputReseed);

But what should I do with the other 2 AdditionalInput inputs? The spec seems to only specify the reseed mechanic that takes AdditionalInput?


texts: Using zk-snarks to check if value is greater than another

texts:
Can I use Zk-SNARKS to prove that a given secret value is greater than another public value. for Example to prove that secret_value >10 . if so How would such a circuit look

I am using snarks.js which uses circuit file .


texts: Does ssl_rsa_with_rc4_128_md5 have known weaknesses?

texts:
My bank's website uses HTTPS with the cipher suite ssl_rsa_with_rc4_128_md5.

What are the known weaknesses of this suite? Do they have a practical impact for banking-related communications?


texts: Can zero-knowledge proof be used to determine if another person knows a certain movie with a twist ending?

texts:
Suppose I want to talk with a co-worker about a movie called "The Twist Movie". I know the movie contains an interesting twist, and bringing up the movie in a discussion about twists in movies might spoil the first time experience of someone who has not watched that movie, because now the viewer knows to expect the twist.

Is there an algorithm so that both parties can verify beforehand that both know the movie without sharing the information about the movie? (So neither side gets spoiled by mentioning the movie)


texts: How do I calculate e, d and N based on raw and encrypted message in RSA?

texts:
I've got raw and encrypted message, which contains only numbers. For example:

Message: 32016550980634121428089400169, encrypted: 35682226122303060179704449482

I've written such an algorithm:

d = 1
n = enc+1

for k in tqdm(range(1, 10**7)):
  e = k * n
  if pow(msg, e, n) == enc:
      print("WE")

But looks like I've mistaken somewhere. How do I make it work?


texts: Origin of the SHA-224 initial hash value?

texts:
At the start of each of the SHA-0 through -2 algorithms, the initial state is set to certain constants.  I'm curious where the initialization values in SHA-224 are from.

MD5's initial values are simple increasing and decreasing patterns of hex digits.
SHA-0's and SHA-1's values are the same as MD5's with one additional value that is also a simple hex digit pattern.
SHA-256's values are the fractional bits of the square roots of primes $2$~$19$.
SHA-384's values are the fractional bits of the square roots of primes $23$~$53$.
SHA-512's values are SHA-256's values expanded out to 64 bits.

But what are SHA-224's initialization constants from?  They're the only one in the SHA family that I can't find the source of.  They're also not simply the square root of primes $23$~$53$ like you might expect.


texts: Factoring RSA number knowing some B-smooth numbers

texts:
Hi I am studying for an exam and having some problems solving one of the questions. It reads as follows: Factor $$N=44370047$$ using Quadratic Sieve by using the information that you get from squaring the following numbers modulo N.

$$33965, 2145407, 19416874, 15213395$$

I know how the algorithm works, i.e   $$19416874^2\mod 44370047 = 9 = 3^2$$

And then calculating $$gcd(19416874-3,44370047)$$

I can do this using the computer easily but I have no idea how to calculate the modulo of numbers of this size by hand. Any help would be greatly appreciated as I am currently banging my head against the wall.


texts: Non-Linearity of an Sbox affects its resistance towards Linear Cryptanalysis. What happens, if an Sbox has low non-linearity (specially with respect to Linear Cryptanalysis)?


texts: Is there any reason to use RSA or DSA when we have ECC?

texts:
I am having trouble coming up with a use case for RSA or DSA.  It appears that ECC is better in every way.

Is this true?

I am looking for cases where RSA/DSA is superior to ECC, not where it is used for historical reasons.


texts: Proving the CCA-insecurity of El Gamal encryption scheme

texts:
I am trying to prove that El Gamal Encryption is not CCA-Secure.

If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\cdot 1)=(g^y,g^{xy}).$ Then he could calculate $g^{-xy}$. Then he sends the challenger a pair $(m_0,m_1)$. When he gets the challenge ciphertext $(c_1^*,c_2^*)$ he can decrypt it and finds out which message has been encrypted. Hence, the adversary wins the experiment with non-negligible probability.

Does this prove make sense, or did I miss something?

Thanks in advance.

Edit

This solution does not work since the value of y does not belong to the key, but it's generated randomly for every encryption.

A right solution would be as follows:

The adversary chooses some messages $m_0=x\ and\ m_1=y$. Then he sends these two messages $(m_0,m_1)$ to the challenger and get the encryption of one of them $<c_1,c_2>$. Then he picks some z and multiplies it with the  $c_2$ so he gets a new ciphertext $<c_1, c_2 . z> $. Then he queries the decryption oracle for the decryption of the new ciphertext. So, the resulting plaintext is either $x . z$ or $y . z$. Hence he can know which message has been encrypted.


texts:
What is the effect of the birthday bound on the security of AES-GCM, when a very large number of messages are encrypted?

I am looking for attacks that are useful in obtaining information about the plaintext and/or creating forgeries, not just distinguishers.


texts: What does the term "differential" in "differential privacy" mean?

texts:
I'm new in Differential Privacy (DP) and I have two questions:

Why do we have the term differential in differential privacy?
Are The local and global differential privacy and global and local sensitivity referring to different concepts?


texts: How would multiple uses of a vigenère cipher be decrypted on paper (classic)?

texts:
As far as I can tell (from reading the Wikipedia article about it) decrypting a message encrypted with the vigenère cipher is possible on paper.

But what would happen if the message is encrypted multiple times with a set of different keywords?

  "Thwaites challenged Babbage to break his cipher encoded twice, with keys of different length. Babbage succeeded in decrypting a sample, which turned out to be the poem "The Vision of Sin", by Alfred Tennyson, encrypted according to the keyword "Emily", the first name of Tennyson's wife. Babbage never explained the method he used. Studies of Babbage's notes reveal that he had used the method later published by Kasiski, and suggest that he had been using the method as early as 1846."
  Link to the Kasiski examination

(I must admit, I don't quite understand how to apply the method mentioned above effectively).

An example message:

First time (keyword: "ASIMPLEPASSWORD")
This is a secret message that was encrypted multiple times with a vigenere cipher
ASIM PL E PASSWO RDASIMP LEPA SSW ORDASIMPL EPASSWOR DASIM PLEP A SSWORDAS IMPLEP

Second time (keyword: "RANDOM")
TZQEXDEHEUJAHDHSKISTELPTOSOSEFRQXFTOQJLLALZVWIEMELTXWANACSEHRWKUESIG
RANDOMRANDOMRANDOMRANDOMRANDOMRANDOMRANDOMRANDOMRANDOMRANDOMRANDOMRA

Third time (keyword: "UNKNOWNTOYOU")
KZDHLPVHRXXMYDUVYUJTRODFFSBVSRIQKIHAHJYOOXQVJLSYELTXWANACSEHRWKUESIG
UNKNOWNTOYOUUNKNOWNTOYOUUNKNOWNTOYOUUNKNOWNTOYOUUNKNOWNTOYOUUNKNOWNT

Result
EMNUZLIAFVLGSQEIMQWMFMRZZFLIGNVJYGVUBWIBCTDOXJGSYYDKKWATQQSBLJUHSOVZ

The reason I'm asking is simple research (and curiosity). I'm writing a story involving encrypted messages in a fantasy setting (so, no computers!). In-depth knowledge about the cipher (including methods and formulas known today) can be used, though.

I'ld like to see if this method would be impossible to crack by "classic means/hand", or if it has it's own (perhaps obvious to experts) weakness.

How would an expert in this field approach the problem?

At what point would that expert either realize the message was encoded multiple times or mistakingly believe it's not a vigenère cipher?

What additional hint or information would that expert need to decrypt the message?


texts: What's the meaning of cached certificate revocation list and online certificate revocation list in X509RevocationMode Enum?

texts:
In this article, there are cached certificate revocation list and online certificate revocation list terms used.
I tried to find what these lists are but could find any human-readable info.
I want to understand where are these cached list stores on my computer (Windows, Linux) and what online list is used during online check (is there any URL from where I can download them)?
Thank you in advance.


texts: How CL-signature can act as positive & additive accumulator?

texts:
A paper (http://ieeexplore.ieee.org/abstract/document/7961987/) proposes a Braavos (adaptively sound dynamic positive accumulator).

Braavos uses two other accumulators. One is adaptively sound positive additive accumulator $ACC_A$ and the other is an non-adaptively sound positive dynamic accumulator $ACC_{NA}$.

In the paper, the authors says that they uses Camenisch-Lysyanskaya (CL) signatures (http://dl.acm.org/citation.cfm?id=1766811.1766838) as $ACC_A$.

I cannot understand how CL signature can be adopted as $ACC_A$.

$ACC_A$ requires {Gen, Add, Del, MemWitUpOnAdd, VerifyMem} protocols, but in the CL protocol they does not exist. {only Gen, Sign, and Verify}

My goal is to implement Idemix with Braavos (same as the paper).

Does anyone can let me know how can I implement $ACC_A$ using CL signature.


texts: Optimal bit-change-probability of the avalanche effect for hashes

texts:
Avalanche effect:

  The strict avalanche criterion (SAC) is a formalization of the avalanche effect. It is satisfied if, whenever a single input bit is complemented, each of the output bits changes with a 50% probability.

My questions are:

Is a 50% bit-change-probability optimal for any hash or is it just the minimal value so satify the strict avalanche criterion?
What if a hash-algorithm had a 100% bit-change-probability?


texts:
I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts.

The problem is that I need to return the original plaintext sum values.
How could I get them using decryption?
Is there an algorithm I can follow, given that I have both the private and public keys?

I have tried to decrypt it, but it returns the value $((g^{x+y}) \bmod P)$ where $p$ is prime, $g$ is a generator, and $x$ and $y$ are the plaintext which I need to know.

$x+y$ is usually a very large number.


texts:
Given an encrypted file, what are possible ways to find its encryption algorithm?

Heuristic ways are okay as well.


texts: Encryption using static AES256 symmetric key vs ephemeral session key

texts:
For a hackathon I am designing an information exchange system for healthcare. Healthcare data is stored on unsecured systems. I want to assure confidentiality, integrity and authenticity of this data nonetheless. To allow multiple people to access the same data, I want to use a system like openPGP (without the email/HTML vulnerabilities), where I use an AES256 symmetric key (CBC, PCKS5 padding?) that is encrypted with RSA-2048 encryption using the public key of each authorized user.

The encrypted versions of the symmetric key will be stored with the data. New files will be added to the data over time, so I don't want to create a symmetric key per file, since revoking or granting access to a new user would mean we need to re-encrypt the symmetric keys of all files every time we do this.

To guarantee integrity and authenticity of the files, I want to sign them using the private key of one of the authorized uses using SHA256-RSA.
Public keys will be stored on a PKI, but public key validity will be verified in a face-to-face contact.

My question is two-fold.

What is the risk of using a static symmetric key for encryption vs a session key that changes each time? Is it purely the forward secrecy that ensures that if one session key gets compromised the other data remains safe? Or are there also other risks with not changing the symmetric key?
How good/bad is this setup in general? Any other problems I am overlooking in this setup? Other algorithms I should use?


texts: Can the statistical width of the avalanche effect be calculated?

texts:
This question follows on from my answer to calculation-of-the-avalanche-effect-coefficient earlier.  I have reproduced the graph for this question.

Consider the red line which represents the number of bits changed for a single flipped input bit to SHA-512.  This is for 100,000 random bit flips.  The graph is normal, as expected for a full avalanche effect.  From preparing this graph, I can say that the mean (of course) is 256 bits, which is 512 /2.  As expected. (I actually get 255.5 but that could be my fault).

The standard deviation of this normal curve is approximately 11.3 obtained empirically.  That's for a SHA hash with a block size of 512 bits.

Q.  Is there a calculable mathematical relationship between the standard deviation and the block size, or must it always be determined empirically?


texts: Can a Feistel network have more than two halves, widening the block width?

texts:
Just to help   form this question, this is a Feistel network:-

To me this looks like:-

Why does the generic architecture have to have two halves?  We already have asymmetry in some variants.  As I understand it, the principal security comes from a secure permutation within the round function. All that happens outside of the round function is simple xor and swapping halves.

Could it have more than two halves then? Say five like the bread?  Or perhaps it has to be an even number of plaits /halves, so say four? Or ten? Yes it would mean more rounds to ensure good mixing of halves and be secure, but that's doable. So for example, with six halves of 64 bits each, would you have a 384 bit cipher?  Is there some intrinsic reason why this wouldn't work?


texts:
I am trying to find the sub keys of a FEAL-4 cipher. I am able to get a number of possibilities for $K_0$ after using Michael Stamps formula using a as a constant and going through $2^{32}$ keys. The problem is that I don't know what to do next as it isn't in any of the literature.

Stamps formula for a constant is

$$a = S23,29(L_0 \oplus R_0 \oplus L_4) \oplus S31(L_0 \oplus L_4 \oplus R_4) \oplus S31(F(L_0 \oplus R_0 \oplus K_0))$$

Looking for $K_1$ to $K_5$.

The FEAL-4 steps are:


texts: What Does This Symbol Mean? (Hardcore Predicates for One-Way Functions)

texts:
I am studying Pseudorandom Number Generators and when reading the discussion on One-Way Functions and Hardcore Predicates, I came upon this equation.

$$b(x,r)=\displaystyle \bigoplus_jx_jr_j$$

I understand that the $b(x,r)$ is the hardcore predicate (either a $1$ or $0$) but I do not understand the operation being performed here. Specifically, I have never before seen the XOR symbol ($\oplus$) used in this way and do not understand what it signifies. Is it the sum of the values found by XORing $x_j$ and $r_j$? $\bmod 2$?


texts: Can CTR mode be used with public key cryptography?

texts: Can counter mode be used in some way in public key cryptography? Can we decrypt when counter mode is used if 1. we have the key and 2. we have the cipher text? Is there any other mode in which this is possible?


texts: Is there an algorithm to check if an elliptic curve is secure?

texts:
As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$
Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there a known algorithm that can evaluate a pair of numbers $(a,b)$ and return YES if they are valid ECC parameters. Is this algorithm deterministic or probabilistic ?


texts: For the theoretic scenario of a brute force attack, how would you know if you succeeded?

texts:
That is something I never understood:

If you managed to brute force an AES encrypted text, how would you know you cracked it? After every attempt, you wold have to compare the text to an English dictionary right? That would take ages.

In the scenario of an AES encrypted program, you would get hexadecimal code every time even if you succeeded right? So you would not even know if you cracked it.

So i want to know, how do the best AES cracking methods of today work?


texts: File integrity checking: why use a hash tree instead of a hash list?

texts:
File sharing systems sometimes use the likes of a Tiger Tree Hash to check the integrity of a file as it is downloaded.

Hash trees in general are useful to check integrity of the tree leaves without downloading the full tree, instead needing only the root and tree branch that contains the interesting leaf (plus necessary stubs in the branch).

My question is: why use a tree at all for file integrity checking when what one presumably wants is to download the full file? A plain hash list (a hash per file block + a hash of the list) would have been trivial to implement and manage, and only be marginally bigger than the tree. The list's hash still works as well as the root hash in the tree case.

In fact I only know one file sharing client that allows one to select parts of a file to be downloaded, so the whole use case looks atypical.

So, is this a case of early, marginal, mostly unused optimization? Or am I missing something?


texts: RSA: Is it secure to use the private key to encrypt and the public key to decrypt?

texts:
This may sound weird:
What if I don't let others know my public key, then use my private key to encrypt, and the public key to decrypt? Is this secure?
Let me explain a little bit:

Common usuage: use private key to sign and disclose public key, then others can vefriy the data signature use public key

Weird usage: use private key to encrypt and don't disclose public key, in other end use public key to decrypt. notice here I will not disclose private key
either so it's not swap
In second scenario, if I can keep both keys secure(I mean don't disclose to otheres), does it secure?


texts: Is there any way to make an encryption scheme where you can check whether two values were very similar by only looking at the encrypted values. By alike I mean something like 1113740 and 1123740 are alike. Ideal would if you could make something like a threshold distance in a normed space. Is this possible or will these demands inevitably break the encryption?


texts: Polynomial sum of negligible functions need not be negligible

texts:
Let $\{\epsilon_i\}_{n \in \mathbb{N}}$ be a sequence of negligible
   functions and $q(n)$ be a polynomial in $n$. Then $f(n) = \sum_{i = 1}^{q(n)} \epsilon_i(n)$ need not be a negligible function.

Ideas

A typical negligible function is $2^{-n}$. Maybe we can expand it to the family $2^{-(n+i)}$ and set $q(n)$ to something that will give a sufficient large sum [didn't work]


texts: Can you help me understand this (old) school question related to RSA usage?

texts:
An old question I am preparing for a security / cryptography class has an example of an RSA chiper.

This is almost the same as "RSA by hand - did I do something wrong? (c = m on encryption)" but with some other question following up.

  Let $p=3$, $q=5$ giving $N=15$ and $\phi=8$
  Let $e=7$. Find $d$.

Fair enough, $e\times d = k\times \phi+1$ can be rather quickly evaluated to $d=7$. $k$ would be $6$ in this case.

Encryption of messages $m$ in the range $1 < m < n$ work fine with $e=d=7$. Not very helpful to have $e=d$, but it works. Well, kind of, as some messages get encoded to the same value (4, 5, 6 and 9 for example). So the target of encryption is reached only partly but the answer for the test $d=7$ is correct and complete.

This was the easier part.

Now… could you have chosen $5$ for $e$? And follow-up question: Why not? The solution provided has

  no

and

  because $5$ has a common divisior with $n$

Our lecture script and every page I found regarding RSA demands $e$ and $d$ to not share a divisior (except $1$, of course) with $\phi$. I never found a remark regarding sharing with $n$.

Problem is this: What happens if you use $e=5$ (and in turn get $d=13$) is that you get no encrytion at all. $c = m^e\ mod\ n$ stays $= m$ for all $m$.

So the mathematics "work", no information is messed up, but the desired encryption is not reached at all. Is there a reason why $5$ is kind of "neutral exponent"? Does such a thing also happen for "real" rsa values?

In this example $e=5$ is equal to $q$, is that what makes the encryption become an "Involution Mathematics" (wikipedia)?

How would one word his reasoning why $5$ is an unsuitable value for $e$? More important, how can one see this in a exam situation without excel spread sheet to quickly run some numbers (without any calculator, in fact)?


texts: Combating Traffic analysis Msc Dissertation ideas

texts:
I have started my MSc dissertation on anonymity (how to beat traffic analysis techniques) and i'm looking for practical ideas.  What tactics and software technology would be that guarantees private and confidential access to the web?

Any help will be much appreciated.


texts: Cracking short ciphertexts made by Vigenère cipher

texts:
I've encrypted a couple of 10 letters words from https://www.bestwordlist.com/10letterwords.htm  using a key of 10 characters. This is done using Vigenere cipher. Decrypt the cipher and give the key

Ciphertext: XRPEFGMHNL XDBEWUMHNL

How we can decipher when we have only 2n size ciphertext where n is the key size

Can you please explain how it can be done? Frequency analysis is not effective in this case as the ciphertext is really short...


texts: Can RSA be used as a one-time pad for authentication?

texts: In the case of Smart Contracts, there are self-destruct functions for the contract which can only be run by the contract owner.  In many cases attackers have found a way to take over the contract owner.  Would it be possible to place an encrypted blob along with the public key and original plain-text message in the smart contract?  Then at time of required authentication (when the true author wants to destroy the contract) the original private key could provided for authentication.  Is there any crypto flaw in this?


texts: Can a Vigenère cipher be solved if the alphabet is modified (custom)?

texts:
Let's say I have about a statistically good sample of characters of text that appear to be uniformly distributed, but the composition of the text is [A-Z], [a-z], [0-9], +, and / — constituting basically a base64 alphabet. To me, the more or less uniform distribution of the text suggests at least a polyalphabetic cipher, and possible a Vigenère.

As far as I've been able to find, there doesn't exist any Vigenère cipher program to decipher a base64 alphabet. As an amateur coder, I can see why, but firstly the biggest obstacle to creating the code is that the + and / and separated from the rest of the characters in the ASCII lookup table, so a rotation algorithm is not straightforward, like it is for just caps.

Would it be possible to create a custom code/algorithm to code and decode base64 text using the Vigenère method?

The barrier to coding it would be the order to place the alphabet— should it be lowercase, UPPERCASE, numbers, symbols— mapped in that order, or does it matter?

Does the ordering of the alphabet matter to using a Vigenère? Can the keyword be altered to decode the cipher text in a shuffled alphabet?

See, I actually have a lot of text that I suspect is base64 Vigenère, and I also have the key— but I just don't have an algorithm to decode it.

I should probably add that the amount of characters is in the thousands, so it would not be practical to decode it by hand.


texts: Requirements for attacker-controlled ECDSA identity point signature

texts:
Wikipedia's description of the ECDSA verification algorithm suggests verifiers should confirm that step 6 doesn't produce the identity point:

  Calculate the curve point  ${(x_{1},y_{1})=u_{1}G + u_{2}Q_{A}}$
  If $(x_{1},y_{1})=O$ then the signature is invalid.

Can a forged signature force this condition? If so, does the entity producing this signature need to know the private scalar for $Q_{A}$? What about forcing this condition for a given message?


texts: Does a key exchange protocol with mutual authentication which does not provide forward secrecy can be proven secure in Bellare-Rogway model?

texts: Is forward secrecy a necessary security property for a AKE protocol to be proven secure in Bellare-Rogway model? Is freshness also a necessary security property for a  AKE protocol to be proven secure in Bellare-Rogway model? If not why A(k) MTI protocol with key confirmation can not be proven secure in the Bellare-Rogway model?


texts: Discrete Logarithm (512 bits numbers) - Find exponent parameter

texts:
I'm trying to resolve a discrete logarithm equation:

$$y = g^x \bmod p$$

Every parameter is a 512-bit number. I know the values for $g$, $y$ and $p$ and I need to find the $x$ value. Finally, I know that $g$ is a primitive root of $p$.

I tried to look at some related topics about the discrete logarithm, but I can't figure out how to implement an effective algorithm  to solve this problem.

Here you can find the value for each parameter: http://pastebin.com/JKvedKNd

I have started to look at how some algorithm works, but I would like to know depending on these value parameters which could be the more efficient.

It is 80 bits from the actual record I think: https://en.wikipedia.org/wiki/Discrete_logarithm_records.
So there is something I am missing due to my lack of skills in the mathematics area.


texts: Decryption possible only within a period of time

texts:
Time-locked encryption and time-released encryption seem to be security systems focused on making sure that the decryption of certain message cannot take place before a certain time has passed.

However, I was wondering if there's in cryptography something aiming at the opposite of the above, so I would like to make the decryption possible ONLY during a certain period of time but NOT after that time has passed.

Would it be possible? If so, which mechanism do you know achieving this?


texts:
As per wikipedia
$$c = m^e \bmod n$$
where $c$ is the cipher text and $m$ is the original message.

To decrypt $$m = (c^d) \bmod n$$ that is $$m = (m^e \bmod n)^d \bmod n$$

My question is how do we have the following equivalence? $$(m^e \bmod n)^d \bmod n \equiv (m^e)^d \pmod n$$


texts: Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?

texts:
A fixed length CBC-MAC uses an all-zero block as the initialization vector.

Suppose that we used a randomized IV instead, and sent the IV along with the tag.
So if the message $m$ will be $m = b_1 || b_2 || b_3 || ... || b_l$, the MAC will be $(IV, t)$ where $t$ is the authentication tag defined as normal.

Why is this method of using a randomized IV more insecure than the normal method of using an all zero IV?

(This method was used in some nCipher products, and declared insecure in nCipher Advisory #13 – see also  nCipher Insecure CBC-MAC API Vulnerability.)


texts:
This question may seem like a duplicate of some others, namely this one, but even though that question asked when and how to use HMAC, the answers only addressed what HMAC was and why/how it worked.

So, my questions are:

When is it appropriate to use HMAC? If I'm encrypting files on my local computer? If I'm encrypting and syncing files to a server? If I'm sending messages to Bob? When is it not needed?
Simply, what is the recommended algorithm for generating a HMAC? I've seen the Wikipedia page, which does something strange with padding, and have read about HMACs in 'Practical Cryptography', where it says a and b are "specified constants" without going into detail about the constraints on these constants.
The book previously used h(h(m)||m) to prevent length extension attacks, then later defined a different algorithm for HMACs. Why was the former not appropriate for HMAC?


texts: UMAC: to what extent is it in use today?

texts:
Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the idea.

However, I've also discovered UMAC which sounds very much like a hash function/lookup table to select an appropriate hash for use in a MAC, via, crucially, "some secret process".

Is selecting an algorithm secretly in this way secure? Is the only secret in UMAC the algorithm in use, or does it combine some known secret as HMAC does? In other words, is it HMAC with a random H?

Finally, is this being used anywhere? HMAC has its own RFC whereas UMAC does not appear to have yet been so well adopted.


texts: Affine Cipher Keys that map plaintext to a given ciphertext

texts:
We first need to show that for each pair of plaintext-ciphertext
  letters ( x,y ), there are exactly 12 keys that encrypt x to y .  For
  each choice of a , the key ( a,y − ax ) encrypts the plaintext letter
  x to the ciphertext letter y , since ax
  + ( y − ax ) = y .  There are twelve possible choices for a so there are exactly twelve keys that map a given plaintext letter to a given
  ciphertext letter.

This is an easy question, I'm just trying to make sense of this statement found on page three here www.maths.uq.edu.au/courses/MATH3302/2010/files/cryptotute2.pdf

In the affine cipher how is their only 12 keys that map a given plaintext x to a given ciphertext y? I learned that the affinecipher has 286 nontrivial keys. So if thats the case how can only 12 of them map a given plaintext x to a given ciphertext y.


texts: How to find the right additive polynomial in inverse affine transformation in AES

texts:
Addition polynomial affine transformation rijndael is (x^7 + x^6 + x^2 + x)

The affine transformation represented in A(x)

A(x) = (x^7 + x^6 + x^2 + x) + a(x)(x^7 + x^6 + x^5 + x^4 + 1)mod x^8 + 1

Inverse of the multiplication can be found easily is (01001010) (x^6 + x^3 + x^1), so how to get the addition polynomial inverse affine transformation ?
it should be (01010000) (x^6 + x^4)

The inverse affine transformation represented in B(x)

B(x) = (x^6 + x^4) + a(x)(x^6 + x^3 + x^1)mod x^8 + 1


texts: There is a feature in Thunderbird under Account Settings > Security, in it are two options one can use: digital signing and encryption. What's the difference between it and Enigmail? Are they both equally secure or is the other more secure and reliable? As I understand it, one do need to have CA or S/MIME from a third party to use that secure feature from Thunderbird? Is it advisable to use that than Enigmail or can I combine the two?


texts:
I have an embedded device. It produces larges files (200 MB).
I want the device to encrypt the file before writing to disk, so I gave them all a 16-byte random key.

How can I transform the large file with the small key, with the least amount of CPU?

If I XOR the data with the 16byte key, its almost good enough. But it will show repeated patterns from which you can distract the key (for example if the input is 16 zeroes), but can I make it better without sacrificing on performance?


texts: How does using a really small block size reduce the key space?

texts:
I read this online and was confused:

Modern block ciphers tend to have block sizes of 128 bits or larger, because if the block size is too small there is the same problem as a small key space as described previously—the adversary can enumerate all the possible options and thus undermine the algorithm.

How does a small block size reduce the key space?


texts: How to distribute session keys in public key cryptography?

texts:
In public key cryptography we can also use session keys which are symmetric. How do the sender (say a server) provides this session key information to its clients?

If the sender (here server) provides the session key by encrypting using its private key, all the clients (including a malicious one) can decrypt (using available public key) and see that session key , right? The server can't use public key to encrypt the session key since none of the clients have private key to decrypt it.

I am wondering what information I missed here to understand the basic idea of distribution of session key?


texts: Rainbow tables, where have I got it wrong?

texts:
There seems to be some error in my understanding of the concept of rainbow tables, despite going through quite a bit of articles on it.

Let me show what I don't seem to agree with.

My plain text is 5-digit numeric input.
Hash function - MD5
Reducing func - Get the first 5 decimal digits from the cryptotext

Constructing a single chain

12345   827ccb0eea8a706c4c34a16891f84e7b
82708   71b8e22700e63c2a0c1bad6506549d3b
71822   03010f7d7933a011782c10faf91c4fca
03010   cae05e8533d17be83bce0f451d5c7dd7
05853   a6864772e19671240f491bc2c89a36e0

This gets me one entry in my Rainbow table

12345 -- a6864772e19671240f491bc2c89a36e0

Lets test this with a sample:

Test hash (nota bene: this is not a valid hash, just for consideration)

th = tb05be8531317be83bce0f451d5c7dd7

With the reducing function:

R(th) = 05853

Then on hashing gives us:

a6864772e19671240f491bc2c89a36e0

Now, though the end result matches, its doesn't resolve my hash into a valid plain text.

Would this not be the case for every hash generated through this process? The only true hash match would be the last plain text value which is hashed, and doesn't really relate to the initial plain text.


texts:
Let $\mathbb G$ be a cyclic group of order $q$. The Discrete Logarithm Problem (DLP) is, given $g, g^x \in \mathbb G$, to compute $x \in \mathbb Z_q $.

I'm interested to know if there is a known variant of DLP as follows:

  Given $g, g^x, g^{x^{-1}\bmod q} \in \mathbb G$, compute $x \in \mathbb Z_q$

It is clear that this variant would not be harder than the DLP, since a DLP solver could be used to solve this problem simply by ignoring the third input.


texts: Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

texts:
I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way the same input encrypted with RSA should produce a different output each time.

However, the wikipedia page for probabilistic encryption addresses a seeming simple solution but doesn't give any details what is wrong with it:

  An intuitive approach to converting a deterministic encryption scheme into a probabilistic one is to simply pad the plaintext with a random string before encrypting with the deterministic algorithm. Conversely, decryption involves applying a deterministic algorithm and ignoring the random padding. However, early schemes which applied this naive approach were broken due to limitations in some deterministic encryption schemes. Techniques such as Optimal Asymmetric Encryption Padding (OAEP) integrate random padding in a manner that is secure using any trapdoor permutation.

Can someone explain (to a beginner) what is insecure about random padding being added?

In addition, for PGP encryption using RSA, my understanding is that a random nounce / AES key is generated and encrypted using RSA. Then that AES key is actually used to encrypt the source text.

So, if the whole AES key is random to begin with (and required to know anything about the encrypted text) - what exactly is OAEP adding?


texts: Is there an additive homomorphic encryption that supports exponentation

texts: For example say we have two numbers a and b. Now is there any partial homomorphic encryption scheme that allows to compute (a-b)^2 over the ciphertexts of a and b without round trips.


texts: ECDSA signing and verification between Python and JS

texts:
I'm trying to have Python (2.7) and JS solutions for ECDSA signing (with secp256k1 curve) where ideally signatures generated by one side can be verified by the other.

For the python side, I'm using the ecdsa library:

from ecdsa import SigningKey
from ecdsa.curves import SECP256k1
ecdsakey = "59b1ad799522457fa5ed171cb850800fe511e55181d81250e66d42ff536427a1"
sk = SigningKey.from_string(ecdsa_privkey, curve=SECP256k1)
hash = "b93b25c03a2238e749272a99d8a47dbcc19c2db65b9b27671f1ec6b5defd279b"
print(hash)
hash = codecs.decode(hash, 'hex')

sig = sk.sign_deterministic(hash)
print(codecs.encode(sig, 'hex'))
vk = sk.get_verifying_key()
print(vk.verify(sig, hash))

For JS, I'm using secp256k1:

let hash = "b93b25c03a2238e749272a99d8a47dbcc19c2db65b9b27671f1ec6b5defd279b";
hash = Buffer.from(hash, 'hex');

// generate privKey
let privKey = "59b1ad799522457fa5ed171cb850800fe511e55181d81250e66d42ff536427a1";
privKey = Buffer.from(privKey, 'hex');

// sign the message
const sigObj = secp256k1.sign(msg, privKey)

console.log(sigObj.signature.toString('hex'));

// get the public key in a compressed format
const pubKey = secp256k1.publicKeyCreate(privKey)

// verify the signature
console.log(secp256k1.verify(msg, sigObj.signature, pubKey))

Both of the above work fine on their own, the signature is verified as expected. The problem arises when I try to get the signature from JS and verify it using Python or vice versa.

The signature generated by Python is:
3fa041c044403331c19767e2c4ff3a44e764ec7bdbb7fffa190157ffbe3f9ba317c1ff5254fef28597862a7adec3699cb0fda0ec003b3d9d28b554b321006ee8
So I feed it into secp256k1.verify:

let signature = "3fa041c044403331c19767e2c4ff3a44e764ec7bdbb7fffa190157ffbe3f9ba317c1ff5254fef28597862a7adec3699cb0fda0ec003b3d9d28b554b321006ee8";
signature = Buffer.from(signature, 'hex');
console.log(secp256k1.verify(msg, signature, pubKey))

The signature generated by JS is: 062a87f01f86a540c6c28dcfb7b59ed85ea72ef3549bc1ddff8bb08cbabcc6b444a13bab43c82521cf3440db8619ab1ac14d46b4b696dd506fd5b104c06366dc
So I feed it into the verifying key:

sig = "062a87f01f86a540c6c28dcfb7b59ed85ea72ef3549bc1ddff8bb08cbabcc6b444a13bab43c82521cf3440db8619ab1ac14d46b4b696dd506fd5b104c06366dc"
sig = codecs.decode(sig, 'hex')
print(vk.verify(sig, hash))

Above throws BadSignatureError

So my question is: is there any setting or something else I'm missing that I need to set in order to have the two solutions be cross-compatible?


texts: Is there a guarantee that for each possible hash y there exists a number x such that with hash function H, H(x) = y?

texts:
Specifically talking about SHA-256 here and its involvement in Bitcoin, this was a question someone asked me which I didn't know the answer to. Yes, I am aware that SHA-256 can only have a hash from $0$ to $2^{256} -1$, so it is fine for this to be the range for our y. I am asking within the range, is there a guarantee that there is an x for each possible y.

I ask this mainly because I wonder if there is anything that guarantees that a new Bitcoin block can always be made with a hash below its target.


texts: Suppose $H(X) \rightarrow Y$ is collision resistant. Is $H$ also one-way?

texts:
If we have $H(X) \rightarrow Y$
and it is collision resistant.
Can we say that $H$ is also one-way? And if that is true can you give me an example?


texts:
A = hash("blue" + X);
B = hash("pink" + X);

If A and the literals are known and X is unknown, are there attacks on B aside from the attacks on directly on hash()?  In other words, is B safe?

Would it be better to reverse the concatenation?

A = Hash(X + "blue");
B = Hash(X + "pink");

If it matters, I am using hash=sha256.


texts: Locally Dedcodable Codes and Private Information Retrieval

texts: Does anyone know about Locally Decodable Codes (LDCs)? It seems the private information retrieval schemes that based on LDCs are computationally efficent (answer a query without processing the whole database). Why LDCs receives little attention in cryptographic world?


texts: Why is time-lapse cryptography not popular?

texts:
Time-Lapse Cryptography has been introduced by Michael Rabin and Christopher Thorpe in the paper “Time-Lapse Cryptography”, but it does not seems to be popular. It is a really good paper with an great theoretic background and the authors themselves mention to release an implementation of it “in a few months” (stated in 2006). Yet surprisingly, I couldn't find any reference of it on Google.

Does any one know the reason behind this? Have the authors abandoned this idea?


texts: Confusing notation in the definition of differential privacy

texts:
I've started looking into differential privacy from scratch following "The Algorithmic Foundations of Differential Privacy" by Dwork and Roth (freely available online). The mathematical notation is however somewhat confusing. On page 16, they define Probability simplex and Randomized algorithm as:

Is it correct that $\Delta(B)$ is a simple categorical probability distribution over $B$? Or is is something else?

Here's my reasoning:

$B$ is a categorical random variable of cardinality $|B|$ (so having $|B|$ categories) so $\Delta(B)$ is a probability mass function, PMF (which is a discrete probability distribution function) over $B$. Why? It assigns each category from the random variable B a probability value > 0 such that the sum of all values is one.

But the second definition looks somehow under-defined:

  A randomized algorithm $\mathcal{M}$ with domain $A$ and discrete range $B$ is associated with a mapping $M : A \rightarrow \Delta(B)$

What exactly is $A$ here? It is the domain of the algorithm, but is it discrete, continuous, single-dimensional, multi-dimensional, or what? Or it doesn't matter?

  On input $a \in A$, the algorithm $\mathcal{M}$ outputs $\mathcal{M}(a) = b$ with probability $(M (a))_b$ for each $b \in B$.

This notation is confusing: $(M (a))_b$ - why they index with lower-cased $b$ and what does it mean?

  The probability space is over the coin flips of the algorithm $\mathcal{M}$.

Flipping a coin sounds funny in a formal definition (why not simply say "a Bernoulli distribution with $\theta = 0.5$"?). Nevertheless, the last sentence doesn't make much sense to me: what is "the probability space"?

I've looked up several other sources but they use different notation and don't even bother with these "first principles". So any explanation is much welcome.


texts: How secure is AES in a critical situation?

texts:
So this one is a tinfoil-hat question.
It is 99 % theoretical.

So we assume that I am someone who stores highly confidential information. Maybe super secret stolen goverment stuff. And I get caught by the authorities.
The information is store in an AES256-XTS: Sha512 volume.
The attacker has unlimited money and power. Maybe a data-center.
So how long would it take to crack this and what would he attacks? The hash or the block cipher ?

PS: I know that AES was not chosen as standard because it is so secure, but because it has the best performance / hardware implementation / security balance. So maybe there are some AES backdoors in the implementation of some encryption-tools. So would it be better to use another algorithm in the case of highly sensitive data?


texts: Server authentication in TLS 1.2 with static DH

texts:
For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (link):
  struct {
      select (KeyExchangeAlgorithm) {
          case dh_anon:
              ServerDHParams params;
          case dhe_dss:
          case dhe_rsa:
              ServerDHParams params;
              digitally-signed struct {
                  opaque client_random[32];
                  opaque server_random[32];
                  ServerDHParams params;
              } signed_params;
          case rsa:
          case dh_dss:
          case dh_rsa:
              struct {} ;
             /* message is omitted for rsa, dh_dss, and dh_rsa */
          /* may be extended, e.g., for ECDH -- see [TLSECC] */
      };
  } ServerKeyExchange;

For RSA cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by decrypting pre-master secret sent by client in ClientKeyExchange message (link):
struct {
    select (KeyExchangeAlgorithm) {
        case rsa:
            EncryptedPreMasterSecret;
        case dhe_dss:
        case dhe_rsa:
        case dh_dss:
        case dh_rsa:
        case dh_anon:
            ClientDiffieHellmanPublic;
    } exchange_keys;
} ClientKeyExchange;

How does the server authenticate itself and prove possession of the private key matching its cert for static DH? It won't send ServerKeyExchange, because its public key embedded in its certificate already contains relevant info. Client won't send ClientKeyExchange with EncryptedPreMasterSecret, because this is not RSA.
Does the server prove possession of the private key solely by being able to arrive at the same master secret as the client?


texts: How much data can I encrypt with AES before I need to change the key in CBC mode?

texts:
In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted.

It seems that the advantage of $1/2 ^{32}$ is somewhat arbitrarily chosen, and I'm not sure where that comes from.  Can anyone explain the reasoning of why this is chosen and when it should be higher or lower than $1/2^{32}$?

My class notes:

  CBC: CPA Analysis

  $q = $ # of messages encrypted with key $k$
    AES uses 128 bit blocks
    $L$ = length of the max message

  For every adversary $A$ that attacks cbc encryption, there is a
    PRP adversary $B$ with

  $$  Adv[A,E_{cbc}] \leq 2 · Adv[B, E_{prp}] + \overbrace{2 · q^2· L^2 / |X|}^{\text{error term}}$$

  So CBC is only secure as long as $q^2·L^2  \ll |X|$.

  Example

  The error term = $q ^ 2 · L^2  / |X| < 1/2 ^{32}$

  AES:    $|X| = 2^{128}$ (bits per block)
            So after $2^{48}$ AES blocks the key needs to be changed.

  DES:    $|X| = 2^64  \Rightarrow  q·L < 2 ^{16}$

Also, the instructor said that DES needed a new key after $2^{16}$ blocks, and he said that means every .5 MB of data requires a change.  This is the formula he wrote down, Is this correct?  $2^{16} · 8 = 1/2$ MB.


texts: How exploitable are cache timing attacks?

texts:
So there's a recent PHP package that has been written to protect against cache timing attacks, which can be seen here
.

My question is...  just how exploitable are cache timing attacks?

My overall impression is that they're extremely difficult to exploit and attempting to protect against them is rather like using a 1MB two-prime RSA key instead of a 2KB two-prime RSA key to protect against factorization - that it is unnecessary and impractical


texts: Bitwise operation on secret values revealing the result only to the participants

texts:
Given the following situation, what sort of cryptographic construction am I looking for?

Alice has a bitfield (vector, polynomial representation, etc.)
Bob has a different bitfield of the same length
Alice and Bob want to know the bitwise AND of their two bitfields without revealing the result to others and without revealing their personal bitfields to each other or anyone else

For example

Alice has 0101
Bob has 1100

What would one do for Alice and Bob to know the result 0101 & 1100 = 0100 without revealing anything as stated above?

I imagine this would require some combination of zero-knowledge and homomorphic techniques, but I will be the first to admit that this is probably a bit out of my depth.


texts:
Can someone help me understanding the CCM authenticity bound by Phillip Rogaway?
i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$.

$\tau$ is tag length, where as $b$ is block length. $q_{\text{dec}}$ is the number of forgery attempts, I can not get whats "$\sigma$" is?

Also If i am not looking for forgery attempts but looking for the channel errors that cause invalid message to go through CBC MAC. Then for that case $q_{\text{dec}}=1$. Am I right?
And I am attempting to send 500MB of data? So what will be the number of un-authenticated messages that go through CBC MAC because of channel errors.


texts: HMAC construction based on the combination of two hash functions

texts:
I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of $\operatorname{HMAC}(H_1)$ and of $\operatorname{HMAC}(H_2)$.  The combined HMACs in TLS and SSL have attempted to achieve this property, but according to Anja Lehmann's dissertation, not very well.  Lehmann suggests a construction for combining $H_1$ and $H_2$ to make a generic $H_*$, but with considerable complexity and expense.

I was wondering if there is a construction specific to $\operatorname{HMAC}$ that's simpler and cheaper.  One I thought of is something I call $\operatorname{HMAX}_{H_1,H_2}(k,M)$, which derives $\mathrm{ipad}$ and $\mathrm{opad}$ from $k$ as in standard $\operatorname{HMAC}$, then computes

$$\mathrm{inner} = \mathrm{opad} \operatorname\| H_1(\mathrm{ipad} \operatorname\| M) \operatorname\| H_2(\mathrm{ipad} \operatorname\| M)$$

and then outputs:

$$H_1(1 \operatorname\| \mathrm{inner}) \oplus H_2(2 \operatorname\| \mathrm{inner})$$

This construction seems to capture the collision-resistance of the concatenation hash combination and the PRF-amplification of the XOR hash combination. It also doesn't inflate its output length. I don't have a proof that it works though.  Does this seem like a good or bad idea?

Edit: Add "$1$" and "$2$" to the outer hashes to prevent an answer of $0$ when the same hash is used for $H_1$ and $H_2$.  Thanks to Paŭlo Ebermann for pointing out that corner case.


texts: what if key of aes will be more than 32 bytes?

texts:
For example, if I use AES-CTR and use key of 44 bytes.
Will it be breakable or not and why?
How to use AES-CTR correctly?


texts: What criteria make the theta step of Keccak's round function reversible?

texts:
From what I've been reading, Keccak's round function is reversible. That's pretty obvious for the $\rho$, $\pi$ and $\iota$ transforms. For $\chi$ to be reversible, $x$'s range has to be odd — but that's alright since Keccak's $x$ has a range of 5. Yet, what criteria make the theta step reversible?

Checking some small $x$, $y$ and $z$ ranges, it shows that:

where [x][y][z]'s ranges are [3][3][2], $\theta$ is not reversible, and
where [x][y][z]'s ranges are [3][3][3], $\theta$  is not reversible either.

So, what makes the $\theta$ for (eg) [5][5][64] reversible?


texts: "Double Encryption" using the same cipher?

texts:
When it comes to the words "double encryption", I cringe.  What I see is the following scenario play out.

Someone has plain text and they encrypt it with the AES cipher using the 14 round variant, so AES256.  Then they run that encrypted information, through again another 14 rounds thinking it is double encrypted.

In my mind, I think of it differently.  When I think of encryption and doubling it, I believe the strength of encryption, in the case of AES, as being tied to the number of rounds through the algorithm. So in this scenario, I think of double encryption as 28 rounds through the AES cipher.

In short - AES(28 round) > AES(14 round) + AES(14 round)

I have read some whitepapers on cascading encryption, but they referred to using two different ciphers, not the same cipher twice.

Is there anyone able to shed some light on this for me?


texts:
We all see X509 certificates with 2048/4096-bit RSA key pairs; however, it is difficult to understand how they work in the DH part of the TLS handshake.
At most, they authenticate and sign. DH 4096-bit generates "parameters," which I know is time-consuming.
When the server generates those parameters, what do they look like? What has the 4096-bit key become? I generated certificates with Let's Encrypt, but I cannot recall seeing the process. I only saw an RSA key pair, I think. Yet DH will be used for the session key exchange, not the RSA keys.
So far, I have only found one document that talks about public and private keys for Diffie-Hellman, even though most people on the web say there are public and private keys with DH.


texts: Are ECDSA keys and RSA keys interchangeable?

texts:
Is it possible to use an ES512 key pair for RS512 signatures?
Is it possible to use an RS512 key pair for ES512 signatures?
I've also posted an issue in the NodeJS jwa package.

I created a key pair for EC512 with the following commands:

openssl ecparam -genkey -name secp521r1 -noout -out ecdsa-p521-private.pem
openssl ec -in ecdsa-p521-private.pem -pubout -out ecdsa-p521-public.pem

Then, instead of using ECDSA as I should, I used RSA:

jwa = require('jwa');
rsa = jwa('RS512');
signature = rsa.sign('hello', fs.readFileSync('ecdsa-p521-private.pem').toString());
result = rsa.verify('hello', signature, fs.readFileSync('ecdsa-p521-public.pem').toString());

And the result was true!

Is this an expected behaviour? Is it possible to use ECDSA keys for RSA and vice versa?

Thanks

--- EDIT ---

Here's a list of possible algorithms to choose from (for my json-web-token implementation), so we will have common terminology:

HS256:   HMAC using SHA-256 hash algorithm
HS384:   HMAC using SHA-384 hash algorithm
HS512:   HMAC using SHA-512 hash algorithm
RS256:   RSASSA using SHA-256 hash algorithm
RS384:   RSASSA using SHA-384 hash algorithm
RS512:   RSASSA using SHA-512 hash algorithm
ES256:   ECDSA using P-256 curve and SHA-256 hash algorithm
ES384:   ECDSA using P-384 curve and SHA-384 hash algorithm
ES512:   ECDSA using P-521 curve and SHA-512 hash algorithm

--- EDIT ---

Following Squeamish Ossifrage's suggestion to use ed25519, here is my Node.JS code for signing and verifying "nonstandard ed25519 json-web-tokens".

const jwt = require('jsonwebtoken');
const base64url = require('base64url');
const ed25519 = require('ed25519');

const ed25519Header1 = base64url.encode(Buffer.from('{"alg":"Ed25519","typ":"JWT"}'));
const ed25519Header2 = base64url.encode(Buffer.from('{"typ":"JWT","alg":"Ed25519"}'));
const noneHeader = base64url.encode(Buffer.from('{"alg":"none","typ":"JWT"}'));

function sign(obj, privateKey, options) {
  const noneToken = jwt.sign(obj, '', { ...options, algorithm: "none" });
  if (jwt.decode(noneToken, {complete: true}).header.typ !== 'JWT') {
    throw new Error("Invalid object to sign");
  }
  const [, payload] = noneToken.split('.');
  const signature = base64url.encode(ed25519.Sign(
    Buffer.from(`${ed25519Header1}.${payload}`),
    { privateKey } // passing an object makes sure we want to sign with private-key, not seed.
  ));
  return `${ed25519Header1}.${payload}.${signature}`;
}

function verify(token, publicKey, options) {
  const [tokenHeader, payload, signature, ...leftover] = token.split('.');
  if ((tokenHeader !== ed25519Header1) && (tokenHeader !== ed25519Header2)) {
    throw new Error("ed25519 jwt malformed - unexpected header");
  }
  const signatureBuffer = base64url.toBuffer(signature || '');
  if (base64url.encode(signatureBuffer) !== signature) {
    throw new Error("ed25519 jwt malformed - invalid signature format");
  }
  // signature is a string, therefore payload is a string (not undefined)
  if (!ed25519.Verify(
    Buffer.from(`${tokenHeader}.${payload}`),
    base64url.toBuffer(signature),
    publicKey
  )) {
    throw new Error("Invalid signature");
  }
  return jwt.verify([noneHeader, payload, '', ...leftover].join('.'), '', {
    ...options,
    algorithms: ['none']
  });
}

a pair of publicKey and privateKey can be generate with the MakeKeyPair(...) function of the ed25519 package (privateKey should be 64 bytes long and publicKey should be 32 bytes long).

The code allows to enjoy both ed25519 signing, and the features of the jsonwebtoken package.

For example:

var token = sign({hello:"world"}, privateKey, {expiresIn:'1 minute'})
console.log(verify(t, publicKey)); // prints { hello: 'world', iat: 1526078738, exp: 1526078798 }
// After 1 minute:
verify(t, publicKey); // Throws "TokenExpiredError: jwt expired"


texts:
I have three questions regarding CP-ABE:

1) Is it correct to assume that in this scheme there is only one public key? Private keys are generated based on one's attributes that I do understand, by the authority.

Previously I thought I would be able to generate one's public key based on one's attribute (identity ID for example) and encrypt data with one's public key which I generated based on recipient's ID. But now I see it was wrong thinking, you need to encrypt data with a public key, which is only one throughout the lifetime of the system, and the encryption mechanism just takes into account the values of attributes which you've specified. Is that correct?

2) If above holds true and there is only one global public key based on a global secret then I assume there's no way for message originator to sign his message under this scheme. So that a recipient could verify that the message originator is really the one in possession of a given attribute (such as Id). I'm thinking of ways of implementing authentication under this scheme.

3) If one encrypts a message under specific access structure parameter values are these values in plaintext? I mean if one encrypts a message under attribute ID value '11' is everyone else able to see who the recipient actually is? I mean are they able to read the value '11'.


texts: What is Standard Referencing of Cryptography Papers

texts:
I am writing a paper. One of my references is

  1)Barreto, P. and Rijmen, V., “The Khazad Legacy-Level Block Cipher,” Submission
     to the NESSIE Project, vol. 97, 2004.

My professor criticize me that why I wrote submission to the NESSIE Project or why you did not write the journal of this paper or did not wrote the number of pages of this paper. What is its conference and where did it hold?

I searched in internet but most of all papers write this reference like $(1)$.

I am really confused and need help to write this kind of cryptography papers.

Really Thanks for any suggestions.


texts: Which signature is considered more secure and has less communication cost?

texts:
This article uses Elliptic Curve Cryptography, but when it comes to signing and verifying messages it is not using the ECDSA signature algorithm. In the article, they mentioned that the communication cost for a single message is 104 bytes. According to what I've read about ECDSA signatures is that their sizes are 2 times longer than the private key (For the secp192k1 curve, the private key is 192-bit integer (24 bytes) so the signature will be equal to 384-bit (48 bytes)).
So, I was wondering:

First how to calculate the communication cost because I didn't understand exactly how did they find in the article the result 104 bytes?

Second which is more secure and has less communication cost (lightweight), is it the ECSDA or the article's method for calculating the signatures?


texts:
Why is the complexity of pre-image resistance $2$ raised to the power of $n$?
I have been looking in everything lecture about pre-image resistance, but I still didn't know the answer.