texts: Does it matter if I publish only publish good or bad MD5 hashes after recovering from a hack?

texts:
(This question is a follow-up from another question I asked about MD5, which is why I'm insisting on using MD5 in this question as well)

My imaginary Linux distribution, Sushi Linux has had a big incident.  Hackers gained access to the website and replaced the download link with a link to an infected ISO file.  The website was taken down, and a backup was restored, after making sure that this cannot happen again of course.

Still, my logs show that the infected ISO file was downloaded by a lot of people.  I want to give them easy instructions to check whether or not they are infected.

Both the infected and the uninfected ISO file have the same size, but they have different MD5 sums.  My religion does not recognize any other hashing algorithm than MD5, so that's what I'll use in 2019.  I know about the weaknesses but since no other hashing algorithm exists I'll use it anyway.

My users are afraid that they installed Sushi Linux using an infected ISO and they ask me how they can check.  The ISO file they can download from my website today is the uninfected one, and I've fixed the problem the hackers used to get in last time, they're not getting in a second time.  However, my users want a way of verifying their local file without downloading a new one (most Sushi Linux users are on 56K modems so they don't want to download it again).

I've considered publishing the MD5-sum of the infected ISO, so that users can identify their local ISO as being the infected one, and I've considered publishing the MD5-sum of the correct ISO, so that users can identify their local ISO as being the uninfected one.  My webmaster is hourly, so I can only publish one hash.  Does it matter which hash I publish for users to be able to check if they have the infected file or the real file?


texts: Required key size for an ideal cipher with a 32 bit block size

texts: For an ideal block cipher, what size key would be required when the cipher has a 32-bit block size?


texts: Proving that you have $k$ keys out of $n$ without revealing which keys they are

texts: I'm looking for a cryptographic algorithm where Alice can prove that she has at least $k$ private keys out of $n$ to Bob, without revealing which keys she knows.


texts:
Let $\Bbb{G}$ be a cyclic group of prime order $q$ generated by $g \in G$.

Let $G$ be a  PRG defined over $(\Bbb{Z}_q^2, \Bbb{G}^3)$ such that:

$G(a, b) = (g^{a}, g^{b}, g^{ab})$

How can I show that $G$ is a secure PRG assuming DDH (decisional Diffie-Hellman) holds in $G$?

After reading this, I'm confused to prove $G$ is secure:

  Importantly, the DDH assumption does not hold in the multiplicative group $\mathbb{Z}^*_p$, where $p$ is prime. This is because given $g^a$ and $g^b$, one can efficiently compute the [Legendre symbol] of $g^{ab}$, giving a successful method to distinguish $g^{ab}$ from a random group element


texts: Cryptographically strong seeded pseudo random number generator

texts:
Why is the following not cryptographically secure?

Seed the algorithm with 32 random bytes S[0].

S[0] --hash--> S[1] --hash--> S[2] --hash--> S[3] ...
 |              |              |              |
hash           hash           hash           hash
 |              |              |              |
 v              v              v              v
R[0]           R[1]           R[2]           R[3]

The hash function is cryptographically strong, i.e. it cannot be reversed.

The outputs (R) comes in 32 byte blocks, R[0] onwards.

Obviously this is far too simple to be secure, but I wondered why.


texts: Generating HMAC(SHA256) keys using WebCrypto deriveKey() API

texts:
I am using the javascript WebCrypto API window.crypto.subtle.deriveKey() API to generate HMAC keys like this:
this.key = await window.crypto.subtle.deriveKey(
  {
    name: "PBKDF2",
    salt: someSalt,
    iterations: 50000,
    hash: "SHA-1"
  },
  keyMaterial,
  // default length value!
  { name: "HMAC", hash:"SHA-256"},
  true,
  [ "sign", "verify" ]
);

now, here is what the documentation on the MDN site
https://developer.mozilla.org/en-US/docs/Web/API/HmacKeyGenParams
mentions about the key length:
HmacKeyGenParams
The HmacKeyGenParams dictionary of the Web Crypto API represents the object that should be passed as the algorithm parameter into SubtleCrypto.generateKey(), when generating a key for the HMAC algorithm.

Properties
name
A DOMString. This should be set to HMAC.
hash
A DOMString representing the name of the digest function to use. You can pass any of SHA-1, SHA-256, SHA-384, or SHA-512 here.
length Optional
A Number — the length in bits of the key.
If this is omitted the length of the key is equal to the length of the digest generated by the digest function you have chosen.
Unless you have a good reason to use a different length, omit this property and use the default.

It basically says that the default length of the key is the length of the digest (in bits).
I was expecting a key length equal to 256 bits assuming that the digest size in bits for SHA256 is 256. However, dumping the object returned by deriveKey() into the developer console reveals a length of 512 bits (both for chrome and firefox - pretty recent versions).
Leaving apart that this kind of issues are difficult to discover and debug (since initially you see that some message digest computed somewhere else does not match the one computed in the browser), after fixing the issue (by using an explicit length of 256 bits) there are some things which I still do not understand:

Which standard recommends the key length for HMAC based signing, authentication aso?
Is there a bug in the WebCrypto API documentation or in its implementation?
Which is the optimal/recommended key length for HMAC(SHA256) based signing?

deriveKey() is documented here on the MDN site:
https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveKey


texts: Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?

texts:
If we assume the strength of RSA is based on the difficulty of factoring (which I know we can't guarantee) and we compose the modulus of some other quadratic ring that is a unique factorization domain like the Gaussian integers, what is the resistance to attacks based on factoring with classical computing techniques?

As far as I know they are still vulnerable to quantum computing attacks as factoring in most (all?) of these rings is reducible to the hidden subgroup problem for finite Abelian groups, but for classical attacks involving number field sieving, are these rings as difficult to factor as the integers?

For instance, if I composed a key in classical RSA of 2048 bits, is 1024bits of the real part and 1024 bits of the quadratic coefficient equivalent? (1024bits a + 1024bits bi for example for Gaussian integers?)

Are there any tricks to make it easier to factor or do discrete log in these fields, like there are in polynomials?


texts:
Is a perfect hash function always bijective ?
  In Wiki  "In mathematical terms, it is a total injective function" but it does not mean, that it is bijective.


texts: What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE

texts:
The general limits from the NIST recommendation are as follows:

  Maximum Encrypted Plaintext Size ≤ 239 - 256 bits;

  Maximum Processed Additional Authenticated Data ≤ 264 - 1 bits;

This stack overflow answer (https://crypto.stackexchange.com/a/20340/44337) hints that the maximum invocation of 239 - 256 bits of encrypted plaintext is too big and “you should be advised to stay well away from those limits.” In this case what kind of limit makes sense where I can optimize the use of a generated key, but also not decrease the security of the cipher text? Is reaching the maximum invocations of the encryption operation of 232 operations considered too dangerous? Should I go ahead and limit the amount of invocations to 231? Or may be half that to 216? I have the ability to generate new keys at any time for any file. So the question is what is a good trade-off between maximum key use and security. Obviously I can’t process more than 239 - 256 bits with the same key.

Some of the comments on stack exchange mention the maximum number of 96 bit NONCEs to use with the same key is 228.9 which will keep the security above 264  (Is the length limit of AES-GCM per key or per (key, nonce) pair?). I am strictly trying to figure out what the maximum safe size of the processed message with the same key/NONCE is before the need to re-generate the key or change the NONCE.

Another stack exchange question deals directly with the size of the encrypted message but does not give a recommendation of the safe maximum size (Plain text size limits for AES-GCM mode just 64GB?). Instead it shows that the security depends on the tag and the number of encrypted message blocks. The relationship is n - k, where n is the tag length and k is the number of encrypted blocks. So for a 96 bit tag processing a message of size 232 blocks, this gives us 96 - 32 = 64 or 264 security. Which is pretty low. Other commenters say to chunk the encryption at around 10GB per chunk. But what kind of security are we achieving then?

It seems that AES-GCM is not well suited to encrypt large files unless more complexity is added in chunking the files appropriately at some safe limits such as 1 GB or 10 GB etc. May be a better solution would be to use ChaCha20/Poly1305, but that is out of the scope of this question. I want to see what the current limits of AES-GCM are before I decide to change the cipher.


texts:
have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and its modes of operation.

When we say that we use a 128-bit key, does it mean that the data input's size is 128-bit or not? Generally can the block size be smaller than key?
A block receives a plaintext. When the same block can receive a new plaintext?
How can I perform each mode to make a system which encrypts information (parallel sequential)? I think that in NIST publication is clearly which modes can be performed pipelined or not. Although, I've been asked to find new ways of performance. What can I do? Please some help.


texts: Difference between polynomial embedding and canonical embedding

texts: Can anyone tell me the difference between working in the polynomial embedding for $R$-LWE, and working in the canonical embedding?


texts: Security reason for introduction of PCI Key Blocks

texts:
MAC and encryption keys used in financial transactions have always been stored encrypted as cryptograms (of same length) on ostensibly unassailable hardware devices using 3DES. Now the requirement is that these cryptograms be replaced with key blocks of greater length in which the key and other data is embedded. The reasoning is that they will be harder to break this way.

But since all PIN blocks must at some point in a transaction be translated from one key to another, and PIN blocks, which have a known format, would be the easiest things to decrypt, key blocks don't seem to add any security. And still, as in all symmetric systems, if one key is broken, all are.

I'm trying to understand and appreciate the need for this cumbersome new layer.


texts: Is it right that the Bomba can halt, but give you a different settings other than the one Germans really used for encryption using an Enigma?

texts:
Considering different groundsettings for these messages:

AWE RDE

AFR AFG

HIU HKQ (where similar letters were known as (1,4) ,(2,5) females etc.

I think the cipher clerk rotated the rotors based on the groundsettings with an offset of the 3 for the 2nd enigma in a pair. While that might produce the same letter in each enigma in a pair whether Bomba gives an accurate result of rotor order and ring settings. In other words can bomba still halt but give you different settings other than the one Germans used.


texts: High Power Computing for Crypto Research

texts:
Obviously, much of cryptography requires the assumption that adversaries have bounded computing power.

So, I was wondering, are there any fields in cryptographic research for which high power computing would aid researchers? Obviously, even the most advanced computers today will not give them an asymptotic advantage, but my question is:

Does crypto research require high computing power and if so specifically which field?


texts: differential cryptanalysis cipher for the final round

texts:
I have a problem to find the sub-key.
The  system is…

For each round, we make the following stage:

We add the round key $K_i$.

Substitution : we have 8 blocks of 4 bits, and an S-box takes each block.
S = [7,3,6,1,13,9,10,11,2,12,0,4,5,15,8,14]

Permutation : circular shift of 2 to the right.

I choose the differential $\Delta(1 \implies 4)$ because after the permutation the differential trail is $\Delta(1 \implies 4 \implies 1)$.
I coded in C, the algorithm to find the $K_5$, the sub key after 5 rounds.
plainText[m] is a random message and plainText[m+1] is plainText[m] ^ 1(difference).
 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000   0000   0000   0000   0000   0000   0100
                                                    \
 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000  0000    0000   0000   0000   0000   0100

I tested the function of encryption and decryption, it operates normally.
The problem is that I get a uniform array, because when I decrypted message, the differential trail is good for all the keys while normally this should not always be the case for any key for a message.
For example:
plaintText[i]=7584 and plaintText[i+1]=7585(7584 XOR 1).

In my code, for key=0,u=69b900ca and up=645100ca and tmp=2b131dd4 so beta=4. For key=1,u=69b900ca and up=645100cb and beta=4. The problem is that for any key, I get the same beta.


texts: Point of Diffie-Hellman key exchange when public keys are known

texts: Since the basic version of Diffie-Hellman key exchange protocol is vulnerable to Man In The Middle Attack, some sort of authentication is needed. It was mentioned that RSA digital signature can be used to handle this case. However, I don't understand that if the public keys of the two parties are known to each other, what would be the point of using DH at all? One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key. I appreciate if anyone can clarify the benefit of using DH in case of known public keys.


texts: Separate Read and Write Keys in TLS Key Material

texts:
Why does the TLS protocol use different symmetric keys for receiving and sending data?

Isn't it enough to have a single key used for both reading and writing?


texts:
I was reading about Encrypt-then-MAC and everywhere I go it seems people include the IV with the ciphertext generated for each message then MAC that and send all the information concatenated.

Why do I need to send the IV more than once?


texts: DSA: why using mod p mod q and not just mod p

texts:
I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$.

As far as I understand, we want to use two different primes $p$ and $q$ instead of just one to make sure that $g$ is of prime order $q$ in order to be able to invert elements (let me know if my understanding is wrong). But once we make sure to have $g^q = 1 \bmod p$, why do we add on top of that another modulo q? After a quick look, all the equations seems to hold if we just work modulo $p$...

The only reason for me that could explain it would be that because $s$ is computed modulo $q$, it's not really useful to store $r \bmod p$, and for "optimization" one can store directly $(r \bmod p) \bmod q$... Is it the reason or did I miss something?

Thanks!


texts: Just how insecure are VeraCrypt containers encrypted with short passwords?

texts:
When I create a VeraCrypt file container using the GUI, it displays a warning whenever I type in a password under a given number of characters. I was wondering just how insecure, in practical terms, such a method of encryption really is.

To give a concrete example, suppose:

I have a 4 GB VeraCrypt-generated container on a USB drive.
The password for said container consists of 9 lower case letters, from the standard English 26 letter alphabet.
Within said container are a dozen or so files, ranging from a few bytes to a few hundred megabytes in size.
The USB drive in question falls into the hands of a party hostile to me.
Other than the contents of the USB drive described above, this hostile party has no knowledge of how the container is encrypted.

How much trouble will that hostile party have in decrypting my container? Could an intelligent and motivated, but otherwise quite ordinary, programmer with a mid-range laptop do it, or would he have to call in the CIA, etc?


texts: Does classifying an integer as a discrete log require it be part of a multiplicative group?

texts:
This question is not a question about the discrete log problem, the generalized discrete log problem, or an additive group.

The confusion is whether any integer can be considered a discrete log or whether a discrete log has as a precondition, that it be part of a multiplicative group. This wikipedia would seem to indicate that the answer is yes.

For example 0 doesn't have a multiplicative inverse and is therefore not part of a multiplicative group.


texts:
I saw this answer at this site about decoding a 3-rotor Engima machine's settings:

How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

And did some math for the decoding method in the highest ranked answer:

$2^{20}$ * $2^{19}$ * $2^{9}$ * ("run Index of coincidence as statistical test again, deriving of the trigram information of the underlying language")

To get an estimate of the number of operations to be 281,474,976,710,656. Googling Nvidia GTX 480 graphics card says that it can do about 1.3 teraFLOPS, so I got about 4 minutes as an estimate for running the decoding.

My question is approximately how many minutes would it take to decode a few sentences of text encrypted with a 3-rotor Engima machine simulation with a PC with a GTX 480 GPU without a crib with this index of coincidence method? I'm guessing maybe 10 minutes?

I haven't found a GPU based solution online yet and am hoping reinventing this wheel won't take too much effort to code and run.


texts: How can I calculate non-linearity of an s-box element wise?

texts: First i transform the s-box into row matrix like if i have 4×4 s-box having 16 elements into 1×16 row matix then substitute the binary values in column . multiply the matrix by mobius trasformation matrix then tell me how to trasform the s-box which is in binary form into decimal form? Also how i calculate the non linearity of certain element of that s-box.


texts: UC-framework: Simulating specific cases (proof in PVW)

texts:
I am struggling to understand the proof of security in the UC-framework of the OT by PVW.

The cases I don't understand are the cases where:

i) Both parties are corrupted. In this case, they say that the simulator just lets the adversary generate and exchange all the messages. But isn't the simulator supposed to extract their inputs? What does the simulator sends to the ideal functionality in this case? How is this case indistinguishable from the ideal-world execution?

ii) Both parties are honest. In this case, they say that the simulator just simulates internally the protocol between the parties and delivers the exchanged messages to the adversary in the real-world. I don't quite understand how this simulation is indistinguishable from the ideal-world execution because the simulator does not have access to the inputs of the parties in the ideal world. So, it is unlikely that the parties in the simulated protocol end up with the same inputs and outputs. What am I missing in this case?

Thanks!


texts: Do Weil, Tate, and Ate pairings exist on all elliptic curves?

texts:
I don't know much about the math behind elliptic curves.
Do Weil, Tate and Ate pairings exist on all elliptic curves? If the answer is negative, then what pairings do MNT, BN and SS curves have?

When we say that an elliptic curve has an embedding degree of $k$, do all these pairings map $E(GF(p))$ to $GF(p^k)$? Furthermore, when we speak of embedding degree, are we assuming a specific pairing?

Which of the Weil, Tate and Ate pairings is more efficient? Are there any security trade-offs between these pairings?


texts: Are HAIFA-construction based hash functions (e.g. Argon2) resistant to length-extension attacks?

texts:
Would a HAIFA-construction based hash function like Argon2 resistant to length-extension attacks?

I say that Argon2 is HAIFA-based because BLAKE is, and Argon2 is based on BLAKE.


texts: Groth-Sahai proofs and the hidden-bits model

texts:
In the Groth-Sahai proof system, the authors mention (section 1.2) that one of the reasons behind the inefficiency of previous NIZK proof systems is their reliance on the hidden-bits model. Then, they state that other previous work avoided this by using bilinear pairings (but still used a reduction to CSAT, which is not the focus of their proposal.) Thus, I understand that, in their system, they follow the bilinear pairing approach to avoid the inefficiency stemming from the hidden-bits model.

Then, in the description of their framework (section 5), they use a Common Reference String (CRS) that includes some carefully chosen group elements and mappings. Among these mappings, there is $\iota_1,p_1,\iota_2,p_2,\iota_t,p_t$, where the $\iota$'s allow moving from the "witness domain" to the "commitment domain" and the $p$'s the other way around. The security of their proposal relies on the hardness of applying the $p$ mappings without an appropriate trapdoor.

Now, my doubt is: How is this avoiding the hidden-bits model? I mean, there is a predefined CRS with public information, which is later used by a prover to "hide" information from a verifier, since the verifier cannot apply the inverse mappings (the $p$'s). Which is precisely the hidden-bits model if I'm not mistaken.

Is it just that, with the statement in section 1.2, they rather meant that they create an "efficient version" of the hidden-bits model? Have I just got something messed up?


texts: Product of Negligible and Non-Negligible Functions

texts: I know that the product of two negligible functions will always be negligible, but I'm wondering if it's possible for the product of two non-negligible functions to be a negligible function?


texts:
I'm looking for a cryptographic algorithm that allows encrypting only 8 bits of data in a block. Is there any such algorithm that is considered secure?

The reason I'm asking is because I have to encrypt and decrypt the data contained in SPI Flash memory (the BIOS flash), and I need it to be really fast to get the cyphertext and give the plaintext to the CPU. The CPU can fetch 8 bits at a time, and can jump to a different address each time.


texts:
Suppose a set of Shamir's redistributable-secret-sharing participants issue a redistribution of subshares.

I envision this as a series of points on a line (2 of N, is planar, easy to think about).   Redistribution appears to create new lines that point to the heights of the original shares - but when the vectors are transposed they now can be used to derive points on a line that intersects the original key.

During redistribution, new indices can be chosen instead of re-using the same, there is no effect on the final values.  Imagine the actual indices chosen are not redistributed however, and instead a fixed value W is secretly added to each of the x-indices before transmission of the subshares.

Now the recipients reassemble the sub-shares, producing shares.   These shares will all lie on the same line, and will pass permutation based consistency checks.

But they will point to a different, essentially random, but consistent "secret".

The question is... can the recipient of these modified subshares determine what the original secret is?  From what I can tell, the effect of adding W depends on the random coefficients used during subshare redistribution, and should not be recoverable.

Normally the recipient could reconstruct... but with the fixed addition of W the recipient should receive... in essence ... the computation of a distributed hash function on W.

But I'm not sure.  If I graph this using 2 of 2, it seems like the recipient of the final shares, in order to deduce the original secret, would have to know the random coefficients used during each shareholder's redistribution.

Essentially I'm trying to create a distributed hash function.   I haven't found one that is "redistributable" the way shamir's secrets are.   Using a shamir secret, I can create a function ... and then add new members of the group and remove members of the group without re-rolling the original discarded secret.


texts: What does $\Pi$ represent in cryptography?

texts:
I am doing a project in cryptography and while reading a tag generation algorithm for files, I got stuck with the meaning of $\Pi$. The screenshot of the algorithm is inserted below.

Here the KeyGen algorithm generates 1 public key and 2 secret keys and the TagGen algorithm takes a file $M$ (which is divided into $n$ blocks which is again divided into $s$ sectors) and the secret keys generated by the KeyGen algorithm. TagGen has to compute tags for blocks of the file $M$. I am stuck with how the data tags are computed here.


texts: How to encrypt incomplete block with RSA as a block cipher?

texts:
I have a question about an RSA academic example.
If we are using block-RSA with a block-size of 3 and we have this message: "android". It is broken into 'and', 'roi', 'd'.

How to encrypt the last character 'd'?


texts:
I know that

  In cryptography, the linearization attack is a method of cryptanalysis
  for block ciphers

I am looking for an example of linearization attack couldn't find it online

Could anyone please explain it with an example?


texts:
In MAC forgery, is it assumed that the attacker has the secret key or not?
I find this in Wikipedia but still not clear.

  Existential forgery is the creation (by an adversary) of at least one message/signature pair, ( m , σ ), where σ was not produced by the legitimate signer. The adversary need not have any control over m, m need not have any particular meaning; the message content is irrelevant — as long as the pair, ( m , σ ), is valid, the adversary has succeeded in constructing an existential forgery.


texts:
Recently, when I studied the permutation cipher, I saw a matrices structure which is same as permutation cipher. This method was so simple and interesting for me.

Let $m$ be $n$-bit plain text and $P=[p_1,...,p_n]$ be the permutation secret key such that $P(m_i)=m_{p_i}$.

For example, let $m=5={(101)}_2$ and $P=[2,1,3]$. So $P(5)={(011)}_2=3$. In mathematical points of view, we can do this method with matrices multiplication as fallow:

$P(m)=\left(\begin{array}{ccc}m_1&m_2&m_3\end{array}\right)\cdot\left(\begin{array}{ccc}0&1&0\\1&0&0\\0&0&1\end{array}\right)=\left(\begin{array}{ccc}m_2&m_1&m_3\end{array}\right).$

In general case, instead of using $P$ as $1\times n$ vector, we can use $n\times n$ matrices with $0,1$ elements, such that there exist only one $1$ in each column( in the position $p_i$).

This equivalent presentation make analysis and attacks so easier. Is there exist similar mathematical method for substitution cipher?


texts: The "openssl genrsa" command only generates a private key?

texts:
The command :

openssl genrsa -out RootCA.key 4096

generates a single file named RootCA.key. When I open the file, it only contains the private key.

Then the next command:

openssl req -new -x509 -days 1000 -key RootCA.key -out RootCA.crt

Generates a certificate , named RootCA.crt containing the Root's public key.

How can the second command generate a public key, given ONLY the private key?
 Isn't the whole value of cryptography depends on the impossibility of generating one key from another in a key pair ??


texts:
Assuming I have multiple symmetric keys on specific machine(more than 10000 probably),
can I use the same rsa key to encrypt all of those keys?
I'm a bit concerned from a situation where multiple encrypted keys will have similar pattern
and will leak data about the original ones


texts: How to break AES CBC PADDING with chosen ciphertext attack

texts:
I'm doing a penetration testing for a web application that uses AES CBC PADDING encryption for the parameter ?email=ciphertext then it's printing the plaintext email on html body.

I would like to know if is there any possibility to :

Crack the IV or the KEY using chosen plaintext attack?
Can i encrypt a given plaintext?


texts: Given a pseudorandom function F, is $(F_k(r) \; | \; F_k(r + 1))$ also a PRF?

texts:
Given: F is a pseudorandom function, G is a pseudorandom generator with $l(n) = n+1$. The following schemes should be classified as being insecure, IND-COA secure, IND-CPA secure.

To encrypt $m \in \{0, 1\}^{n+1}$ choose a random $r \leftarrow \{0, 1\}^n$ and output $[r, G(r) \oplus m]$
To encrypt $m \in \{0, 1\}^{n}$ output $m \oplus F_k(0^n)$
To encrypt $m \in \{0, 1\}^{2n}$ choose a random $r \leftarrow \{0, 1\}^n$ and
send $[r, m \oplus (F_k(r) \; | \; F_k(r + 1))]$

My guesses are that:

Insecure, since an attacker A is not only given the ciphertext c, but also the key $r$ with which the message was encrypted. Thus, it can easily decrypt the ciphertext.
I would say that it's not IND-CPA secure, since it's deterministic. But how can I prove/determine whether it's IND-COA secure? I would usually do proof a by contraposition, but I don't know how to start.
I have no idea whether this scheme is IND-COA or IND-CPA secure, since I don't know whether $(F_k(r) \; | \; F_k(r + 1))$ is a pseudorandom function.

Any hints or ideas? I appreciate any help!


texts: Encrypt entire payload or only confidential parts of payload?

texts:
In cases where a large complex data structure contains elements that are a mix of confidential and not-so-confidential data, what would be the pros & cons of:

encrypting the entire structure with one key; or
encrypting only the parts of the data structure that contain confidential data?


texts: What is the difference between a cryptographic primitive and a functionality?

texts:
In the context of papers using the UC framework, I have seen the same cryptographic tools refereed as cryptographic primitives and functionalities. Are the two terms interchangeable?

An example is here:

  Bulletin Boards and Smart Contracts are primitives which form the backbone of our result.

and

  We also assume that there exists a Smart Contract functionality that incorporates this ideal Bulletin Board.


texts: Randomized functions cannot increase statistical distance

texts:
In these lecture notes instructor Chris Peikert states the following lemma without a proof

  Let $f$ be a (randomized) function on the domain of $X$, $Y$. We have

  $\triangle (f(X), f(Y)) \leq \triangle(X, Y )$

where triangle denotes statistical distance between two random variables.

First question: How can I prove this?

Second question:

Assume $X$ and $Y$ are independent uniformly distributed random variables. Define randomized algorithm $f$ like this:

$f(x) := \text{return 1 if $X = x$ and 0 otherwise}$

However, $\triangle (X, Y)=0$, but $\triangle (f(X), f(Y))$ is not zero? What I am missing here?


texts: The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable output function?


texts: How does second pre-image attack on Merkle Signature Scheme work?

texts:
I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public key) being constructed 1. However, I thought that there are two steps to verifying the signature.
Assuming, Winternitz is used as the one-time signature, the one-time signature is first being verified and then following the authentication path to get the root node. Assuming the attacker used the intermediate nodes as the leaf nodes, would this mean that he would have to use that intermediate node (hash of 2 child nodes) as the public key of the OTS.

I am confused as to how the OTS verification would work, does this mean that the attacker has to find a pre-image $x$ so that $H(x) = y$ where $y$ is the intermediate node?
Are there any reference papers talking about this attack on the Merkle signature scheme?

I understand the portion on the merkle tree attack, but for the merkle signature scheme, there is the portion of verifying the OTS first before traversing the tree to construct the root node. My question is on how the attacker can get past the OTS verification given that it seems he has to find a pre image


texts: I used to figure that message authentication codes function like digital signatures: a hash of a message is calculated and then encrypted with a secret key. To verify the authenticity of a message, the recipient calculates the hash of the message, decrypts the MAC with the secret key, and compares the two. I have not seen a single MAC that works like this. Is this insecure?


texts: Are there any Truth Table to Boolean expression converters?

texts: I am working on Bent functions that are of interest in cryptography. I developed an algorithm that construct such functions. However, I need some tools to calculate boolean expression from the truth table. Is there such a application or applet available? (Actually I am interested in expressions without any NOTs).


texts: Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature?

texts:
A DSA signature consists of two scalars $(r,s)$.

When signing $s$ is generated as:

$s=k^{-1}(H(m)+xr) \mod q$
The signature is $(r,s)$

When verifying $s$ is only used to compute $w = s^{-1}$. So why does DSA store $s$ in the signature instead of $w$?

Using $w$ has no performance effect on signing since computing either $s$ or $w$ requires one modular inversion. $w = s^{-1} \mod q = k (H(m)+xr)^{-1} \mod q$.
It would speed up verification since the modular inversion to compute $w$ isn't necessary anymore.

The only advantage of $s$ I see is that the modular inversion can be computed before the hash is known. Did the DSA designers consider that pre-computation more important than the verification slowdown, or is there some other advantage of using $s$ that I don't see?


texts: Hash function over numbers that preserve addition and multiplication

texts:
I wonder if there is a known hash function that for any $x$, $y$ which are numbers in a certain range with certain accuracy (I guess one can think of them as integers?), you can define two functions corresponding to addition and multiplication such that:

$h(x) \# h(y) = h(x+y)$

and

$h(x) \cdot\cdot h(y) = h(x \cdot y)$.

Edit: I now see it is slightly duplicated with Is it possible to subtract/multiply numbers using homomorphic encryption?


texts: aside from DES has the NSA ever strengthened algorithms?

texts:
When DES was originally developed, the NSA changed the s-boxes. For decades people thought that their changes introduced a backdoor but then it was discovered that their changes actually strengthened DES against differential cryptoanalysis.

The NSA is well known for it's placement of backdoors into algorithms. They kinda did this with DES when they reduced it's key strength but Dual_EC_DBRG is the most famous contemporary example of this.

Anyway, my question is...  are there any other examples of the NSA strengthening non-classified cryptographic algorithms?


texts:
This might sound as a silly question but does the Sylow theorem III apply to (Z/pZ)*?

For Example for (Z/11Z)* we have the order of the group being 10 = 2 * 5.

I would expect to have only 1 Sylow 5-subgroup. Or am I wrong?


texts:
I gather, from reading the GPG manual, that symmetric encryption based on a password uses one of a variety of Key Derivation Functions (KDF). Although not explicitly mentioned I assume that PBKDF2 is the default as the other options appear to be legacy algorithms from the PGP standard.

However I can't find any information on the number of iterations that the KDF does by default of whether there is a way to change that value manually. I want to know this because it would have an impact on the required complexity for the password (e.g. number of words generated using the diceware method) to achieve a given level of security.


texts: Encrypt a file once with 50 characters password or twice with 25 characters?

texts: What better Encrypt the file once with 50 characters password or encrypt it twice each time with 25 characters password.


texts:
The Problem is as follows:

$E: y^2=x^3+17230x+22699 \pmod{23981} $
$p=23981$ is prime number
point $G$
$G$'s order $109$ :  prime number

Alice creates a public key by selecting a private key $d$ ($d<q$)
public key $Q= dG= (3141,12767)$
therefore public information : $a,b,p,G,q,Q$
private key : $d$
However this curve has the following characteristic:
$$\Delta =-16(4a^3+27b^2)\bmod{p} = 0$$
That is, the discrimant is $0$.
and embedding degree is 2

Q. How do I determine if a curve is a CUSPS or a Node?
Q. How to find private key $d$ in this case?


texts: Is it possible to reverse the final rounds of SHA-256

texts:
I've seen a lot of preimage and collision attacks on SHA-256 that target the first few rounds. So far, the best attacks break preimage resistance for the first 52 rounds out of 64 rounds.

However, I've never seen an attack that targets the last few rounds of SHA-256. Is it possible to launch a preimage attack on the last few rounds of SHA-256, rather than the first few rounds?

EDIT:

For example:

Scenario 1:

The attacker knows the second half of the plaintext message (32 bytes out of 64 bytes). At the 64th (final round, not including the final group operation), the hash output is X.

Can we find the output of, for example, the 55th round based on X? In other words, is it possible to execute a full preimage attack and reverse the last 9 rounds of SHA-256?

Scenario 2:

The attacker knows the second half of the plaintext message (32 bytes out of 64 bytes). Only 8 bytes of the hash output at the 64th round (final round, not including the final group operation) is known.

Can we find the possible outputs of, for example, the 55th round based on the partially-known output from the 64th round? In other words, is it possible to execute a partial preimage attack and reverse the last 9 rounds of SHA-256?


texts:
What is the "created" field below? How can you translate that into an actual date?

Source: https://davesteele.github.io/gpg/2014/09/20/anatomy-of-a-gpg-key/


texts: SHA1 calculation for millions of strings having common prefix

texts:
I have a function in which I need to calculate SHA1(common_prefix + random_string). I am calling this function many times so that calculation of SHA1 slows down the performance of the function. As for the all of the calls, I am using a common_prefix, is it possible to tweak SHA1 in a way that it won't calculate the hash for the (common_prefix+random_string), however it does something like a preprocessing for (common_prefix) and using this preprocess(calculated values) to calculate SHA1(common_prefix+random_string)?

Is it somehow possible to do it?


texts: Are there any practical differences between running a PRNG on a subset of bits from an RNG compared to running the RNG?

texts:
Given an RNG and a PRNG.

We define RNG(k) to mean that the RNG produces k random bits.

We define PRNG(k, seed) to mean that the PRNG uses seed to produce k pseudo-random bits.

Case 1: - Generate n random bits using just the RNG.

bits = RNG(n)

Case 2: - Generate n random bits using the PRNG, and using the RNG as a seed

seed = RNG(n/2)

bits = PRNG(n, seed)

My question is whether there is any practical or even theoretical difference to these in terms of security?

From an outsider, I am assuming that both would seem to be completely random bits.
How does the amount of random data fed to the PRNG from the RNG affect the randomness? My intuition is that if the PRNG is fed less than 256 bits of random data, then the result from the PRNG can be calculated by brute force.


texts: How can AES be considered secure when encrypting large files?

texts:
Why is AES considered to be secure when encrypting large files since the algorithm is a block cipher?

I mean, if the file is larger than the block size, the file will be broken down to fit the blocks. Then the same key is used to encrypt each block of the file. And as I know it, using the same key to encrypt multiple messages/blocks is not a good idea. Is not that how AES works?

Or do I have misunderstood something? :-)


texts: Would reuse of the symmetric key in a hybrid cryptosystem between files be inherently insecure?

texts:
This question stems from a UX problem where I want to allow the user to input their PIN only one single time when they open up an mobile app. Here are some properties of the application to provide some context.

The user is on a mobile device with a bluetooth smart card reader
The data stored on the device is PII-data and national regulations (Sweden) state that the data must only be accessible via secure 2-factor auth
I'm planning to use a hybrid cryptosystem for the sensitive data
The symmetrical key will be decrypted with the smart card
I want to store the information for offline use so an embedded web browser for an online webapp does not cut it.
There will be multiple files that requires encryption, media for example will all be individual files.

Given these prerequisites I plan to have one symmetrical key defined for each unique user per app install.

This means any data synced to that app install for a single user will use the same symmetric key. This way I want to decrypt all files related to one user with the same symmetrical key. I consider it something similar to an OAuth2 token (but without the renewal part right now).

Please help me assess if there are any security flaws with this model!


texts: How to produce a ternary value (3-face "dice roll") digest from a message?

texts:
Apologies in advance if the terminology I am using in the title of this question, is flawed.
I want an algorithm that will produce a ternary value (meaning from a set of three, as opposed to from a set of two as is the case with a 1 bit / binary value) given some message (of arbitrary length, much the same way message digest procedures accept such messages).
The required properties of the algorithm mirror requirements on cryptographically secure message digest algorithms:

The algorithm has to be deterministic with respect to input, producing same output for same input

The product of the algorithm must be irreversible to the original message. Arguably, reversing one single ternary bit into some message of any substantial length sounds akin to solving some intractable data compression problem, but just mentioning this for the requirements own sake.

The set of values the algorithm would produce must feature a sufficiently "random" distribution.

Every value would be present in quantities amounting to exactly 1/3 of the set, meaning the algorithm must also feature "fair" distribution of values.

To express this more plainly, perhaps, I am ultimately looking for a message digest algorithm which, instead of yielding some 128-, 256- or any other amount of bits worth of digest, yields one single ternary (as opposed to binary) value/number.
An algorithm that, by extension, turns a product of some existing traditional message digest (e.g. SHA-256) into a ternary value, would suffice, but I am not sure I can, for instance, just divide some 256-bit value by 3 to get me some sufficiently random value distribution. However, piggybacking on an existing, cryptographically secure message digest algorithm, could be a solution in general, I suppose.


texts: Is Schnorr's digital signature a non-interactive zero-knowledge proof?

texts: If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-Shamir transform, can we convert Schnorr's protocol into a NIZK proof?


texts:
Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used.

In Bouncy Castle, for example, FpCurves take curves of the form $y^2 = x^3+ax+b$ (Weierstrass), whereas the (safe) curves found on the above linked have different forms, such as $y^2 = x^3+ax^2+x$ (Montgomery) - how do I translate between the two? How do I use the second form of curve with, for example, Bouncy Castle?

(Or do I simply have to accept that no safe curves of the Fp form exist?)

What else have I tried? Guide to Elliptic Curve Cryptography (Hankerson et.al.) covers curves of the forms $y^2 = x^3+ax+b$ for fields with characteristic > 3, and only offer alternatives (that are not interchangable with the safe curves, either) for lower characteristics, that are not very useable in my situation. Even then, some curves on the safe curves website are of forms that I cannot immediately find explained anywhere.


texts: Does Right-to-Left Modulus Exponential Technique make sense for RSA?

texts:
The theory for right to left modulus exponential technique is very straight forward if the explanation is using a small modulus n number. For example,
$$3^{77} \bmod 11$$
In this example, we know that the remainder will be always less than 11 which the maximum remainder in this case will be 10. Hence, when we are implementing the square across right-to-left binary bits, the biggest square operation will be 10 and followed by modulus 11 & so-on
However, if we are applying this in the RSA formula. For example,
$$S^e \bmod n$$
where $n$ is the product of $p \times q$ and it can be up to 4000 over bits. Regardless of the value of $e$, using the right-to-left technique, the sub-step anyhow will involve the square of the remainder. In this case, does it mean worst case we will have 4000 bits x 4000 bits, and it will yield 8000 bits result & followed by the modulus $n$ operation. (This doesn't sound make sense to me, of course, there is also a high chance I don't 100% understand this technique)
I apologize if the question sounds silly to you. But I like to get more idea of how to practically apply this technique into the real world RSA implementation. The right-to-left technique looks like only help in the big exponential side, but there is still a big modulus number portion to be resolved which I still couldn't make sense where the most internal source is more focusing on the exponential side.
Appreciate it if you can enlighten me.


texts: Is it possible to get better randomness by using multiple PRNGs?

texts:
I don't know if this question even makes sense, but:

Is there be any benefit or impact to some sort of hierarchical (e.g. a PRNG drives the decision for which PRN to pull from a set of PRNGs) or state-based model (e.g. a PRNG determines the next PRNG to pull from, which in turn determines the next, etc.) or combination thereof. Or might this somehow lead to a less-random output.

If there is some benefit to the aforementioned, then what about the difference between using multiple PRNGs with same implementation using different seeds, versus using multiple different PRNG implementations.


texts: Is MAC-then-encrypt with stream ciphers secure?

texts:
While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is secure with stream ciphers, even if not generically.

However, there's this attack when the MAC is deterministic and the cipher a stream cipher (or a block cipher in e.g. CTR or OFB mode, or even a OTP):

Assume the attacker knows the authenticated plaintexts of two different equal-length messages: $m_1||MAC(m_1)$ and $m_2||MAC(m_2)$.
The attacker intercepts the ciphertext of a third equal-length message: $E_k(m_3) = S_k(n) \oplus (m_3||MAC(m_3))$, where $S_k(n)$ is a unique keystream from nonce $n$.
The attacker can now modify the message in flight to $S_k(n) \oplus (m_1||MAC(m_1)) \oplus (m_2||MAC(m_2)) \oplus (m_3||MAC(m_3))$.
With a high probability, that is only a valid message when $m_3$ matches either $m_1$ or $m_2$, which the attacker could learn from whether the receiver e.g. asks for a new message (assuming corruption) or accepts it. If it was one of those two messages, it becomes the other instead.

This seems to both give the attacker information on the original message $m_3$ and allow them to forge communications.

Is there something wrong with the attack (e.g. did I assume too much) or is this just a lesser break than the paper (pdf) from that answer considers?


texts: Does XOR'ing a random number with its inverse reduce its security if the result is a palindrome?


texts: How to sign a large file for random-access reading?

texts:
I need to write an "Authoring" application which produces large files. These files must be signed so that the "Consuming" application knows that it was authored with a matching key.
The consuming application must access the signed files read-only, with random access. This means it will not read the full file but still must check that the read bytes are signed.

I have thought cutting the data into 64k blocks and sign these blocks individually using a RSA private key with Crypto++.

Is there a RSA scheme which produces fixed size signatures?
The last block can be as small as 1 byte. Is there any cryptographical risk doing this?
Is this globally a good idea?


texts:
When I've been researching authenticated encryption, the following terms keep showing up:

NM-CPA
NM-CCA

....without any definition as to what they mean. I've tried searching the web for their definitions, but I'm not getting very far. Could someone explain what these abbreviations mean, and why papers such as this one don't give a definition of their meaning?

Edit: While the possible duplicate question explains IND-CPA and IND-CCA (which I think I'm still going to have trouble remembering), it doesn't explain the NM- ones.


texts: Why this brute force attack doesn't reduce all cryptographic hash functions' security bits against collision attacks to N/3?

texts:
The traditional brute force collision attack is generate $2^{N/2}$ (unique) random strings, hash them and this results in ~50% chance for collision.
The attack talked in the question's title is generate hashes by the sequence $H_0 = F(S), H_n = F(S||H_{n-1})$, where $S$ is a string to make collision with, $F$ is the hash function, and the sequence stops at $2^{N/3}$.

The above attack needs less calls to the hash function because it relies on the fact that each sequential hashing reduces the number of possible hashes. When hashing $2^N$ random strings, there will be $(1-(1-\frac{1}{2^N})^{2^N})2^N$ possible hashes because of all the collisions.

The sequence that tells the fraction of the possible hashes for each hash in the sequence is $P_0 = 1, P_n = 1 - (1-\frac{1}{2^N})^{2^NP_{n-1}}$, which roughly approximates to $P_n = P_{n-1} - \frac{P_{n-1}^2}{2}$ as $\lim_{P_{n-1}\to 0}$, which can be approximated into a function $P(n) = \frac{2}{n + 2}$. (these reductions in precision make it easier for future calculations)

The chance for a collision to NOT happen for a hash in the sequence against all of it's following hashes is $C_n = (1 - \frac{1}{P_n2^N})^{M - n - 1}$ where $M$ is the sequence's length, because the fraction is so close to $1$, it can be approximated to $C_n = 1 - \frac{M - n}{P_n2^N} = 1 - \frac{Mn - n^2}{2^{N + 1}}$. Now to approximate the multiplication of all $C$s ($C_0C_1...C_M)$ to get the chance for collision for all hashes combined, we can discard the multiplication (because again, $C_n$ is very close to $1$) and add all the subtracted parts and subtract them from $1$, which results in $1 - \frac{M^3/2-M^3/4}{2^{N+1}} = 1 - \frac{M^3/4}{2^{N+1}}$, and to reach ~50% collision rate $M = 2^{(N+3)/3-1}$, which is just $2^{N/3}$.

Is there a reason why this won't work?


texts:
Given that theres no initial permutation only 16 32 bit long randomly generated keys and the round function is simply f(x) = x ⊕ Ki. Also there are 10 64bit plaintext/cyphertext pairs given.

Now I have to show a way to universally break this cypher, but I can only think of brute-force. Any suggestions?


texts: Why does the server in S/KEY authentication only store a single password?

texts: I've been reading about the S/KEY One-Time Password system on wikipedia here and was wondering why the server only stores a single password and not the list of one-time passwords like the client does.  In other words, why is the implementation not a simply a password-to-password compare but instead a cryptographic hash function is run on the password and then the result of that hash function is compared to the previous One-Time-Password the client sent to the server?


texts: How secure is reducing length and concatentation of hash?

texts:
Let's say we have input data X and a hashing algorithm H that produces 256-bits of output (e.g. SHA256).

Now, let's take a second hash function G that produces 128 or more bits of output (say RIPEMD128 or SHA1). If we define our final hash function L := sub128(H(q)) + sub128(G(q)), where sub128 takes first 128 bits of the result and + is concat, so that the result is 256 bits again.

Is it now more, less, or about the same difficulty to Y such that L(X) = L(Y) compared to how difficult it is to find Y such that H(X) = H(Y)?


texts: initial value for RSA and SHA-256 signature encoding

texts:
As described in RFC 8017, RSASSA-PKCS1-V1_5 uses the following bytes during the encoding process :
0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60,  0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
Does anybody know how to compute these values?


texts:
A Brute Force Attack obviously involves attempting to decrypt ciphertext (with the associated  plaintext being known) using all possible encryption keys.

Aside from attempting all possible encryption keys in sequence, have there been, or is there any alternative methods of performing a brute-force attack?

I'm aware of the Distributed.NET attack on DES (which leveraged parallel/distributed computing)  whereby the entire keyspace of DES was subdivided and allocated to a number of different computers, with each computer decrypting a piece of ciphertext using the section of the keyspace it was allocated.


texts: Proving the semantic security of the One Time pad

texts:
Currently hearing a lecture on cryptography, and the professor gave us the definition of semantic security, which is roughly the following (formally not quite complete, but you get the idea):

  Given a function $INFO(1^n,m)$ which determines the information the
  attacker is interested in (e.g. $INFO(1^n,m)=m$ would mean that the
  attacker wants to know the plaintext message $m$) and any
  polynomial-time attacker $A(1^n,C)$ in posession of the cipher text
  $C$, it is possible to construct a Simulator $S(1^n)$ without
  knowledge of the cipher text that has an equal chance of determining
  $INFO(1^n,m)$.

(From reading this stackexchance, it seems like the definition of semantic security that others use here is what was called Indistinguishability (IND) in our lecture. I am not interested in IND, only in semantic security as outlined above)

He then proceeded to talk about how the one-time-pad (OTP) fulfills this requirement, and offered the beginning of a proof. The basic idea of the proof went something like this:

  Given any attacker $A(1^n,C)$, we construct the Simulator $S(1^n)$ in
  the following way: $S$ will pick a random binary string $C \leftarrow \{0,1\}^n$ and then return the result of $A(1^n,C)$. This would mean
  that the chance of $S$ to succeed would be as high as the chance of
  $A$.

Now, to me, that does not make any sense. I mean, it works if you already know that the OTP is secure and that the chance of $A$ to succeed is $2^{-n}$ (for $INFO(1^n,m)=m$), because $S$ also has a chance of $2^{-n}$ to pick the correct binary string. But as we are trying to proove the security, we can't argue that way. And as soon as we can no longer use that knowledge, the proof no longer works in my eyes.

I tried to come up with a proof of the semantic security of the one time pad, and failed so far. I also tried to find an existing proof on the internet, and failed as well. I would have an idea on how to proove indistinguishability, and as far as I know, IND and semantic security are practically equivalent, but I'd be interested in a proof using the above definition.

Any pointers to existing proofs I may have overlooked, or pointers on how I could proove this myself, would be appreciated. Alternatively, an explanation on how the proof the professor outlined could actually work would be appreciated as well. This is not homework, I am doing this because I am interested in the subject matter and because I will go mad if I cannot find a proper proof or an explanation why the proof by the professor works.


texts: Elliptic Curves and Finite Abelian Groups

texts:
One can note that, given an elliptic curve mod $p$, that the set of points together with the usual addition law gives a finite Abelian group.
Now by the fundamental theorem of finite abelian groups, $$E\cong\mathbb{Z}/p_1^{a_1}\mathbb{Z}\otimes\dots\otimes\mathbb{Z}/p_k^{a_k}\mathbb{Z},$$ where $$E=\{(x,y)\in\mathbb{Z}/p\mathbb{Z} \times \mathbb{Z}/p\mathbb{Z}:y^2\equiv x^3+ax+b\}\cup\{O\}$$ and $n=p_1^{a_1}\dots p_k^{a_k}$.
Are there any cryptographic attacks on elliptic curve cryptography that utilize this decomposition? $n$ can be obtained easily enough by Schoof's algorithm.


texts:
I recently posted a question about AES dual ciphers based on a certain understanding of them. Now I am not so sure if my understanding is correct. AES: a question about dual ciphers and security

Originally I thought $AES$ dual ciphers were essentially the same as the original,  but with slight (but equally secure) changes that would produce distinct ciphertexts.

For example, if we encrypted $M$ with $AES$, using key $K$, we would get ciphertext $C$.
But I thought if we encrypted the same $M$, using the same $K$, but using some dual cipher $AES*$ we would get $C*$ (i.e. a different ciphertext).

However, from this paper I read (in the Intro, par. 3):
 ... how to make dual ciphers which are equivalent to the original Rijndael in all aspects ... the idea is to make another ciphers which generate the same ciphertext as the original Rijndael for the given plaintext and key.

This makes it sound as though the same input $M$, in ANY dual cipher (or is it just some?), will produce exactly the same ciphertext regardless of the dual cipher being used.

Is this correct? Or is it just the case for some dual ciphers?


texts: Did a certain cryptography method get abandoned due to security flaws in the past?

texts:
I am researching how quantum computers affect current encryption methods (RSA and more).

However, I remember learning in a course that there used to be a particular encryption method which was popular but suddenly had a very bad vulnerability in the past (like quantum computers and Shor's algorithm would be for RSA) and everybody had to move on (is that right?).

I cannot find anything about this in the past, does anybody have any idea which cryptosystem I am talking about?


texts:
I have the following requirements:

64 bits (8 bytes) of data ($D$) that requires confidentiality and integrity;
the data itself is a nonce, never need to authenticate/encrypt the same value twice (e.g. a counter);
I can only use AES cipher (128-bits key);
I can have a maximum of 128 bits as output (one block).

Given two different AES-128 keys ($K_\mathrm A$ for Authentication, $K_\mathrm E$ for Encryption), I'm using the following MAC-then-Encrypt scheme:

compute $\mathit{MAC} = \operatorname{CMAC}(K_\mathrm A, D, 8)$ (see RFC 4493)
truncate the MAC to get the tag: $T = \operatorname{MSB}_{64}(\mathit{MAC})$ (see NIST 800-38B)
get the plaintext $P = D\mathop\Vert T$ (16 bytes)
get the ciphertext $C = \operatorname{AES}(K_\mathrm E, P)$ by using AES/ECB/NoPadding mode

I generally know that MAC-then-Encrypt schemes can be secure, but I'm not able to demonstrate it for this scheme. Could you elaborate on that? Is there any improvement I can do?

I know that a good alternative would be AES-GCM (or CCM). Is there any way to fit into a single block of ciphertext by using AES-GCM on 8 bytes of data?


texts: Formula for bits of entropy per bit, when combining bits with XOR

texts:
Assume that bits $A$ and $B$ each have .5 bits of entropy per bit.
The two-bit result of the concatenation $A‖B$ has 1 bit of entropy total, and it retains the entropy density of .5 bits of entropy per bit.
How many bits of entropy would the single-bit result of the exclusive-OR of $A$ and $B$, namely $A⊕B$, have per bit?
I'm guessing the formula is something like $\mathord{\mathrm{E}}(A⊕B)=1-(1 - \mathord{\mathrm{E}}(A))(1-\mathord{\mathrm{E}}(B))=.75$ bits of entropy per bit. Is this correct? If so,  is there a short proof of this equation that I can refer to?
Also, do I correctly interpret that you can only approach 1 bit of entropy per bit by XOR-ing bits of less dense entropies but never actually attain it?


texts: Decryption or attacking DES encrypted file

texts:
I have a file that has been encrypted using DES and am looking to decrypt and find a secret message encoded. All I have is the file which is full of binary data. There is no key or anything else which makes me wonder how can I be able to do it by Brute Force.

I spent some time reading and understanding DES and I know how it works but would appreciate some advice.


texts:
Suppose:

$m$ is a positive integer.
$n=2 \times m$.
$H: \{0,1\}^{*} \rightarrow \{0,1\}^n$.
$p$ is a password.
$s$ is a salt.
$K=\{0,1\}^n$ is the derived key.
$PBKDF(p,s)$ derives a key from $p$ and $s$ using $H$ in some manner.
$K=PBKDF(p,s)$.

Given the birthday paradox, is the key strength here $m$-bit or $n$-bit?


texts:
Let me know a cryptographic symmetric stream cipher system with only two functions say S() and P() and it should satisfy the following conditions:

There will be two independent computers say M1 and M2 (no connection exists between them) and only one function should be stored in a machine.

For example: Function S() will be executed on machine "M1" and the function P() on machine "M2".
User selects a random string of bits (say X) of desired length (L) as input.
User selects a machine randomly (either M1 or M2) and executes the function with the selected random string X as input to it. For example: if machine *"M1"*is selected then the function S() will be executed to produce a output Y = S(X).
Then the user executes the other function P() with Y as input to produce the original random string X.

For example: X = P(Y).
And again user repeats the process in reverse order using the same random string X as input. For example: the function P() in machine "M2" will be executed to produces a output Z = P(X).
And again the user executes the other function S() with Z as input to produce the original random string X. For example: X = S(Z).
Length of outputs Y and Z should be equal to the length of input X.
Outputs Y and Z should be non-linear with respect to the input X, and
Output of S(X) and P(X) should be different. For example: Y != Z.
Keeping it simple, it should demonstrate S(P(X)) = P(S(X)) = X.

For example: function S and P are inverses of each other.

My questions:

How secure such a cipher?
I feel such functions output may be difficult for any known cryptanalysis, if not, why?
Is it easy/hard to design such a system?


texts: Why are cryptography algorithms not exported to certain countries?

texts:
There have been strict laws about the export of crypto software to certain countries. I can understand the intent, but never gauged the fact that there is nothing stopping these countries from developing their own crypto software. So why limit the export?

And in light of the recent NSA revelations, of backdoors being engineered into crypto algos, wouldn't the export of such compromised algorithms have helped to unravel secrets?


texts:
I am currently reading Cryptography Engineering by Bruce Schneier and Niels Ferguson. There is this chapter about MACs and they recommend HMAC-SHA-256, but with the side note that SHA-3 will be most likely be recommended in the future.

I wanted to google what MACs are currently recommended but couldn't find satisfying pages. If I search for something including MAC I will only get some computer pages (thanks apple) and if I type it out it shows only general pages that show how they are generated or pages that are already a few years old and maybe outdated.

I don't want to know how to construct MACs or how I should use them. My questions are:

Which MACs are currently considered as secure?
Where can I get information about the currently recommended MACs myself?
Is there maybe a list that shows recommended MACs for either speed or security?
How do you keep yourself up-to-date with the newest MACs, hashes, cyphers, implementations, ...?

Maybe the first question is to much opinion based and to fast out of date so feel free to ignore the first one.


texts: Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

texts: I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?


texts: Can all affine cyphers be expressed with this formula

texts:
There are $26!$ permutations of the English alphabet.
In Modern Cryptography textbook, William Easttom states that

the basic formula for any affine cipher is $ax + b \equiv \pmod{26}$.

I'm wondering whether this formula can express every possible permutation. It does not seem obvious that for every permutation $\sigma$ there exist $a$ and $b$ capable of expressing it. If this statement is true, what approach can be used to find $a$ and $b$?


texts:
Bingo is the game of chance where each player matches the numbers on their card with the numbers that the caller draws at random. When the first player has collected enough called numbers on their card, they declare that they have won, and their card is verified.

Imagine this game being played online with players allowed to choose their own card.

Question: Is there a way to play Bingo online and assert that your card won, without revealing what your card is, only that you chose this card at the beginning and that it does contain the called numbers?

Sub-question: Is this a practical application of an existing, generalised problem?

Own thoughts: In the first iteration of this game, we could ask that players publish, signed, which card they chose at the beginning of the game. When the first player has collected enough called numbers, the winner will be apparent. But I don't want for players to publish their card at the start of the game.

In the second iteration of this game, we could ask that players publish, encrypted, which card they chose at the beginning of the game. We could include salt to avoid reverse lookups, and we could include a checksum to ensure that what they publish can't easily be decrypted into any card. But I don't want for players to publish their card at the end of the game, either!

Once a game is won, we know which subset of cards could have won. Perhaps it is possible to say that your card belongs to this subset (with some probability?) without saying what member it is? Perhaps this involves generating a large amount of winning cards, of which perhaps one is the actual winning one, and then prove that your card is one of them, without saying which one it is.

Clarification 1: This problem does not deal with calling numbers in a fair way. Assume that the players cannot predict what numbers are called.

Clarification 2: To prove that you have collected all the numbers, the subset of cards that could have won contains exactly that card, so the method of the first and second iteration are the same; this question applies to the subgoals of collecting one row, two rows...


texts:
HMAC does nested hashing in order to prevent Length Extension Attacks.

Given that you use the SHA-3 hash (which is resistant against length extension attacks), would you still need to go through that procedure in order to produce a secure MAC?

Needless to say we'd still use a key, which we prepend or append to the message, but is that sufficient for a MAC?


texts: How can i define the base point of the elliptic curve group element used as the elliptic curve domain parameter over Fp (prime)


texts: Secure Communication Protocol Design using oblivious transfer?

texts:
I have a problem I need to solve with the following scenario and I hope someone can help me find an approach or direction to start tackling it.

Consider Alice as a sender who has $n$ strings which she encrypts with her private key $k$ and some encryption algorithm $E$. Bob has access only to the encrypted strings and wants to inspect them to see if they contain any one of possible blacklisted words, which if detected should obligate Alice to reveal the matching string to Bob in clear-text. Otherwise, Alice is entitled to her privacy and Bob should not be aware of the clear-text content of her data.

How would you suggest the parties to communicate in order to achieve such a common goal ? What cryptographic primitives would you suggest me to use?
I thought of using oblivious transfer in some way, but I find it a little hard to form a clear idea how.


texts: Is this method of deterministically using CBC secure?

texts:
I'm trying to design a deterministic encryption scheme to enable searching in untrusted databases with the smallest possible IV overhead on ciphertexts. I know it's very bad practice but unfortunately it's a business requirement, so I'm just trying to offer the best security I can under the circumstances.

Right now I'm thinking about a way of using AES-CBC deterministically. My idea is based on a scheme presented in Deterministic and Efficiently Searchable Encryption by Bellare, Boldyreva and O'Neill.

Given a plaintext $x$ that we need to encrypt deterministically, we first compute $MAC_{k_1}(x)$ where $k_1$ is a key used only in this step. Next, we take the bottom four bytes of the computed MAC, call them $y$, and compute $H(y)$ where $H$ is a public hash function (e.g. SHA-256). Truncate this computed hash and use it as an IV for CBC mode. The ciphertext is $y||CBC_{k_2, H(y)}(x)$. ($k_2$ is our encryption key)

This may seem convoluted (and it is) but I'm trying to think of a way to get around the equality leakage when a predicable IV is used with CBC. With a fixed IV, different plaintexts with the same first block will encrypt to ciphertexts with identical first blocks. With the above scheme, the only way for the first block of two different plaintexts to be equal is if their computed MAC values have the same four low-order bytes, which we expect to happen only after $2^{16}$ encryptions.

We can of course decrease the likelihood of a collision by using more than four bytes of the MAC, but for length-restricted environments four bytes might be acceptably insecure.

I'm wary of this construction because of how kludgy it seems - if there's an obvious flaw please don't hesitate to point it out.

Thanks for your help, all.


texts:
I would like to prompt users for a single passphrase to establish trust with separate, normally (but not always) complementary systems from one password input.

I'm essentially looking for a box where one password enters and two leave, where maximum of entropy is maintained and the ability of an attacker using either output password to derive the other is minimized.

There are some constraints:

The algorithm must be public knowledge.
No other secret keys can be involved.
Output passwords must be deterministic for any given input password.

A simple answer seems to be:

$\rm pass1 = HMAC(password, \text{ "Magic One"})$
$\rm pass2 = HMAC(password, \text{ "Magic Two"})$

With this method, it should be as difficult for someone who knows $\rm pass1$ to derive $\rm pass2$ as it would be for them to guess $\rm password$.

Are there better existing algorithms?  The only reference I have been able to find is Steve Bellovin's Hashed Password Exchange Internet-Draft using the same basic method.

Specifically, is it practically possible to increase the difficulty of someone with knowledge of $\rm pass1$ to derive $\rm pass2$ to be more than the difficulty of guessing $\rm password$ itself, even if it requires spending portions of available $\rm password$ entropy?

For example, let's assume that $\rm pass2$ is exposed in an environment where it is being attacked "offline", while $\rm pass1$ is less vulnerable.  In this case, $\rm pass1$ is effectively also exposed to the "offline" risk as much as $\rm pass2$.


texts: MD-compliant hashes don't really accept arbitary length input, do they?

texts:
When people talk about hash functions, they usually say that they accept arbitrary-length input, but if you actually look at the padding (eg MD-strengthening padding), you see it's like M100.000||length where length is the binary representation in bytes or bits. But what if the length is so large that you can't represent it in a single block?

Obviously you can get around this problem by just using the most significant bits, but doesn't this destroy the MD-compliant padding property (which you need in proofs of one-wayness and collision resistance etc, assuming properties of the compression function)?


texts: Multidimensional meet-in-the-middle attack on AES

texts:
Is an MD-MITM attack possible for AES? As I know, we can break 2 rounds of AES. So we could apply the MD-MITM attack 5 times. This should significantly reduce the security of AES.
What stops us from these kinds of attacks? Why GOST was broken with such method and AES not?


texts: What are the public key and output sizes for the four remaining PQC KEM candidates?

texts:
Currently there are only 4 direct candidates left that provide KEM. Generally performance seems to be "OK" for those candidates. However, the key and encapsulated key sizes (i.e. the output size of the algorithm) may require some interesting tweaks in the protocols.
I could not directly find these sizes on the Internet, so are they known (for the different levels of security required by the NIST competition)?
The round 3 candidates are:

Classic McEliece
CRYSTALS-KYBER
NTRU
SABER

I'm only interested in the sizes of the dynamic values in minimum number of bits as well as any encoded sizes - if an encoding has been specified. Domain parameters - assuming that they are static - may be excluded from the calculation.


texts: A discrete-log-like problem, with matrices: given $A^k x$, find $k$

texts:
Let $p$ be a large prime; we will work in $GF(p)$.  Let $A$ be a $n\times n$ matrix.  Also, let $x$ be a $n$-vector and $k$ a positive integer.

Suppose we are given $p$, $A$, $x$, and $y$.  The goal is to find a $k$ that satisfies $A^k x = y$.  Is there an efficient algorithm that solves this problem?  You can assume you are promised that at least one solution exists, if you want.

More generally, what is the complexity of this problem?  How does its hardness relate to the hardness of the standard discrete log problem modulo $p$?  I'm pretty sure the answer will depend upon the matrix $A$.  Can we classify for which matrices $A$ this is as hard as the standard discrete log problem, for which it is harder, for which it is easier, for which it can be solved in polynomial time?


texts:
I wonder what is wrong with this scheme for authentication.

Server sends random challenge, C
Client returns (C, B(P)) encrypted in H(B(P)) where B(P) is high work factor salted hash of the user passphrase (e.g., bcrypt), and H() is a low work factor hash
Server has K = H(B(P)) in database, and can use it to decrypt (C,B(P)) and verify that H(B(P)) = K and that C is equal to the challenge

I wonder is B(P) adequately protected by encryption in key = H(B(P)) when sent over the network?  Or, other problems?

EDIT:  Let me clarify based on comments.  I obscured the main question by splitting the password hash function into 2 stages.  I think the answer to my question is the same if there is no B(P) and H() has high work factor.  So, client is submitting (C,passphrase) encrypted in H(passphrase).  Server knows H(passphrase), as in typical password authentication, so can decrypt.  Then can compute H(passphrase) to verify client knows passphrase.  It is like classic bcrypt based authentication, but using H(passphrase), rather than SSL, to secure the transport.  My concern is how to safely do encryption when the key is derived from the data being encrypted.

The reason for the 2 stage H(B(P)) in my original question is to minimize load on the server, which is the main aim of the protocol, to allow run of the mill hardware to separate wheat from chaff in face of gbps DoS attacks.

EDIT2:  Also, I left out how the server proves to the client that it also knows K, which is necessary to prevent active man in the middle.  In step 2 the client includes a random session key encrypted in K, which is used to compute a message authentication code on all subsequent messages, including the server return.


texts: How to generate a random integer in interval $[1, 2^n-1]$ from random integer in interval $[0, 2^n-1]$?

texts:
For a project I am working on, I have access to a CSPRNG that outputs a random integer in the interval $[0, 2^n-1]$ for any integer $n$ greater than 0. I cannot use the zero values, so I have my RNG code in a while loop that runs until the random number is !==0. For small $n$ it is very likely that the while loop will run more than once, even more than twice (for $n=8$, the probability is $1/65536$). While this is not the bottleneck in my program, I want to eliminate the while loop and replace it with a linear transformation on the the generated random integer to get the integers I need in $[1, 2^n-1]$.

Is there a transformation that can be performed on the interval $[0, 2^n-1]$ to yield integers in $[1, 2^n-1]$ while retaining the uniform distribution of the random numbers?

(Would this be better posted in math.se?)


texts: What role does Representation Theory play in Cryptography?

texts:
Shannon said that every cryptosystem can be expressed as a system of linear equations with a large number of unknowns of complex type. In cryptography groups are used since they are a natural representation of objects that satisfy known relations, this let us to build cryptosystem based on these relations that maintain the scalability when using a decent amount of resources.

Since representation theory is used to represent groups in linear algebra, the aforementioned relations can be also expressed in terms of linear algebra. This theory can lead to representation of cryptosystems as a matrix algebra, thus a system of linear equations can be build to express the cryptosystem's operations.

Q: Is it necessary to study representation theory to analyze cryptosystems based on group theory?

Q: If representation theory is not the point behind group-based cryptanalysis, then what techniques are used here?


texts:
As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key!
Is this safe to do? My question can be formalized into these (I believe) equivalent questions about the definition of KEMs (I'm mostly interested in NIST Round 3 PQC KEMs, but more general answers are ok too)

Does an $X$-bit KEM shared secret contain $X$ bits of entropy?
Are the bits of a KEM shared secret guaranteed to be IID?
Can a KEM shared secret be used directly as a symmetric key?

Background to explain how I arrived at this question; not actually part of the question.
I am expecting the answer to be "No, you need to run the SS though a KDF", but I'm looking for citations to back that up. That would align with this answer that @poncho gave about ECDH, which would also be true of DH, but maybe those are not formally KEMs?:

Can a raw ECDH shared secret be used directly for encryption?


texts:
There  is  an  elliptic  curve  El  Gamal  digital  signature  scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$.  She makes $(E, p, A, B)$ public. To sign a message m (which is an integer), she computes a point $R = (x, y)$ on $E$ and an integer $s$, and sends $(m, R, s)$. The verification is $xB + sR = mA$.
Eve chooses $R1 = B − A = (x1, y1)$.
How do I find an integer $s1$ and message $m1$ so that $(m1, R1, s1)$ is a valid signature?
I referred to this to relate the normal El Gamal to the one on the Elliptic curve, but am not able to do so. Also, why is hashing required in such situations to prevent such forgery?


texts: How to design number of rounds in my cipher?

texts:
I have specific cipher which is built from permutations. It has or should has few rounds. If we do 2 rounds it is like 2 permutation composition. 3 rounds are like composition of 3 permutations and so on.
It is 128-bit block cipher, so every permutation has $2^{128}$ elements. Every unique permutation can be define by key. Keys are pairs of odd numbers from $-2^{128}$ to $2^{128}$. What's more - every permutation changes exactly 50% of input bits in average.
My problem is how to design number of rounds vs size of round keys? Let's say we want to security level equal to 128-bits. Theoretically we can use exactly $2^{128}$ permutations define by $2^{128}$ keys, but I would like to limit key sizes. For example - choose partial keys from the collection: -7,-5,-3,-1,1,3,5,7. Now make a round keys: (-7,-7), (-7,-5), ..., (7,7). We have 64 of them. Every pair is key and define specific $2^{128}$-element permutation in my cipher. Now we can composite rounds. Let's do 21 rounds. So we need 21 keys from our 64-element collection. In the end our main KEY is 21-element variation with repetition. $64^{21}$ is about $2^{128}$. So we have good security level.
But let's say we would like to do 5-rounds. We can make another version on this algoritm, we can choose partial keys: $(-2^{13}-1)$, $(-2^{13}-3)$, ..., $(2^{13}-1)$. Now we can make $2^{13} \cdot 2^{13}$ pairs, which gives 67108864 keys. So we can compose $2^{26}$ permutations. We can choose 5 different keys in 5 rounds. It gives $(2^{26})^{5}$ variations with repetition in 5 rounds - again about $2^{128}$.
How to decide how many rounds and how big keys my cipher should have? For safety reasons, is it better to use 5 rounds with larger keys or 21 rounds with smaller keys? Theoretically, you can even choose one of 3-bit to 128-bit key and make one round. I do not want to talk about possible types of attacks on this cipher (I analyze it independently) or about what is faster, beacuse there are many nuances in this cipher. I am only interested in the issue of security. Is it possible to prove that in such conditions there must be at least 3, 7, 10 rounds?


texts: The Goldreich-Goldwasser-Micali Construction with bad PRGS

texts:
I understand that if we have a secure PRG then the Goldreich-Goldwasser-Micali construction gives us a secure PRF.

However, what I've not been able to find much material on is how will the GGM construction fairs when the PRG is less than perfect.

Suppose we used AES-128 in CTR mode as the PRG to generate 256-bits of output for use in this construction. I don't think anyone would argue whether this was secure or not. They might say it's horribly slow but let's ignore that for now.

What happens if we replace AES-128 in CTR mode with a bad PRG. One that has a bias that's significant? Let's say we had a bias in our PRG of  $ \epsilon = {1\over2^{16}}$. That would be a pretty terrible stream cipher and completely broken normally.

However, my intuition leads me to think the whole construction might even be secure with such a terrible PRG because we're only producing a stream double the key length. As such, the set of keys fed in to the next layer should still be pretty much uniform.

In fact, I'm tempted to claim that as long as there's no attack that can distinguish the PRG using only the first $2 \times k$ bits, the overall scheme is secure.

The argument goes like this:

The key at the top of the tree is seed to the prg. This is selected at random from the set of all possible keys.
We then feed this seed in to the prg. The prg can not be distinguished from random with the $2 \times k$ bits generated from it.
Thus the two cells below it can not be distinguished from random.
One of these cells then becomes the new key to the next layer down.
Given that this key could not be distinguished from random we replace it conceptually with a real random key.
The situation is now symmetric with step one, except we're now one step removed from the root of the tree.
We can now re-run steps 1-6 for each level in the tree and have a provably secure prf from a horribly bias prg.

That seems like it proves too much to me; it's an absurdly strong result.

Am I right or does the construction succumb in the presence of a wonky PRG in a way I haven't anticipated?


texts: Is there an increased risk of nonce reuse when using GCM with a nonce more than 96 bits?

texts: GCM is designed to use a 96-bit nonce, which can be generated either randomly or deterministically. If you use a nonce that isn't 96 bits then it is padded and hashed with GHASH to create a pseudorandom nonce (and block counter) instead. For example, suppose that you generated uniformly random 128-bit nonces, these would be hashed with GHASH and converted into a 96-bit nonce and 32-bit random block counter. Given that GHASH is not collision resistant, is this significantly more likely to result in nonce reuse than generating a random 96-bit nonce directly?


texts: ISO 9797-1 MAC Algorithm 3 and Doc 9303-11

texts:
I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 Algorithm 3 (padding mode 2).

In Appendix D-3, the MAC of E.IFD 72C29C2371CC9BDB65B779B8E8D37B29ECC154AA56A8799FAE2F498F76ED92F2 using K.MAC of 7962D9ECE03D1ACD4C76089DCE131543 is meant to return 5F1448EEA8AD90A7.

However, when I calculate the MAC, it returns AAE3F35132ED3465. This is the return when I run through the steps step-by-step using pyDes (ECB mode and manually xoring as appropriate) and when I use the code as written here.

I am clearly missing something - would love any help!


texts: How to defend AES against chosen-plaintext attack?

texts:
I have a server which encrypts files with the same AES key. Users can upload a file and download its encrypted version. A user can upload as many files as he wants. Users can decrypt the documents via the server after a D date. A user may see an other user's encrypted document, but it would be a disaster if he could decrypt it before the D date!

I've read in other stack overflow post that using the same initialization vector can make chosen-plaintext attack easy. So I want to generate a different initialization vector for every uploaded file. Is it a standard secure way to add this IV to the encrypted document?

My first idea is that I encrypt it with a different AES key and simply concat it to the encrypted byte array. But I'd rather use a more standard solution for this problem.


texts: Can you derive a 128 bit AES encryption key using PBKDF2 with SHA-256

texts:
I got confused about key derivation functions. For my project, I need to derive a 128 bits AES encryption key in CTR mode. To do so, I'm using a PBKDF2 to derive this encryption key using an initial information like a password.

PBKDF2 allows me to set its parameters before deriving a key, such as hashing function and iteration number. So, my question is if i set the PBKDF2's hashing function as SHA-256, and specificy the derived key's length as 128 bits, would that be okey? As SHA-256 will hash the input multiple times and produce a hash of 256 bits, how can I get a 128 bits encryption key while having 256 bits output of the SHA-256?


texts: Vector dot product in Microsoft SEAL using the CKKS scheme

texts:
I'm trying to use the Microsoft SEAL library in order to do Matrix multiplication. That's why I'm trying to find a way to compute the Dot Product of 2 vectors.

My issue is that the CKKS encoder in SEAL encodes entire vectors. So if I had a 2D vector of floats I get a 1D vector of Plaintext (and then a 1D vector of Ciphertext after encryption).

The operations that I am able to do are: addition, component-wise multiplication, exponential, and rotation. In order to do a dot product of vectors I need to multiply the components of the first vector by the components of the second vector and sum them up. If I want to multiply 2 matrices, I can transpose the second matrix and multiply the rows together but I am unable to compute the sum of the elements inside the Ciphertext. Is it possible to get the sum of those elements in the Ciphertext? Should I change my approach?


texts: Supposing I wanted to send a one-time pad to a friend. What would be a good way to do that, supposing that it could be intercepted? At first blush, encrypting it would seem safe, because the encryption would seem impossible to crack, given that what it encodes is random (result of unsuccessful decryption is not obviously indistinguishable from successful deception). Yet perhaps there is still a risk is if the encrypted one time pad and a message encoded with it were intercepted.


texts: How do I communicate the value of the initialization vector to the end user? Should it be part of the encrypted message?

texts:
I am taking a cryptography class and our first homework is to implement a 32-bit block cipher. I implemented a simple block-cipher that uses CBC. Currently, my implementation reads both the 32-bit IV and the 32-bit key from a key file.

However, I read that the initialization vector is generated randomly, and can be public as well. If I changed my algorithm to generate a random IV, where would I store this IV (or communicate it to the user)? Would I simply output the value of the IV to the user after I finish encrypting the message? Or could I store the initialization vector as part of the message itself (perhaps at the beginning).

Then my decryption algorithm can simply read the first 32-bits of the encrypted message, which will be the initialization vector. Is this the right way to do it?


texts: Encrypt large data with RSA through blocks in java

texts:
I'm working on a communication protocol where a client sends encrypted data to a server. What happens is that in some point, the client creates a symmetric key used to create data digests through the HMACSHA256 algorithm. Then, the idea is that data is sent to the server along with its digest, so the server can calculate the digest on its own and compare it to the digest sent to check data integrity.

For this, the symmetric key created by the client has to be sent to the server in a secure way, for which the key is RSA encrypted with the public key of the server but additionally, this encrypted message has to be encrypted with the private key of the client. I know that this second encryption has no sense since encrypting data with the private key doesn't assure data confidentiality, but the protocol states that I perform this action just for academic purposes.

The RSA keys are 1024 bits long so I can't encrypt data larger than 117 bytes and the RSA encryption produces 128 bytes long messages, so the question is, if after the first encryption (encrypting the symmetric key with the server's public key with RSA) I get a 128 bytes long message, how can I use RSA to encrypt this output with the client's private key?


texts: The Encode algorithm of Garbling scheme is probabilistic or deterministic?

texts:
In general the garbling scheme works as follows:

$\textrm{Garb}(1^\lambda, C)$: on input the security parameter $\lambda$ in unary and the circuit $C$, it outputs a garbled circuit $\widehat{C}$ and a garbling key $K$
$\textrm{Encode}(x, K)$: on input the input value $x$ and the garbling key $K$, it outputs a garbled input $\widehat{x}$
$\textrm{Eval}(\widehat{C}, \widehat{x})$ outputs the result of $C(x)$

My question is whether the second algorithm "Encode" is probabilistic or not? I reviewed some papers and most of them indicate it is deterministic, but some of them think it is probabilistic. I'm currently in confusion about this, please give your best illustration why it is probabilistic or deterministic?


texts: Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?

texts:
Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems?  Is it believed to be secure and represent the state-of-the-art in RSA-based signatures?

I understand that RSA-PSS is a newer signature scheme, also standardized in PKCS #1.  I found a memo from RSA recommending that people transition to RSA-PSS.  Is that right?  Would it be better to recommend that people use RSA-PSS, instead of RSA-PKCS1-v1_5?  If you were going to recommend a single RSA-based signature scheme, which would you recommend that new systems use?

Practical relevance: for instance, at the moment the current draft of the WebCryptoAPI recommends supporting RSASSA-PKCS1-v1_5 (but not RSA-PSS).


texts: Technical details of attack on Android bitcoin usage of SecureRandom

texts:
Reports are surfacing that Android's Java SecureRandom class has issues and isn't totally secure.

A specific example of how this issue translates to applications is bitcoin, where reports are stating that the bitcoin wallet is at risk of theft. With bitcoin specifically, the reports say that "colliding R values" can result.

Why did SecureRandom fail to output secure pseudorandom bits?
What exactly are "colliding R values", why is that a problem, and how can it be resolved?


texts: Does sending the same message with 2 different keys in OTP leak information?

texts:
Suppose a common message ($M$) is XOR'ed with two different keys $K_1,K_2$ producing two ciphertexts $C_1,C_2$. Thus,

$$M \oplus K_1 = C_1\\
M \oplus K_2 = C_2$$

On observing $C_1$ and $C_2$, an adversary can obtain the value of $C_1 \oplus C_2 = K_1 \oplus K_2$. Is this scheme semantically secure? Note that $|K_1|=|K_2|=|M|$ and the keys are randomly chosen from a uniformly distributed large key space ($\approx 2^{255}$).


texts: Some literature said the running time of attack algorithm is measured by clock cycles. What is the meaning of clock cycle and why  the running time of attack algorithm is measured by clock cycles?


texts:
This recent new curve mentions something that's new to me: twist security.

http://safecurves.cr.yp.to/bada55.html

Are the existing C25519/Ed25519 curves secure against this form of attack?


texts: Hash or compression function in Merkle tree nodes?

texts:
Wikipedia says about a Merkle tree:

  Nodes further up in the tree are the hashes of their respective children. Usually, a cryptographic hash function such as SHA-2 or SHA-3 is used for the hashing.

A cryptographic hash function can be defined using a 1-way compression function. Can we use a 1-way compression function for hashing children? It seems more efficient. We don't do length padding. For every node there is 1 less computation of a compression function.

In Merkle hash torrent extension of BitTorrent and in TTH (Russian version describing Tiger Tree Hashing) they use hash functions, not compression functions. I did not find data on AICH of eMule. What about other tree hash functions (I don't know such; maybe, you know)?


texts: Cross correlation of two Boolean functions

texts: I have been studying Cryptographic Boolean Functions and got stuck with the calculation of cross correlation of two boolean functions. I know the formula is $$c_{f,g}(y) = \sum_{x \in V_{n}} f(x)\cdot g(x\oplus y).$$ What I don't understand is if $f = g$ and $y$ is $0$ shouldn't the correlation be $2^n$? When I calculate, if $f$ and $h$ has the value $0$, $f(x)\cdot g(x)$ will yield $0$, but shouldn't I have $1$ in order to reach $2^n$ in the end? I am sorry if this question sounds silly but I have really spent so much time trying to figure out. Any help would be greatly appreciated.


texts:
So I have the value of N. I have to use this value of N to find the value of D.
N = 265291078722948385089717069136983657793
Now I read about RSA algos and found out that
N=PQ | where P and Q are prime factors

I found -
P - 14716976826788780483
Q - 18026193955816294571

The following is an example of what I've approached
Choose p = 3 and q = 11
Compute n = p * q = 3 * 11 = 33
Compute φ(n) = (p - 1) * (q - 1) = 2 * 10 = 20
Choose e such that 1 < e < φ(n) and e and n are coprime. Let e = 7
Compute a value for d such that (d * e) % φ(n) = 1. One solution is d = 3 [(3 * 7) % 20 = 1]

We have
P = 14716976826788780483
Q = 18026193955816294571
N = 265291078722948385089717069136983657793
E = 65537 (given)
φ(n) = 265291078722948385056973898354378582740    [using (p-1)(q-1)]

I'm unable to solve the equation  (d * e) % φ(n) = 1 for the above values.
We need to find/derive D.
I tried using this online calculator
Princeton Extended Calc
But it doesn't accept large values
Any help is appreciated


texts: Why is the compression function in Miyaguchi-Preneel scheme secure?

texts:
I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I could find about this was Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV.

Again, I am having trouble with the explanation provided there. So, if someone could please clear my doubt, that would be great, thanks!