texts: Key exchange without an underlying semigroup

texts:
I am wondering whether there is a general reformulation of perfect forward secrecy for 2 party key exchange in 2 messages using semigroups. I am looking for references, which would discuss such approach. I am trying to prove my probably misguided intuition, which tells me that every 2 party key exchange requires an underlying semigroup wrong, but so far I failed. The intuition is that if we want to work in 2 messages:

send message from A to B, B derives final key and sends a message from B to A and A derives the same final key we need a relationship like this.

We need a triple of operations (opAinit,opB,opAfin) such that opAinit : seed1 -> (shareA,msg1), opB : seed2 -> msg1 -> (msg2,key), opAfin : shareA -> msg2 -> key and the following to holdopAfin (fst (opAinit(seed1)),fst(opbres)) = opB (snd(opbres)), where opbres=opB(seed2,snd(opAinit(seed1)). Can this always be turned into an underlying semigroup? I am thinking that it should be possible to glue the different operations and domains/codomains into a semigroup action somehow.


texts:
Given two commitment schemes $Com_1, Com_2$ (both have the hiding property), I'd like to prove $Com_1(m) || Com_2(m)$ is also hiding.

I built these hybrids and want to show $H_0 =_c H_1 =_c H_2$.

\begin{align}
H_0 &= Com_1(m) || Com_2(m) \\
H_1 &= R_1 || Com_2(m) \\
H_2 &= R_1 || R_2
\end{align}

For $H_1 =_c H_2$: If some $D$ tells apart $H_1$ from $H_2$ then we can distinguish $Com_2(m)$ and $R_2$ by prepending some random $R_1$ and then call $D$.

But how could we prove $H_0 =_c H_1$?


texts: Is there any Corelation between the SHA256 and SHA512 hash of the same data?

texts: Is there any Corelation between the SHA256 and SHA512 hash of the same data ?


texts: Is multiplicative blinding less secure than additive?

texts:
It's easy to see that additive blinding (e.g., $x+r$ for secret x and random r) is perfectly secure in a finite field (this is a one-time-pad) and statistically secure for $r$ uniformly distributed in a domain sufficiently larger than $x$.

What I'm confused about is multiplicative blinding (i.e., $x \cdot r$) - in some places, I read that it's being used and is as secure as additive blinding, while in others it's stated that it is much less secure (e.g., multiplicative blinding less secure). Assuming, of course, both $x \neq 0$ and $r \neq 0$, is multiplicative blinding as good as additive (ignoring side channel attacks), and if not - what's the explanation?


texts: How exactly is the output of the XOR step in PBKDF2 used?

texts:
I'm attempting to diagram PBKDF2 for a school project and I'm not 100% sure how to represent the XOR step. Specifically, I'm confused as to whether the output of the XOR step is used in subsequent rounds or if it is calculated each round in order to make all rounds identical. Here's a diagram showing what it might look like if the answer is that the output of the XOR step is not used as an input to later rounds. Is this correct?

This diagram is based on the one on the very excellent blog post here: https://stewilliams.com/serious-security-how-to-store-your-users-passwords-safely-2/


texts:
I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an academical exercice, to see what the table would look like.

The first part is a multiplicative inverse in the polynomial binary finite field, isn't it?
The $g: a \rightarrow b = a^{-1} \in \frac{\mathbb{F}_{2^8}[z]}{m(z)}$, right?

I can use Sage to calculate it, but I prefer to implement it by myself. I've tried with section 4.3.2 of the Rijndael's design book and I've look with others like cohen's book (its about curves but the binary field maths are explained), but I'm not finding something that convinces me because play with different word sizes would decay in an ugly set of if statements in the first case or my background is too pour to really get the others in the right way.

What would be the best way to attack an implementation of this?

I have another question with in this subBytes() and it's about the parameters in the affine transformation. In this sub-operation

$f: a \rightarrow b = r\times a+s$

where $r$ is a rotation matrix representation of the polynomial $z^7+z^6+z^5+z^4+1$ (that I'm not getting what's behind this matrix, or why/how this MDS (Maximum Separable Distance) are coming to the scene), and $s$ looks to be a vector representation of the polynomial $z^6+z^5+z+1$. I'm also confused because the book and the amended version 2 from 1999 uses different values on what I've called $r$ and $s$.

How were those $r$ and $s$ chosen?

To undo this $f$, $f^{-1}$ is using an $r^{-1}$ and $s^{-1}$ that, if I didn't made a mistake, are not the inverses calculated using the first operation.

Any clue about how they are calculated?


texts:
I started studying Elliptic Curve Cryptography, and I do not know if I understand the difference between ECDH and ECIES (even with the other posts here on stackexchange).
I'm wondering if ECIES can be used to encrypt the ECDH key exchange to guarantee that it does not exist a man-in-the-middle. I'm thinking about this like TLS, where there is an asymmetric encryption before symmetric keys are exchanged.
In brief, something like:
Use ECIES to establish a secure client-server session and ECDH to generate the shared key to exchange information securely over the established secured session between server and client. In the Asymmetric Encryption Algorithm, the sender needs a Public key to encrypt the message, and the receiver need a Private Key to decrypt the message, while in Symmetric Encryption Algorithm, Both sender and receiver need single Symmetric session key to encrypt and decrypt data.
This make sense? If not, please help me understand the difference between ECIES and ECDH and if ECDH has some authentication.


texts: What curve and key length to use in ECDSA?

texts:
I'm developing a client/server system in Java which is not interacting with third-party software, so I don't have to worry about compatibility.
At a certain point, I need the client and server to exchange a digitally signed value. I thought to use ECDSA, but I'm not sure what curve and what key length should I use. I'm mostly worried about the security rather than the computational time or the length of the signature.
I'm using BouncyCastle for security-related operations, so the curve and key length must be supported by it. Here you can find a list of curves supported by BouncyCastle.
Do you have any advice?


texts: If you wrote a reversible SHA-256 algorithm, how many "metadata" bits would be required for reversability?

texts:
I was reading about reversible computing while thinking about FPGA circuits. I realized that it would be possible to write a reversible SHA-256 algorithm if you stored some additional information as "garbage". E.g. The algorithm/circuit would compute a SHA-256 hash, but it would also produce some metadata that allows you to walk backwards through the logic gates and arrive at the original preimage.

A NOT gate is already reversible, and an XOR gate just needs to pass one of it's inputs as an output. Toffoli gates can be used for everything else, so any boolean function can be made reversible. A fully unrolled SHA-256 algorithm is just a boolean function with an input and output.

If you used reversible gates for every step in a SHA-256 circuit, how many garbage bits would be in the output? And would it be possible to compress this data?

Let's say you have a 447-bit preimage (so one 512-bit chunk.) Would it be possible to compress the garbage from a reversible SHA-256 circuit into less than 447 bits, so that [SHA-256 hash plus garbage bits] would be enough to reconstruct the preimage? (If not, then you may as well just store the original preimage.)

Another way of framing this question: How many bits of information about the preimage are stored in a SHA-256 hash?


texts: HMAC does it matter if I chose the cipher text or the plain text as the message?

texts: I am using HMAC to create a message authentication code. My question is, does it matter if I use cipher text + encryption key or plain text + encryption key? I had a look at a implementation and as far as I can see they just concatenate the values (message and encryption key) and hash them.


texts: What are the first 4 and last 2 bytes in DH parameter files?

texts:
When we generate DH parameters file in PEM format, like this:

-----BEGIN DH PARAMETERS-----
MCYCIQDyl7rfGI2GywHp7JC7juWhv3VL+skipzl/329sQCEBQwIBAg==
-----END DH PARAMETERS-----

or

-----BEGIN DH PARAMETERS-----
MIGHAoGBAdilyft4T5FJO0xga8hzoBcUmAZRTlxE930Dfda4LaC8TFsQkibgUYPJ
AuFWuAnKgjWjLH80Pt1shilYdd8b7vL2TL2/e3BBNr4sr8DJLLa7p04mt0t4CSKO
Cp+/pqanm6Mq9xJ3Wo4SDrx70czGhwi5ZNLwwusez9Djwq8dX8IDAgEC
-----END DH PARAMETERS-----

besides additional header and footer lines, there are 4 bytes at first and 2 bytes at the end of the base64 line, and it depends to the DH parameters. How I can generate them knowing DH parameters?


texts: Conjugate variables in Quantum Key Distribution?

texts:
According to Heisenberg's Uncertainty Principle, it is impossible to measure the values of conjugate variables simultaneously as measuring one accurately would make the other equally corrupt.

So in QKD, there's a thing that states that Eve can't eavesdrop as the very act would change it's quantum state(Heisenberg's principle). I would like to know the measurement of which conjugate pair is being referred to here. Do answer fast as I'll need to do a seminar on this topic tomorrow :)


texts: Extended Canetti-Krawczyk - Clean Session Definition

texts:
In the extended Canetti-Krawczyk (eCK) model [1] the adversary $\mathcal{M}$ is allowed to make a sequence of queries, eventually performs a $Test(sid)$ query, receives a value $C$ and at some point later has to guess whether $C$ was the session key or a random value. In order for $\mathcal{M}$ to win the experiment, they have to both guess the challenge correctly and the test session has to be clean. The latter means none of the following conditions may be true:

$\mathcal{A}$ or $\mathcal{B}$ is an adversary-controlled party. This means in particular that $\mathcal{M}$ chooses or reveals both the long-term and ephemeral secret keys for the party and performs all communications and computations on behalf of the party.
$\mathcal{M}$ reveals the session key of $sid$ or $sid^*$ (if the latter exists).
Session $sid^*$ exists and $\mathcal{M}$ reveals either both $sk_\mathcal{A}$ and $esk_\mathcal{A}$, or both $sk_\mathcal{B}$ and
$esk_\mathcal{B}$
Session $sid^*$ doesn't exist and $\mathcal{M}$ reveals either $sk_\mathcal{B}$ or both $sk_\mathcal{A}$ and $esk_\mathcal{A}$

The first condition appears to state, that the adversary $\mathcal{M}$ would not be allowed to perform a man-in-the-middle attack on the test session between $\mathcal{A}$ and $\mathcal{B}$.
As far as I can tell, the original CK model didn't make such a restriction and intuitively I don't see why the adversary would be forbidden to impersonate the parties to each other. It would demonstrate that the adversary is able to break the authentication of the AKE protocol and as such it wouldn't be secure.
Am I misunderstanding the definition or is this actually forbidden in the model? If a MITM is allowed, then please point out the particular aspect of the model definition that allows this.
[1] LaMacchia, Brian, Kristin Lauter, and Anton Mityagin. "Stronger security of authenticated key exchange." International conference on provable security. Springer, Berlin, Heidelberg, 2007.


texts: eavesdropping on sha 256 consist of two entries one is public is secure

texts:
If i need to use symmetric encryption(AES), sending the same message for many times with the same password and initial value is absolutely not secure(i don't use Public key exchange ((in first approach)'PKI,CA, etc') i will use Certificateless.

So if i used sha-256 to hash the password with public value(the current date and hour), then used the hashed value as the password

can the attacker retrive the original value of the password from the hash(he also kmow the current date and time)

The reason for asking this question:
Anew a pproch called (Certificateless cryptography),
Certificateless_cryptography

Certificate-Less_Authenticated

The step of trusting KGC server or trusted center(TC), is using pre definied password (known for only user and the server)encrypt the id, so the server decrypt the password and identify the ID and generate a partial private key back(encrypt it with the password)

if the user for any reason repeate the process so it's the same message (user id) same password(PKDF used)


texts: Is there a way to verify an original author using encryption?

texts: I feel like the title explains the problem fairly well. Is is possible to use encryption to verify a document's original author? In my case, I have a doc that I want to release online. Is there a way I can make sure that anyone who finds the doc can verify that I was the original author who created it and not someone who just copied it?


texts: Encryption in which ciphertext is bigger than plaintext?

texts:
Is there an encryption which would produce a ciphertext longer than the plaintext?
(please ignore block-chaining IV stuff, which would result in a data being generated from the plaintext).

The point in question is that a ciphertext generated $\{0,1\}^n$ seems inferior to one twice as long $\{0,1\}^{2n}$ in terms that more permutations are possible in the later one.

Yet if the plaintext was of a blocktype being $\{0,1\}^n$ it seems puzzling how the encryption would map bothways
$$\{0,1\}^n \to \text{encrypt} \to \{0,1\}^{2n}$$ and
$$\{0,1\}^{2n} \to \text{decrypt} \to \{0,1\}^n$$

I assume this question to touch on the necessary attriubutes of encryption that it is reversibility and deterministic behaviour both way.


texts:
QUIC requires that servers reuse keys so that session resumption works.  That breaks many post-quantum key exchange systems.

I am looking for a post-quantum key exchange algorithm with the following properties:

Fast (Lattice-based)
IND-CCA2
The chosen key depends on randomness from both parties (this is important for many uses of channel binding).


texts:
Consider a "MAC" that uses a symmetric key $K$ to generate an authentication tag $t$ for a message $M$ in the following way:

Concatenate a timestamp with the message (to prevent replay attacks)
$$
m = \mathit{Timestamp}\mathbin\Vert M
$$
Divide into suitable number of blocks.
$$
m = m_0\mathbin\Vert m_1\mathbin\Vert m_2\mathbin\Vert\cdots\mathbin\Vert m_n
$$
Compute CRC of a symmetric key concatenated between each block. (CRC algorithm is known - CRC-16/CCITT/CRC32).
$$
t = \operatorname{CRC}(K\mathbin\Vert m_0\mathbin\Vert K\mathbin\Vert m_1\mathbin\Vert K\mathbin\Vert m_2\mathbin\Vert\cdots\mathbin\Vert K\mathbin\Vert m_n)
$$
Send $C=\mathit{Timestamp}\mathbin\Vert M\mathbin\Vert t$ as the message.

Is this scheme suitable for message authentication against known plaintext attack given a large enough key size, with the assumption that it is infeasible to brute-force all $t$ during the time when $\mathit{Timestamp}$ is valid?

I have seen the following papers, however, they both say that the CRC polynomial must be a secret.

https://eprint.iacr.org/2015/035.pdf

https://eprint.iacr.org/2015/1138.pdf

Slightly related, but it uses an encrypted CRC as a MAC. I'm asking about using CRC as a MAC where the Key is included in the CRC calculations.

Is there a generic attack on encrypted CRC32 when used as a MAC?

Edit: Use case: I have hardware CRC module in a microcontroller that can evaluate CRC asynchronously with the core performing other computations. I am seeing if I can use this CRC module for message authentication as well.


texts: Which MACs can be converted into a secure unkeyed hash function?

texts:
It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC  into secure unkeyed cryptographic hash functions that could be used - for instance - for digital signatures.

In other words, the resulting hash function is not 1st pre-image, 2nd pre-image, and collision resistant.

What are the MACs that do not suffer from that limitation? I believe HMAC is one of them, provided the underlying unkeyed hash is strong.

Are there any others?

EDIT: if the hash used for HMAC is broken, also the HMAC constructed with it will probably be so.


texts: Making PRNG cryptographically secure thru shuffling?

texts:
Is it practical to make a PRNG cryptographically secure if I shuffle the randomly generated numbers (say 256-bit) several times before hashing it, even if a hacker knows when I generate the numbers?

Note: They say PRNG is not cryptographically secure because the generation depends on the state of the generator, that it is somewhat deterministic and not random enough. Can the simple act of shuffling a 256-bit PRNG (length is around 77-78 numbers, i.e. probability of generating all 9s is close to zero) be good enough to make it cryptographically secure?

More specifically, if I use Python's random.getrandbits() to randomly generate a length of 256-bit numbers and then use random.shuffle() on it several times, can this help make the numbers cryptographically secure? Can this even resist quantum hacking?


texts: WebCrypto AES-GCM vs AES-KW for key wrapping

texts:
The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping.

There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates without any supporting reference that both are "recommended".

Is there a practical or theoretical reason why one might choose GCM over KW and vice-versa?


texts: Finite Automata and Application to Cryptography

texts:
The automated inverse theory in cryptography, points to autonomous finite automata, which is relative to the canonical form for one-key cryptosystems based on finite automata, the public key encryption based on finite automata for one-key cipher can be executed by finite automata.
A finite automaton is considered as a natural model for ciphers. The method of converting Ra Rb has been introduced to deal with the structural problem of such automata; then, the public key encryption based on finite automata and a focal type for one key cipher that can be executed by finite automates with limited error propagation and without spreading data is provided.

What is the application of Finite Automata in cryptography?


texts:
I'm trying to understand curve25519, and ECC public points.

I'm playing with Minisign, to better understand the fundamentals of ECC.

Minisign uses curve25519 and outputs public keys as base64 encoded strings in the following format:

base64(<signature_algorithm> || <key_id> || <public_key>)

  signature_algorithm: Ed

  key_id: 8 random bytes

  public_key: Ed25519 public key

As an example, my public key is:

RWRxmbgCt+0wPvdZ0alM7J46oqsOBTtud4E8zRznnCT0q0u7X971eWUN

Decoding this Base64 to Hex we get:

45 64 71 99 b8 02 b7 ed 30 3e f7 59 d1 a9 4c ec 9e 3a a2 ab 0e 05 3b 6e 77 81 3c cd 1c e7 9c 24 f4 ab 4b bb 5f de f5 79 65 0d

This makes sense... 45 64 == Ed

Next eight random bytes... 71 99 b8 02 b7 ed 30 3e

Then, if I'm correct, the public key... f7 59 d1 a9 4c ec 9e 3a a2 ab 0e 05 3b 6e 77 81 3c cd 1c e7 9c 24 f4 ab 4b bb 5f de f5 79 65 0d

Now this is what I'm trying to understand!

The public key is the right size (32 bytes/256 bits), however isn't it supposed to start with 04?

Also is it possible to take the public key and break it into it's X,Y co-ordinates as integers?

Is 16 bytes enough to represent a curve25519 X or Y component?

Thanks for the help.


texts: Can a CSPRNG, seeded with a key, be used to generate a byte sequence as long as the plaintext to XOR it with that?

texts: Given a “safe” (meaning: brute-force is your only shot) cryptographically strong PRNG, wouldn't it be safe to encrypt data using the CSPRNG to create a key as long as the data and then encrypt the data by XORing it with the key?


texts: how to efficiently prove the query result is empty?

texts:
Consider a simplified scenario.
Suppose an untrusted server holds a set of data $A=\{ a_1,a_2,\cdots,a_n\}$.

A client issues a query $b$ to the server and wants to decide if $b\in A$. The server replies a "yes" or "no". Then how can the client verify the correctness of the server's reply?

It is relatively simple if $b$ is indeed in $A$ and the server answers "yes". We can use some siganature- or hash-based schemes. However, what if the server just reply "no"? How can the client verify that $b$ is not in the set?

I know (but not much) some schemes such as Authenticated Set. But the complexity seems rather high.

So I am looking for efficient schemes that can prove that the query result is indeed "empty".


texts: Would the property of perfect forward secrecy still be achieved in MTI/A0 for a session key that was established between C and D when one LL-key aD is revealed so that both LL-keys aC and aD are revealed?


texts: Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?

texts:
To be clear I'm well aware that ChaCha doesn't need to be "improved".  Also, I have no intentions or misguided ideas about trying to "improve" it.  My question is hypothetical, and is inspired by the comments on this answer
I am also aware that ChaCha does not require any padding scheme, and that any positives from the scheme listed below would be outweighed by the negatives.
However, imagine that we choose to use the RSA Optimal Asymmetric Encryption Padding  (OAEP) padding scheme along with the ChaCha cipher.  The padding scheme is used unnecessarily as an attempt to improve security.
Per Wikipedia:

The algorithm takes the form of a Feistel network which uses a pair of random oracles $G$ and $H$ to process the plaintext prior to asymmetric encryption. When combined with any secure trapdoor one-way permutation $f$, this processing is proved in the random oracle model to result in a combined scheme which is semantically secure under chosen plaintext attack

And:

OAEP can be used to build an all-or-nothing transform.

It seems intuitive that OAEP improves the security of the cipher. The padding scheme should provide additional CPA/CCA security.
In the event of a known/chosen plaintext, it would obscure the key stream. As per the Ron Rivest's paper All-or-nothing encryption and the package transform

We present a new mode of encryption for block ciphers, which we call all-or-nothing encryption. This mode has the interesting defining property that one must decrypt the entire ciphertext before one can determine even one message block. This means that brute-force searches against all-or-nothing encryption are slowed down by a factor equal to the number of blocks in the ciphertext. We give a specific way of implementing all-or-nothing encryption using a “package transform≓ as a pre-processing step to an ordinary encryption mode. A package transform followed by ordinary codebook encryption also has the interesting property that it is very efficiently implemented in parallel. All-or-nothing encryption can also provide protection against chosen-plaintext and related-message attacks.

Question:
Would using OAEP alongside ChaCha improve the CPA/CCA security of the cipher?  Specifically, would a key recovery attack using the keystream would be made more secure with an AONT?


texts: Security of HKDF when part of output is exposed

texts:
There is a system in which Alice and Bob need to establish a secure communication channel. Their conversation happens via a "public" server whose only purpose is to rely messages between users. This server must never be able to decrypt communications.

With the protocol that Alice and Boo will use, the first time they want to talk, Alice generates a 128-bit key that is able to exchange with Bob in person.

This is the only communication that Alice and Bob can have in a trusted manner (in person) before begin communicating through the server above mentioned.
As stated, this communication is one-way (Alice-to-Bob) and Alice is only able to give bob at most 128 bits of data.

Now, Alice and Bob connect to that server and need to find each other by going in the same "stanza".
Since the only knowledge that Alice and Bob have of each other to meet is that 128-bit key, they expand this key (using HKDF) to create:

A 256-bit AES key for encryption.
A 256-bit HMAC-SHA256 key for authentication.
A 128-bit "stanza-id" that will be advertised publicly.

Since the server allows any client to choose any arbitrary stanza-id on where to sit and wait for messages, Alice and Bob are able to meet each other in the same stanza, and even if someone is able to listen to them, their communication is secure since it is encrypted and authenticated.

My questions are:

Does exposing part of the HKDF output publicly weak the other "private" parts or leak any other information?
Does it make sense to use AES-256 when the key originates from only 128-bits of entropy?
Does allowing any client to chose any arbitrary stanza-id put the server in danger in any way?


texts: HMAC and assumptions on the cryptographic hash

texts:
According to Wikipedia, a cryptographic hash function has the following properties:

Pre-image resistance: Given $h$, it's difficult to find any message $m$ such that $h = H(m)$.
Second pre-image resistance: Given $m_1$, it's difficult to find another $m_2$ such that $m_1 \ne m_2$ and $H(m_1) = H(m_2)$
Collision Resistance: It's difficult to find two distinct messages $m_1$ and $m_2$ such that $H(m_1) = H(m_2)$

Assuming $H$ is a hash function, the following function $H'$ should — to my understanding — also be a hash function:

$$H'(m) = m_0 || H(m_1||m_2||\dots||m_k)$$

where $m_i$ is the $i$th byte of $m$.

$H'$ leaks the first byte of $m$, but even just leaking one byte, you still can't find a pre-image or any collisions.

When looking at HMAC, Wikipedia says that it takes a hash function (without maker further assumptions on the hash function). Taking my hash function $H'$ (just let it leak $\operatorname{len}(key)$ bytes, but not the long message) for HMAC, HMAC would be insecure, since everybody now sees the key.

So maybe my $H'$ is not a cryptographic hash function after all — in which case my question is: Why not?

Or $H'$ is a cryptographic hash function, but building an HMAC requires additional assumptions. What additional assumptions must be fulfilled by the hash function to be secure in HMAC? Do the three properties above imply some other properties I don't see?

Also PBKDF2 takes a PRF, where HMAC-SHA256 should be secure, but HMAC just given a hash function which has the three properties, won't be a PRF to my understanding. Again the same questions: Are there more assumptions? Even more than on HMAC?


texts:
How the use of unsafe prime in DH key exchange makes DH vulnerable to be broken?
can anyone explain to me what is safe prime, and what is the difference between safe and strong prime?
How the attacker can solve DL problem if safe prime hasn't been used even if the prime is large enough says >1024 bits


texts: I have a key that is the combination of two shorter keys generated by PBKDF2, which together are long more or less 64 bytes. Now I need to shrink it down to 32 bytes and I'm not sure what to use to do it. I was thinking of SHA256. I know that SHA256 is not safe to generate keys by itself, but since what I have is a combination of two proper generated keys, then SHA256 would be just fine. Am I right or I should use something else to accomplish this goal?


texts: Is there a difference between asking for a signature and asking for a decryption in challenge-response authentication?

texts:
Consider the following two authentication schemes. In both cases the server knows a public key of the client (for a signature system in the first and an encryption system in the second case).

Scheme A

Server presents a randomly generated plaintext to the client, and asks the client to sign the message. The server can verify the signature using the public key.

Scheme B

Server randomly generates a plaintext, encrypts the message using the client's public key, and asks the client to decrypt and send back the plaintext. The server can verify that the plaintext matches the one it generated.

The second scenario feels less secure than the first scenario, but I cannot quite put my finger on why.

Is there any effective difference between the two authentication schemes?


texts: How to apply a block cipher to (large) packetized communication when packets can get lost/erased?

texts:
In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for video over internet: > 1200 B payload)

Is it really just a block cipher in ECB mode, so that each packet can be decoded without any prior packet⁰?
Is it a block cipher in some non-ECB mode, but it gets reset at the start of a packet?
Is it a block cipher in some non-ECB mode, but we're just using a sufficiently large number of say $N$ different keys, de- and encoder, which we use in interleaved / sequential fashion, so that any erasure of less than $N$ successive packets gives us enough time to let the transmitter know we need to re-initialize the receiver?¹
Would you go the WiFi/WPA route of deriving a key for each packet, leading to the couple of  attacks we know against that TKIP/KDF method?
Am I totally missing everything?

I've tried to look into how KASUMI (3G crypto standard) does this, but I haven't been able to track down the relevant standards document.

⁰ ... and everyone is bashing Zoom for adhering to industry best practice?

¹ wouldn't that lead to feasibility of forcing the encoder to a known state by an attacker with control over which packets get lost?


texts:
I see that KDFs should be used in systems that rely on PSKs, but what practical benefit does it provide?

For instance, suppose the system relies on a shared secret for AES encryption and decryption. If the en/decryption uses a key derived from a KDF, an attacker could still sniff the key and decrypt the file. Yes, the key could be regenerated using the secret, but for the purpose of en/decryption, it would remain fixed unless compromise is detected.

So, under what scenarios does KDF increase protection? Is it just to increase the entropy of the key so that it'd be harder to crack?

Thanks


texts: How can disk encryption systems (like Truecrypt) resist frequency analysis when they allow random access?

texts:
I don't understand how disk encryption (e.g. TrueCrypt) is supposed to resist frequency analysis.

If blocks can be randomly accessed (which they can), doesn't that mean that frequency-domain information (e.g. contiguous free space) is exposed?

The only safeguard I know against this is chaining, but if they use chaining, then wouldn't a single wrong bit destroy your entire data?


texts: Why is the DES s-box non-linear? Why does it make the cracking of the cipher more difficult?

texts:
I know that if we have a cipher that makes only linear transformations (let's say a bunch of $XOR$s), we break it simply by writing a system of equations with $\oplus$ operation starting from the cipher's scheme.
In the end, we'll have a system of $n$ equation involving the $n$ plaintext bits,  the $n$ ciphertext bits, and the $n$ key bits holding with probability: $\Pr(1)$ and we can solve for the $n$ key bits.
Why with the presence of S-boxes is this not possible in the same way?
Thinking about $DES$, couldn't we just reverse the S-Boxes (which at the end are only lookup tables) to write the same system of equations? In that case, the relations won't be again deterministic? (holding with $\Pr(1)$)
What is the precise meaning of non-deterministic transformation and how is it applied here?
Could you please make me a counter-example of what I'm saying, just to see why this approach couldn't be used as it is, with the presence of S-Boxes?


texts:
I have a very simple compression function, which looks like this in C++:

unsigned long long compress(unsigned long long current_block, unsigned long long last){
  for(int i = 0; i<16; i++){
    last += current_block;
    last = last ^ (last << 13);
    last = last ^ (last >> 11);
  }
  return last;
}

It's my own first try of a compression function :)
Now, this function is the core of a cryptographic hash function. All values are 64-bit. The function splits the message into 64-bit blocks, which get passed to the compression function (current_block) together with the sum (addition modulo $2^{64}$) of the last compressions (last). The initial value (the value that is used for last when the compression function is called the first time) is 0.
About the hash function itself: It is a Merkle–Damgård construction and the messages are padded with the length of the original message (64-bit value).

So, now I want to prove that this compression function is not preimage resistant (first and second) and not collision resistant. In order to do that I want to ignore the padding and just try to find the weaknesses of the compression function itself and then think about improves I could make.
In these days it is of course computationally feasible to brute force a 64-bit hash (particularly with a birthday attack), so I understand the term "collision resistant" as "an attacker needs to try all $2^{64}$ possibilities" (in case of a preimage attack).

What I've done so far
It's obvious, that compress(0, 0) == 0, so I could add as many 0-blocks as I want to the beginning of the message. This problem could be solved by using a different initial value.
It seems to be quite difficult to reverse the compression function, because it does 16 additions and 16 mixings, which creates quite a complex relationship and every bit of the input (current_block) can affect every bit of the output.
A general problem I thought of: Couldn't it happen, that we run into a loop? That would happen, if the result after the mixing in one round would be equals the starting value last. In this case, we would have quite a simple relationship as we need only to break one (or a few) mixing rounds. If this problem exists, I think it could be solved by adding a round constant (changing every round) in each round.

Questions I have
Does it make sense to have a compression function that uses 64-bit of the message to create an output of 64-bit? I see no problem with it, but I'm not sure about it as many common hash function use a much bigger message part to compress (MD5 does 512-bit => 128-bit).
Can we expect collisions with the same last-value, like compress(x, 0) == compress(x', 0) ?


texts: How much would removing enigmas biggest flaw improve it?

texts:
Enigma's biggest flaw was that a letter could never be encrypted as itself. How much would enigma's security increase if it were possible that a letter could be encrypted as itself? I know that would void the method used by Turing and co.

Please give as much detail as possible in answers.

EDIT: clarifying improvement

The improvement is, in the simplest terms:

Once the signal has passed through the rotors and into the reflector, the rotors shift forward before allowing the signal back through, meaning that each encryption operation would use two shifts instead of one.

EDIT 2:
Also, with enigmas flaws removed, how comparable to modern algorithms would it's security be? And as another note, I'm not talking about modifying enigma back in WWII, I'm talking about a virtual software based mod now.


texts: Which is more secure using a CSPRNG for a One-time pad, or AES?

texts:
In reading about the One-time pad it appears to need truly random key for the pad. Since true random values are not practical to generate this presents a problem (thus making One-time pad less practical). If instead I use the operating system provided CSPRNG to generate the key, is that any better than using AES in GCM mode?

Update: Just to be clear, a One-time pad cannot be done with a CSPRNG.


texts:
I would like to share access to encrypted data among many recipients. I do not know the recipients ahead of time (when encrypting the data). Once the data is encrypted, I do not have access to the plaintext (so I cannot re-encrypt).

Right now, I have a shared secret key that is distributed to recipients as they are granted access to the data (again, encrypted so I do not have access ot the shared key). Unfortunately, that means any recipient of the shared secret can leak the key, compromising the data for everybody.

I can't really prevent "bad" recipients from the leaking the key (or the plaintext, for that matter), but I would like to be able to distribute unique keys to each recipient so that if a key is leaked, I can determine who did it.

I think I want a symmetric encryption scheme where the ciphertext can be decrypted by a set of keys, rather than a single key. Each secret key is unique and it's hard to derive one secret key from another (so one recipient cannot forge another's key), but its simple for me to generate new secret keys (so I can easily add new recipients).

Does such a schema sound familiar?


texts: ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?

texts:
I hope that this is not a duplicate because I'm looking for nuance.  I understand the difference between ECB and CBC for a block cipher, and I understand that ECB is susceptible to replay attacks, but my question is just from the standpoint of strength.  If I have cipher that has 256-bit key and 128-bit data that is used to encrypt a file on a disk, the mathematical complexity does not increase between CBC and ECB for cracking the cipher?  I read a lot of answers saying "ECB is insecure", but there's a difference in theory and practice.  I expect to only have 1k 128-bit blocks.

I have an extremely power constrained system, and I'm trying to determine if the 10% overhead required for CBC over a ECB architecture matters from the standpoint of security.  The reason is that if I do have a significant gain using CBC over ECB, perhaps I should just use a smaller cipher size because I'd basically be trading up circuits.

Any suggestions from the engineering perspective would be appreciated.


texts: Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

texts:
In theory, for an ideal cipher $E_k: \{0,1\}^{128} \to \{0,1\}^{128}$, it would be completely fine to use the key and the input interchangeably, but obviously AES is not perfect. For AES128, the key size and the block size are the same. What would the security implications of using the key in place of the input block and vise versa be? I understand that it would be quite inefficient as the key schedule would need to be re-calculated for every block, but would it make cryptanalysis easier?

Encryption and decryption would be possible by putting the cipher in a modified counter mode. Where $n$ is the nonce, $i$ is the counter/position of the block, $C$ is ciphertext, and $P$ is plaintext:

\begin{align*}
C_i &= E_{n \mathbin\| i}(k) \oplus P_i\\
P_i &= E_{n \mathbin\| i}(k) \oplus C_i
\end{align*}

Actual counter mode is:

\begin{align*}
C_i &= E_k(n \mathbin\| i) \oplus P_i\\
P_i &= E_k(n \mathbin\| i) \oplus C_i
\end{align*}

This is a purely hypothetical question and I have no intention of doing something so silly.


texts: Notation of * in hash function of identity-based encryption


texts:
Consider a multi party system where public keys of all receivers are known. Server wants to send message to one of them using (textbook?) RSA. Adversary is given ciphertext and even Message to be send, and all $k$ public keys of participants. Can any attack tell who is the target receiver?
Or in nutshell: Given $C$, $M$ and all $k$ public keys, can an attacker tell with significant probability which public key was used to encrypt $M$ giving $C$ ?

Editor's note: The textbook RSA part is per OP's comment. It was originally plaintext RSA. Alternatively, the question makes (more?) sense with some random encryption padding.


texts: Is it possible to brute-force a hash algorithm of 32 bits

texts:
I have a 30000 user passwords and usernames stored in a table on a database in which the passwords are stored as hash where ,I need to guess the passwords for all users and I have the hash function which its output is 32 bit in length.

My questions is:
How much time do I need to guess that if I use collision attack?

I am confused which is better pre-image attack or collision attack ? if the input to the hash function is 80 bits.

if collision is better, is this mean to look at 32 bits?


texts: Justification for the way s is computed in DSA?

texts:
I am sorry if this is a naive question but is there any justification for the way that s is computed in the DSA signature algorithm:

$$
s = k^{-1} * (rx + m)
$$

This looks to me like a very arbitrary combination of $k$, $r$, $x$ and $m$. Is this just one particular way that's found to work or does it actually have some kind of structure/reason behind it that I am missing?


texts:
My question is about attacking PKCS#5 with CCA using the error feedback.
What we learnt in class about PKCS#5:

CBC requires padding to whole block boundary PKCS#5: standard padding

If last plaintext block has 1 byte: pad with $\texttt{07}$ bytes
If last plaintext block has 2 bytes: pad with $\texttt{06}$ bytes
If last plaintext block has 7 bytes: pad with $\texttt{01}$ byte
If last plaintext block has 8 bytes: pad with another block (8 bytes)    of $\texttt{08}$.

And:

Decryption process: Apply 'regular' CBC-mode decryption Check padding:

If padding Ok, remove and return plaintext
If incorrect, abort with error

Up until now I understand everything. But the last part, describing a CCA attack on PKCS#5 with feedback, is what I can not understand:

Let $(c_1,...,c_8)=F_k(p_1,...,p_8)$ be some ciphertexts.
To find last byte $p_8$: Check which prev block gives Ok decryption
Let $x_8$ be the last byte of a block $X$ giving Ok padding
With high probability, $x_8 \oplus p_8 = \texttt{01}$...

And that's it.
First, I don't get where the IND-test is involved here.
In the test, attacker sends two messages $m_1$,$m_2$ and receives $c'$ which is an encryption of one of them, and has to distinguish which one exactly using the chosen-ciphertext capability, but here we just use the error result, as if the test is ignored.
Now, let's see if I understand that correctly:
$c_1$,...,$c_8$ are the bytes of some ciphertext block we wish to decrypt.
It says that in order to find out $p_8$ we find last block which gives ok on padding - let's assume we found one... this block looks like this: $c'=(c'_1,...,c'_8)$, and I know that the plaintext of $c'$ ends with $\texttt{01}$, or $\texttt{02},\texttt{02}$, etc.. until $\texttt{08},...\texttt{08}$ (8 times).
And now we denote the last byte (decrypted as plaintext) as $x_8$.
Why would $x_8 \oplus p_8$ be $\texttt{01}$ with high probability?
It would be great if someone could enlighten me up, I'm also open for other explanations instead the one I described here.
P.S. Read that question, seems related but I still can't understand how to deduce an answer about my question.
Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?


texts: How can I calculate the entropy of an image?

texts:
I am searching how can I calculate the entropy of a image for a Capture The Flag. I know what is the entropy theory and I tried a pair of things:

Convert the jpg image on binary image and calculate the entropy of binary text.
Viewing the images and intuiting which has greater entropy

I don't know how can I solve it. What can I do?


texts: Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?

texts:
$H(s,r)=d$ is a function that hashes the secret string $s$ with a salt $r$, and returns a digest $d$.
$r$ may be arbitrarily chosen and each $r$ returns a different $d$.
For any $d$, $r$ is known from a function $R(d)=r$.

Both $H$ and $R$ are not reversible, i.e. there isn't a neither a reverse function $H'(d,r)=s$ nor a reverse $R'(r)=d$.
To prove that d is a valid hash for the string $s$, it's given a function $V(d,s) ↦ \{0,1\}$ that outputs $1$ only if $H(s,r)=d$.

Is it possible to compute another valid hash $d'$ for an unknown $s$, knowing only $d$ (and therefore the salt $r$)?
That is, is it possible to find a function $G(d,r')=d'$ such that $V(d',s)=1$ for at least some $r'≠ r$ matching $d'$?

This from a theoretical point of view.

On the practical side, BCrypt is an implementation of $H$. If a know a valid digest for an unknown secret, can I compute another valid digest? I've heard about a technique called "hash extension attack", but this involves changing the length of the digest, that for BCrypt is fixed. Is BCrypt vulnerable from this point of view? For which (if not all or none) cryptohashing algorithms is it possible to have a function like G?


texts: Is XOR adequate for encrypting truly random data?

texts:
It is well-known that the two-time pad is very insecure.  However, it seems unexploitable in the case where the plaintext is indistinguishable from random (ex. symmetric keys).

Is this property useful?

Note: I don't plan on using this in production.


texts: How can I display what digest algorithm has a key? If I import a public key which has MD5 as digest, I get a warning about this weak algorith. But how can I check, what digest algorithms all my keys use in my keyring?


texts: Why this complexity defining AES-GCM counter block?

texts: AES-GCM counter block is defined as nonce || IV || counter. Why this complexity? Knowing that it does not need to be secret and its only required property is to be unique, why not use a 128 bits true random number for the whole block? The counter instead of starting at 0 will start at some random value, wrapping around when reaching maximum value.


texts: Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?

texts:
I understand the need for padding in MD5. But why do we append the message length to the padding?

I heard it strengthens the hash but how?

Please provide an example if possible and how it applies to this quote:

  The inclusion of the length-block effectively encodes all messages such
  that no encoded input is the tail end of any other encoded input.

Why a message being the tail of another message is bad (if it is)?


texts: What restrictions exist for publishing on strong encryption in USA?

texts:
In the past, there were export and other restrictions on publishing information, source code or otherwise making new strong cryptographic items available without prior government approvals.

There are many conflicting regulations, laws, constitutional freedoms like freedom of speech and various legal precedents that make this area confusing; ITAR, EAR, etc.

So my specific questions are, are there still legal or regulatory restrictions for U.S. citizens that prohibit our ability to publish papers and articles about strong encryption techniques, improving existing techniques or introducing new cryptographic methods?

How about publishing source code accompanying such papers which are made publicly available? Is that still considered “exporting” that requires approval?

Edit1:
That’s helpful guidance on software/hardware items.
What about simply publishing research papers about improving and supplementing existing algorithms like AES, ChaCha, etc. without actually shipping anything other than a published paper?


texts:
For my personal research, I have to create a messaging app, but security is only important part of application, security from MITM (man in the middle attack), at device end, and at server level. (note: this will not end to end encryption, as I want to backup messages on server for cross-device access like telegram).

I created the following model:

Server creates RSA key pair first time at installation and keeps private key in a file on server, and broadcast public key with its clients, (A, B)
A&B also create RSA key pair at first-time login, and stores private key at device level and sends public key to server.
A sending message to B:
    create a random salt_key
    encrypt message with this salt_key (AES)
    encrypt salt_key with server's public key (RSA)
    send RSA encrypted key, and AES encrypted message to server
    server can decrypt salt_key with RSA private key and then message
    server will do same as A did, but with B's public key and B will decrypt salt_key with private key then decrypt message.

I Will also add "signature" for sender verification, but my concern is SERVER because if server compromised everything the-end, but if i choose end to end encryption, how to achieve my message backup goal and cross device, access.


texts: how to prove our algorithm is secure against chosen plaintext attack?

texts:
I am working on a topic in cryptography where I have tried to develop an encryption scheme.

How could I prove mathematically that my algorithm is secure against chosen plaintext attacks?.
Will it be sufficient to say that as my algorithm is uniformly distributed, it is secure against chosen plaintext attacks?


texts: Blake2 vs md5 for checksum / file integrity

texts: I'm working on something that requires computing a checksum / file integrity. I've heard MD5 was no longer recommended. Should I use Blake2 instead? Is there a specific variant of Blake2 I should use for checksums? Blake2s? Blake2sp?


texts:
Prove that the affine cipher over Z26 has perfect secrecy if every key is used with equal probability of 1/312.

Just some guidance/help with this problem would be greatly appreciated not sure how to start the proof. Many thanks!


texts:
when does active S box count reduce in AES difference propagation?
what is the relationship between active S-boxes and MixColumns?
can you please explain it with an example?


texts: How does Feistel cipher create diffusion between blocks?

texts: From what I've read about Feistel ciphers, I can understand that within each block, there is both confusion and diffusion. But it is unclear to me how a Feistel cipher permutates among blocks of data. If a message is longer than the block length, how would changing one part of the message affect the encryption of other parts of the message? If L1 and R1 are considered one block, how would they affect the next blocks or the previous blocks of the message?


texts: How to use GCM mode and associated-data properly

texts:
I'm currently migrating a project to use the bouncy castle GCM mode.  I understand that using an authenticated mode removes the need for a HMAC, however I want to be sure that I'm using this mode correctly.  When applying a HMAC to ciphertext, I know it's imperative to include in the HMAC'd data any params that could affect the outcome of the decryption (IV, block-size, algorithm name, etc).  The bouncy castle GCM implementation accepts AEAD parameters, one of which is 'Associated Text'.

With authenticated modes, is it correct to:

use encryption params as Associated Text
encrypt cleartext (without params appended)
append params to ciphertext (in cleartext) to facilitate future decryption

I assume this workflow applies to EAX mode as well?


texts: What is the best mode of operation for file encryption with Threefish512?

texts:
In Cryptography Engineering Bruce recommends using "rand IV CBC mode" but the copy of the book I have is from 2003 and I am unsure if this is still a recommended practice with all the recent attacks discovered on various CBC implementations.

Is there a better choice then CBC mode?

I am writing a program that will be using a block cipher to encrypt a file locally. This is for a personal academic project.

Assume the following

The block Cipher I am using is Threefish512 so GCM is not viable as it is only defined for 128-bit block ciphers
The block cipher I am using is not supported by any modern crypto libraries (I am aware of) so I will be implementing this mode of operation myself
The file is relatively small and the encryption/decryption of it is only done periodically so security is preferred over speed and parallelization ability
The computer doing the encryption has not been physically compromised
I have access to truly random numbers for IV generation
This encryption will not be part of direct network communications so an attacker will not have access to input whatever they want into the cipher.
A mode that offers authentication is preferred
The details required to implement this mode of operation are in the public domain and not encumbered by any software patents


texts: Why is the rand() function in C not a cryptographic pseudo-random generator?

texts:
For example, one of the possible rand() implementations：

int rand_r (unsigned int *seed)
{
    unsigned int next = *seed;
    int result;
    next *= 1103515245;
    next += 12345;
    result = (unsigned int) (next / 65536) % 2048;
    next *= 1103515245;
    next += 12345;
    result <<= 10;
    result ^= (unsigned int) (next / 65536) % 1024;
    next *= 1103515245;
    next += 12345;
    result <<= 10;
    result ^= (unsigned int) (next / 65536) % 1024;
    *seed = next;
    return result;
  }

How to proof that it is not a pseudo-random generator?


texts: Is there an example of a “robust, yet not private” SMC protocol?

texts:
I have been trying to understand the interplay between robustness and privacy of an SMC protocol. It is easy to come up with a protocol that is private but not robust.

Can someone provide an example of a secure multiparty computation protocol that is not private but is robust, under some threshold $t$ corrupt parties?


texts: Obtain 384 bits from a 256bit MasterSecret

texts:
I'm currently implementing, with crypto++, and AES tranmsission system, whose key is based on a previous MasterSecret of 256 bits (which has been expanded using PBKDF2).

This MasterSecret is then split into a key and an iv, to encrypt a message using AES-GCM.

I must work with AES-256, so my key must be 256-bit long. The iv for GCM is always 128-bit long.

So, briefly, I must extract from a 256-bit MasterSecret a 256-bit key and a 128-bit IV.

How to do it ?

I thought of taking the MasterSecret as the key, and then hashing the key to get then the iv of the desired length.

Is there a more efficient/elegant way to obtain 384 bits from a 256 bit MasterSecret ?


texts: Why does NaCl's crypto_auth have twice the security level of crypto_onetimeauth?

texts: The crypto_auth function produces a 256-bit HMAC, with a 512-bit version also available. But the crypto_onetimeauth function (and the Box and SecretBox constructions that use it) only produces a 128-bit authenticator. Is there any particular reason NaCl doesn't include a 128-bit HMAC function?


texts: Why does Shamir's Secret Sharing Scheme need a finite field?

texts:
I read ampersand's question "Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme", where he asked why Shamir's Secret Sharing Scheme uses arithmetic in a finite field of prime order.

The answers to that question explain that a prime field is not necessary for Shamir's scheme, but, rather, that any finite field can be used.  However, they don't really address the other part of the question, namely why do we need a finite field at all?  Couldn't we just use, say, ordinary integer arithmetic instead?

Can someone please explain (in the simplest possible manner) the reason that Shamir's Secret Sharing Scheme uses finite field arithmetic?


texts:
In the classic "Applied Cryptography" (20th anniversary edition) book from Bruce Schneier, there is an illustration of a maximal-length LFSR:

According to the book, this LSFR uses the tap sequence from the polynomial $x^{32}+x^7+x^5+x^3+x^2+x+1$ which is maximal-length.
However, most examples I found online (e.g. Wikipedia) increment the numbering of the shift register bits from the input to the output (left to right)—which could just be a different convention—but the taps are also reversed. On this figure that would translate to taps on $\{b_1,b_{26},b_{28},b_{30},b_{31},b_{32}\}$.
I would normally tend to trust more a reference book rather than random online sources but I found an alarming amount of counter examples. Are the taps placed correctly on the above figure?


texts: Role of AND operation in FHE, MPC and ZK

texts:
Going through LowMC, one of the main advantage of it seems to be useful in Fully Homomorphic Encryption (FHE), Multi-party Computation (MPC) and Zero Knowledge (ZK) proofs. I have no idea about any of these, but it seems lowering the number of AND gates is a big deal. Similar claim is made for the Kreyvium cipher as well.
Could anyone explain it to me, how having a low number of AND gates help in those 3 cases? Mainly, how come a private key cryptographic algorithm helps in those areas which are not at all related? Also, does it mean the cost for linear operation (Exclusive-OR gates) is zero in FHE/MPC/ZK?


texts: Do known-plaintext attacks exist for public key encryption?

texts:
In asymmetric ciphers we publish the public key for anyone, which means an attacker can encrypt any message they want and compare the ciphertext and plaintext without communicating with the owner of the private key. So do known-plaintext attacks make sense for asymmetric ciphers, or are they only for symmetric ciphers?

Ps. What are all the attacks there exist for public key ciphers? (I know of chosen ciphertext and timing attacks.)


texts: What encryption algorithm is context-free, deterministic and symmetric?

texts:
Meaning the same key is used for encryption and decryption (symmetric). The same message always results in the same cipher text (deterministic) and has no memory (conetext free) like nounce or intialisation vector (IV).

Which algorithms exist and are recommended?


texts: Time taken for a brute force attack on a key size of 64-bits

texts:
You can do $2^{30}$ encryptions per second and the key size is 64 bits.

$2^{64}/2^{30}$ should give me the time taken for a brute force attack?
What if you double the key size?

How can I calculate the maximum and average time taken for such an attack.


texts:
Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is not adequate even for AES-128 (this is according to www.cryptopp.com/wiki/Diffie-Hellman)...so far it seems my only options are 1) generating a diffie-hellman group myself, but I don't want to do this when I don't know whether the group I will generate has the ideal properties or 2) Have the application generate a new, adequate diffie-hellman group on the first session start... I would like to avoid this, because it introduces a lot of unnecessary complication on the already complicated system.

In short, my need is to include a pre-generated diffie-hellman group on my application, but I don't want to generate this group myself and include it (and neither do I want to generate a diffie-hellman group on the first session start).

I have also looked into RFC3526 but even the biggest group there (group 16, 8192-bit MODP Group) is not strong enough for my needs according to NIST guidelines (I need at least AES-256) the RFC also doesn't specify the strength of the prime-order subgroup, which further annoys me, it also doesn't specify how, where, when, or under what criteria those groups were generated (RFC5114 got its groups from NIST).

The only groups that satisfy are the elliptic curve diffie-hellman groups, but I do not have the necessary support for elliptic curve diffie-hellman, and already got diffie-hellman implemented.

I seem to have hit a dead end here, can anyone chime in?


texts: Forging a valid tag for an arbitrary message when you have some knowledge about the key

texts: I am using  HMAC-SHA256 with a 128-bit key. Assume my key generator leaks some information to an adversary. Hence, the adversary can predict the key with probability $\alpha$. Can I say that the adversary can forge a valid (message,tag) pair with probability $\alpha$?


texts: Shamir's Secret Sharing Scheme - prime security?

texts:
Does the prime (which needs to be larger than the message) have to be chosen randomly for security, or can it just be a huge constant?

Also, the Wikipedia article for SSSS states

  The size of each share does not exceed the size of the original data.

but isn't each share comprised of both $X$ and $Y$? or is $X$ already known because of the prime? and if the prime is chosen at random then surely the prime has to be distributed with each share?


texts:
In [ELOS15], the authors give an attack on RLWE, and claim that "the hardness of Ring-LWE is...
dependent on special properties of the number field" chosen; whereas, responding to prior attacks on RLWE (including the one cited above), in [P16] the author claims that 'the rings themselves are not the
source of insecurity in the vulnerable instantiations.' Which is the case? Are certain rings (uniquely?) vulnerable to certain attacks, or is it merely the parameters chosen which make a construction insecure (e.g. a poorly chosen error distribution)?


texts: What does "with all but negligible probability" mean?

texts: I have met the sentence that something will happen "with all but negligible probability" in the paper "Homomorphic Signatures for Polynomial Functions". However, I cannot quite figure out what exactly they mean by this. I know the definition of something happening with negligible probability, it is the "all but" that throws me off. In the paper they are referencing, it is described that it happens with probability $1-2^{-\Omega(n)}$, so I figure this must be the definition of it happening with all but negligible probability? However, I do not know what they mean by $\Omega(n)$, and I cannot seem to find the definition in the paper. Can someone perhaps clean things up for me?


texts: In coin flipping protocols, why aborting is allowed, and why the non-aborting party flips a coin at the end?

texts:
To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in [1]:

Alice sends Bob the commitment $c = commit(x)$
Bob sends Alice the bit $y$.
Alice sends Bob $decommit(x)$, Bob verifies Alice actually chose $x$.
Both compute result $r = x \oplus y$

It is said that Alice can place a bias of $1/4$ towards her choice after she receives Bob's bit $y$; if the result is what she wants, she plays along, if not, she aborts, forcing Bob to flip a coin on his own, which has $1/2$ chance of her choice coming up.

I understand the protocol and how a bias can be exerted. What eludes me is why such protocols are of interest:

Why is either party allowed to abort at will? The only point abortion makes sense is when Bob fails to verify, but they can abort whenever they want. If only such an abortion is allowed, the bias-by-abort scheme fails since Alice cannot abort upon seeing the result after the second step.
After Alice aborts, why does Bob flips a coin on his own? If the coin was flipped in case of a dispute, Bob can choose the way it suits him. If Bob could've just generated a random bit without having to prove anyone it is not biased, he would not have bothered with the protocol in the first place.

[1]: https://eprint.iacr.org/2012/643.pdf - Section 1, Example 1.1


texts: How to prove that I am part of a list without revealing my identity?

texts:
Let's suppose and scenario like a secret voting scheme, at the ID verification step.
Considerations:

There is a public list of identities of people who are able to vote (ex, people who live in a certain town).
The identity confirmation process is entrusted to a central server (Bob).
Users send requests remotely and decentralized (ex, with their respective devices).
The idea is that the ID is never sent via the communication channel.
The is no specific ID method, could be anything that does the task, digital signature, etc...

Conditions to be met

The Alice (the voter) must prove to Bob that she is on that list without revealing her identity.
The Bob (the server) has to ensure that no one who is not on the list can access to the voting.

How this problem is called and what is a practical example of the solution?
PD: The voting execution process is not important in this problem, it only deals with identity verification.


texts: Time-sensitive key derivation for sharing with third-party

texts:
Devices:
In this system, users have one or more wearable devices (a smart watch), one of which they will most likely have on their person all the time. The devices are linked to their account by their serial number.

Users must have a mobile device linked to their account too. In fact, the watch can only accesses the network through the mobile device.

Access:
Users must be able to access their personal data on their watches and their linked mobile device. They should also be able to access their personal data on devices that are not linked to their account, such as a PC or another mobile device, via a Web app.

The server storing their data should not be able to read it, but must be able to store new data for the user. You see where I'm going. But wait…

Customer service agents should, with the user's permission, be able to (temporarily) access their data. It can be assumed that the user, when they wish to grant that permission, has a channel open with customer service (phone call or physical conversation) other than the Internet.

So how do I make that work?

And since I am not a cryptography expert, I'm sure I've left gaping holes in my scheme, so please tell me.

My current plan is to generate a private key on each device at the time the user links it to their account. The public key is sent to the server and associated with the user account and hashed device ID.

All the user's data (it won't be large) on the server is encrypted with all their public keys (so any linked device can decrypt it), PGP-style.

When the user links a new device to an existing account, or wants to access their data on an unliked device (that has no associated key pair) or share it with customer service,

user is prompted to turn on any of their linked devices
the linked device generates a short random code (would 6-digit work?)
user (or customer service agent) enters the number into the unlinked device or Web app
both ends perform key derivation on the code with some server-generated salt
the linked device decrypts the user's data, encrypts it with the shared symmetric key and sends it back to the server
the other device (or customer service agent) can use the newly-encrypted data for an hour or two, then the server deletes it

Obviously, the weak code used for key derivation could be easily brute-forced if the attacker has some encrypted data to try derived keys against. That data won't be stored by us forever, but I suppose it could be stolen and stored by an attacker. How can I make that part stronger? is there some secure way to do time-sensitive key derivation so that the derivation cannot be reproduced an few minutes later (or however long it might take to brute-force a 6-digit code with a decent key derivation scheme)?


texts: Does Proxy re-encryption can re-encrypt large data?

texts: Many resources talk about the benefit of Proxy Re-encryption (PRE) and I also implement my PRE using Elliptic Curve key pair. But after I set up Global parameters, I can encrypt very small data maybe less than 1KB. My question is with EC key pair normally, can we encrypt large data maybe about 10MB?


texts: How to provide partial confidentiality and full integrity for a protocol message?

texts:
I want to provide confidentiality and integrity for a protocol. I don't want to encrypt the entire protocol message. I do not want to encrypt the header and timestamp of the protocol message, but I want to have the integrity for the entire protocol message. Thus I do the following:

1- encrypt the message except for the header and timestamp by using CBC.
2- digest the entire message (header, timestamp and encrypted message) by using HMAC.

Is that good practice? if No, what is the best practice?


texts:
I have a locked-down production system that we'd like to process specific requests, picked-up (poll) from a less-secure location.  For security and "go slow, this is production" reasons, a request must be authorized by 2 (or N) people on the team.

I can imagine how to implement this fairly simply just using openssl and signatures -- e.g., the secure server has a pool of public keys (people on the team who can authorize a request) and any submitted request must be correctly signed (e.g., https://stackoverflow.com/questions/10782826/digital-signature-for-a-file-using-openssl) with the private keys of N different people from that pool.

But it seems like a common-enough requirement that it must already exist; any pointers?  I have a suspicion I'm just not searching for the right terminology...  Thanks!


texts: Are there only two ways to prove a cryptographic protocol is secure?

texts: If I want to prove my protocol is secure, can I just use a game based approach and/or a simulator approach? Or are there other common approaches?


texts: Relation between attack and attack model for signatures

texts:
What is the relationship between an attack and an attack model?
For example, let $\Pi$ be the Lamport signature scheme.  This signature has its security based on any one-way function. The Grover algorithm, an attack, inverts this function with complexity $\mathrm{O}(2^{n/3})$. Furthermore, there are algorithms that try to forge a signature, known as adversaries.  Depending on the way they act, we choose an attack model such as the chosen-message-attack model.
Is there any relationship between this model and the attack described above?


texts:
Assume the following scheme for a PRNG generating decimals in [0,100)

Given a message and a key, compute tag := HMAC512(message, key).  Take the first 5 hexadecimal characters of the tag.  If the result is smaller than 1,000,000 in decimal, divide it by 10,000 and return it, otherwise take the subsequent 5 hexadecimal characters of the tag and repeat.  If all 25 cases of 5 hexadecimal character groups yield decimal integers >=1,000,000, the remaining 3 hex digits are divided by 100 (decimal) and returned (in decimal).

In order to compute a stream of numbers, there is a counter within the message that is incremented with each generation.

Obviously, this is not a good scheme (given the final clause listed).  But, can an attacker, knowing the message and not the key, predict subsequent numbers or predict if subsequent numbers will be within a threshold (either >=50 or <50)?


texts: Why is verification using DSA slower than verification with RSA?

texts:
We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this?

DSA parameter generation:

choose prime number $p$
choose prime number $q$ such that $q \mid (p-1)$
$g = h^{\frac{p-1}{q}}\mod p$ with $1 < h < (p-1)$ (multiplicative order)
private key: choose $x$ such that $0 < x < q$
public key: $y = (g^x\mod p)$

Public key: $(p,q,g,y)$ and private key: $(x)$.

To calculate the signature $(r,s)$:

choose $k$ $(0 < k < q)$
$r = (g^k\mod p)\mod q$
$s = [k^-1 (H(M) + xr)]\mod q$. ($H()$ is our hash function)

To verify our signature we calculate

$w = s^{-1}\mod q$
$u_{1} = [H(M)w]\mod q$
$u_{2} = (rw)\mod q$
$v = [(g^{u_{1}}y^{u_{2}})\mod p]\mod q$

So, I understand how this works. But why is verification slower than RSA verification?


texts: When extending the domain of a fixed-length MAC, why do we have to include the message length in each block?

texts:
In Katz's text (2nd edition), it states in 4.3.2:

  The truncation attack can be thwarted by additionally authenticating
  the message length along with each block. (Authenticating the message
  length as a separate block does not work. Do you see why?) That
  is, compute $t_{i} = Mac'_{k}(l||m||i)$ for all $i$, where $l$ denotes the length
  of the message in bits. (Once again, the block length $|mi|$ will need to
  decrease.) This scheme is vulnerable to a “mix-and-match” attack...

I don't understand the "do you see why" part. Why can't we just use the first block to provide the length, and a tag along with it to authenticate the length, and an index to verify that it is the first block? For later blocks, we just give  the message and the index, and don't have to give the length, since it was already given in the first block.


texts: Mental Poker with untrusted server (i.e. no peer to peer)

texts:
The question of implementing peer to peer mental poker has already been asked on stackoverflow. And there appears to be an implementation called LibTMCG.

Also on this site a question was asked about problems such as clients disconnecting or refusing to act (show cards, bet/check/fold). LibTMCG seemed to not deal with such problems from a cursory glance.

An implementation of mental poker that is based on html naturally precludes peer to peer and must rely on an untrusted http server.

So given the constraint that the clients must communicate only with the http server how does the implementation of mental poker change? And are problems such as clients disconnecting or refusing to act (show cards, bet/check/fold) easier or more difficult given communication only with the server.


texts:
I have generated one RSA-2048 signing key and one DSA-2048 signing key, using gpg command

gpg --full-generate-keys

I would expect the key to have size 2048 bits, however, running the command

gpg --export-secret-keys <key-id> | wc -c

gives a size of 1353Bytes for the RSA private key and 1103Bytes for the DSA private key. The public keys are 656Bytes and 1020Bytes.

Why is this? Is this because the exponent and primes, passphrases, my name etc are stored together with the keys?


texts: What is the Knowledge Of Secret Key Assumption (KOSK)

texts:
From what I've read it seems to be where an entity must prove that they own the secret key. Which is done by signing a message M using said secret key.

Is this different than doing a Proof of knowledge for a secret key?
Is this different than doing a zero knowledge proof for a secret key?


texts: $\boxplus$- key addition vs $\oplus$- key addition

texts:
GOST cipher , Hight cipher and SEA cipher use key addition based on modular arithmetic addition (module key size $\boxplus$) compared to many ciphers which use arithmetic addition modulo 2 ( $\oplus$).

Q.1 what is the difference between two operations in term of security evaluation and performance across software and hardware ?

Q.2 why do not we see lots of ciphers apply  $\boxplus$ in key addition ? is it because of lack in mathematical proof?


texts: Do ciphertexts leak information about their algorithmic creators?

texts:
If an adversary holds thousands of encrypted files that were encrypted with the same cipher, can he determine which cipher method had been used on the files?
Assume that the adversary has no prior knowledge about the encryption environment.

Details:
Let's say I have a encryption program that allows me to select 1 out of 5 well established and well implemented encryption algorithms. I use that program to encrypt thousands of file, using always the same block cipher, while following proper cryptographic procedures (e.g. use different passwords every n files encrypted). The files are stored off-site, and an adversary gets a hold of the files. I wonder if by selecting a less common algorithm, e.g. Serpent, I would increase the workload of the adversary by factor of 5, or encryption algorithms do leak some information, some recurring properties, that will help the adversary to identify the encryption method I had used?


texts: Other than an exponent greater than 1, what are the considerations when creating a random 256-bit private key using Diffie Hellman?

texts:
Let's assume that I choose the bits for my 256-bit private key exponent by flipping a coin 256 times.

Are there any other issues, besides the randomness of the 256-bit private key to consider? For example, should the most significant bit always start with 1 in order to ensure a private key of a certain minimum size or is the probability of flipping enough leading zeros to make the exponent small enough to be dangerous statistically impossible or do you simply check the size of the exponent and if it doesn't reach a minimum threshold you choose a different random exponent?


texts: Verifying Self-signed SSL Client Certificates

texts:
I have a service and I want to authenticate my clients using SSL client certificates. Now I want the key exchange process to be as simple as possible, kind of like SSH: You generate a keypair and upload the public key to the server (which you already trust).

Now I want to verify the certs I get from the clients… not by their trust chain, but solely based on the certificates I have stored on the server.

Should I compare the whole certificate or only the SHA256-Hash?


texts:
This is my understanding of Synthentic IVs
You have 2 keys $K_1$ & $K_2$.
$F$ is a PRF
Instead of choosing a separate IV, you instead generate the IV from the PlainText.
$IV = F(K_1, m)$
$c = E(K_2, m, IV)$
You don't need a separate Tag/Hash for authentication. Because the IV is generated using the PT  itself, after decrypting the CT, you can generate the IV at the decryption end & check it it's same as IV send along with the CT.
I was looking at AES-GCM-SIV - https://tools.ietf.org/html/rfc8452
Here the IV seems to be passed as Input to the Encryption Algorithm & is not generated from the PT.

AES-GCM-SIV encryption takes a 16- or 32-byte key-generating key, a 96-bit nonce, and plaintext and additional data byte strings of variable length.

It also seems to produce a tag

Calculate S_s = POLYVAL(message-authentication-key, X_1, X_2, ...). XOR the first twelve bytes of S_s with the nonce and clear the most significant bit of the last byte.  Encrypt the result with AES using the message-encryption key to produce the tag.

So why is this Encryption named as an SIV scheme?


texts: Is AES-CTR-NoPadding resistant to variable-length chosen-plaintext attack?

texts:
Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:$ $A$ queries $\mathcal{O}$ with $p_i$ in order to obtain ciphertext $c_i := \texttt{AES_CTR_ENC}(p_i,k,IV)$ for some unkown key $k$ and initialization vector $IV$ (n padding scheme). Furthermore, assume that $|p_i| \neq |p_j|$ $\forall i\neq j $.

Is it possible that the abovementioned encryption scheme (AES-CTR without padding) is somehow resistant to this type of attack?


texts: How subscriptions are managed in PayTV securely?

texts:
Since there are millions of subscriber for each operator in PayTV and each subscriber can subscribe to any of the package or individual channels, how operators transmit Entitlement management messages (EMMs) to each of the subscriber?
How subscriptions are updated for each subscriber given subscribers can update their subscriptions at any time in the month?
On which basis the grouping of subscribers is done?
How are EMMs addressed to these groups?
How operators manage all theses subscriptions within the bandwidth of just 3 Mbps?


texts:
We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer.

I believe that the digest is encrypted only providing one block, so it will represent an unique congruence in the multiplicative group space. It doesn't matter if two digest are very similar. Hash functions are used to reduce the message length, so data has not to be separated in chunks since length is less than the modulus length.

But I started to wondering what would happen if the CA enciphers the digest chunk by chunk.

For example we could obtain a similar digest of a legit certificate that differs in the last $n$ bits. So we will have almost the same congruences (ciphertext) comparing to the original signature. This ends in brute forcing the different chunks. I know that this isn't the real case, and also, that nobody ciphers a message that is bigger in size than the modulus.

As a consecuence, are hash functions used to reduce the message length so its less in size than the modulus? Can be the data partitioned in chunks and then ciphered by the private key when dealing with signatures?


texts: Can the AES encryption and decryption algorithms be described as a polynomial for a specific key?

texts: AES is a block cipher that consists of non-linear and linear parts to provide the Shannon requirements of confusion  and diffusion respectively. The linear parts can for sure be described as a polynomial and more specifically the SiftRows,MixColumnds,AddRoundKey parts but what about the non-linear one?


texts: Is quantum randomness different to conventional randomness?

texts:
I've been reading a question regarding the uses of quantum computing.  There is a broad theme throughout the answers that seems to suggest that randomness generated via quantum means is somehow better than randomness generated via traditional means.  I get the impression from some of those answers that the massive processing potential of quantum computers can somehow derandomise traditionally generated randomness.

A quantum computer would use quantum gates.  They would be operating via entanglement and superposition to produce random states. A classical physics based random number generator using say a humble diode, would use chaos theory to produce entropy+.  Both constructions would in their gross outputs generate large biases which would be whitened via additional hardware /software. So both techniques converge onto a conventional randomness extractor.  Both techniques would also be massively affected by electrical system noise which might be ~50% of the total raw entropy in the quantum case as in this 2 Gb/s beam splitter.  Electrical noise is generated mainly by classical physics.

Ultimately, a quantum random number generator outputs a sequence of bits that might be "1" with a 50% probability.  I thought that random is random is random.  Have I misunderstood?

+Diodes also use quantum effects for noise /entropy generation.


texts: Using a round function intended for an SP network in a Feistel network?

texts:
If I use the round function from a secure SP network (such as AES)  and use it in a Feistel netwok, is this a good starting point for the second cipher?

My thought is "yes" because:

it already has good diffusion and confusion
it doubles the block size, so the number of rounds can be doubled at no perf cost.


texts: Is there a constant-overhead PRP construction based on PRPs for large inputs?

texts:
Somewhat recently I learned that there's a separation between an encryption scheme being CCA2 secure and being AE secure, namely PRPs.

So if we would use AES as an encryption scheme for fixed-size messages it would be CCA2 secure but not AE secure as an adversary can simply query any ciphertext and not get $\perp$ back but some random value instead distinguishing the decryption oracle from the always-$\perp$-oracle.

Now I know of two constructions that given a PRP $P:\{0,1\}^k\times\{0,1\}^n\to\{0,1\}^n$ construct a larger domain PRP:

The Feistel construction yielding a PRP $F_P:\{0,1\}^k\times\{0,1\}^{2n}\to\{0,1\}^{2n}$
The EME construction yielding a PRP $E_P:\{0,1\}^k\times\{0,1\}^{mn}\to\{0,1\}^{mn}$ for $1\leq m\leq n$.

Using clever stacking of each individual of the two above constructions one can reach a scheme that is CCA2 secure but not AE secure for arbitrary input sizes. But there's a catch: The Feistel construction requires on average ~1/3 of the message size as additional padding as its permutation size only grows exponentially and EME also needs a non-constant (logarithmic?) amount of padding .

My question is now:
Is there a known construction that takes a (s)PRP and constructs a larger-domain (s)PRP such that both large inputs (several GB) are supported and the overhead / required padding for the construction is bounded by a constant independent of the message size?

Note: This is not intended for any practical application.


texts:
Learning about cryptosystems and basic cryptology and I have a sort of vague understanding of key sizes/key space and think I may have done something wrong in my calculations, can someone please explain how to properly calculate key space/length I would greatly appreciate it, thanks!

Assume a password consisting of 8 letters, where each letter is encoded by the
ASCII scheme (7 bits per character, i.e., 128 possible characters). What is the
size of the key space which can be constructed by such passwords?
128!
What is the corresponding key length in bits?
56 bits
Assume that most users use only the 26 lowercase letters from the alphabet instead
of the full 7 bits of the ASCII-encoding. What is the corresponding key length in bits in
this case?
28 bits
At least how many characters are required for a password in order to generate a
key length of 128 bits in case of letters consisting of
a.  7-bit characters?
19 char
b. 26 lowercase letters from the alphabet?
32 char


texts: Warding an ECIES setup against MitM: ECDSA?

texts:
Is it necessary/appropriate to digitally sign an ETM file in an ECIES context? The encryption mode is CTR(using Inferno). The current output is:

[shared public key] [ciphertext] [MAC].

The encrypted files travel through email between users, if it matters.

The users need to make sure the messages they receive come from the expected person, and none of them is willing to trust a CA. Would it make sense to sign the files with ECDSA?

Here is the application's current code(C#) used for encryption, decryption and authentication, using Inferno(without ECDSA):

    internal static void Encrypt(CngKey k, string file, object data)
    {
        var ephemeralBundle = k.GetSharedEphemeralDhmSecret();
        var ephemeralPublic = ephemeralBundle.EphemeralDhmPublicKeyBlob;
        var symmetricKey = ephemeralBundle.SharedSecret;

        using (var fs = new FileStream(file, FileMode.Create, FileAccess.Write))
        {
            fs.Write(ephemeralPublic, 0, ephemeralPublic.Length);
            using (var etm = new EtM_EncryptTransform(symmetricKey))
            using (var cs = new CryptoStream(fs, etm, CryptoStreamMode.Write))
                new BinaryFormatter().Serialize(cs, data);
        }
    }

    internal static object Decrypt(string file, CngKey k)
    {
        object decrypted = null;
        var ephemeralPublic = new byte[104];

        using (var fs = new FileStream(file, FileMode.Open, FileAccess.Read))
        {
            fs.Read(ephemeralPublic, 0, 104);
            var ephemeralSymmetric = k.GetSharedDhmSecret(ephemeralPublic.ToPublicKeyFromBlob());
            if (Authenticate(file, ephemeralSymmetric, 104))
            {
                using (var etm = new EtM_DecryptTransform(ephemeralSymmetric))
                using (var cs = new CryptoStream(fs, etm, CryptoStreamMode.Read))
                    decrypted = new BinaryFormatter().Deserialize(cs);
            }
        }
        return decrypted;
    }

    private static bool Authenticate(string file, byte[] key, int offset)
    {
        using (var fs = new FileStream(file, FileMode.Open, FileAccess.Read))
        using (var etm = new EtM_DecryptTransform(key, authenticateOnly: true))
        {
            fs.Position = offset;
            using (var cs = new CryptoStream(fs, etm, CryptoStreamMode.Read)) cs.CopyTo(Stream.Null);
            if (!etm.IsComplete) throw new Exception("Authentication failed.");
        }
        return true;
    }


texts:
Consider the quantum key establishment protocol. Assume
that bit values, emitter basis, and receiver lter orientation are selected independently
and uniformly at random (i.e., 50% chance for each of the bit values/
bases/orientations).

  1)What is the joint entropy of the emitter bit value and receiver bit
  value?

My assumption is:
H(X=0,Y=0) = 3/4
H(X=0,Y=1) = 1/4
H(X=1,Y=0) = 1/4
H(X=1,Y=1) = 3/4

H(Y=0,X=0) = 3/4
H(Y=0,X=0) = 1/4
H(Y=0,X=0) = 1/4
H(Y=0,X=0) = 3/4

I could not go further here.

  2)What is the mutual information between the emitter bit value and the
  receiver bit value?

In my opinion, the filters can measure the polarasation of a photon if the filter and the photon do not agree the outcome is uniformly random. So, with respect to receiver bit value and emitter bit value we can find the sifted key.

Note:It is not a homework question.


texts:
This is by no means a scientific observation, but it seems to me that stream ciphers receive a lot less attention than block ciphers. Is there any reason for this? (Is it because block ciphers are accepted as superior?)

Additionally, since there is no "AES" of stream ciphers, is there any reference of currently secure stream ciphers other than the few green entries on this Wikipedia page? I know about NESSIE/eSTREAM but much of the trust in an algorithm comes not just from its claimed security, but also from the amount of scrutiny it has received, and it seems that none of those ciphers has been the subject of much debate.


texts:
I've read Intro to Modern Cryptography PRF section (and example 3.26) and on stackexchange(1, 2), but I still don't fully know how to prove it (with probabilities)

To prove it's a PRF, I know you have to prove that no adversary can distinguish $F'_k(x)$ from a random function or I show a possible attack. So the question is (similar to 3.10 from book):

  Let F be a length-preserving pseudorandom function. Prove $F'_k(x): \{0, 1\}^{n} → \{0,1\}^{2n}$ such that $F'_k(x) = F_k(0^{n})||F_k(x) $ is a $F'_k(x)$ keyed pseudorandom function or not. Where || denotes concatenation.

What I've done so far: No. Consider an adversary A that input $r \in \{0, 1\}^{n}$, it returns 1 if its first n bits are 0...0. On a truly random string it returns 1 with prob $2^{-n}$. On a pseduorandom string it returns 1 with probability 1. Then adversary has advantage $1 - 2^{-n}$ which violates the definition of psuedorandomness (as it's no longer < negligible?).
1. I believe this is correct, or what have I not understood correctly?
2. If it is the case, I am having trouble applying this to $F'_k(x) = F_k(x)||F_k(\bar x) $ on a paper I found here, example 3.7.2. It says No, but I'm having trouble connecting it with the method I learnt in class, but it looks random to me. I would say it returns 1 if its last bits?? I'm not entirely sure.


texts: Can we use the sponge construct to efficiently authenticate any cipher?

texts:
The sponge construct facilitates authenticated encryption independently of the
function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the
mixing function in a sponge to produce a fast authenticated encryption
primitive? This question indicates that using a block cipher in the context
of a mixing function for a sponge should be secure

Assume the interface of the sponge construct in question accepts a key and iv to provide to the underlying block cipher, so that the cipher can be used as otherwise intended.

The main consideration I see is that of the size of the capacity + rate
compared to that of the cipher. Supposing the size of the rate and capacity
were equal to the blocksize of the cipher, well, it seems like that would
simply be too small? The security of a sponge appears to be related to it's
capacity, so using a 64 or 128 bit capacity makes me second guess the idea,
and even that would only leave 192 or 128 bits left for actual enciphering of
data.

I imagine a workaround as being enciphering the entire state as a message
under a standard mode of operation such as cbc, but I am unsure as to whether
or not there are problems with the idea. This question seems to more or less address this, but will take me some time to totally understand due to the depth.


texts:
Seedless Fruit is the Sweetest: Random Number Generation, Revisited introduces a theoretical framework for "seedless" RNGs.
AFAICT, this framework injects entropy directly into the underlying cryptographic primitive instead of treating the entropy collection/estimation and randomness extraction as two separate phases.  Is my understanding correct?
What quantitative benefits does this framework have over the more traditional seed-based design?


texts: Is TLS_RSA_WITH_RC4_128_SHA still a secure cipher to use?

texts:
I have read numerous times that the RC4 cipher itself is considered broken in TLS. Still many websites are using the TLS_RSA_WITH_RC4_128_SHA configuration even to date.

Now, I know that sometimes different uses of a cipher mitigate different attack scenarios, so my question is straightforward: Is this particular cipher configuration still considered secure, or are companies just not fast enough in changing to other configurations?


texts: Why should the primes used in RSA be distinct?

texts:
The two primes $p$ and $q$ part of the public key need to be distinct.
What's the reason for them to be distinct? Is it because factorization of $p^2$ where $p$ is a prime is relatively easier, or is there some other reason?


texts:
Is this the mathematical equation for the Vigenere Cipher or something else and if something else what is it?

Where t is the letter of plain text and n is the position of t within the text and c is the ciphered character.

For 't' and 'c' taking a as 1 and z as 26.

((t + n) > 25 -> c = (t + n) - 25) ^ ((t + n) <= 25 -> c = (t + n))


texts: About the Security of PCBC Encryption Mode

texts:
We are designing an encrypted file system. We plan to use the PCBC (Plaintext Cipher Block Chaining) encryption mode for encryption. This is because we desire the feature ("small changes in the ciphertext would propagate indefinitely when decrypting") in PCBC.

However, to our best knowledge, PCBC is not a good choice from security and privacy perspective. It is a non-standard mode. It suffers from the adjacent swap attack. It has been cryptanalysis for message integrity.

So, I want to ask questions:

Can PCBC provide confidentiality on message? I just find some materials for breaking the integrity of PCBC, and the book Applied Cryptography saying "Although no one has figured out how to exploit this weakness, Kerberos version 5 switched to CBC mode after the flaw was discovered." I am not aware of anything discussing the confidentiality provided by PCBC.
For integrity, we plan to append a message hash with the content of message for PCBC encryption, instead of using an identical block. But from a cryptanalysis paper which says "In fact, even if the final plaintext block is a CRC computed as a function of all the previous plaintext blocks, an attack along similar lines is still probably possible.", it seems it is insecure even using hash for integrity checking. So I want to ask whether it is secure if I apply this hash in the FIRST block, or if you can give any better suggestions for integrity checking.
We want, (a) the decryption succeeds only when both the entire ciphertext and key are used; (b) if the ciphertext is not integrated, even getting the key, any useful information about the message cannot be extracted. Besides PCBC, do you have any better suggestions on choosing a standard and secure mode to achieve our goal?


texts: I found some related question but no real explanation of what it is and when and why to use it. What are the benefits and downsides and is it recommended?


texts: In RSA, how does the CPU deal with this huge modulus (8192 bits)?

texts:
Whilst I understand how the RSA algorithm works, I don't understand how the CPU operates when it needs to use the mod function with a huge number $n$, for example.

$n = 8192$ bits;
$c = m^e \mod n$;

In essence my question is how does the CPU deal with this huge modulus?


texts: How to validate the authenticity and integrity of an XML document?

texts:
I am working on a C++ desktop application that reads an XML (also created by my org) from a public server  (does not require authentication). I would like to make sure that the downloaded XML has not been tampered with and was created by my organization.

Digitally signing the XML before uploading it to the server should ensure both integrity and authenticity. However, I am having a hard time figuring out the approach of signing and validating the XML at the client end. So far, I have considered the following approaches:

Generate an RSA key pair using OpenSSL and use the private key to sign the XML before pushing it to the server. Embed the public key in the desktop application and use it to verify the signature of the downloaded file. The problem with this approach is that in case the private key gets compromised, generating a new key pair will break the older clients since the embedded public key won't be able to validate documents signed with the new private key.
Another option would be to embed the public key in the signed XML. This way even if the keys are changed, older clients can still work. However, now I can not be certain that the public key contained in the file is indeed mine. For eg, if someone can modify the file they can also modify the key and the signature.
To ascertain the identity of the signer I can embed a self-signed X.509 certificate in the signed XML that will contain the details of the signer along with the public key. However, I feel since the certificate is self-signed this approach also suffers from the same shortcoming as the previous approach. Getting the certificate from a CA might work but it is paid and has to be renewed periodically (1-2 years, not sure though).

It appeared to be a pretty standard problem but now I feel rather stuck at it. I would like to have a single XML file as opposed to a solution that splits the actual content and signature into different files (maybe kept on different servers).

Considering my extremely limited knowledge of signing and cryptography in general, I would appreciate if someone can help.


texts: Can I use Shamir's secret sharing scheme for multiplicative homomorphism for secure multiparty computation?

texts:
I would like to perform a dot product operation among $m$ parties using Shamir's $(m,m)$ secret sharing that is used for Secure Multiparty Computation.

I am aware that Shamir's $(m,m)$ scheme is additively homomorphic, but can someone please provide an example of how I can use it for multiplicative homomorphism for SMC?


texts: NIST specifies so-called random excursions test and random excursions variant test. From the description I can derive that the number of p-values should be 8 in the first case and 18 in the second. But the result table gives only one line for each test. Keeping all of them is obviously redundant due to correlations. But it is not clear for me, which string out of 8 (or 18) should I take and why only one. Plus there is a question: what if only one of them is not passed, what should that mean?