texts: One-Way Trapdoor Permutation more secure than RSA at same width?

texts:
The classical One-Way Trapdoor Permutation is RSA. The permutation that it implements on a set of $n$ elements¹ is invertible by an adversary knowing only the public key with work $w$ conjecturally² such that
$$\log w=O\left(\left(\log n\right)^{1/3}\right)$$

Is it known any other One-Way Trapdoor Permutation with faster asymptotic growth of $\log w$ w.r.t. $\log n$, and still efficiently computable in both directions in time polynomial w.r.t. $\log n$?

I'd be surprised if the answer was yes with modular arithmetic or plain Elliptic Curve over a finite field; but I can't tell for pairings or other constructs.

¹ and a particularly nice one: $[0,n)$; but don't make that an absolute requirement.

² assuming in particular that GNFS remains the best attack, and that the first coefficient of its currently conjectured cost $L_n\left[1/3,\sqrt[3]{64/9}\,\right]$ is not improved.


texts: How does the I2OSP primitive in RSA work?

texts: I'm trying to figure out how to convert a message to a message representative (non-negative integer) in RSA. I think I understand how the OS2IP primitive (converting from message to integer). It involves finding the sum of all the integer representations of each byte multiplied by 256 to the power of the length of the message minus the index for the byte. However, I don't understand how the opposite process works. PKCS#1 says to write the message representative x in its    xLen-digit unique representation in base 256. I'm not very good with the actual mathematical processes here, so I'm not sure how the integer is supposed to be separated into the separate bytes multiplied by powers of 256.


texts: How to ensure integrity of encrypted data having hashes only?

texts:
Having:

plaintext $P$
a hash function $H$, encryption $E$ with key $k$
$h_p = H(P)$ and $h_{E_P} = H(E_k(P))$

Is there an encryption scheme $E$ or hash algorithm $H$ that allows proving that $h_{E_P}$ represents the same plaintext $P$ (but encrypted) without knowing $P$ itself?

In my transmission scheme, there is a trusted Broker for plaintext metadata   (i.e. doesn't have the $P$ itself, but $(h_p, h_{E_P}, k)$ and I want it to "be sure" that the $K$ was really used for encrypting plaintext $P$.


texts: Can I Implement a Well-Trusted Protocol with Well-Trusted Libraries in JavaScript securely?

texts:
Just for anyone reading this: DO NOT ROLL YOUR OWN ALGORITHM.

Besides that, is implementing a well-trusted protocol with well-trusted algorithms and libraries a good idea? Is this likely to colossally fail like rolling your own crypto? Could this be used in production after enough peer review? (I know that rolling your own crypto is definitely NOT secure)

Let's say I'm trying to implement a simple JavaScript website that generates RSA key pairs, RSA encrypts, and signs, and also AES encrypts data (e.g. an asymmetric key exchange than a symmetric conversation; the simplest protocol out there). If I use well-respected libraries, respected algorithms (i.e. AES & RSA) and peer-review the website, is this likely to have vulnerabilities?

(We're ignoring all the issues of authenticity in code with JavaScript) (Also, I'm not implementing my own algorithm, i.e. AES, to keep that clear)


texts: Possible CPA or CCA attack when using AES-CBC mode under the following situation?

texts:
Both client and server know a shared key in advance. Both sides us EVP_BytesToKey() derive a pair of same key and same IV. Then, client and server start transferring data encrypted by AES-CBC mode using this pair of key and iv.

Is there any possible CCA or CPA? Should I use randomized IV every time? Is it safe to transfer IV in plaintext with the encrypted data?

Can CPA be avoided if I use randomized IV every time? How should I mitigate CCA?


texts: Public Key encryption /Assymetric encryption

texts:
For a start, I 've got a question regarding the Public key encryption.
I know the public key encryption overcomes the Key distribution issue with the symmetric encryption and that in the case of communication between 2 parties, there is a total of 4 keys (each party has a public and a private key )

But here's what's been confusing me.
If Bob wants to send a message to Alice, then he will encrypt the message using Alice's public key. For Alice to understand that message, she would decrypt the message using her private key.  The problem is, isn't it like they both have the same keys? Because if Alice were to decrypt the message using her private key and no one else knows what that key is but her, won't she get a different message than the one sent by Bob?


texts: How is the MAC or HMAC secret shared with the other party for verification?

texts:
I've seen people everywhere say to use a MAC or HMAC with block ciphers. I think I understand the basics, but I'm still not sure how the HMAC secret is distributed so the other party can verify that it's valid. Is the secret distributed freely like the IV (though the name suggests it is secret)? Is it part of the ciphertext? Is it sent over a secure channel like the AES key?

Also, is it safe to use the same HMAC secret for each subsequent AES encrypted message after the initial connection? Assuming all keys (other than public/private keypairs) are destroyed after the connection is closed.


texts: Can wiping a disk writing zeros on an encrypted device be a weak point?

texts: Can cryptsetup suggestion of wiping a disk before encryption with zeros written to an encryted device as described in question 2.19 as the recommended method on the CryptsetupFAQ (the part that starts with "For device set-up, do the following:" (which ends writing the encrypted random looking represantation of zeros) be a weak point as an attacker, knowing that the device is encrypted with LUKS, could suppose that the end of the disk is just zeros. With this information could he more easily find the key used on the initial wipping and, with this info, isolate the part of the disk that actually has relevant encrypted information?


texts: Proof of non-membership on a Merkle tree?

texts:
Assume a user $U$ and a server $S$. $U$ uploads its data and wants later to perform an authenticity check. It also sends a Merkle tree to the server. Let’s say we would like $U$ to ask for a specific element in the tree. $S$ then returns the leaf node and the path to the root that would allow $U$ to verify. This acts as a proof of completeness.

In the case an element is not part of the Merkle tree, how the server can prove the non-membership proof?


texts: Is there a formula for calculating the inverse of a sum in modular arithmetic?

texts:
Suppose there is a cyclic group $G$ of prime order $q$ of elements in $Z_p^*$ with a generator $g$ and a value $x \in Z_q$.

$h_1 = g^{x+1}$

$h_2 = g^{x}$

Is it possible to write $h_2^{((x+1)^{-1})}$ as some combination of $g$ and $h_1$?

$x+1$ is invertible in $Z_q$ only if $gcd(x+1,q)=1$, which means $ax+a = 1 \bmod q$ and $gcd(x,q)=1-a$, so $x$ is not invertable in $Z_q$. However, then it seems that  $h_2^{(x+1)^{-1}}$ can't be represented as combination of $g$ and $h_1$.

P.S. I'm trying to figure out whether verifier can distinguish real and fake proofs in this questions if verifier assumes that $x_{tr} = \hat{x}_{tr} +1$, computes $e$ for $\hat{h}$ but adjusts $r_{ch}$.


texts: How to retrieve BIP39 seed phrase: 3 words missing of 24

texts:
I lost 3 middle words of my 24 words seed phrase for a nano ledger hardware wallet.
As an example (not my real seed phrase)
pledge horror unfair category a.... xxxxxx a...... core abuse tenant crew captain insect angry again deposit detail similar arrest kind copy pony door brass

So I know the missing words in position 5 and 7 start with a and I don't have any clue for word number 6.
I know for sure an ethereum public address that I used back in 2017, but I am not sure about my BTC address.
I believe that cracking the seed phrase is doable, but as I am not a programmer (I have a beginner level in python for data science) I don't know how to do it.
So far, I have explored:

BTCRecover but it only handles one missing word and 3 typos
Seed Savior but it only handles 1 missing words

Does anyone know how to solve this problem in a practical manner?


texts: Does it make sense to have long SSH Key with shorter Passphrase?

texts: If we encrypt our data with a longer SSH key which is protected by a shorter passphrase (with a decent entropy), then the limiting factor is entropy of the passphrase. So why do we use a longer key at all? We could simply encrypt the data with the passphrase.


texts: Should I use a self-designed Block Cipher Mode of Operation?

texts:
We all know we should NOT roll our self-designed encryption algorithm, how about block cipher mode with a certificated cipher method like AES? Will a self-designed block cipher mode cause any flaws or weakness to the cipher?

I have search over the Internet but can't find a answer. Hope here is the right place to ask such a question.


texts: Is it secure to use ECDSA for any arbitrary point on the Elliptic Curve as the Generator point?

texts:
My question concerns the elliptic curve $E$ over a prime field $\mathbb F_p$. To the best of my understanding, ECDSA requires a Generator point $G$ of prime order $n$, and the $r$ and $s$ values of the signature must be within the range $[1,n-1]$. The concept of ECDSA is to show a person that one is in possession of a secret $k$ s.t. $kG = K$, without (obviously) revealing $k$.

However, suppose that you are aware of public key $K$ and are looking to do a tweak of $K$. Let $t$ be the tweaking factor, and so $tK = K'$. If you then wanted to prove that you are in possession of $t$, how would you do that?

An immediate thought (which I am confident will not work) is to use ECDSA with $K$ as the generator point. However, it might be the case that $K$ is of a very small order $n$ which may not be prime.

If someone can shed light on how to prove that one is in possession of secret $t$, I would be very happy. Also, the verifying party is in possession of both $k, K$, the secret key and public key pair.


texts: Time locked cryptography using Bitcoin difficulty param and/or smart contract?

texts:
Outcome:  Create a message with a count down timer.  Once a top level password is entered, a countdown timer starts.  Once timer expires, the message is decrypted.

Known methods:  Proof of work.  User has to use computing power to decrypt the message.

Problem:  The computer power will change in the future.  I want relatively accurate time lock, now & years from now.

Are these possible solutions…?

Proof of work time lock tied to Bitcoin difficulty:  Bitcoin has a reactive difficulty parameter that will reflect current state of processing technology.

Is there anyway to use the Bitcoin difficulty parameter as to make a time locking message with a relatively accurate time lock time, now & in the future?

Smart contract based:  A smart contract, that once a first layer password is input, a count down timer starts, based on a time now oracle of some kind.  Once expired, the second layer message is decrypted.

A) Are any of these possible?

B) Are there any other existing solutions that would get the desired outcome currently?

**Removing serial hashing burden, but still getting the same benefit: **
When top level password is entered, BTC current block is noted.  When BTC block reaches current block + X, 2nd layer message is decrypted.

Possible?


texts:
I'm studying the multivariate cryptography and specifically attacks using Groebner basis. On the complexity of such direct attacks, it is well-known that the most important parameter is the degree of regularity.

It is very confusing that there are index of regularity and degree of regularity in literature. Often, the definitions of them are different. For example, The degree of regularity of HFE systems by Dubois and Gama defined the degree of regularity using nontrivial degree falls.

However, in the Asymptotic behaviour of the index of regularity of quadratic semi-regular polynomial systems by Bardet et al., they defined the index of regularity by using Hilbert polynomial. And some article (I cannot remember, sorry) defined the index of regularity as a maximum degree of Groebner basis.

Referring the algorithm complexity formula everywhere, it seems like all are the same. Are those definitions all equivalent? How about this example?

What is the degree or index of regularity of the set $\{x_1,\cdots,x_n\}\subset\mathbb F_q[x_1,\cdots,x_n]$? I think the degree of regularity by the first definition (nontrivial degree fall) is $(q-1)n$ since there never be a nontrivial degree fall. However, the index of regularity by the second and third definition is 1, obviously.

It will be also thankful if you recommend some material to read about them.


texts: Can anyone let me know the difference between SHA1 and SHA1HMAC algo?


texts: How difficult is it to brute force d in RSA: d = (1/e) mod φ in a CPT attack?

texts:
Given that  RSA key generation works by computing:

n = pq
φ = (p-1)(q-1)
d = (1/e) mod φ

If I was an attacker who wanted to brute force d, could I brute force d given just the public key, the plaintext message, and the generally known facts of RSA such as

φ is always less than n = pq
n is known by the attacker by the public key
e is known by the attacker
The implementation of d = (1/e) mod φ is reasonably efficient

The attack would be brute force φ by iterating from a max value of n, and decrease the value for φ and compare that to the known plaintext of m.  An optimization of this would be to skip all values of φ that fall into the conditions of

Prime numbers ( φ is a product of pq and therefore not prime)
Where GCD(φ, e) != 1
Omit values that would result in a small d (FIPS 186-3 requires $d > 2^{nlen/2}$)
Odd values and be omitted (see comments below)
etc... (what else can be added?)

Question

How can I calculate or estimate the difficulty of attacking d when only the public key [edit and plain text message] is known?  (no optimizations)
With the optimizations listed above, and those you may be aware of, what is the difficulty of attacking d?
What is a more efficient manner of attacking RSA with a known plain text attack?


texts: CSPRNG made out of Block Cipher running in CTR Mode?

texts:
From Definition of CSPRNG, it has two characteristics

It satisfies the next-bit test.
It withstands 'state compromise extensions' - part of all of the state being compromised does not allow for reconstruction of the prior stream of random numbers.

The Design of CSPRNG can be based on

Cryptographic Primitives
Number Theory Problems
Sepcial Designs like Yarrow, Fortuna etc

If CSPRNG is constructed out of AES/Twofish/Camellia in CTR Mode, does it satisfy 2nd characteristic? i.e Compromise of internal state will not lead to reconstruction of prior stream of random numbers?

If we consider state as Counter only, or Counter and IV only (excluding the key). Will it be a CSPRNG?

Will any CPA secure Block Cipher working in Counter mode made CSPRNG under the assumption that compromise of internal state only consists of compromise of Counter only or Counter and IV only (not the key).


texts: Collision resistance of composed hash functions

texts:
Consider the following hash function

$H^{1\circ2}(x)=H^1(H^2(x))$

I have been asked to prove that if $H^1$ is CR,  $H^{1\circ2}$ will not generally itself be CR. I am assuming  $H^2$ is not CR, this is not explicitly stated. I have seen similar questions here but they always consider a double hash with a single function, not two.

I understand that by "not generally" or similar wording it is meant that there exists at least a case where $H^{1\circ2}$ is not CR. Admittedly however I thought that since $H^1$ is hashing $H^2(x)$, this makes the resulting hash function CR as well. Is this not always the case?


texts:
I'm writing an Android app which will need to store some data for the user as a byte array of unknown length. The data must be encrypted. I have gone down the path of the hardware-backed keystore and this is where I am:

At first start after installation:

The app has an AES-128 key and IV for CBC generated

Created in hardware and stored in the hardware-backed keystore
Flags set:

only reveal the key to this app and only do so when the user passes fingerprint authentication
delete the key and generate another from the same parameters if another fingerprint is enrolled

IV stored on disk unencrypted

The app prompts user to choose a password (lots of hints to make it a good one)

Salt generated and stored on disk unencrypted
SHA256(password + salt), where + is byte-array concatenation, stored on disk unencrypted

Each time the app starts, unless the key changes:

Fingerprint requested from user to unlock hardware-backed keystore
AES key from keystore used to decipher the data file and load plaintext data to memory (key does not enter system memory)
Plaintext data deserialized and used
Another cipher instance initialized while the keystore is open to be used later
Keystore closed

When saving data:

Data serialized
Data enciphered using cipher from step 4. above.
Encrypted data saved to disk.

Note the

  unless the key changes

On regular start. In this case, the key has been invalidated by enrollment of further fingerprints making the encrypted data file useless. From here, the user is prompted for their password which is checked. At this point my app will know that the user is or is not authenticated to use the AES key in the keystore, but the keystore is not convinced since the app told it not to dispense the key unless the user authenticated with biometrics.

Here are two options I have considered:

Store another copy of the data file encrypted with AES-128, using as the key SHA256(password + salt) (mod 2^128) or some other 128-bit transformation of the hash
Disable the below flag when creating the key

  delete the key and generate another from the same parameters if another fingerprint is enrolled

... and here are the reasons for which I do not like those above:

But then the level of security is reduced from about 128 bits to that of whatever password the user thinks up (probably much less than 128 bits)
Goes against my instincts because it feels like cutting corners in a security context.

What should I do here - do I just have to face the fact that either enrollment does not invalidate the key or the security on the file is only as strong as the user's password?


texts: detect the RSA public key from encrypted text

texts:
we have a service who has a list of public keys got from clients (for example 1000 public keys. not too many)
service gets an encrypted message from one of clients. this message is encryped with a public key and defenitly service has that key.
can service find out which public key is used to encrype that data?
for more information (you can ignore it): service must broadcast data between all the clients (each one has a pair of RSA keys and service has their public keys). clients must send message to each other with no clue for tracking on service.
for example client A wants to send a message to client B. A encrypts the message with Bs public key and sends it to service. service broadcasts the message to all clients. but only one of the clients (it's B) can decrypt the message.


texts: Does security under ROM imply exactly what?

texts:
I'm not sure I understand really the implications of proofs of security in the random oracle model. Does a proof of security in ROM translate to a reduction of security of the crypto-system to the security of the hash function in the standard model? If not, then this would imply that the meaning of the ROM proof in the SM depends on the particular algorithm and it would seem almost impossible to say anything general about implications of proofs like this. However, people seem to put a lot of effort in producing proofs of security in ROM so perhaps these proofs do have some value (I just don't exactly understand what, and it would seem extremely hard to point out any general implications). Textbooks tend to be typically quite vague at explaining this.

A very much related question: Does anyone have any insight to whether there is some general reason why proofs of CCA security are expected to be hard (if they even exist) in SM?

By the way, are random oracles really impossible to have in reality? True randomness could be produced by quantum phenomena, so why not use that?


texts: How can RSA be used to compactly sign and encrypt?

texts: How can RSA be used for digital signature with message recovery and encryption, providing transmission of a small message with confidentiality and authentication simultaneously, small cryptogram size, and little or no reliance on symmetric/hybrid encryption?


texts: How to allow a partner to encrypt a message that I can decrypt without using a random initialization vector?

texts:
My company has a requirement to allow a partner vendor to log people into our web app via some kind of single sign on. We need this to be a simple process for them, not involving the use of substantial new middleware or learning curve.
We can pre-exchange any secrets that we need, as well as a database of their users, whom we want to allow to log in on our site.
My thinking is that they could just hit an endpoint on our site like /sso/token/{token}, where token is string generated as urlencode(encrypt(user_id)). Then I could call decrypt(urldecode(token)) to recover user_id, and just log in that user (assuming the id is valid in the dataset).
The partners are using PHP, so I want to make sure to use an encryption scheme that is PHP friendly. It turns out that PHP has openssl_encrypt, with example code like so:
$key = "secret-key";
$plaintext = "message to be encrypted";
$cipher = "aes-128-gcm";

$ivlen = openssl_cipher_iv_length($cipher);
$iv = openssl_random_pseudo_bytes($ivlen);   <--question about this line
$ciphertext = openssl_encrypt($plaintext, $cipher, $key, $options=0, $iv, $tag);
//...
//store $cipher, $iv, and $tag for decryption later
//...
$original_plaintext = openssl_decrypt($ciphertext, $cipher, $key, $options=0, $iv, $tag);

I see how this could be used to generate an encrypted token, which I can then decrypt, if we share in advance the secret key and initialization vector.
The thing I don't understand is that in this example, the IV is randomized, and likewise Wikipedia says:

The IV is typically required to be random or pseudorandom, but sometimes an IV only needs to be unpredictable or unique. Randomization is crucial for some encryption schemes to achieve semantic security, a property whereby repeated usage of the scheme under the same key does not allow an attacker to infer relationships between (potentially similar) segments of the encrypted message.

I get that if the IV is constant, then anyone who intercepts the message can replay it, or maybe even figure out how to spoof tokens entirely. But if the IV is randomized, then the token encryption is different every time as well, and I wouldn't be able to decrypt it.
How is one supposed to do the encryption so that it avoids replays but still allows decryption? Would they just send along the IV in plaintext, like iv~token, and I would parse off the vector for feeding into the decrypt function, and we rely on the secret key to provide security? Is it insecure to send the IV in the clear like that?


texts: Forward secrecy in Merkle trees vs. hash chains

texts:
Say we have a one-time password authentication system that uses a Merkle tree. Assume that the secret keys are of the form {sk0, sk1, ..., sk7}, and at time t = 3 an attacker recovers sk6. Will he/she be able to recover any of the previous secret keys (ie sk3, sk4, sk5, and sk6)?
My guess would be no, since all Merkle tree would do is provide confirmation whether the root value computed from sk7 is equal to the one stored on the server. Would the adversary somehow be able to recover any other key?
Follow-up question. What if a simple hash chain is used? I assume the answer to this would be yes as to get to k0, we would have to be able to calculate all the previous hashes (which includes sk3, sk4, sk5, sk6).


texts:
I was looking at this question and i can`t understand this part:

QA = dA G
= 5 (5,1)
= (9,16)

I saw that algorithm used for this was Double-and-add algorithm but i didn't get it. Can anyone explain how can i do this calculation on papir?


texts:
I'm trying to get my head around zero-knowledge proofs and my definition of a zero-knowledge proof is as follows.

  A zero-knowledge proof is a method by which one party can prove to
  another party that they know a secret value, without sharing any
  data about this secret value.

To implement a zero-knowledge proof some data will need to be exchanged.

With that in mind, is the following assertion correct?

To implement a zero-knowledge proof, data can be exchanged but this data should not contain any information about the secret value?

If the above holds true, could a digital signature be classified as a zero-knowledge proof?


texts:
I heard that there are 128 stochastically independent bits in an MD5 output. Is that true?

If so, are there any citations or proofs for that?


texts: If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?

texts: In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality but also integrity/authentication. So, then...why it's necessary to include a Hash algorithm in the cipher suite? I mean...why isn't ChaCha20 (or AES-GCM, etc) enough so Poly1305 (or SHA256, etc) should be necessary?


texts: What is the difference between TRNG and CSPRNG?

texts:
I understand the output of a TRNG is almost impossible to reproduce, such a flipping a coin 100 times to produce a 100-bit sequence. However, it is also my understanding that a CSPRNG produces an unpredictable output.

If they are both non-deterministic are they not the same? Are they not both producing unpredictable outputs?
Do we not use both TRNG and CSPRNG to produce sessions keys?
Can we (do we?) use TRNG to produce CSPRNG?


texts:
I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my problem with their answer.

I'm new in Crypto can anyone tell what can I do?

I know when XOR two ciphertext (Let's assume that the plaintexts consist only of spaces and ASCII letters) if both of them were space the result is null. If one of them was space and another was ASCII we have a new ciphertext. If both of them were ciphertext we have new word that is XOR of orginal message but how can I reveal the plain-text?


texts:
We have a one time pad where:

We have 8 bits. probability that a bit=0 is p.
The key is common for all 8 bits. It can have a value of 0 or 1 with equal probability.
After applying the XOR operation we take the encrypted result that has n zeros and 8-n ones.

What I am asked to do is calculate the probability that the key used is 0.

Until now I am thinking like this:

There are 2 events:

EventA. We have k zeros in the original 8 bits

EventB. We have k zeros in the encrypted data.

P(A) can be calculated from the binomial distribution
P(B) = 2P(A)
I am searching the probability P(key=0|P(B)).

Is my thinking correct until now? How can i procede from there?


texts: Homomorphic Encryption, LWE, and Practical Applications

texts:
I've been reading Brakerski and Vaikuntanathan's Efficient Fully Homomorphic Encryption from (Standard) LWE.

When the authors discuss a small modulus p used for the transition from (n, log q) to (k, log p), how 'small' are they talking about?

If a database has two data types - TEXT (character arrays) and INTEGER (4 or 8 byte integral values), will 'p' ever be 'small' enough to transform an INTEGER value in-situ or in place? Or will the database need a new, larger integer?

I'm asking because I'm curious if an INTEGER value can be encrypted and homomorphically evaluated in a practical sense. I suspect not, but I want to ensure I'm not missing something obvious.


texts: PKCS#10 why keeping the Subject Public Key in the X.509 Certificate

texts:
In the pkcs#10 workflow to obtain the x.509 certificate used in digital signature, in the Certificate Request Information, itself in the CSR, we have the Subject Public Key.

That Subject Public Key will be used to verify that the CSR isn't modified since the Subject wrote it. All is fine up here.

Once the verification of the CSR is done, the Certificate Authority generate the X.509 Certificate. In the PKCS#10 (3. Overview, first paragraph after the ordered list), it is stated that we give the Subject Public Key in the X.509 Certificate.

The Subject Public Key was provided because we signed the CSR with the Subject Private Key, but this private key won't be reused afterward. It might have been generated only for the CSR creation, and the CSR isn't kept in the X.509 Certificate.

Also, the X.509 Certificate is signed by the Certificate Authority with its own private key, not the Subject Private Key.

So the question is : Why keeping the Subject Public Key in the X.509 Certificate, as its goal is reached once we verified the CSR, verification done before the X.509 Certificate generation?


texts: Increase in security with increase in size of salt

texts:
Does increasing or doubling the size of salt result in improved security?

It will require some extra time to brute force the passwords, but any added advantage?


texts:
Recently I'm working with a chinese vendor for POS devices and their devices use 2048bit RSA keys for signing binaries. I had to generate a public/private pair (so I can sign my own binaries) and I did some research about this.

During the research I came across a recomendation from vendor's documentation: please, check if the very first byte of the Modulus (N) of the private key is greater than 0x80. If not, please, generate another key and do the same check.

Well, if you think about it, if it is less than 0x80 the key won't actually have 2048 bits but less than that. After all, RSA keys parameters are essentially big integers and zeros to the left in integers doesn't play any role into calculations. I even found that OpenSSL has code to test this condition (I guess at least).

Now, question: shouldn't the other parameters have exactly the same requirements? I mean, they are all integers and will be used in calculations like so. Why doesn't e.g. the private exponent is subject to the same checking?


texts: Technical feasibility of decrypting https by replacing the computer's PRNG

texts:
Intel has an on-chip RdRand function which supposedly bypasses the normally used entropy pool for /dev/urandom and directly injects output. Now rumors are going on that Intel works together with the NSA... and knowing that PRNGs are important for cryptography is enough to get this news spreading.

I personally don't believe this is true, so this is entirely hypothetical: Let's assume that indeed RdRand does what news says it does and that it indeed outputs randomness into a place where applications and libraries would look for cryptographically secure randomness.

How feasible is it that the chip's manufacturer can predict the output of this PRNG when it passed tests from the people applying the use of this RdRand instruction in kernels?
If the chip's manufacturer can predict the output of the PRNG to some extent, how feasible is it that they can decrypt any https traffic between two systems using their chips? (Or anything else requiring randomness, https is only an example.)

My reason for asking: http://cryptome.org/2013/07/intel-bed-nsa.htm
As said, I don't believe everything written here, but I find it very interesting to discuss the possibility technically.


texts: Relation between short and «regular» Schnorr signature

texts:
I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (modern) Schnorr signature.
I get the construction, and that it's described by

The transformation $(u_t,\alpha_z)\mapsto(H(m,u_t),\alpha_z)$ maps a regular Schnorr signature on $m$ to an optimized Schnorr signature, while the transformation $(H(m,u_t),\alpha_z)\mapsto(u_t,\alpha_z)$ maps an
optimized Schnorr signature to a regular Schnorr signature.

Thanks to helpful comments, I now fully understand the mappings, and can now answer my original question: why

It follows that forging an optimized Schnorr signature is equivalent to forging a regular Schnorr signature.

Update: But I lack understanding of why

It will be sufficient to work with 128-bit challenges.

My thinking is that the proof of the regular Schnorr signature models the hash as a random oracle, but we can't model something with a 128-bit output as a random oracle and claim 128-bit security. Also, I'm worried the reduction to the Discrete Logarithm Problem could become one to a different DLP with some 128-bit limitation. And that could be an issue: for example, the problem of finding $x$ given $(g,y)$ with $y=g^x$ becomes tractable¹ when we limit $x$ to 128-bit, or to $x=a\,x'+b$ with 128-bit $x'$ and given $(a,b)$.
Update 2: Pondering that comment, the crux seems to be that a verifier in Schnorr's identification/Σ-protocol needs only a $t$-bit challenge for error probability $2^{-t}$. But that's still foggy for me.

¹ by Baby-Step/Giant-Step in principle, or Pollard's Rho in practice


texts: Is it OK to reseed a Deterministic Random Bit Generator from itself?

texts:
I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against.  So even though I don't care about cryptographically secure random numbers, a cryptographically secure Deterministic Random Bit Generator seems like the way to go.

For this purpose, I am thinking of using pycrypto's Crypto.Random.Fortuna.FortunaGenerator.  It only allows $2^{16}$ blocks of pseudorandom data before reseeding because it uses an AES stream in counter mode.  Since I care only about its resemblance to uniform independent draws and not about the entropy which would secure it from cryptographic attack, is there any harm in seeding the generator from its own output?


texts: Does Encryption add difficulties to File Recovery?

texts:
Seems Yes. People always tell us, it is very hard (or almost impossible) to recover an encrypted hard disk.

But after a second thought. I think this is not true.

Given that we know the KEY, and the method/algorithm of decryption, the decryption(key, encrypted_data) should be no different from plain text.

For example,

We mistakenly deleted a file. We have to examine the bits on the hard disk, identify the start and end positions of the file, and un-delete it. Of course the bits on the hard disk looks meaningless. However after decrypted, it appears no different from an ordinary hard disk.
Bad sector happens to the hard disk. For those error bits, those bits are lost, no matter encrypted or not. (Of course you can guess those bits and recover them.) For the rest intact parts of the hard disk, we can still decrypt those files as normal.

However there are some concerns that I am not clear about.

As some (or most) disk encryption algorithms are chaining previous and next sectors. Will this lead to whole hard disk not recoverable with just one error bit?
Consider the "bad sector example" above. If an error bit falls on an JPEG file. With a normal hard disk, we can still view the image, with display error on certain parts only. However with an encrypted hard disk, will encryption leads to whole image not viewable?

All-in-all, given that we know the KEY, and the decryption algorithm, does Encryption still add difficulties to File Recovery?


texts: Explanation of CAVP format for NIST Test Vectors for SHA-2 and 3

texts:
I want to run the SHA2 and SHA3 NIST algorithm test vectors provided in the zip files at the bottom of this page:
http://csrc.nist.gov/groups/STM/cavp/secure-hashing.html#sha-2

I don't quite understand how the test vectors are encoded. For example, if I run the SHA2-256 algorithm on an empty string as so:

import hashlib
sha2_256_test_str = b""
sha2_standard = hashlib.sha256(sha2_256_test_str).hexdigest()

I obtain the hash:

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Which is correct. However, if I look at the first test vector in the NIST zip file it says that:

#  CAVS 11.0
#  "SHA-256 ShortMsg" information
#  SHA-256 tests are configured for BYTE oriented implementations
#  Generated on Tue Mar 15 08:23:38 2011

[L = 32]

Len = 0
Msg = 00
MD = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

This would seem to indicate to me that for a message of "00", I should receive the hash above. However, this is the hash I obtain for an empty string. So for instance, the way that I interpret to run this test vector in Python is:

import hashlib
sha2_256_test_str = b"00"
sha2_standard = hashlib.sha256(sha2_256_test_str).hexdigest()

But this gives the hash

f1534392279bddbf9d43dde8701cb5be14b82f76ec6607bf8d6ad557f60f304e

What key point am I missing here? How would I be able to convert the messages in the NIST zip files to a message for my Python script?


texts:
I spent all day trying to figure ring signature schemes out but apparently I wasted time.
I read the original ring signature paper (Rivest's How to leak a secret).
I'm having numerous problems. Let's just say that a nice and simple example would make everything clear.

I'm talking about something like this example for RSA.

The problem is that no one provides this. I read 12 papers and… nothing. I would like to have an example with small numbers. Is this even possible? Could you provide such a “toy” example?

If I can be more specific: my problem with the original paper is step 4:

  solve for…

I have no idea how to solve an equation where on the left side I have the encryption (known key) of an unknown value and a value on the right side.


texts: First 16 characters replaced after decrypting AES encrypted string

texts:
I encrypted the string below using AES

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ValidationRequest>
    <ID>1234567890</ID>
</ValidationRequest>

and after decryption, the first 16 characters of the xml was replaced with special characters as shown below:

Q)ZvZ~J+/De*.0" encoding="UTF-8" standalone="yes"?>
<ValidationRequest>
    <ID>1234567890</ID>
</ValidationRequest>

What went wrong?


texts:
I'm trying to understand DES and a bunch of other cryptographic systems using S-Boxes.

I have now a quite basic question about how Sboxes work in general. For DES, Sboxes are substituting a 6-bits input for 4-bits output. It is clear for me how this works using the suitable substitution table. What I don't understand though is how the cryptosystem deals with the "loss of information" (at least it seems for me to be a loss of information, but I might be wrong).

If you map 6 bits on 4 you lose information. So there might be more than one 6-bit combination which is mapped on the identical 4-bit combination. As a consequence, after the S-box operation it seems for me that it is not possible to get the original 6 bits again out of your 4-bit result. How is it possible then to decrypt your ciphertext again?


texts: In Diffie-Hellman, are $g$ and $p$ universal constants or are they chosen by one party according to a set of rules?

texts:
I can't find any clarity on this. In textbooks, what I'm reading suggests there's already a standardized $g$ and $p$ that everyone uses, but I can't find what they are.

The closest I've come to is this RFC link.


texts: Probability of disavowing a signature in the Chaum-van Antwerpen Disavowal Protocol

texts:
Why in Chaum-van Antwerpen scheme, the probability that a cheating signer disavow a valid signature is $1/q$ ? From Handbook of Applied Cryptography at page 477:

  Suppose that $s$ is indeed A’s signature for $m$, i.e., $s = m^a\ mod\ p$. Suppose that B follows Protocol 11.125 correctly, but
  that A does not. Then the probability that $c = c_1$ (and hence A
  succeeds in disavowing the signature) is only $1/q$.

In disavowal protocol, the signer must return two values $w$ and $w'$ to the verifier and these two values must satisfy:

                                                    $(w.\alpha^{-x_2})^{x'_1} = (w'.\alpha^{-x'_2})^{x_1} \ mod\ p$

I think the only way for the signer to compute such $w$ and $w'$ is as follows:

Guess two independent values $x_1,x'_1 \in \{1,2,\dotsc,q-1 \}$.
Compute $\alpha^{-x_2}$ from $((s^{-x_1}z)^{a^{-1}})^{-1}\ mod\ p$
Compute $\alpha^{-x'_2}$ from $((s^{-x'_1}z')^{a^{-1}})^{-1}\ mod\ p$
Select a random $w \in \{1, \dotsc,p-1\}$ and check wheter $w \ne m^{x_1}\alpha^{x_2}\ mod\ p$.
Calculate $w'$ which satisfies $(w.\alpha^{-x_2})^{x'_1} = (w'.\alpha^{-x'_2})^{x_1} \ mod\ p$.

But this way the probability of correct guess is $1/(q-1) \times 1/(q-1)=1/(q-1)^2$, as two values $x_1$ and $x'_1$ are independent.

Any idea ?

Chaum-van Antwerpen Disavowal Protocol:

(A: signer, B: verifier)

B obtains A's authentic public key $(p, \alpha, y)$.
B selects random secret integers $x_1,x_2 \in \{1, 2, \dotsc, q-1\}$, and computes $z=s^{x_1}y^{x_2}\ mod \ p$, and sends $z$ to A.
A computes $w=(z)^{a^{-1}} mod \ p$ ( where $aa^{-1}=1 \ mod\ p$ ) and sends $w$ to B.
If $w=m^{x_1}\alpha^{x_2}\ mod\ p$, B accepts the signature $s$ and the protocol halts.
B selects random secret integers $x'_1,x'_2 \in \{1, 2, \dotsc, q-1\}$, and computes $z'=s^{x'_1}y^{x'_2}\ mod\ p$, and sends $z'$ to A.
A computes $w'=(z')^{a^{-1}}\ mod\ p$ and sends $w'$ to B.
If $w'=m^{x'_1}\alpha^{x'_2}\ mod\ p$, B accepts the signature and the protocol halts.
B computes $c=(w\alpha^{-x_2})^{x'_1}\ mod\ p$ and $c'=(w'\alpha^{-x'_2})^{x_1}\ mod\ p$. If $c=c'$, then B concludes that $s$ is a forgery; otherwise, B concludes that the signature is valid and A is attempting to disavow the signature $s$.

Ref: Handbook of Applied Cryptography, page 477.


texts: How can I find the generator of a composite group and $Z_p*$?

texts:
I was doing some research on elliptic curves. I know how to find the generator of $Z_p$ (this is a prime group). But I came across the term $Z_p*$ (group containing elements that relatively prime to $p$, which is composite obviously).

So I want to know how to find the generator of a composite group. How can I find the "generator" of a "composite group" (group order is composite)? And how can I find the "generator of $Z_p*$" (field with composite elements ranging from $\{1,2,\dots,p-1\}$)?


texts: I don't understand the definition of monotonic access structures

texts:
I am very confused with definition 1 in section 2.1 of this article.

  Definition 1 (Access Structure [2]) Let $\left\{ P_1, P_2, ..., P_n \right\}$ be a set of parties. A collection $\mathbb{A} \subseteq 2^{\left\{ P_1, P_2, ..., P_n \right\}}$ is monotone if $\forall B, C : \text{if } B \in \mathbb{A} \text{ and } B \subseteq C \text{ then } C \in \mathbb{A}$.

Following to this post, why isn't $\mathbb{A} = \left\{ \left\{ 1, 2 \right\}, \left\{ 3, 4 \right\} \right\} \subseteq 2^{\left\{ 1, 2, 3, 4 \right\}}$ monotone?
Where do $B$ and $C$ come from? Are they both elements of $\mathbb{A}$? Are they any kind of sets? If yes, $B = \left\{ 1, 2 \right\}, C = \left\{ 1, 2, 3, 4, 5 \right\}$ would be true, but doesn't make sense, because $C$ is not an element of $2^{\left\{ 1, 2, 3, 4 \right\}}$, so it can't be an element of $\mathbb{A}$, too. But the definition above implies that.


texts: Can one use zksnark to prove the knowledge of a discrete logarithm? In another word, can zksnark (R1CS) encode exponentiation?


texts: How does randomized hashing defeat collision attack?

texts:
SEC#1 recommends randomized hashing when using SHA-1 with ECDSA; SPHINCS+ uses randomized hashing in WOTS+ to defeat collision attack so as to reduce signature size.
How does a randomized hashing defeat collision attack? What are the limitations?


texts: Pre-determined points in Shamir's secret

texts:
I have distinct sets of pairs of values $(a_1, b_1), ..., (a_i, b_i)$. This set of pairs is ordered, and each $a_i$ and $b_i$ are related.  I want to share the $a_i$ values publicly. I do not want to share the $b_i$ with anyone.

I want the $b_i$ values to correspond to a single Shamir secret $S$ (Perhaps concatenate them, and encrypt with AES).

Is there any way to use Shamir's secret to make $a_i$ be the shared points D($i$, f($x_i$)=$a_i$) that corresponds to the Shamir secret , such that the $a_i$ are the shared points?

In other words, have the $a_i$ be the solution to the (k-1) degree polynomials?

My end goal is to "transmit" all $a_i$, but be able to use compute the $b_i$ after I know ALL of the $a_i$. I thought polynomial interpretation might be useful for this scenario.

If not Shamir's, is there any other method that may work?


texts: How much data can we encrypt using AES 256 before changing the key?

texts:
Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM)and GMAC has a different view on this. It says

Now 2^32 block ciphers, means 2^32 * 16 bytes of data, which is approximately 68 GBs. So do I need to change keys after 68 GBs?
I am confused because I am very new to the field and I would be very thankful for any help or suggestion in this regard.


texts: How to calculate period of stream cipher with multiple LFSR and NLFSR

texts:
I am interested in knowing how to calculate period of a stream cipher with more than one FSR (linear as well as non linear). I know for a single FSR, period can be calculated with farmula q^L-1 where q is elements in finite field and L is length of feed back polynomial. However what I am confused in is, is this period is considered period of whole cipher if cipher has only one LFR?

Also if cipher has multiple LFR (both linear and non-linear), how can I calculate overall period? will it be equal to peroid of LFR with minimum period or there is some thing else?

Thank you.


texts:
One thing I know about the Vernam cipher is that the key must not be repeated over the plain-text, for example:

Plain-text (hex):   48 65 6C 6C 6F 57 6F 72 6C 64 // HelloWorld
One-time-pad (hex): 47 72 61 70 65 47 72 61 70 65 // GrapeGrape
Cipher-text (hex):  15 23 13 28 10 16 29 19 28 01 // ??????????

Notice that in the one-time-pad, the sequence 47 72 61 70 65 is repeated.

How does this constitute a vulnerability, and how can the one-time-pad be discovered through its repetition?

Side-note: I'd be especially interested to know how it would be possible to determine a single repeated byte pad, for example:

Plain-text (hex):   48 65 6C 6C 6F 57 6F 72 6C 64 // HelloWorld
One-time-pad (hex): 56 56 56 56 56 56 56 56 56 56 // VVVVVVVVVV
Cipher-text (hex):  1E-33-3A-3A-39-01-39-24-3A-32 // ??????????


texts: Why doesn't this authentication protocol work?

texts:
I am a student taking a cryptography course so forgive me if this comes off as a silly question.
This is an assignment question:

Alice ------R--------> Bob
Alice <-----[R]B------ Bob
Alice ------[R+1]A---> Bob

Why doesn't this protocol provide mutual authentication?

Here's a plausible scenario Alice sends R trudy intercepts it and sends it to bob impersonating alice. Bob sends back R signed by him to trudy. Trudy now impersonates Bob and sends R with Bob's signature to Alice impersonating Bob. alice sends [R+1] signed by alice which trudy can now use to impersonate as Alice to Bob.

If that is a valid attack. Wouldn't this work with every protocol? After all we're merely just relaying message back and forth among two parties.
Is there any way I can modify this to get mutual authentication?


texts: Define a Decryption algorithm on a given group-based Cramer Shoup lite scheme

texts:
I am currently working on public key encryption schemes and I want some help to figure out how decryption algorithms work. Suppose we have a public key $pk = (G,p,g,e)$ with $e \in Z^*_p$ . (where $G$ is the message space, $g$ is a generator of $G$, $p$ is the prime order of the cyclic group $G$). The secret key $sk = d$ where $d \in Z_p$ such that $ed = 1\bmod p$ (similar to Cramer-Shoup). Now Suppose that the encryption algorithm given the pk and a message $m \in G$ and a arbitrary picked group element $h←G$ is defined as $E_pk(m,h)=(u,v)=(m^eh,h^e)$.

I am trying to find an efficient decryption algorithm (using the same secret key sk). Can this scheme be IND-CPA secure. I tried to reduce this problem to a cryptographic assumption (e.g. a computentional hard problem) but I did not manage to. Any help would be appreciated.

Edit: Eventually, the above scheme is similar to Cramer-Shoup (lite version). Any idea of finding an efficient decryption algorithm? The scheme is not secure.


texts: Is it possible to attack a one-time pad encrypting only slightly more than its length?

texts:
This question might be uncannily similiar to this one posted over 6 years ago, but the structure is completely different.
It's written nearly everywhere that OTPs are incapable of sustaining more than their length of data - but I have yet to find an answer besides "reusing them makes cryptanalysis possible" in several different ways.
Suppose Alice and Bob wanted to maintain a OTP-based connection, but are unable to physically exchange entropy besides an initial file. Luckily, Alice has her own entropy source. What Alice and Bob could do is use the initial OTP to send two bits of data at the cost of one bit of entropy. The order of entropy and starting offset could be negotiated beforehand using typical OTP, but let's assume for simplicity's sake that you're sending 2 payload bits in series - and XORing them with an entropy "key" bit, and that the offset Alice picks is also taken from her entropy source.
A meddling Eve, if she knows how this protocol works, could only tell one of two metadata possibilities as a fact:

that any two linked data bits are the same (ambiguous between 00 and 11)
that any two linked data bits are different (01 and 10)

However, Eve should be unable to determine which of the 2 ambiguous combinations is the correct combination... right? After all, Eve could pick up on patterns of the metadata, but not before Alice and Bob notice.
The data transferred this way (which could be even more entropy - Eve doesn't know which part of the data is which!) would be protected by the initial challenge, and by the entropy of the initial OTP. Knowing all this, we can finally rephrase the question:
Is it possible to perform a cryptanalysis on a hybrid OTP described above, and if it is, what would be an efficient attack vector?
Would it be instead preferable to perform an RSA/Diffie-Hellman key exchange over the initial OTP?


texts:
Does any one have, or can refer to a Known-Answer-Test (KAT) for Triple DES Keying Option 2?

(Keying Option 2 means $C = DES_{k_1}(DES^{-1}_{k_2}(DES_{k_1}(P)))$ for encryption and $P = DES^{-1}_{k_1}(DES_{k_2}(DES^{-1}_{k_1}(C)))$ for decryption, where $k_1$ and $k_2$ are independent parts of the key bundle.)

I have developed an implementation of 3DES Keying Option 2 in a FOSS library called TurboPower Lockbox (or at SourceForge). I need some KAT vectors to validate my implementation. I've done a good search, but every 3DES KAT I have found has either been KO-1 or KO-3.


texts: Different ways for modular exponentiation $A^E$ with negative A's

texts:
I was looking at a way for modular exponentiation $X=A^e \mod{n}$ with negative base $A$ in order to evaluate how it needs to be changed so I can use it with my hardware acceleration unit.

The crypto library I was looking at deals with negative base $A$ (MPI) as follows:

Check if A was negative and if it was, remember that it was negative and invert its sign (e.g. -5 --> 5)
Perform the actual modular exponentiation using a specific algorithm (e.g. sliding window method) with the positively signed $A$
If $A$ was positive at the beginning, you're done
If $A$ was negative at the beginning and the exponent $e$ was odd compensate by performing $ X = n-X$

This library can work with arbitrarily large (or small) values of $A$. However my crypto core which accelerates moudular exponentiation expects the input parameters $e$ and $A \in [0 \dots n-1]$ which is why I came up with following solution:

At the beginning always perform $A = A \mod{n}$. This would reduce $A$ if $A \ge n$. In case $A \lt 0$ this would make $A$'s sign positive.
Perform the actual modular exponentiation using a specific algorithm (e.g. sliding window method) with the positively signed $A$

I think that performing the reduction at the beginning to reduce A and make its sign positive should not change the final result as $A^e \mod{n} = (A \mod{n})^e \mod{n}$. However I wanted to make sure, that I did not forget anything.


texts: How much time will it take to brute force a password

texts:
I am building a client-side app that will encrypt data, using password-based key generation, into the database. Can someone verify my calculations to figure out what is the right number of iterations I should use to dissuade a potential hacker?

We'll assume that the password is at least eight characters long with a mix of numbers and upper, lower, and special characters. So that makes $72$ possibilities per character
Thus total passwords to brute force $= 72^8 \approx 722$ trillion
If I want it to take 100 years to try all possibilities using 10 computers, then per second my settings should be able to produce 22,900 passwords
Now what I am unable to figure out is, how many iterations would it take to limit a GPU such as 8x Nvidia GTX 1080 to be able to generate 22,900 passwords?

We can assume HMAC-SHA-1 or HMAC-SHA-256.


texts:
I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC key on the response than used on the request.

This particular variant key seems to course some trouble in our HSM (it's don't work .. ), and I'm wondering if it is standard to have two keys in use on DUKPT MAC. Many references seems to only talk about one MAC key when talking about DUKPT.


texts: Encrypting data on both iOS and Android without external dependencies (can I use AES-CBC?)

texts:
I am trying to achieve AWS KMS envelope encryption on both iOS and Android. From the KMS API I get a 256 bit data key in both plaintext and encrypted forms (encrypted by a master key held only on KMS HSMs).

Right now, I am using iOS CommonCrypto and Android's built-in Cryptography library to encrypt sensitive data fields with AES-256-CBC.

This data is then sent over TLS to the server. Eventually, the events containing the encrypted fields are read out into into a secure ETL process where the fields are decrypted for analysis.

The reason I am encrypting on-device is so that the events may flow through existing data analytics infrastructure that isn't built to handle sensitive data. I want to do this without including additional dependencies to my client-side code.

Is CBC an appropriate choice for this? It is unclear to me if I need GCM for this. I can't find a good way to implement AES-GCM on any version of iOS except the latest one, v13.

Am I missing a more obvious design here to meet my needs?


texts: Difference between salted hash and keyed hashing?

texts:
A cryptographic salt is additional input other than message itself for a hash function so that it prevents attacker from launching dictionary attacks . Usually the salt is stored along with the hash of say the password etc.

Keyed Hashing is secret key is used as input for hashing along with message like HMAC .

Now is there a difference between salted hash and keyed hash ?


texts:
Is it possible to recover password having ZIP/AES file and unpacked file?

Or unpack other files with the same password?


texts: Why is recipient hashed in this Sign/Encrypt/Sign proposal?

texts:
Own research

In my journey into trying to understand PGP, and public key signing and encryption as a whole, I came across this answer on CE. It is an answer to a question with the title: Should we sign-then-encrypt, or encrypt-then-sign? Although this satisfies my original quest, it has an interesting link to an article called: Defective Sign & Encrypt in S/MIME, PKCS#7, MOSS, PEM, PGP, and XML.. The article as a whole explains why "naive sign & encrypt" systems are not as secure as most people think. Also, it proposes some solutions to the issue.

Question

A proposal which caught my attention from section 5.2 Sign/Encrypt/Sign of the article.

  Surprisingly, we can get an effective repair for S&E, if Alice signs
  and encrypts the plaintext, and then she signs the ciphertext, too:

A ---> B   :   {{{msg}a}B , #B}a

  (Here, #B means Alice hashes Bob's key, not his name.)

  This message means:

  Inner Signature: "Alice wrote the plaintext;"
  Encryption: "Only Bob can see the plaintext;"
  Outer Signature: "Alice used key B to encrypt."

  [...]

Is there any cryptographic / security reason why Alice would Hash Bob's public key? If I would implement something like:

A ---> B     :   {{{msg}a}B , B}a

(B is Bob's public key, not hashed)

Would I still benefit from the security offered by this fix?

Background

I'm in the research phase of developing a messaging platform based on public-key encryption. My first intention was to use the OpenPGP standard. However, this standard alone would make it impossible to identify the sender until the message is decrypted. I want to offer end-to-end encryption, but at the same time, offering my servers to verify the sender is a registered user.

Off course, this could (and will) be done by client - server authentication. But even in such a case, using openPGP and authentication alone, a client can still misbehave:

  PGP's strongest security option is naïve Sign & Encrypt, so PGP is
  vulnerable to surreptitious forwarding:

A ---> B   :   {{ "The deal is off." } a}B
B ---> C   :   {{ "The deal is off." } a}C

The server wouldn't know that Bob is illegally forwarding Alice's massage and gladly forward the message to Charlie on Alice's behalf.

I know that most of this can be prevented on the application level. Like e-mail is doing with authenticated SMTP and fields like From: and To. But as an experiment, why not fix these issues directly in the cryptography protocol? I think, the server reading the intended receiver's public key would be a nice solution.


texts: Key renewal when the sequence counter is only 32-bit

texts:
If we look at the use-case that our sequence counter within our TLS communication is only 32-bit, would an automatic key re-newal be necessary a lot more frequently? We're going to use state-of-the-art algorithms consisting of AES-GCM (at least 128-bit keys) and HMAC-256. I'm referring to the answer posted here - https://security.stackexchange.com/questions/55454/how-long-does-an-https-symmetric-key-last - where it states that key renewal would not be necessary due to the substantial amount of data that can be encrypted with AES without the necessary need for a key renewal.
The sequence counter is not the one used within TLS but a protocol specific one. We're not sure if we continue with the "normal" TLS handling after the handshake has been done. We're going to use EAP-TLS for the handshaking. So we don't know if we make use of the implicit 64-bit sequence counter of TLS - would this make a difference for the question asked above?


texts: I'm studying the Index Calculus method for Discrete Logarithm. In the book "Introduction to Cryptography with Coding Theory" by Trappe it's told that, if $$\alpha^k\equiv \prod p_i^{a^i} \mod p$$ holds, then $$k\equiv \sum a_i L_\alpha(p_i) \mod (p-1).$$ However, it doesn't show why. Can you explain to me?


texts: Does a cryptosystem provide unconditional security if and only if it provides perfect secrecy?

texts:
Is unconditional security and perfect secrecy one and the same thing, i.e a cryptosystem provides unconditional security if and only if it provides perfect secrecy ?

I've wondered about the above and seen that the one-time-pad provides unconditional security in terms of perfect secrecy. Does this hold in general ?


texts:
I have created an application that will be able to read any file and encrypt it using AES Encryption. For efficiency, I am reading a block of data, encrypting it and so on. So for decrypting, I just have to read each block and decrypt using the same key to get the data back. This was what I had in mind.

But it turns out that the size of each encrypted block varies, so I am currently saving the encrypted block size before each block into my encrypted file.

And my question is: Is it normal that AES produces encrypted blocks of varying lengths or am I overlooking something?

(I'm using a padding, as my input block size is not always a multiple of the AES block size.)

I faced the same issue when I had used C++ a few years back, and now as3crypto library for an AIR application while implementing the same application.


texts: How do the constants in this implementation of AES match up with the algorithm?

texts: In this file on GitHub, from lines 154 to 169, there are twelve arrays of constants that I've not seen in other AES implementations. How do they relate to the algorithm?


texts: In the reduction proof below, where OWF exists only if is a PRG. I am not able to understand the highlighted part

texts: I am able to understand how G(x) id generated. But then what is the use of variable z. Also if the probability is >1/2 + e then the distinguisher wins! Then how is this still a OWF


texts: Decryption of RSA with e that has no inverse

texts:
I'm studying the RSA protocol and I was wondering if there was any way of decrypting a message if the $e$ doesn't have an inverse $\mod (p-1)(q-1)$.

Usually, you have to choose a value of $e$ that is inverse $\mod (p-1)(q-1)$, but I made a mistake in my calculations. If someone where to write to me using the formula $C = M^e \bmod n$, would there be any way for me to decrypt it if my $e$ is wrong or am I out of luck.


texts: How to securely combine multiple sources of entropy?

texts:
Suppose that I have $n$ secure 32-bit keys that were generated separately using methods that are known to be secure. For example, one of them might have been generated by using a proven CSPRNG. Another may have been generated using PBKDF2.

Now, I want to turn all of these keys, combined together in to a new key that I can use to encrypt and decrypt data.

The important thing is that I want to require all of the keys to be present in order to perform the encryption and decryption.

What I want to know is, what is the best way to combine these keys and maintain the highest level of security against attacks?

For example, I could just concatenate all the 32-bit keys and then run them through PBKDF2 again:

# pbkdf2(key, salt, iterations, derived_key_length)
# Also, "a + b" indicates concatenating a + b as strings, i.e. "hello" + " world" = "hello world"

new_key = pbkdf2(key1 + key2 + key3, some_salt, 10000, 32)

Or, instead of concatenating them, I could concatenate some of them in the salt:

new_key = pbkdf2(key1, key2 + key3, 10000, 32)

Or, I could iteratively run pbkdf2:

temp_key = pbkdf2(key1, key2, 10000, 32)
new_key = pbkdf2(key3, temp_key, 10000, 32)

Or, I could concatenate them all and hash them:

new_key = sha1(key1 + key2 + key3)

Or, I could iteratively hash them with concatenated versions of the previous hash:

a = sha1(key1)
b = sha1(a + key2)
new_key = sha1(b + key3)

Or, I could produce a hash using one of the above methods and then run that hash through PBKDF2:

hash = sha1(key1 + key2 + key3)
new_key = pbkdf2(hash, some_salt, 10000, 32)

Or, I could xor them all together:

new_key = xor(xor(key1, key2), key3)

Or, xor them all together, and then run though pbkdf2, etc. etc.

Clearly there are a ton of ways to combine these keys to produce a new secure key.

Is there any prior work on this? What is the best and most secure way to do this?

If any of the above methods are not secure, can you explain why?

P.S. As an additional aspect of this question, I am curious if the "password" or the "salt" are more or less secure places to put entropy. For example, are both of the following equally secure?

new_key = pbkdf2(key1 + key2, key3, 10000, 32)

and

new_key = pbkdf2(key1, key2 + key3, 10000, 32)


texts: Can one detect if two pairs of elements in Zp have the same exponential relation?

texts:
Suppose that $p$ is a safe prime of 2048 bits ($p = 2q + 1$, and $q$ is prime).
Suppose that one is given two pairs $(x_1, y_1)$ and $(x_2, y_2)$ such that:

$y_1 = x_1^{r_1} \pmod p$

$y_2 = x_2^{r_2} \pmod p$

Where $r_1$ and $r_2$ are unknowns.

Is it easy or hard to check if $r_1 = r_2$ without further knowledge? Does this problem have a name?

Is there a relation $f$ of $r$ and $x$, $y_1 = f(r,x_1)$, such that it is difficult to extract $r$ from it but it's easy to detect if the same $r$ is used in another pair $y_2=f(r,x_2)$ without leaking $r$?


texts: Is 512 bits a more secure hashing than 256 bits?

texts: I know that 512 bit hashing is more secure, but I don't really know why. I hope someone can help me to better understand it in more detail.


texts: Can physical object hiding be quantified with entropy?

texts:
If it works in the virtual world, why can't the same principle work in the real world?

For example if you want to hide a private key, you need a virtual haystack to hide it inside, which is the entropy of it's random source.

So if we want to generate a 21.9 bit key we need to select one random one out of 4000000 possibilities.

The same way in the physical world if we have a 10 m^3 size room, but only 2m^3 area can be used to hide things, then if we were to hide a small object like a dice which is like 0.5 cm^2, then we have 4000000 possibilities, which would be 21.9 bits.

So could the real world hiding of object be quantified in the same way ( excluding the fact that our eyes have a wide vision range so it would be easier to find, but also we could not go through all possibilities as fast as a computer could)


texts:
Let $f(x) = ax + b$ be an affine encryption function. $a$ and the cardinal of the field of our keys $K$ (in English, 26) must be coprime so that the encryption function is bijective and the decryption function defined and bijective as well.

Could you please clarify how (in terms of congruences) the two having a $pgcd>1$ make the encryption function not bijective?


texts:
I'm reading about CL-PKC and in Al-Riyami's FullIndent, I find some notations I must be sure to understand, to well explain it in my report.

  This algorithm takes paramsand $A$'s secret value $x_A$ as input and
  constructs $A$'s public Key $P_A$ like this :

  $$P_A = \langle X_A, Y_A\rangle$$

  With $X_A=x_A P$ and $Y_A = x_A P_0 = x_a s P$

Does $\langle A, B\rangle$ mean the concatenation of $A$ and $B$ ? If yes, why not using the || operator ?


texts: Increasing Entropy of Limited Information / ID

texts:
Supposed that I get an ID from third party (in this case, Telegram ID which is  the range $-2^{31}$ to $2^{31}-1$). I want to store the ID securely and privately into my database by hashing it. I don't really care what the ID is, but I do really want to store the ID uniquely without actually storing the real data.

The problem is the entropy is pretty small (32-bit). Any people can get the real ID by brute forcing it. Also it is impossible to ask user to create a passphrase (or something like that) to make a derivative key, since I only get data from API and not interacting to it. I tried to figure out salting it, but since the main problem is the entropy is too small, I don't think it might work as expected.

HashIds is not a solution because the ID comes from third party.

How should I store the hash so that the hash won't be easily bruted-force? Currently, I am using SHA-512 to hash the ID.

Edit: for clarification

I can't store plain ID to database so that I must hash it
I don't need to recover original ID, but I need to check whether the hashes ID exists or not in DB, regardless the original ID
This has nothing to do with user. Yes it was the user ID from third party, but it is no way for user interacting with it. Thus, it is impossible to ask user for a pass phrase or something like that.

To sum up, I need to hash the ID and making it harder to brute force. Is it possible even if attacker try to brute force the entire 32 bit entropy?


texts: How to show that a result of hash function and a random is computationally indistinguishable?

texts:
I want to ask: How to show that a result of hash function and a random is computationally indistinguishable

If we denote $H(): \mathcal{X} \rightarrow \mathcal{Y}$ is a secure hash function, $m$ is a fixed message, and $r$ is chosen randomly.

Let $c_1 = H(m \mathbin\| r)$ and $c_2 \in \mathcal{Y}$ chosen randomly.

Is there any method to show the $c_1 = H(m \mathbin\| r)$ and $c_2$ is computationally indistinguishable?


texts: If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

texts:
An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption.

  If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number [...] an adversary can perform a single enormous computation to "crack" a particular prime, then easily break any individual connection that uses that prime.

Why do we generate these primes using tools like dhparam when using DH, but in ECDH we often admit which particular curve (like Curve25519) we're using?

Isn't that exactly what we should avoid? Shouldn't we generate the curve properties in a similiar manner? Or is that hypothetically correct but the computation is not even in well-paid adversary's capabilities?


texts:
Let $N=PQ$, where $P=2p+1$ and $Q=2q+1$. $P,Q,p,q$ are prime numbers. $QR_{N}$ is the set of quadratic residues modulo $N$.

Please help me to prove $QR_{N}$ is a cyclic group.  Note: $QR_{P}$ and $QR_{Q}$ are cyclic groups.
How to find/determine generator for $QR_{N}$?


texts: What is the benefit of artificially padding messages?

texts: For ECB, CBC, and CFB, padding is required when the plaintext does not fill out a complete multiple of the block size. However, I have heard that is good practice to pad all messages, even if the plaintext does fill out a complete multiple of the block size. What benefit does doing such a thing have? Does it increase security in any way?


texts: Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

texts:
I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme.

$k_1$: encryption key
$k_2$: authentication key
$m_1$: plaintext message
$c_1$: encrypted message (AES-CBC with random iv)
$IV$: from PRNG

where $k_1$ and $k_2$ are independent.

$$MAC = SHA256(m_1 || IV || k_2)$$
$$c1 = AES(k_1, IV, m_1)$$
$$SEND(c1 || MAC)$$

MAC is completely insecure because it is not a proper HMAC as defined by $H((k_1 \oplus opad) || H((k_1 \oplus ipad) || m_1))$.  MAC can be easily compromised by an extension attack since the MAC is in the clear.

However, I am trying to determine if the above MAC becomes secure if it is included in the $c_1$ encryption of an Authenticate-then-Encrypt (AtE) scheme.

$$SEND(AES(k_1, IV, m_1 || MAC))$$

MAC is no longer in the clear and should not be vulnerable to the extension attack.  I am aware of other general attacks on AtE schemes but my specific question is whether including a $MAC=SHA256(m_1 || IV || k_2)$ in the encrypted ciphertext is cryptographically secure for message authentication.

ie: Decrypt $c_1$ using $k_1$, then immediately verify decrypted MAC with $k_2$.

This is an academic question since in practice I would use AES-GCM for authenticated encryption.


texts: Primality test in GPG/RSA or extract numbers of private key

texts:
I cannot find if the two numbers for RSA are tested against an elliptic curve primality test. If not, is there a way to extract the two integers of my private key in order to test it by myself?

If this is not an accurate question why?


texts: Why do we always prove cryptographic protocols via completeness and soundness?

texts:
Most of the proofs that I have seen for cryptographic protocol include completeness and soundness.

Why do we always prove completeness and soundness?
Why do we not also see other propertes such as "validity", "consistency", "integrity"?


texts: Has anyone implemented a public-key encryption scheme using a universal one-way function?

texts:
There exists a function $f$ such that if one-way functions exist then $f$ is a one-way function.  Such a function is called a universal one-way function.
Now the public-key encryption schemes that I’ve come across use functions for which it is an open problem whether they are one-way functions even under the assumption that one-way functions exist.  My question is, has anyone implemented a public-key encryption scheme based on a universal one-way function?
If not, what makes a universal one-way function impractical to use?


texts: What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

texts:
I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently the ChaCha20 as part of the ChaCha20-Poly1305 AE cipher.

Are there advantages to using a stream cipher especially?


texts: Can a combination of encryption algorithms weaken the overall encryption?

texts:
Are there any instances where a combination of industry standard encryption algorithms can weaken the overall encryption of the data?

As a Naive example using non-standard encryption algorithms, running ROT13 on textual data a second time would actually unencrypt the text.


texts: Why mounting/dismounting an encrypted file container takes only a few seconds?

texts:
When the encrypted file container contains 100000 files and 500 GB of data, all of them must be decrypted/encrypted when the container is mounted/dismounted.
How can Truecrypt/Veracrypt perform this within a few seconds?


texts: Is there any encryption system where the sender cannot prove that a specific ciphertext belongs to a specific plaintext

texts:
I'm trying to create a message-transfer system where

The encrypted messages are stored in a public database.
It is possible to verify who is the sender of this message.
The sender cannot prove to anyone else the content of the message. I mean, he/she cannot re-encrypt the plaintext message and match with the ciphertext on the public database to prove the content of the message to someone else.

Is there any existing encryption protocol that can get the job done? This encryption protocol can be interactive/non-interactive, symmetric/asymmetric or anything else. It just needs to get the job done.

I'm new to cryptography. Please pardon me if my question is too dumb or has been answered already. I tried to look for solutions online but failed to find any practical solution. While searching I came to know a little bit about deniable encryption and zero-knowledge proofs. Can they help with my matter in any way?

Thanks in advance.


texts:
I'm trying to understand how certificate signing and verification works conceptually. I know the classic example with asymmetric cryptography- the sender encrypts data with public key of receiver, data goes over unsecure channel, receiver decrypts with private key.

When it comes to certificate verification that's where I start to get confused.

According to Wikipedia in the picture they show, the hash of the certificate is decrypted with signer's public key. So which is it?

I thought that maybe upon receipt, the contents of the certificate are hashed and encrypted with the public key and the result is compared with the provided "digital signature". But then I realized an attacker would be able to reproduce this process as well without knowledge of the private key.


texts: What are the major differences between theoretical cryptography and applied (practical) cryptography?

texts:
There are a lot of theoreticians who don´t have a clue of the applied aspects involving cryptography.
Are the two disciplines mutually exclusive?
Can you learn one without the other?


texts:
I've been reading: https://github.com/bellaj/Blockchain/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf

On page 22 it shows an eliptic curve over F17.

I have added the orange lines and labels.

Do the orange lines illustrate that a line through points at P(2,10) and Q(5,9) also intersects the "curve" at -R(12,1)?

i.e. Does the finite field version graphically match an elliptic curve over real numbers, with the provisos that the finite field curve is discontinuous and that lines wrap?

Or am I hopelessly confused about elliptic curves on finite fields (as I expect).

P.S. If this is an accurate graphical representation, how do I illustrate tangents to the discontinuous curve?

P.P.S. There are multiple lines which contain three points.  X, Y and -Z, in purple, are another (below).


texts:
I just started work on lattice-based cryptography and I could not understand the concept of worst-case to average-case reduction.
We generally say,
Average Case Hardness: Random instance of a problem is hard to solve.
Worst-Case Hardness: Hard to solve every instance of the problem (even if most instances are easy)
So far, so good
But I could not establish the relationship between lattices and worst-case hardness concept. Let's say our problem is "Shortest Vector Problem (SVP)". I know it is a hard problem and we can prove the security of lattice-based cryptosystems based on hardness of this -or other related problems- problem.
My question is: What is the instances of this problem? Lattices? Given bases? or shortest vector of that lattice? Firstly, I thought "worst" related with "shortest vector" but I was wrong. Could you explain this?


texts: Function with no fast path and with fast proof

texts:
When a function is iterated and each time a previous result is used as input to the next iteration (feedback), so that there is a limited benefit from parallel computing, is there such function that:

requires polynomial time to get the result of N iterations
has an Nth result that can be verified in constant time to be the Nth result for a given start value

Assuming that Alice iterates the function:

Problem with Makwa: At first Bob must use and throw away p and q.

Problem with LCS35: At first Bob must construct the puzzle.

But I need a function so that Alice can choose an arbitrary number or data to begin iterating with, not something prepared by Bob. Only when Alice has done N iterations Bob will join and verify.


texts:
I have a need to generate a unique hash for millions of Strings of same length.
Would prefer a non cryptographic hashing algorithms for performance reasons.
The hash can be of length upto 24 bytes, but hash collisions are a strict no.
A dumb implementation I can think of is to use the String.hashCode() method in java as 4 bytes [of the allowed 24 bytes]

First 4 bytes = String.hashCode(string)
Second 4 bytes = String.hashCode(reverse of string)
Third 4 bytes = String.hashCode(first half of string)
Fourth 4 bytes = String.hashCode(last half of string)

Thats just 16 bytes of hashes... and as the size of the string is fixed, would this give a unique 16byte hash for every different string? This is similar to using a bloom filter, but I need to ensure there are absolutely NO hash collisions.
Keeping this hash is memory if more efficient than keeping the entire string in memory.


texts:
How long does it take to extract a key from a FIPS-140 Level 2 device?
What records are there of successful extraction?
How much did the first extraction from a given device cost?
How much would a subsequent extraction cost?

Dr. Google is usually very helpful on questions like this but he isn't helping me here.
Any ideas?


texts: There are a large number of algebraic NTRU variants: for example, in some (such as ETRU), the underlying ring has been changed to the ring of integers of a certain number field; there is GR-NTRU, which is over group rings; there is NTRU over quaternions, and octonions, and even sedenions; and there are various other non-commutative and non-associative schemes. I am aware that non-commutativity helps avoid an attack of Coppersmith and Shamir, but my question is the following: are any of these variants considered essentially superior to standard NTRUEncrypt? Is the more exotic algebraic structure of these variants considered preferable by experts, or are these schemes academically interesting but impractical/not trusted for real world use?


texts: Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

texts:
PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat keyspace, and the first half of the input is far more sensitive than the second half, which is only the tweak key. Am I correct in assuming that disk encryption utilities which use PBKDF-HMAC-SHA256 to derive a 512-bit key for a 256-bit cipher in XTS mode are in error?

If so, what can they do instead? Can they derive the cipher key and master key directly from the 256-bit output of the KDF, e.g. $K_1 = H(D \mathbin\| 0)$ and $K_2 = H(D \mathbin\| 1)$ for PBKDF2 digest $D$?


texts: Finding exponent $e$ in RSA given modulus and a plaintext/ciphertext pair

texts:
Assuming
$$c = m ^ e \bmod n$$
and given the values of $c$, $m$ and $n$ (32 bit integers),

How would one find the exponent $e$ (also 32 bit integer) ?


texts: Can I clone MD5 hash to a different file?

texts:
one.ttf (3f67f2feb32a72cf4b90c767eb43aa52)
two.ttf (8880bae64dc9e6ba22446f789d09d3d7)
I want to set one.ttf md5 hash to two.ttf
It is possible?
Like this
one.ttf (3f67f2feb32a72cf4b90c767eb43aa52)
two.ttf (3f67f2feb32a72cf4b90c767eb43aa52)


texts: I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will be faster to use?


texts: Question about Novotney's paper on Weak Curves

texts:
This is the paper - https://wstein.org/edu/2010/414/projects/novotney.pdf
In Section 2.1
I see 2 chunks of code/commands in SageMath
sage: #Group Order Compare SLOW
sage: m = 21345332
sage: p = 4516284508517
sage: E = EllipticCurve(GF(p), [7,1])
sage: Q = E.gens()[0]
sage: mQ = m*Q;
sage: print E.order().factor()
sage: time mRec = PolligHellman(Q,mQ)
sage: print mRec
11 * 13 * 31582419389
Time: CPU 49.14 s, Wall: 49.14 s
21345332

sage: #Group Order Compare FAST
sage: m = 21345332
sage: p = 4516284508517
sage: E = EllipticCurve(GF(p), [7,1])
sage: Q = E.gens()[0]
sage: mQ = m*Q;
sage: print E.order().factor()
sage: time mRec = PolligHellman(Q,mQ)
sage: print mRec
2^3 * 19 * 23 * 67 * 2089 * 18913
Time: CPU 0.16 s, Wall: 0.16 s
21345332

E seems to be the same in both cases - but E.order.factor() is different. How can that happen?
I see this pdf referred to here also - http://koclab.cs.ucsb.edu/teaching/ecc/project/2015Projects/Sommerseth+Hoeiland.pdf
From Page 3

the article ”Weak Curves InElliptic Curve Cryptography” written by
Novotney.He looks at the elliptic curve E:y2=x3+ 7x+ 1and Galios Field
over prime p= 4516284508517: When the order of the
point P is 4516285972627 it has the prime factors 11·13·31582419389.
Solving the ECDLP with Pohlig-Hellman takes 49.14 seconds.
When the order of the point P is 9254332285624 it has the prime
factors 2^3·19·23·67·2089·18913.
Solving the ECDLP  with the same Pohlig-Hellman code takes 0.16 seconds.

9254332285624 = 2^3 * 19 * 23 * 67 * 2089 * 18913
So both are the same thing.
So - is it really E.order() or P.order()
How do I get the points which have the order 9254332285624 &
I tried this in sage
p = 4516284508517
E = EllipticCurve(GF(p), [7,1])
P = E.gens()[0]

print (E.order())
4516285972627

print (P.order())
4516285972627

How do I get the point for which the order is 9254332285624?


texts:
In the book "Introduction to Cryptography with Coding Theory" by Trappe, in the paragraph about the security of the One Time Pad, is it told that given the set of possible plaintexts $P$, the set of possible keys $K$ and the set of possible ciphertext $C$, then:

$H(P,K,C)=H(P,K)=H(P,C)$

However, he doesn't explain why. Can you show me ? If possible also formally


texts: Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

texts:
We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as:
$s=\frac{H(m)+xr}{k}$

Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, that verify under two pubkeys $x_1G, x_2G$.

If the two public keys are equal then the secret keys should be equal $x_1 = x_2$ and we can easily recover the $k$ using the standard attack on nonce reuse. Once we know $k$ we can recover the secret key.

$\frac{H(m_1)-H(m_2)}{(s_1 - s_2)} =\frac{k(H(m_1)-H(m_2))}{H(m_1)-H(m_2)+x_1r - x_2r}$

$x_1 = x_2 \rightarrow x_1r - x_2r = 0$

$\frac{H(m_1)-H(m_2)}{(s_1 - s_2)} =\frac{k(H(m_1)-H(m_2))}{H(m_1)-H(m_2)} = k$

My question is can this attack be made to work if the secret keys are not equal i.e. $x_1 \ne x_2$:

$\frac{H(m_1)-H(m_2)}{(s_1 - s_2)} =\frac{k(H(m_1)-H(m_2))}{H(m_1)-H(m_2)+x_1r - x_2r} = \frac{k(H(m_1)-H(m_2))}{H(m_1)-H(m_2)+ (x_1 - x_2)r}$

If you know either $x_1 - x2$ or $\frac{x_1}{x_2}$  you should be able to compute $k$ as long as $s_1 \ne s_2$.

You can calculate $x_1 - x_2 = \frac{H(m_2) - H(m_1)}{r}$ in case where $s_1 - s_2 = 0$. However this case seems to reduce to the hardness of ECDSA since anyone can compute the pubkey for a new message $m_2$ that verifies under first signature $(s, r)$ using public key recovery.

If $s_1 \ne s_2$ you can compute $\frac{x_1 - x_2}{k}$ which allows you to convert $s_1$ into $s_2$ and vice versa.


texts: Would a non-envelop, prefix only, SHA2 built MAC be susceptible to key recovery attacks?

texts:
When aiming to build a MAC, classic literature discusses the use of Envelopes or key "Sandwich" to build MACs. These were proved to be as secure as HMAC in “Sandwich” Is Indeed Secure: How to Authenticate a Message with Just One Hashing by Yasuda. In these Envelopes, a key (K) is prepended to the padded message (M) and then another key is appended afterward (K). We can describe the MAC construction as $\operatorname{MAC}=H(K\mathbin\|M\mathbin\|K)$.

As Yasuda explains, the key after the message is added in order to avoid length extension attacks on the MAC. It is also important to keep the appended key in its own hash block in order to avoid attacks such as the one described in On the security of two MAC Algorithms by Preneel and Oorschot.

Now, what I haven't found in recent papers is any security analysis on the security (or lack of) of MAC algorithms such as the ones described by Yasuda in his paper as "prefix". In other words, I'm trying to find how secure MAC=H(K||M) nowadays is and which are the tradeoffs of using such algorithms beyond the danger posed by length extension attacks.

More explicitly, I'm currently trying to find out if a "prefix" MAC building algorithm that would use SHA2 as its hashing algorithm would be susceptible to key recovery attacks. Let's suppose that this algorithm makes use of SHA2-256 and generates a MAC over 2 blocks containing a key, data, and padding. The blocks would look like this:

Block1 (Secret key 32 bytes || 32 bytes of message data that can be influenced by an attacker))

Block2 (64 bytes of message data & padding).

As far as I can see attacks such as the one discovered by Preneel & Oorschot will only work for keys whose value lies between two hashing blocks, so I'm trying to find other methods of key recovery attack that would be relevant for "prefix" MAC building algorithms.
I'm assuming that any number of MACs and message data can be gathered by an attacker but considering that the key can only be recovered through cryptoanalysis.


texts: Euclidean norms do not need full rank lattices

texts: There is a sentence in Micciancio's Lattice lectures that says when we bound the minimum distance of a lattice using the convex body theorem for norms other than the Euclidean norm we need to assume that they are full rank lattices. The reason stated for the full dimensionality condition not been necessary is that in Euclideadean norms one can embed any lattice in $\mathbb{R}^d$ of rank $n$ into $\mathbb{R}^n$ using orthogonal projections. My question is : are such orthogonal projections not possible in other norms?


texts:
Why perfectly secrecy needs the key space to be as large as the message space?

I think the definition (1)

$\Pr[M=m\mathrel|C=c]= Pr[M=m]$
still holds.

Let $M(c)$ be the set of messages that can be decrypted from $c$. We know that  $|M(c)| \leq |K| < |M|$ where $K$ and $M$ are the key and message space, and we can infer that some message, say $m'$ can never be the plaintext of $c$, but how does that violate the definition (1) ?


texts:
I'm using the Windows certreq command line tool to submit a CSR for signing to a Windows Server CA.

certreq.exe -attrib "CertificateTemplate:WebServer" -submit webapp.csr webapp.cer webapp.p7b

It's working as expected I'm getting the Base64-encoded certificate webapp.cer and the certificate with the certificate chain webapp.p7b.
But the Microsoft documentation specifies that an extra parameter can be used named FullResponseFileOut which generates a Base64-encoded certificate file.

What is the purpose of this "Full Response File Out" and is there any way to display/decode it's content with OpenSSL or any tool?


texts: How to generate successive stream-cipher keys?

texts:
I've identified a weakness in a distributed simulation system I'm looking at, and I'm looking for some advice on how to fix it.

Clients initially negotiate an authentication token with a login server using Diffie-Hellman. They then connect to the each simulation node they require (seperate hosts) in turn, using the token as a key for data encryption.

The problem is that for a single client the same key (i.e. the token data) is being used for each node.

I'm thinking of hashing the token n+1 times each time it is used, to produce a new key each time. Unfortunately I don't have the option of re-negotiating an entirely new key for each node a client wants to access.

Does this sound OK, at least for a temporary fix?

Thanks for any advice.

Cheers!


texts: How should we interpret the cryptanalysis results of SIMON and SPECK?

texts:
The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for the same SIMON and SPECK.

But how should we interpret those results? Are they considered good or bad?

For example:

Attack complexity of key-recovery attack for SPECK32/64 is it requires $2^{29}$ plain texts…
Is that good or bad?
Rectangle attacks need $2^{30}$ plain texts…
Is this good or bad?


texts:
This might be in danger of being too elementary a question for this community but I'm hoping for expert help:

Assuming that TLS is not enough to protect messages transmitted between a client and a server, what is a good way to establish secure communication between a client and a server?  In my case this is between a web server and a mobile app, with typical requests and responses between the two.

I have the following idea:  Generate an asymmetric key pair, distribute the public key with the mobile client and keep the private key on the server.  When initiating communication with the server from the client I could generate a symmetric key for the session, encrypt the key using the public key, send the encrypted key to the server which would then decrypt the symmetric key using the private asymmetric key, and then continue to decrypt requests and encrypt responses using the symmetric key.

Is this anywhere close to an acceptable solution, what are the nuances I should be aware of to achieve an acceptable solution? What algorithm choices should be made?


texts:
I've come to understand that twisted curves, as for instance defined in the Brainpool specifications, are $F(p)$-isomorphic to their regular $F(p)$ equivalents. So brainpoolP256r1 is isomorphic to brainpoolP256t1.

In a protocol, does it make sense to specify support for twisted curves? Should it be possible to specify the twisted curve OID instead of the $F(p)$ equivalent? If so, could using the twisted curve representation of the curve have any performance benefits over the regular representation? Or is the twisted curve representation only used for the security analysis of the curve?


texts: Asymmetric Encryption vs Shared secret via ECDH

texts:
I'm reading RFC8291. Here's a figure on how Web Push Notifications work in general:
    +-------+           +--------------+       +-------------+
    |  UA   |           | Push Service |       | Application |
    +-------+           +--------------+       +-------------+
        |                      |                      |
        |        Setup         |                      |
        |<====================>|                      |
        |           Provide Subscription              |
        |-------------------------------------------->|
        |                      |                      |
        :                      :                      :
        |                      |     Push Message     |
        |    Push Message      |<---------------------|
        |<---------------------|                      |
        |                      |                      |

                                 Figure 1

Then, RFC8291 adds cryptography on top of it. If I understood correctly:

In the "Provide Subscription" step, the User Agent (UA) and the Application both agree on a shared secret using ECDH.
Then, when the Application wants to send a push notification to the UA, it encrypts symmetrically (via AES) the notification content using the shared secret.
The Push Service relays this encrypted notification to the UA.
The UA decrypts the notification content using the shared secret.

My question is: why use ECDH when simple asymmetric encryption/decryption can be used?

UA generates a private/public key pair.
In the "Provide Subscription" step, the UA sends its public key to the Application.
The Application, when it wants to send a push notification, encrypts the notification content with UA's public key.
Same as before, the Push Service, relays the encrypted message.
The UA decrypts the encrypted notification content with its private key.

What are the trade-offs between the method I described here, and the one in the RFC?


texts: Use derived keying material as key for stream cipher

texts:
Section 7.3 of SP 800-108:

  To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher.

Footnote:

  The level of security provided by using the key derivation functions specified in this Recommendation to generate a key stream for stream ciphers has not been investigated.

I was wondering why the derived keying material can be cut into valid cryptographic keys but cannot be used for stream cipher. Since it is marked as a shall not, are there any serious concerns if the derived keying material is used for stream cipher (other than it may not be long enough for given plaintext)?


texts:
Based on my skimming over FIPS 180-4 it looks like the only difference between SHA-512 and SHA-512/256 is the initial hash value and the fact that the final output is truncated to 256 bits.

My question is:  if you have a library that does SHA-512 can you transform that to SHA-512/256?

Like maybe there could be some sort of magic string that, when prepended to the original message, makes the first 256 bytes of the SHA-512 hash of the original message the same as SHA-512/256? Or maybe you could xor the first x bytes of the original message with some magic string?

I'm guessing that there isn't such a way but I thought I'd ask all the same.


texts: What are the implications of a non “constant time” implementations on trusted systems in a non-network scenario?

texts:
Assume a scenario where a symmetric encryption algorithm (for example: AES) wasn't implemented in a way it would safeguard against timing attacks. This symmetric encryption implementation is only used locally to encrypt/decrypt data.

The only time that data is passed via a network (if at all), it is done so as pre-encrypted data (read: as locally created ciphertext). Yet, network transport itself is implemented differently, uses SSL, and doesn't have any constant time issue. Practically this means that if, the locally created ciphertext passes the wire in a – let's just call it – double-encrypted form. So, let's not focus on network transport, but rather on the core of the scenario which I'm asking about: the local, non-network part where data is encrypted/decrypted locally using a different, non constant time implementation.

In the above scenario, it seems as if timing attacks aren't much of an attack vector unless we assume trusting local systems might be a problem, which – in this scenario – can be ruled out as the local systems are trusted (think along the lines of a Sensitive Compartmented Information Facility).

To be sure I'm not missing something due to limiting my thoughts too much on network-related timing attacks:

What are the potential implications of a non “constant time” implementations on trusted systems in a non-network scenario, if any?

Differently put:

If we assume the local, non-network encryption/decryption to be handled by trusted systems in a compartmented facility, do we still have to worry about implementing that local encryption algo in constant time? If so, what are the attack vectors we're trying to cover by doing so?