texts:
From Wikipedia:

  Blind signatures can also be used to provide unlinkability, which
  prevents the signer from linking the blinded message it signs to a
  later un-blinded version that it may be called upon to verify. In this
  case, the signer's response is first "un-blinded" prior to
  verification in such a way that the signature remains valid for the
  un-blinded message.

This is a useful feature, no doubt.  Continuing on the Wikipedia article, it considers message $m$ and blinded message $m'$, and states that:

$$m' \equiv mr^{e} \pmod N$$

Which means that the $r^e  \pmod N$ part is what keeps the message a secret from the signing party.

How hard would it be for a signing party to link blind messages to later revealed un-blinded versions, by keeping a log of blinded messages that they sign.  The Wikipedia article states that this is hard but does not specify why.  It does however specify that an attacker could possibly use a blinded signature to get signatures for something different than what was signed, but that this could be mitigated by signing a hash instead.  Wouldn't that break the unlinkability, as explained in this accepted answer?


texts:
Finding the public key given the private key $d$ and the prime numbers $p$ and $q$.

$$p = 3092551601$$

$$q = 3490383433$$

$$d = 10719928016004921607$$

Since this is RSA, here is my thinking.

In order to find the public key $e$ it must satisfy this equation

$$d\cdot e=1 \mod \varphi(n)$$
Since I am looking for $e$,
$$(e \cdot 10719928016004921607) \mod 10794190867245091200=1$$
However, after this step is where I am lost.

I tried using basic mathematics but it gives me the inverse of $d$. Plus, I don't think that using brute force is the right way to learn or understand this question.


texts: Will cryptanalysis always stay a relevant topic?

texts:
I hope this doesn't look like a silly question. In an age where our current cryptography is often impossible to crack when properly implemented and used, would we be able to decipher anything, for example if WWIII were to break out ? Similarly to how the Germans added some rotors to Enigma, what could be done against 500-rounds AES if classic AES were to be broken ? Iirc, quantum computers can trivially break RSA, but I don't know about AES. Also, while talking about quantum things, I think I heard about a paper related to the teleportation of some bits between 2 processors. This would mean that in the future, even intercepting the messages would be impossible.
In ~1900, the physicists thought that, minus one small problem, they were almost done with describing physics. Is it possible than in the future, cryptanalysis would also reach a state of near-completion ?


texts:
Possible Duplicate:
  Is SHA-512 bijective when hashing a single 512-bit block?

Is there any guarantee that there are no collisions for all 512-bit input values for SHA-512 (every 512-bit input has a unique output), or just that they are highly improbable and can't be algorithmically deduced?


texts: AES S-Box: Possible options for constant to calculate S-Box values

texts:
To calculate the values of S-Box in AES, I came across a lot of resources where constant {63} was chosen. It is said that {63} satisfies the condition of S-Box that it should not have any fixed points or opposite fixed points. What are other choices for constants?

eg: will {1},{2},{3},{4} be valid choices for constants? what are other options for constant available?


texts: Why can't the IV be predictable when its said it doesn't need to be a secret?

texts:
I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should hash(salt+pepper) it. Why on earth should i be doing that if they don't need to be a secret?

In this specific case i am encrypting rows with one secret AES key and i am using a fixed IV but xor-ing it with the row id. Its predictable and not secret but by doing this it isn't reused which i thought was the important part.

Are IVs suppose to be secret? Are predictable IVs ok? Should i be hashing predictable IV?


texts: User revocation in Identity Based Encryption

texts:
I read several papers about user revocation in IBE recently. A common point is that when a user is revoked, some other valid users should also update their private keys. Does this mean that one identity is actually associated with many users? If not, why do other valid users still need to update the keys?

I am also thinking whether the PKG can keep a list of revoked IDs. Then before sending out the message, the sender will check the list. If the ID is revoked, the sender can modify the public key as ID+ a random number. Then the receiver can update the private key according to the new public key. What's the problem with this idea? Does it violate the design philosophy of IBE?


texts: What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?

texts:
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key.

How serious is this weakness?

Also, is AES less effected than DES?


texts: How to formally say that the integers modulo $p$ for a prime $p$ gives results that are "more random" than for a composite $n$?

texts:
I'm doing a presentation on cryptography for non-experts. My main algorithm of the presentation is the Diffie Hellman key exchange. It uses modulo arithmetic for a prime $p$. During my presentation, I'd like to be able to explain why the modulo operation uses a prime instead of a composite number. I've seen documents that kind of 'hand wave' the explanation. The best explanation I've seen, albeit hand-wavey is from Quora:

But when data is not random then strange things happen. For example
consider numeric data that is always a multiple of 10.
If we use mod 4 we find:
$10 \bmod 4 = 2$
$20 \bmod 4 = 0$
$30 \bmod 4 = 2$
$40 \bmod 4 = 0$
$50 \bmod 4 = 2$
So from the $3$ possible values of the modulus $(0,1,2,3)$ only $0$ and $2$
will have collisions, that is bad.
If we use a prime number like $7$:
$10 \bmod 7 = 3$
$20 \bmod 7 = 6$
$30 \bmod 7 = 2$
$40 \bmod 7 = 4$
$50 \bmod 7 = 1$

My question is: Can we get more precise than this? Are there any mathematical theorems that can show why this pattern would emerge?


texts: Is the number of creatable torrents limited?

texts:
Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes (packages) to the right people. So therefore, there are $16^{40}$ (1461501637330902918203684832716283019655932542976) possible hashes to uniqueliy identify a torrent. What happens after this number has been reached or two torrents with different content have the same hash? (Although this practically never happens, there is a chance of $\frac{x+1}{16^{40}}$ where $x$ is the number of public torrents aka. assigned hashes, that your hashes collide.)

So to make long things short: What happens if two magnet-link-hashes are equal for different contents? What happens after every magnet-link has been used?


texts: Mixing x into permutation through XOR vs. modular addition

texts:
Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way.

Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but since reversing them is trivial that doesn't matter) into permutation output.

What is the rationale behind using 32-bit modular addition instead of XOR for that final step? MD hashes which have the exact same problem solve it with XOR and not modulus > 2 addition.


texts: Encrypting and Decrypting a 19-digits long BigInteger

texts:
How can I take a maximum 19-digits long BigInteger and encrypt it with the following rules:

The result must be based on digits and lower-case English letters only.
All outputs must have the same length to any input. The length must be between 11 to 16 characters, depending on your method, but should be consistent for all possible inputs.
No easy patterns. For example, if you encrypt 000...1 and 000...2 the results should look completely different.
No collisions at all
Should be able to decrypt back to the original BigInteger.

Things that I have tried

Take the original number, XOR it by some key, multiply it by a factor and convert it to a base 36 string. The purpose of the factor is to expand the range so there won't be too much 0 padding. The factor must be between 1 to 36^16/10^19. The problem with this method is that a) it's not 'secure' enough, and b) close numbers have very similar results.
This answer. However, the result was often too short or too long, and the factor method used before didn't work here.


texts: Using Whirlpool hashing function to encrypt data

texts:
I've read that the Whirlpool hash function can produce footprints that could be used as a pseudorandom generator.

Is it "OK" to use it to encrypt some data using something like the following?

EncryptedData = Concat(DataBlock XOR Whirlpool(DataBlock + SecretKey))


texts: Is using a smart card and password two-factor authentication?

texts:
I use a smart card - as read only device - for user identity as well as a password:

The smart card (holds the user ID) is something I have;
The password is something I know.

Is this still two-factor authentication?


texts: How secure is AES-256, but with an effective key length of 56-bits?

texts:
I need to encrypt a few drives using Kaspersky Total Security.  I however noted something peculiar, Kaspersky's description of their cipher is:

  Data will be protected using AES-256 encryption with a 56-bit effective key length?

Does this mean that they are using the same key generator that AES-256 uses but their key in reality isn't 256-bits long, instead 56-bits?


texts: Does rsa-oaep provide or not plaintext integrity in addition to confidentiality?

texts:
My own understanding (possibly wrong of course) of RSA-OAEP encryption scheme is that it  provides plaintext integrity (in addition to confidentiality) due to MGF function which for encryption operation, applies to maskeDB sequence which value directly depends of input M (plaintext) message, and is further checked during decryption operation.     However in previous post on that subject, the answer indicated that no public key encryption scheme can satisfy INT-PTXT (nor INT-CTXT) requirements

So is it possible to have confirmation if rsa-oaep insures integrity of input symmetric session key to be encrypted or if it is recommended with rsa-oaep to encrypt a symmetric session key appended with a hash or eventually crc value for insuring integrity ?


texts:
I've worked on low-level security (side-channel attacks etc.) for years and have a PhD in crypto. Web security is something I've never needed to touch beyond knowing how the TLS handshake works with various cipher suites.
I'm starting a role where I'm expecting to also do work on mobile app security. It seems like e.g. the OAuth standards are split over a large bunch of RFCs and most online tutorials are written for dummies and are doing a great job avoiding telling what sorts of cryptographic primitives are used and where. In other words leave out material that allows doing your own reasoning about security.
My question is whether there are any good papers (e g. from CCS¹ or S&P³) or sources that go in depth through the actual cryptography, the assumed models for the attacker and the design choices made in the protocols? In other words what to read to get up to speed quickly?

¹ CCS = ACM³ Conference on Computer and Communications Security.
² S&P = IEEE⁴ Symposium on Security and Privacy.
³ ACM = Association for Computing Machinery.
⁴ IEEE = Institute of Electrical and Electronics Engineers.


texts: Secret sharing scheme with ability to add or update share number

texts:
I would like to have a secret sharing scheme with the following properties:

Generate secret $S$ a split it to $N$ shares $(s_1, s_2, ..., s_N)$
Require $k$ of $N$ shares in order to reconstruct secret $S$
Update $N$ to $N+1$ and generate new share $s_{N+1}$ (everything remains
the same, $N$ shares not changed)

The scenario is that I use Shamir secret scheme to split secret $S$ into for example 4 parts and require 2 of them to be present in order to reconstruct $S$. In that case if I would like to reconstruct S then I have to also input scheme type, i.e. 2 of 4.

What if I need to update number of parts but need to preserve existing shares and be able to reconstruct the same secret $S$? Is there a way how to do it?


texts:
p is a prime greater than 2 and $a \in \mathbb{Z}_p$. Why are there exactly three solutions for a³ = a mod p?
Obviously 0 and 1 are both in $\mathbb{Z}$ and valid solutions, but that still means, there is one element (and only one) missing. I can't figure out which one and neither do I understand why there could not be more valid solutions. Any tips?


texts: Type of cipher used where ciphertext has no discernible pattern, spaces. Type?

texts:
What type of cipher could give ciphertext where for example random ASCII chars between say F-z (symbols and numerals inclusive), but with only a few spaces? Frequency of chars shows some similarities to alphabetic frequency and is 200 chars in length.

I've been reading up on ciphers and have not come across any common ones that would work.

Can someone enlighten me how a seemingly random group of ASCII chars in the given range could be encoded?

Yes, I understand this is broad, so I'm asking what cipher or combination of ciphers could present these observations? I'm happy to research from a jumping off point if someone can point out any thoughts that come to mind


texts:
I am trying to decrypt a message, which was encrypted using a stream cipher and 8 bit LFSR.

First two letters of plain text are given: K and A.

To find $X_n$ I used following formula:

$$X_n = M_n \oplus Y_n$$

I found $X_1 = 81$ and $X_2 = 65$.

Assuming the next step would be to find $C_1,C_2,\dots,C_n$ then how can I find them?


texts: Speed up modular exponentation with fixed base and modulus

texts:
Can someone explain, how $a^x \mod N$ can be speeded up, when $a$ and $N$ are known constants? How big is the gain and what resources are needed?

https://www.imperialviolet.org/2013/05/10/fastercurve25519.html

Just to mention: it can speed up SRP hashes bruteforce, which is calculated as  $v = g^x \mod N$ where $x = hash(username, salt, password)$


texts:
Is it possible to compose or combine $n$ ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate $n$ ciphertexts from the same key, $k$, and that recovering the key, $k$, from the $n$ ciphertexts is equivalent to breaking all $n$ ciphers.

Note that the size of the key, $k$, is the same as the size of the $n$ ciphertexts.

$$ ||k|| = ||cipher_i(k, k)||$$
$$ n \times |k| = ||cipher_0(k, k)||+||cipher_1(k, k)||+...+||cipher_n(k, k)||$$

I'm not asking about finding the pre-image of the $n$ ciphertexts, but rather the original key that was used.

This is related to this answer ( Changing algorithms during encryption ).


texts: What are the memory requirements for this type of search if the hash function has an output length n bits?

texts:
Let us suppose that we perform a collision search to find a pair $x_1$, $x_2$ with $x_1 \neq x_2$ such that $h(x_1)=h(x_2)$ for a given hash function, and we would like to specify the memory requirements for this type of search.

What does memory requirements means in this question ?


texts: Explaining Low-Degree Extension in layman terms

texts:
I am trying to learn the sumcheck protocol used in different interactive zero knowledge proof systems, however I can't move forward due to my little understanding of Low-Degree Extension (see Chapter 5).

What is it?
What is the problem it solves?
How does it work?


texts: Can one trade off the number of iterations for key length with the PBKDF2?

texts:
When using the PBKDF2, is one taking on significant risk if one chooses to lower the number of iterations and choose to have very long keys?

Can I XOR my message with a a very long key (plain-text sized) generated using PBKDF2? Will this make XOR encryption as strong as a one-time pad?


texts: How does the 'Flatten' function reduce the coefficients of a vector/matrix?

texts:
Seen here, at the bottom of page 5, $\operatorname{Flatten}(\vec{a})$ is defined as:

$\operatorname{Flatten}(\vec{a})=\operatorname{BitDecomp}(\operatorname{BitDecomp}^{-1}(\vec{a}))$

For an n-dimensional vector $\vec{a} = (a_{1,0},\ldots,a_{1,l}, \ldots, a_{k,0},\ldots,a_{k,l-1})$. Where $a_{i,j}$ is the $j$-th bit in $a_i$'s bit representation.

But if we're computing the function through its own inverse, would this not just result in the original vector a?


texts: Asymmetric code signing also tied to a device

texts:
I have an asymmetric key pair.  The public key is stored in many targets.  Is there a way to take that private key K, derive a new private key K' with a known value x, sign the code, and then each target can take the same value x and derive a public key that pairs with K' and verify the code?

I want to authenticate code for only a specific device, but only have the ability to store a common public key in many targets.  So the known value x would be some kind of hardware serial number.


texts:
I trying to understand how can an IPEK created from a given KSN and BDK (Triple DES Edition). From this article-Creating an IPEK from a given KSN and BDK (Triple DES Edition):

  Derivation of Initial Key (IPEK) from Base Derivation Key (BDK) The initial PIN Entry Device key (the key initially loaded into the PIN Entry
  Device) is generated by the following process:

  Copy the entire key serial number, including the 21-bit encryption counter, right-justified into a 10-byte register. If the key serial
  number is less than 10 bytes, pad to the left with hex “FF” bytes.
  Set the 21 least-significant bits of this 10-byte register to zero.
  Take the eight most-significant bytes of this 10-byte register, and encrypt/decrypt/encrypt these eight bytes using the double-length
  derivation key.
  Use the ciphertext produced by Step 3 as the left half of the Initial Key.
  Take the 8 most-significant bytes from the 10-byte register of Step 2 and encrypt/decrypt/encrypt these 8 bytes using as the key the
  double-length derivation key XORed with hexadecimal C0C0 C0C0 0000
  0000 C0C0 C0C0 0000 0000.
  Use the ciphertext produced by Step 5 as the right half of the Initial Key.

What is double-length derivation key ? I can't find any useful information regarding this from internet.


texts: Is Strong MAC stronger than existential unforgeability?

texts: Especially in the context of Encrypt-then-Authenticate.


texts: Is ed25519 quantum resistant? I am using ed25519 as a cryptographic primitive for decentralized identity platform, thus this very crucial question.


texts: How to prevent Public Key from being replaced entirely?

texts:
I am using RSA to sign my license file using Microsoft CNG API. I am signing the license file and sending the file with the public key to the end user.

Now I have a problem, what if someone's signs the license file content with entirely new set of private\public key pair. Then they can easily replace my public key with their own key and the license file with the one signed by new corresponding private key. Is their some guideline I am missing? Also Can it be prevented If I store the Public key in a certificate store?


texts:
Public/private key algorithms such as RSA encrypt a message with a private key but only decrypted with another (mathematically related) key.

Can the public key decrypt the messages encrypted with the private key and the private key decrypt messages encrypted with the public key?
If the algorithm is based on multiplying two big numbers this seems possible. However, I'm not sure.


texts: Why does the one-time pad not imply $P \not= NP$?

texts: I apologize that this is a rather trivial question, but I haven't been able to find an answer anywhere.  If the one-time pad is unconditionally secure and impossible to crack (with just ciphertext), why does this not imply $P \not= NP$?  If not the one-time pad, what properties would a cryptographic system need to exhibit in order to imply $P \not= NP$?


texts: Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

texts: As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. Could anyone offer a bird-view about their respective pros and cons if applied in the Blockchain industry?


texts: Can "collisions" occur with encryption algorithms?

texts:
For a given Key $K$ and two messages $m_1, m_2$ is it possible for an encryption algorithm (say AES-256) to produce this: $AES(K, m_1)$ = $AES(K, m_2)$?

I understand that the output has to be unique (aka every input has to be mapped to a different output) so that it can be decrypted, but it just seems so bizarre to me that it is possible for an algorithm to consistently map every single bit of input to a different output such that $AES(K, m_i) \ne AES(K, m_j)$ where $m_i$ and $m_j$ are numbers  $<2^{256}$.

Do I just have to dive deep into the maths?


texts: I am looking for different ciphers that use a key word (like "hello" or "awesome") to encrypt a given text. I know about the Keyword Cipher already; I'm looking for others.


texts: How often do I need to rotate AES 256 keys

texts:
I'm trying to design a protocol for a resource constrained environment. The device has to communicate with a server through an insecure node. My plan is to use AES 256 end to end for all communications. From what I understand, keys carry a risk factor that increases with use and time.

From reading this post: How much data can I encrypt with AES before I need to change the key in CBC mode? there is an equation for determining the maximum amount of data it is safe to send given an acceptable risk factor.

My question is two fold:

Is it necessary to factor time into this equation for devices that communicate infrequently with the same key?
How does one determine an acceptable risk factor?


texts: AES-128. Do there exist two different keys for a pair (text, encrypted text)?

texts:
I have two very close questions.

Question 1

y = AES-128(x, key).
Is it possible that AES-128 will return the same y (encrypted text) for different keys?

I know that each key selects one permutation from the set of (2^128)! possible permutations. We have (2^128) possible keys and it is less than number of possible permutations. But it doesn't mean that there are no two different keys for some pair of text and encrypted text.

Question 2

If we have fixed x,y (both of them have the size of 128 bit) does there exist a key( key size is 128 bit) so that
y = AES-128(x, key) ?

Example.
We have 2 bit message and 2 bit key. There are 4 possible messages: msg1 = {0,0}, msg2={0,1}, msg3 = {1,0}, msg4 = {1,1} and there are 4 possible keys. We have 4! = 24 possible permutations of messages.
I can select the next permutations

| From\key | key1 | key2 | key3
--------------------------------
| msg1     | msg2 | msg3 | msg4
--------------------------------
| msg2     | msg1 | msg4 | msg3
--------------------------------
| msg3     | msg4 | msg1 | msg2
--------------------------------
| msg4     | msg3 | msg2 | msg1
--------------------------------

Here I have a mapping from a message to every message. e.g. I can get msg4 from msg1 using key3. Has the AES-128 the same property for the mentioned x,y?


texts: Distributed Random Oracle with Verifiable Shares

texts:
$Setup$:

Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol.
Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, giving $y$ as the secret that can only be known from at least $f + 1$ shares.
Define $y \times G = Y$ as the public key (EC point) for the scalar $y$ and base point $G$. This can also be derived from $\mathcal{L}^i(Y_i) = Y$. Confirmed here.
Define $H_c(r) = R$ as the hash-to-curve function on $r$ that gives R. $r$ is a public deterministic value that is known by all nodes. For instance, the round number in a blockchain consensus protocol.

The goal is to find a random value $V$ for the round $r$ that cannot be known or predicted in advance.
The oracle value for a round $r$ is given by $y \times R = V$. Such value cannot be derived in this way because $(y, \alpha)$ are not known. Where $\alpha \times G = R$, but $R$ is derived from $H_c(r) = R$.
$Derive(V)$:

Each node calculates $y_i \times R = V_i$ and broadcasts $V_i$.
The value can be derived from $\mathcal{L}^i(V_i) = V$

$SignInterlaced(V_i)$:

Each node can sign $V_i$ with a Schnorr's Signature (SS) (a double interlaced signature).
From SS definition we start by deriving a local random nonce $m \in \mathcal{Z}_p$.
Define $m_i \times G = M_i$ and $m_i \times R = M_{r,i}$
Define $c_i = H(Y_i||V_i||M_i||M_{r,i}||r)$
Sign with $p_i = m_i - c_i * y_i$ where $\sigma_i = (p_i, c_i)$
Broadcast $\sigma_i$ and $V_i$

$CheckShare(V_i)$

On each node we can verify that $V_i$ is derived from $y_i \times R$ if we:
Get $p_i \times G + c_i \times Y_i = M_i$
Get $p_i \times R + c_i \times V_i = M_{r,i}$
Check that $c_i = H(Y_i||V_i||M_i||M_{r,i}||r)$

Informal Validation
Note that, if we try to fake $y^{'}_i \times R = V^{'}_i$ it will fail because $p_i$ is always derived from the same $y^{'}_i$.

It will result in an incorrect $M_i$ if $p_i$ is derived from $y^{'}_i$ (on $SignInterlaced$) and then calculated with $Y_i$ (on $CheckShare$).
It will result in an incorrect $M_{r,i}$ if $p_i$ is derived from $y_i$ (on $SignInterlaced$) and then calculated with $V^{'}_i$ (on $CheckShare$).

We cannot detach both verifications because they use the same $\sigma_i = (p_i, c_i)$, and $(G, R, Y_i)$ are known and forced EC points. Incorrect $(M_i, M_{r,i})$ will fail due to Fiat–Shamir heuristics.
If this really works, then we are "checking" a second degree constraint without Pairing-Based Cryptography! In PBC, normally this would be checked via $ê(V_i, G) = ê(y_i \times R, G) = ê(R, y_i \times G) = ê(R, Y_i)$
However, this is a naive security proof. So I'm posting this here for better scrutiny, if you can help me?
Edit: I saw that this is much similar to what is done here. I think this kind of proves that it works.
From here I can use it for different use-cases:

Generate a pseudonym from a piece of public information.
Build a distributed key escrow.


texts:
I am reading about S-boxes.

By looking for the reason why the S-boxes are not linear, I found the following:

The mappings $B \mapsto S(B)$ are all non-linear, since it holds

$S(000000) \neq 0000$

We notice that at each of the 8 S-boxes $S_1, S_2, \dots, S_8$ , the number at the upper left-hand corner is not equal to zero and so $S$ cannot be linear.

Could you explain to me why at the S-boxes the number at the upper left-hand corner is not equal to zero ?


texts: Can error correcting codes be used to guess this plaintext?

texts:
I pick a finite set of messages, perhaps the set of integers $M = \lbrace n \in \mathbf{Z} \, : \, 0 \leq n\lt10 \rbrace$, which you are then allowed to encode in any way you want (some form of error correcting code is assumed), transforming $M$ into a set of equal size, $P$, which you send back to me. Then, without your knowledge, I select a single $p \in P$ from your encodings, to which I apply an encryption operation under a key that transforms your $p$ into $p'$. To what extent are you able to determine the original message that I selected given

a) You have full knowledge of the algorithm used and the key is known.
b) Same as (a), except that one of two possible keys have been used.
c) Same as (a), except that you have no knowledge of the key.

No particular symmetric cipher is specified. I am interested in the general information theoretic properties that make this decoding possible or impossible.


texts: What is the difference between DROWN and ROBOT vulnerability?

texts: It seems like the main idea is the same for both the vulnerabilities then what is the difference?


texts:
What does "hard-coded" mean in the context of garbled-circuit?
Is it not encryption?


texts: Is there a simple hash function that one can compute without a computer?

texts:
I am looking for a hash function that is computable by hand (in reasonable time). The function should be at least a little bit secure: There should be no trivial way to find a collision (by hand). For instance, a simple cross-sum is not meeting this criteria since one can easily construct a number with the same hash than another.

Is there a (simple) function? I am interested in this for a presentation about commitment schemes in my CS class at school.


texts: Understanding one-way hash functions construction

texts:
I understand the needs that lead to the development of cryptography and I am quite familiar with the uses we make of the cryptographic tools.

But, as a programmer, I am conditioned to see them as "black boxes" with specific properties. To me, SHA-X (with X being 1, 2 or 3) is some dark magic, even though I understand why I need it and use it.

That said, I am eager to find some literature to light this up.
From what I have read so far, I have seen that the common mathematical demonstrations consist of games and the evaluation of the winning advantage of an enlightened attacker over a player that would just randomly take decisions. This is exactly the kind of things I am looking for : what mathematical background lead to this construction for this hash function. Learning through an example can be worthy, but the more global this maths background is, the better.

To say it in other words, how does a cryptographer prove the essential properties of his design ? In the case of cryptographic hash functions, these properties are one-wayness, collision resistance and preimage resistances.

What are the logical steps, starting from the required properties, that lead to the specification of a hash function ? How are these properties translated into mathematical definitions ?

Note : I think I needed to ask that last question because for a cryptographic hash function, I feel there is the need to define some thresholds somewhere.


texts: Can iterated key expansion in Blowfish slow down bruteforce attacks on small key sizes?

texts:
Suppose I have to use 64-bit keys for encryption (e.g. to comply with export restrictions). For this question, assume this key is truly random, and the encryption algorithm is Blowfish.

Blowfish key schedule expands this 8-byte key into 4168 bytes of state (P-array and S-boxes). Will it slow down bruteforce attacks if I run this expansion a huge number of rounds?

REPEAT rounds
   state := ExpandKey(state, key)
END

(Basically, the scheme is similar to bcrypt if you throw away salt and instead of encrypting a constant to derive a key, use the final state for actual encryption.)

Are there any other practical attacks on such schemes faster than brute force?


texts: The real-life meaning of proving over a group that doesn't support the oracle?

texts: If I proved a scheme's security under GDH assumption, in real-life, if this DDH oracle does exist, then it's good, but what about  other side ? In real-life, if this DDH oracle doesn't exist, then what's the meaning of proving?


texts: What does this part of the SHA-3 algorithm mean?

texts:
I was reading through this paper and came across (pg. 11 of PDF, 5 of paper) the right_encode(x) and left_encode(x) pseudo-code sections. These contained this:

  Let $x_1,x_2,\ldots, x_n$ be the base-256 encoding of $x$ satisfying:
  $x = \Sigma \;2^{8(n-i)} x_i$, for $i = 1 $ to $n$.

What does this mean the algorithm does?


texts: What does the linear assumption over bilinear groups mean?

texts:
In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say:

  In both schemes we rely on the linear assumption over bilinear groups.

What is the linear assumption ? How do you break this linear assumption ?

I would appreciate if somebody could give me concrete examples. More specifics about the paper where they talk about linear assumption:


texts: PSI protocol reveals only one element of the intersection of two sets

texts:
So let Alice has a set of integers, says, $A = \{a_1,\dots, a_n\}$, similarly, Bob has a set of integers $B=\{b_1,\dots, b_n\}$.

is there any protocol that allows Alice and Bob to randomly learn exactly one element from the intersection, $A\cap B$? I am aware of few private set intersection algorithms, but all of them reveal the whole intersection.


texts: Do I need an IV to use AES-CTR as a CSPRNG?

texts:
I'm using AES128-CTR for generating pseudo-random values, which is considered secure for up to 1MB (at least from what I've read).

I simply encrypt a 128-bit little-endian counter, starting from 0.

Should I use an IV? Should I start counting from a non-zero random value? Does it make any practical difference?


texts: Simulation Based Proof: What Can / Can not Simulator Do?

texts:
I have seen some examples in "Foundation of cryptography" and "Efficient two party computation", in which simulator can do some things that in the real world model the parties cannot do, for instance:

In "Foundation of..." page 660, Coin Tossing protocol, the simulator first receives the result from trusted third party (TTP) without sending the parties input to it. My question is why can it do so, where in the real protocol the parties exchange their input first.
In "Efficient two..." page 140, full simulation oblivious transfer, the simulator:

(a) Can receive the adversary input to underlying zero knowledge and extract its secret value. This is not possible for an honest party in the real world model.

(b) The simulator (despite using some incorrect input to zero knowledge) makes the adversary believe that the zero knowledge proof is verified, where it would not occur in the real world model.

Main question: What can and cannot the simulator do when simulating the real world?


texts: How to find key given Vigenere Ciphertext?

texts:
I can't seem to find a tutorial online that helps me with this tasking. I have some Vigenere ciphertext (LVGPA...). It only says to assume that encrypting the key letter A results in no change, B results in an increment of one, C increments 2, and so forth.

How would I start to find the key?


texts: 2048 bit hashing and 1024 bit symmetric encryption

texts:
The most strongest public encryption key today, is $256$ bit symmetric (e.g. AES-256) and $512$ bit hash (e.g. SHA-512).

So, if there are 2048-bit hashing and 1024-bit symmetric encryption, it is theoretically unbreakable by the universe by current science.

Today, the theoretically smallest length is planck length (~$10^{-35}$ meter), and the theoretically smallest time is planck time (~$10^{-44}$ seconds). The observable universe is $93$ billion light years ($10^{27}$ meter), and the age of universe is $13.8$ billion years ($10^{18}$ seconds).

Just a simple calculation, we can found that the universe is actually around $10^{186}$ cubic planck length (or planck volume).  ($(10^{27}/10^{-35}) ^3$), and the age of universe is $10^{62}$ planck time ($10^{18}/10^{-44}$).

If the smallest particle (planck length) in universe trying to crack the 1024-bit password, and it can crack 1 time in the smallest time unit (planck time). Using all universe particle to crack the password in fastest way, it still not possible to crack a 1024-bit password ($10^{186}$ planck length $10^{62}$ times = $10^{248}$, which is much smaller than $2^{1024}$ bit = $10^{308}$ combination).

Due to birthday problem, 2048-bit hash strength is approximately equivalent to 1024 bit encryption.

So, is that we can conclude that, 2048-bit hash and 1024-bit symmetric encryption is never obsolete. No matter the strongest quantum computer is, it still impossible to crack. But Why there are no 2048-bit hash and 1024-bit encryption available in the public market ?


texts:
Let's say I have a web "widget" that a customer could include on their website. They would include the widget by adding an iframe that points to a URL on my site. I want to ensure that my widget can only be used by paying customers so I was thinking of using an HMAC (HMAC-SHA256 specifically) to verify the customer like so:

The URL would contain a customer ID (randomly generated 6 character hexadecimal number), a timestamp (the current time in seconds since UNIX Epoch), and the HMAC "signature". Since the widget is displayed in an iframe, all of these parameters would be sent clear-text (as a GET request).
The "signature" would be computed based on the URL (since there are multiple widgets), the customer ID, and the timestamp, with a (randomly generated) secret key that would be given to the customer.
On the server, the timestamp is checked to ensure that it falls within a specific window (15 minutes, for example) to prevent replays, and then the signature is checked by recomputing the HMAC and comparing.

I patterned my design off Amazon's web services, but Amazon's scheme requires that some of this data is passed via HTTP headers which would be encrypted over SSL. I don't have that luxury, since everything needs to be passed via GET parameters.

Does this sound reasonably secure? A coworker mentioned that it may not be very secure because all of the inputs to the HMAC algorithm are available in clear-text. An attacker would still need to figure out the way in which the URL, customer ID, and timestamp are combined to create an input to the HMAC algorithm, but, if they did, then they'd have both the input and output. My coworker worried that this information could be used to obtain the secret key via brute force or rainbow tables. Everything I've found via searching seems to indicate that our sun would explode before brute force would finish, and rainbow tables don't work on HMAC's, but the wide world of cryptography is very foreign to me. Plus, most of the answers I've found are 2+ years old and much can change... maybe some new vulnerability was found in the last 2 years or something...

So, is this reasonably secure? And, if not, what can I do to improve security?


texts: Difference between DER encoded signatures in JavaScript, Java, and C++

texts:
I'm trying to understand the DER-encoded signatures for the secp256k1 (ECDSA) curve better, so I have the following data array: 000102030405060708090a, which is a hex-encoded version of an array containing the numbers 0 to 10.

Also, I have the signed it with the following private key: fabb33890c65b059996546344a7e8c5adc09167fe9e09ddd6cbcac5a84790f7f, and corresponding public key:
{x: '1b6ae9e65a66ee3de4d04d479a806fc0f3266a0aa12e0c03f8c0f31e1bbf98fd', y: 'abc78ffe0a5381472098738d0d14b0c0f1bdda149ccf5866a4b523b8bcc9fba6'}

In Java, I get the following DER signature: 3045022065A67F8FF9CB5EA8BE899E94CB338FE09E2E596BC047D936FC2B96DC013B5DFC022100BE123D3F143AF91E4551AAFAE49C9187F64E323F5660D6C6198A9446C3F818A1, with the following code:

BigInteger priv = new BigInteger("fabb33890c65b059996546344a7e8c5adc09167fe9e09ddd6cbcac5a84790f7f", 16);
PrivateKey privateKey = getPrivateKeyFromECBigIntAndCurve(priv, "secp256k1");
byte[] data = DatatypeConverter.parseHexBinary("000102030405060708090a");

Signature signature = Signature.getInstance("SHA256withECDSA");
signature.initSign(privateKey);
signature.update(data);
byte[] signed = signature.sign();
DatatypeConverter.printHexBinary(signed);

However, in JavaScript using the Elliptic or any other library, I get the following signature: 304502210099d0c79559ab4e5484a116e858ce7f59b91050cf4931a925438d876fad500ed2022067fd6e1012ed7ebcd772546bd5bf130f8af1b8282c5395f4a7164bc55255975c, using the following code:

const ec = new EC('secp256k1');
const key = ec.keyFromPrivate(privateKeyHex, 'hex');
const signature = key.sign(msg, { canonical: true });
signature.toDER('hex');

In C++, using the library botan and with the code beneath I get the following signature: 304402201EE0F965F837E7C0874C99B6C2B8C7475C7DD748AC9521B40A3BEDDB58A7722A02205125EFB0E36F6ABB59A97AFAB5D2795BCBA3D1A181D97D20587B6DC2CED5299A.

Botan::AutoSeeded_RNG rng;
Botan::PK_Signer signer(*privateKey, rng, "EMSA1(SHA-256)", Botan::DER_SEQUENCE);
signer.sign_message(data, rng);

Is there a reason for these differences, because signing it in one language and verifying it in another language will give an error. Also, if possible, how would I get the result of Java using JavaScript? My guess is that it has something to do with the encoding.

Thanks in advance!


texts: Does knowing modular eth roots help in factoring n?

texts:
Consider $x^e \equiv a\pmod n$, given $n$, $a$, and $e>2$, with $n$ being a composite integer and unknown $x$.
Can a hypothetical function $f(a)=x$, an $eth$ root extractor, be used / adapted to factor $n$, in the same way that the multiplicative order of $x \space modulo\space n$ can be used to factor $n$ like in the classical part of Shor's algorithm?


texts: OpenSSL - creating random elliptic curve and measuring performance

texts:
I want to generate random elliptic curves (over $\mathbb F_p$ and $\mathbb F_{2^m}$) using OpenSSL, that's my task.

At first curves over $\mathbb F_p$. Now I am able to generate prime $p$, $a$ and $b$. Then I need to get random point and measure time of adding and multiplying points.

To get random point:

I need to know order of the group. So I should count it with Schoof–Elkies–Atkin algorithm, right?
I need to have generator (base point), right? So I have to find it. It can't be random point, but it should be point which generates as much as possible points on the curve, right? (depends on cofactor, if is it = 1, then generator generates all the points, if it is 2, then it generates 1/2 of points, etc).

I found I can find generator with this algorithm:

$|E(\mathbb F_p)| = k \cdot r$ with a prime $r$.
Choose a random element $x_0 \in \mathbb F_p, 0 < x_0 < p$.
If $x_0^3 + a x_0 + b$ is square in $\mathbb F_p$, we denote by $y_0$ a square root of $x_0^3 + a x_0 + b$ in $\mathbb F_p$. Otherwise we choose new random values $x_0$ until we succeed.
We may assume $1 \leq y_0 \leq p − 1$. $y_0$ may be computed using Shank’s RESSOL algorithm.
$(x_0, y_0)$ is a point in $E(\mathbb F_p) \setminus \{\mathcal O\}$.
If $k \cdot (x_0, y_0) \ne \mathcal O$, then $G := k \cdot (x_0, y_0)$ is a point of order $r$, $r \cdot G = \mathcal O$.

This algorithm is from this paper (PDF), page 11.

Is all what I wrote correct, or is there any other easier way how to get generator (base point) and order of the group? (Maybe there are some functions in OpenSSL but I didn't find it.)

EDIT: Exists some code in C of SEA algorithm? I need to generate elliptic curves (so I have to find the order of the group because I want to find base point) on devices with constraint resources (rasp pi etc). It have to be multiplatform. I thought I could copy some code to my appliacation.


texts:
I have a rough idea of what is symmetric and asymmetric encryption, but I can't apply the idea to the SET protocol (Secure Electronic Transaction
Specification), so how the symmetric and asymmetric encryption are used in the SET protocol? Also I want to know more about the Preq messages.


texts: For ElGamal-based key encapsulation, is it necessary to hash before using as AES key?

texts:
I'm working with SJCL, specifically using ElGamal to encrypt messages. Behind the scenes, this is doing something similar to what's described in this SO post (emphasis mine):

  Regardless how big prime p is, you can always generate a random m
  number in the range of 1 to p-1 and use that to produce your
  asymmetric ciphertext. Afterwards, you can take the previously
  generated m, encode it into a byte array (use toString(16) to produce
  a Hex-encoded string and then simply parse it as Hex for the hashing)
  and hash it with a cryptographic hash function such as SHA-256 to get
  your AES key. Then you can use the AES key to encrypt the message with
  a symmetric scheme like AES-GCM. This is called key encapsulation.

Here is the actual function:

kem: function(paranoia) {
    var sec = sjcl.bn.random(this._curve.r, paranoia),
        tag = this._curve.G.mult(sec).toBits(),
        key = sjcl.hash.sha256.hash(this._point.mult(sec).toBits());
    return { key: key, tag: tag };
  }

My question is: regarding key = sjcl.hash.sha256.hash(this._point.mult(sec).toBits()), is it necessary to compute SHA256 hash and use that as AES secret? Or can we get by with something like this: key = this._point.mult(sec).toBits() (no hash)? Would this be less secure?

I ask as I am trying to take advantage of multiplicative homomorphism of ElGamal. So, multiply encrypted secret by a scalar, decrypt new ciphertext, and multiply decryption result by scalar inverse to get original secret. I am able to do this when I remove the SHA256 hashing code above, however with hashing code still enabled I am getting a not on the curve error when trying to multiply decryption result by scalar inverse (because we are using hash for key which I believe pushes it off the curve).

So, wondering if removing hash logic degrades security of the method / is not advised or if hashing is performed for different reasons (and wondering what those reasons are if so).


texts: Advantages/disadvantages of different message numbering schemes

texts:
For a stream of packets, where each packet is individually encrypted with a block cipher, it's desirable to have each encrypted packet only valid for that position in the stream.

A message number would work, but there are many different ways of implementing it.

Given a construct using HMAC for integrity check (i.e. we send (HMAC || cipher-text) or (HMAC || IV || cipher-text), where HMAC is over cipher-text or (IV || cipher-text) respectively).

I can think of the following:

Encrypt (message || message-number), after decrypt check the message number.
HMAC instead (encrypted-message || IV || message-number), message number check is built into the HMAC.
Don't reseed the IV, so assuming CBC the IV of the current packet is the cipher-text of the last block of the previous packet.
Use a random initial IV, then for each packet, the actual IV used is HASH(IV || message number)
Use a random initial IV, then for each packet, the actual IV used is ENCRYPT(IV + message number)

What's the standard way of adding a message number, and are there any known security risks with the other methods I mention above?


texts: Why bcrypt is one-way while Blowfish is reversible?

texts:
While bcrypt is often regarded as an irreversible hashing function, it's based on the reversible Blowfish cipher. I'm just curious about how does this work. Here's the pseudocode from the wiki:

bcrypt(cost, salt, input)
  state ← EksBlowfishSetup(cost, salt, input)
  ctext ← "OrpheanBeholderScryDoubt" //three 64-bit blocks
  repeat (64)
    ctext ← EncryptECB(state, ctext) //encrypt using standard Blowfish in ECB mode
  return Concatenate(cost, salt, ctext)

I know that first bcrypt will go through EksBlowfishSetup key shcedule function which outputs a the state as a encryption key. Then it encrypts the text "OrpheanBeholderScryDoubt" with the key.

According to an answer in https://security.stackexchange.com/questions/66050/should-bcrypt-be-used-for-client-side-password-hashing/66056#66069, bcrypt is irreversible because BCrypt can be seen as encrypting with throwing away of the key. Although a known-plaintext attack is almost impossible with Blowfish, but is this what makes bcypt irreversible? Because I think a known-plaintext attack is still "computationally feasible".

What I want to know is that, if we get the encryption key (produced by EksBlowfishSetup(cost, salt, input)) with known-plaintext attack or in some other ways and we have the cost and salt which is passed to EksBlowfishSetup, is it possible to get the real password?

According to an answer here, EksBlowfishSetup is what makes brcypt one-way as you need to know all 3 arguments passed to it in order to retrieve the plaintext password. So can I say that it is EksBlowfishSetup that actually makes bcrypt irreversible?

Something might help you: Technology and Practice of Passwords


texts: What was the first hash and what problem was it supposed to solve?

texts:
Today's hashes have many uses. File integrity, verification of a secret without revealing the secret (i.e. passwords), hash maps, bloom filters, and probably a few more cases not immediately coming to mind. The Caeser Cipher and Vigenere Cipher were both originally done with pencil and paper long before computers as we know them today existed.

I'm curious, what was the first hash we know about and what problem it was trying to solve?


texts: Number of words to be outputted from PBKDF2 based on HMAC-SHA512?

texts:
I'm using PBKDF2 to generate a 512 bit key. My question is language agnostic, but for the sake of demonstration, I'm using CryptoJS, which defaults to using SHA1, but can be overridden like so:

var hasher = CryptoJS.algo.SHA512;
var output = CryptoJS.PBKDF2(input, salt, { keySize: 512/32, hasher: hasher });

The output string I get for input = "hello" and salt = "world" is

  d75f41243491533cc1ecc178d4bae14e7c3384dd2d94067c333594ebf3aa4cce4cd6670e4a3233af4237425617b3b21ec7d586a9478c0749cc40a778500821c8

However, upon inspection of the output object, it tells me that the output has:

64 sigbytes
16 words

If I run the function without specifying a hasher, which means I would be demanding a 512 bit output from SHA1, like so:

var output = CryptoJS.PBKDF2(input, salt, { keySize: 512/32 });

Then I get 64 sigbytes and 20 words, and a result of:

  798ef2617367d80daeacf8b457af7903eebf6d1f384c9fed762b14186036e912b37026c14ae315da0a9782aa773bdafcd9cd259e95381ac9ab26d026fe6a3375

My question is, what is the right number of words for a 512 bit function? Why does the second one result in more words?


texts: Are two halves of PBKDF output "related"

texts:
In other words, in the context of authenticated encryption using Encrypt-Then-MAC, is this stupid?:

derived_key = PBKDF(key, salt, dkLen=32)
hmac_key, enc_key = derived_key[:16], derived_key[16:]

It is advised that separate keys be used for MAC and encryption. Is this sufficient? If not, how dangerous is it?


texts: Potential vulnerability in DH key selection - am I understanding this right?

texts:
I'm reading through a DH implementation, and I think I found a potential hole.

Public $p$ and $g$ values are properly selected.
A candidate secret value $\bar a$ is pseudo-randomly selected such that $0 \leq \bar a < 2^{|p|}$, where $|p|$ is the number of bits required to store $p$.
If $\bar a \geq p$, discard it and repeat the previous step. Otherwise select it as the secret value $a$.

This already leaks some information about the output of the PRNG, since measuring the number of repeated selections via timing tells us how many $\bar a$ values were chosen such that $\bar a \geq p$. Whilst the PRNG is poor (it's Java's inbuilt Random class), this doesn't constitute a feasible timing attack.

An interesting case is when $p$ is close to $2^{|p|}$, since there will be cases where the $\bar a \geq p$ condition will only be met when certain bits are set. For example:

$p = 0xFE4041FB$, or 11111110010000000100000111111011 in binary.
$|p| = 32$, therefore the maximum selected $\bar a$ value will be $2^{|p|}-1 = 0xFFFFFFFF$.
For every iteration in the loop, we know that $\bar a \geq p$, so the first 7 bits of $\bar a$ must have been 1.

Am I correct here, or have I missed something? Are there any other holes?


texts: I have a function that derives two sub-keys from one passphrase using PBKDF2 one which is used as a encryption key the other for HMAC generation, because these two sub-keys will need to be regenerated when the user wishes to decrypt there file so the salt used and the number of iterations must be available to the client and I am wondering whether it would be a massive security risk to simply store them in the cipher text or somewhere on the users machine?


texts:
Popular multivariate schemes are constructed by having a several easy-to-invert functions/maps as parivate key, and their composition as the public key.

When signing, the hash, or a padded form of which is converted to a series of multivariate variables, and its pre-image under the maps computed as signature. However, public-key encryption is not as easy to construct as signature schemes in multivariate cryptography right now.

I'm wondering if it's possible to do the following:

For signature:

Generate a random public multivariate system $g()$,
Generate a random private multivariate system $f()$ as private key, and publish $p = g \circ f$ as public key.
Publish $\sigma = f(h)$ where $h$ is the hash of the message signed, and verify $g(\sigma) = p(h)$.

For key exchange:

Generate a random public multivariate system $g()$,
Generate a random private multivariate system $f()$ as private key, and publish $p = f \circ g$ as public key.
Client generates a random $x$ and sends $y = g(x)$ as public component, and calculates $p(x)$ as the key exchanged.
Server calculates $f(y)$ as the key exchanged.

My questions are:

What are the known attacks that doesn't involving inverting the multivariate equations system?
Had there been similar proposals? And if not, possibly why?


texts: What is the "brand X" cipher mentioned in the Usenet thread about RC4?

texts:
In the original Usenet thread about RC4 when it was finally reverse engineered, a user by the name of Michael Johnson mentioned that the RC4 algorithm looked surprisingly like another proprietary cipher which he had seen which he called "brand X", and mentioned several similarities between the two:

  I am suprised at (1) how simple the cipher is, and (2) how closely it
  resembles another proprietary (but unclassified) cipher that I have seen.  The
  biggest difference between alledged RC-4 and brand X is that brand X includes
  some data dependencies.  Brand X is stronger against a plain text attack, and
  can be used for data authentication.  The plain text attack part is not a big
  deal if you heed the caution in observation 1, above.  Brand X performs 3
  swaps per byte emitted instead of 1, and uses different index manipulation,
  but it also uses a 256 byte array and very similar principles of operation.
  The 3 swaps are not needed to avoid short stream cycles, but they do make the
  authentication properties work.
  The key expansion of alledged RC-4 and brand X work a little differently.
  The alledged RC-4 version is faster than brand X, but is more likely to
  generate the same state from a different user key.  The key AAAAA is the same
  as the key AAAAAAA.  The key setup in alledged RC-4 makes no attempt to
  differentiate between different sized keys, but it does in brand X.

What cipher is he talking about? Does this description match any known cipher?


texts: How can I study the math behind cryptography?

texts:
I am a junior in high school and I am currently studying algebra 2. Where can I go to learn about the mathematics behind cryptography? I have a very basic knowledge of cryptography, but I am really interested in things like, why is a 2^256 bit cipher so secure? I would really like to learn about things like that so I can learn to make my own and analyze other ciphers.

Are there any good books or websites where I could learn about cryptography from a mathematical perspective?


texts: How to decrypt using CRT, and then verify by encrypting without CRT?

texts:
Here is the actual question that I need to answer:

An RSA encryption scheme has the set-up parameters $p = 31$ and $q = 37$. The public exponent is $e = 17$.

Decrypt the ciphertext $y = 2$ using the CRT.
Verify your result by encrypting the plaintext without using the CRT.

I have figured out the answer for the first part: $x = 721 \bmod 1147$, but I am unsure how to encrypt it. I know that using RSA would mean: $y = e_{kpub}(x) \equiv x^e \mod n$, where $x,y \in \mathbb{Z}_n$, so it should be as easy as $721^{17} \bmod 1147$, but this is a huge number that I cannot work with. I am pretty sure that I should use the square and multiply algorithm, but I don't understand how, and my textbook is not clarifying.

I know that $x^{17}$ means #MUL + #SQ= 5, but what do I do with this information? The textbook does not describe this well.

I could really use some help!


texts: Is the security of an HMAC equally important as the security of the cipher itself?

texts:
I'm a little unclear on how hash based MAC works... So I would like to know, is the security of your hash function as important as the security of the overall cipher? Basically, if you can crack the hash, does this compromise the cipher?

I understand that in most situations it isn't particularly feasible to crack either.


texts:
From the class:

Shannon Theorem: For a perfect encryption scheme, the number of keys is at least the size of the message space (number of messages that have a non-zero probability).
Proof:
Consider ciphertext $c$. $c$ must be a possible encryption of any plaintext $m$. But, for this we need a different key per message $m$. $m \neq m' \iff c \neq c' $. Why?

Can someone explain the logic behind the proof? I understand that the one above is a partial one but still can I have an easy to understand explanation? No need a formal one.

$c$ must be a possible encryption of any plaintext $m$.

I understand that.

But, for this we need a different key per message $m$.

Why? I can have the same key for different messages and still produce different ciphers, and those ciphers would be " a possible encryption of any plaintext m ".

$m \neq m' \iff c \neq c'$  Why?

Didn't understand that either, could have different messages but same ciphers.
But if we indeed force that each message has it's own unique key then it is true, and then we showed that size of keys space > size of messages space.


texts:
Assuming we have an El-Gamal pk tuple $(G,q,g,g^s)$. Someone, knows only the first three parameters.

In round $i$, I send him $X_i=(g^s)^{t_i}$ (the $t_i$ values are chosen randomly for each round), and I want to prove to him that I know also $s$ or $st_i$, so I choose a random $\rho \in \{0,1,...,q-1\}$, and send him the proof $P$:

$$P = [p_1, p_2] = [g^\rho, hst_i+\rho]$$

$h$ is define as $H(i || X_i)$, such that $H$ is a secure cryptographic hash function.

Now, he can verify that I know $st$ by comparing ${X_i}^h \cdot p_1$ and $g^{p_2}$.

My questions are:

How can I prove that the procedure I described is a NIZK proof of knowledge?
Considering the fact that this procedure is repeated for several rounds. Is it possible to link between the proofs? Namely, can someone learn that in some two proofs there was the same $s$? Does the fact that someone can't learn anything about $s$ or $st_1$ (ZK) implies that he can't link the proof for $st_1$ to $st_2$ (and learn that they both use the same $s$)?
If the ZK property is not enough, how can I prove such a property (if possible)?


texts: How to find an element of high-order in an RSA group?

texts:
Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements.
What happens if you use the RSA group in a scenario where you want that the discrete log problem is difficult. If you cannot find a generator, you want at least find an element with a high order, or?


texts: Can you help me understand Format Preserving Encryption?

texts:
I came across the definition of format-preserving encryption (FPE) as first defined in a seminal paper by Black and Rogaway. Based on their paper, FPE (or prefix cipher) is defined as follows (quoted from Wikipedia):

  One simple way to create an FPE algorithm on ${0,...,N-1}$ is to assign a pseudorandom weight to each integer, then sort by weight. The weights are defined by applying an existing block cipher to each integer.

Can you help me understand the difference between this and monoalphabetic substitution, and what security is offered by FPE?


texts: Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?

texts:
I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and privately-verified. Here's a brief explanation of the problem:

Private:

  Alice sends a very large file to Bob.

  Bob agrees to store the file for Alice in exchange for $5 per month.

  Alice is suspicious of Bob's intentions, and suspects that Bob could delete all or part of the file and fool her into paying $5 per month, without Bob holding up his end of the agreement. Therefore, Alice wants to conduct periodic random audits to verify that Bob is in fact storing all of the file, as agreed upon.

  Alice could download the entire file from Bob, and then verify the hash of the file against one that was recorded earlier. However this would waste a lot of bandwidth, and also take a lot of time, since the file is very large.

  Instead, Alice would like a more efficient interactive audit protocol, in which she chooses a random subset of the contents of the file, and Bob must be able to correctly respond with an answer that is based off of those parts of the file. Since Bob doesn't know which parts of the file will be needed in the future to pass the audit, Bob is forced to store the entire file, or he will fail the next audit. Since Bob is storing the entire file, it is reasonable to say that Bob is holding up his end of the agreement.

Public:

  Same as the above, except we have a third party, Carol, who also wants to audit Bob to verify that he is storing Alice's file. Carol might have more limited information about the file, for example, Carol might never have actually seen Alice's file. However Carol still needs to be able to perform the audit.

I have looked at two papers on this subject (see below) and it seems like a simple but inefficient privately-verifiable scheme is possible using MACs. More efficient schemes seem to use complicated "homomorphic linear authenticators" and fountain codes. It also seems like these more advanced schemes allow an unlimited number of challenge-response verifications to be performed in the future.

Unfortunately my understanding of this subject is limited, so my goal is to piece together a working implementation of a simple scheme that does not require advanced knowledge of cryptography. That said, I am most interested in the public verification aspect of proof-of-retrievability schemes, and it seems like the simple scheme using MACs is only privately verifiable. It also seems like there is a trade-off between the algorithm's efficiency and complexity.

So my question is, if we relax the requirement of being able to perform an unbounded number of verifications, and we also relax the requirement of using resources efficiently, is it still possible to produce a proof-of-retrievability scheme which is both publicly-verifiable and simple in construction?

Any additional information about this would also be appreciated.

"Proofs of Storage from Homomorphic Identication Protocols" (Ateniese et al)
"Compact Proofs of Retrievability" (Shacham and Waters)


texts: How secure is a system that retrieves encrypted private keys from a public database?

texts:
The system in question is one with multiple users. Each user has a password associated with their account, and each user owns several public-private keypairs. A user's private keys are encrypted using the user's password, and stored in a publicly accessible database. A system like this would allow users to retrieve their public-private keypairs from any machine, and decrypt the private key using their password.

Assuming that a strong encryption algorithm was being used to encrypt the private keys (perhaps Blowfish/Twofish), what sorts of attacks might this system be vulnerable to?

PS: There are two ways I can think to encrypt the user's private keys.

Each private key could be encrypted and stored individually
The private keys could be aggregated into one file which is then encrypted and stored

In the first option, users would be able to retrieve keys individually, leaving the other keys encrypted and not risking their exposure. However this might lead to an association attack on the user's password, as there would be multiple cyphertexts all encrypted using the same key (the password). Aggregation of the private keys before encryption might help avoid this, but then the user would have to retrieve the entire file and decrypt all of their keys at once, potentially exposing all their secrets. Which of these two methods (or maybe there are more) would be more secure?

EDIT
So far, the answers to this question have mentioned deriving keys from the password and storing secret, randomly generated salts to be provided to the user upon login. These are great ideas that slipped my mind. However, what I failed to clarify was that the system database has all the data public with no stored, hidden fields. With such a system, it might be possible to implement this as a distributed P2P network, and would nullify the threat of data breaches (nothing to steal since it's all public).

With this requirement, storing secrets is impossible, and we should assume any algorithm used to derive keys from a password is public as well, to avoid security through obscurity. Because the deriving algorithm is public, it wouldn't add any security (in theory) to the private key encryption as opposed to just using the password as the key.

Lets say every user averages ~100 private keys. How realistic is an association attack on these cyphertexts encrypted with the same key if TwoFish were being used? Is brute forcing still the easiest path?

What about every user owning ~1 million keys? How many keys (about) would it take to make some sort of association attack plausible? And is there any way that this system could be hardened, like by somehow increasing the password entropy?


texts: Check linear and differential cryptanalysis of a new block cipher

texts: I am developing a new block cipher primitive. I would like to test its robustness against attacks of linear and differential cryptanalysis. Is there a tool to evaluate this using only plaintext and ciphertext?


texts: Proof that $gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$

texts:
What is the proof for the fact that
$gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$

Where:

$N = P * Q$ where $P$ and $Q$ are both primes.

$\varphi(N)$ is Euler phi function

$\lambda(N)$ is Carmichael function


texts: Statistical (innefective) Fault Attacks on DES

texts:
I read this paper: Exploiting Ineffective Fault Inductions on Symmetric Cryptography.

I was wondering if the same idea is applicable for DES. I know both algorithms are symmetric but the idea is not the same.

I thought if an attacker shot the left part of the penultimate round, but the final permutation on the Feistel function is a problem for me.

Does anyone have some information about this topic?


texts: Using hash functions for Key Check Values (KCV)

texts:
As discussed in this post, calculating key check values for block cipher keys can introduce vulnerabilites. Plus, this method only applies for block ciphers, and there is no equivalence for private keys used for asymmetric cryptography (although an alternative is given in an answer of this post, the KCV size is huge in this case).

Would it be relevant to compute a hash over the key (with SHA-2 or any other secure cryptographic hash function) and to consider the $n^{\text{th}}$ first bytes ($n = 3$ for example)? Or could it introduce weaknesses in some specific cases?


texts: Recommended password complexity for SSH key encryption using AES-256-CBC

texts:
When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime in the near future if the key got stolen / disclosed somehow.

For the purposes of this question, the private key is a 2048 bit RSA key (I don't think that matters for this question but FYI in case there's some relevance I'm not aware of), and it's being encrypted by AES-256-CBC.

I'm assuming of course the key isn't getting stolen by a computer being hacked to a degree that a keylogger could just be installed but rather for example being stolen by some vulnerability like the recent Firefox pdf.js vulnerability that was being exploited in the wild and looking for SSH keys.


texts: Probability of factoring keys as a function of bit length

texts: kinda new here, I had a question pertaining to someone being able to factor one's RSA keys through the GCD. Anyways the question goes that there are two people: A and B. A makes his/her private key as $N_a = p_a\cdot q_a$ and B does the same with $N_b = p_b \cdot q_b$. I'm assuming here that both random primes are of length n bits and so I'm wondering whats the probability of the two keys sharing a common prime. I was considering that it may have something to do with the Prime number theorem but not entirely sure.


texts: Optimal way to get checksum digits from hash?

texts:
Let msg be some data we want to hash using an arbitrary digest size algorithm such as blake2b. From that hash, we would like to compute a checksum field with n decimal digits.

If we suppose that the hash algorithm has a perfect distribution, we would like to design the checksum with a probability of collision as low as possible, ideally 1/10n.

Let n be in the range 1..10 (1 digit checksum to 10 digits checksum).

For each value of n, what would be the safest way to calculate a checksum of size n?

More specifically, what size of digest should we aim for every size of n and how should we reduce the value of the hash h to a decimal number.

E.g.: For n = 2 (2 checksum digits):

a) digest_size = 1, checksum formula = h mod 100

b) digest_size = 4, checksum formula = h mod 97

If the formula used to reduce the hash h to a checksum is h mod p, are there optimal values of p and digest_size for each value of n?


texts: SHA-256 support for SecretKeyFactory in Java 6 and 7?

texts:
According to the following linked Java documentation, the relevant option for SecretKeyFactory algorithm (ignoring deprecated options involving MD5 or DES etc.) running in JRE 6 and JRE 7 is: PBKDF2WithHmacSHA1

With the advent of SHAttered, does Oracle have any plan to support later SHA versions for SecretKeyFactory? What are the alternatives?


texts: Can a message be encrypted with BOTH mono-alpha and poly-alpha ciphers?

texts:
For my class assignment, I was given this text;

  Qpuvu vo vv stazpuykzh Hhycmlmv asb. Ad dhyaqva wh uyo uzb jpwww Avlw.
  Tkpjllfdmbp zoatz vzjavfvna ZLHqh. Amva luy yyvlz yu bhk zua zlhvvalaz
  yow llh uldu llzy yzlvao. Hzk caslyv kfzounf zayy sh pvsv. Uopz ala
  yrvhbhm tk ppp Thlll jya. Blz o bblw tol Lsjay hba ljw oro lp nta
  avlnktn.

There is more than one cipher method used, with one of their keys being 'ANNIE'

POSSIBLE METHODS: Caesar, Vigenère, One-Time Pad, Columnar Transposition, Railfence Transposition...

Using Cryptool 1 to analyze the histogram, I figured out that there's a Caesar shift 7 cipher, which decodes the text to:

  Jinon oh oo lmtsinrdsa Aarvfefo tlu. Tw wartjot pa nrh nsu cippp Toep.
  Mdiceeywfui shtms osctoyogt SEAja. Tfot enr rroes rn uad snt seaootets
  rhp eea newn eesr rseoth. Asd vtlero dyshngy strr la iolo. Nhis tet
  rkoauaf md iii Maeee crt. Ues h uuep mhe Elctr aut ecp hkh ei gmt
  toegdmg.

I figured out the plaintext by using columnar transposition through a website.

  jamesisanundercoverinterpolcophereportstoouroldenemysuptshamshuddinusingencryptedsmsestheyareawareofallouractivitesforthelastfourmonthsthepolicesuspectthatweknowtheyareworkingtogetjamesoutsetatrapforjamesandgetridofhimtonight

Is there a way I can explain why it couldn't have been Vigenère or a one-time pad? Is my assumption that a mono substitution cipher cannot be combined with a poly substitution cipher correct?


texts:
Is there a known risk in having two keys wrapping each other?

Let's say, an adversary has access to both AESkey1(key2) and AESkey2(key1).

Does it make it much easier for him to recover the keys?


texts: Does XORing a random block into a layer of CBC encrypted message add some bit strenght?

texts:
Let's suppose I encrypt a message with a block cipher in CBC mode, keep the key and IV secret and XOR a random block of data in each encrypted CBC block, being the XORed block the same for each CBC block (constant).
Does it add some encryption strength?
(I know this question is weird, but I need to know).


texts: Why are PRNG in programming languages not cryptographically secure by default?

texts:
In most programming languages, there is a module or function in the stdlib for creating random output like random.random() in Python.

Because those functions use a normal PRNG that is not cryptographically secure, over all the years those generators have been used for crypto nonetheless because of the name "random".

Why do not programming languages use only cryptographically secure PRNGs in the stdlib? It's able to produce random output even if not needed for crypto and it's secure if you use crypto.

Is there an advantage of normal PRNGs compared to CSPRNGs? I'd be happy if you could explain it in a way that someone like me without any crypto background can understand, thanks a lot! :)


texts: Can "Approximate Hashing" work in a Proof-of-Work context?

texts:
Here is a draft of an article claimed to soon appear in a peer-reviewed conference: Matthew Vilim, Uenry Duwe, Rakesh Kumar, Approximate Bitcoin Mining.

It is proposed to simplifying a SHA-256 engine (used in a Proof-of-Work context) in some way, at the expense of quite always having a correct result; and concluded that the ASIC area saved allows to implement significantly more (or/and faster or/and more power efficient) SHA-256 engines on the same area, with the potential of increasing the expected work demonstrated (translating to profit obtained by bitcoin mining gear using the design by 30% overall).

Increasing work demonstrated implies that the rate of correct SHA-256 produced increases at least as much (in a bitcoin context: twice as much, since an incorrect SHA-256 in the two chained SHA-256 characterizing a valid bitcoin will make it rejected with overwhelming certainty, yielding no profit; and odds that a SHA-256 input yields an incorrect result will be largely independent of whether it is involved with a valid bitcoin).

However, I find it hard to believe that the rate of correct SHA-256 obtained does not fall down steeply when we remove any sizable portion of whatever part of a competent ASIC design computing SHA-256 for Proof-of-Work (including the carry-look-ahead logic that is considered as the target of the area reduction).

Any well-informed opinion+explanation?


texts: Finding the basis of the transpose of a q-ary lattice

texts:
Given $q$ and a matrix $A \in \mathbb{Z}_q^{n \times m}$, the $q$-ary lattice is defined as
$$\Lambda(A)=\{x \in \mathbb{Z}^m:Ax=0 \bmod q\} $$
An instance of a q-ary lattice and its short basis is computed in Generating short basis for hard random lattices. Once the short basis $T_A$ for $\Lambda(A)$ is given, computing the short vector $s$ in $\Lambda
(A)$ is given in SamplePre algorithm.

Is it possible to find a short basis for $\Lambda(A^T)$, if we are given a short basis of $ \Lambda(A)$?

Basically I want to find the short vector $s^\prime$ such that $A^Ts^\prime=0 \bmod q$.


texts: Is there any pseudorandom function that outputs $n$ prime number of ring $Z_{N}$ where $N$ is Paillier public key

texts:
Let's assume $N$ is Paillier encryption public key, where $N=pq$ and $p,q$ are strong prime numbers.

I have a set of plaintext $p_i$ whose domain is $N$. I want to deterministically generate a series of pseudorandom values $r_i$ that have multiplicative inverse. So $r_i$ should be distributed uniformly random over $N$ or its subfield.

I want to blind each plaintext as $b_i=p_i\cdot r_i \bmod N$. So given $b_i$ a semi-honest adversary cannot learn anything about $p_i$.

Question: Is there any way to construct a pseudorandom function that outputs uniformly random values over $N$ (or its subfield) and has multiplicative inverse with a high probability?


texts: How to compute negative point in EC-DSA?

texts:
Assuming we have a valid EC-DSA signature $\sigma = (r,s)$. We can then easily create another valid signature without the knowledge of the secret key by negating $s$. That is, $\sigma' = (r, -s)$ can still be verified. The verification algorithm of ECDSA works the following

$e = H(M)$
$w = s^{-1 }\mod p$
$u = ew \mod p$ and $v=rw \mod p$
$Z=(z_1,z_2)=uG+v\cdot pk = uG+v\cdot xG$
If $z_1=r\mod p$ return TRUE, otherwise FALSE

I'd like to understand mathematically why $\sigma'$ is still valid. If we fully extend the forth step of the verification algorithm, we get the following:

$Z = (x,y) = uG+v\cdot xG=G\cdot(ew+rwx)=G\cdot (e\cdot s^{-1}+r\cdot s^{-1}x)=G\cdot s^{-1}(e+rx)=G\cdot k\cdot(e+xr)^{-1}\cdot(e+xr)=G\cdot k $

Negating $s$ in $\sigma'$ essentially means, that we compute $Z = G\cdot (-k)$ instead of $Z = G\cdot k$. However, I see two ways to interpret $Z = G\cdot (-k)$, but obviously only one can be correct.

Recall that EC-DSA is applied on a finite field $\mathbb{F}_p$ with $p$ prime. $Z=G\cdot (-k) \mod p $ means that we first set $h = -k \mod p$. This is $h=p-k \mod p$ (For instance, $-3 \mod 17 = 14$.). We then calculate $Z = G\cdot h$. However, $G\cdot h$ does not equal $G\cdot k$ and thus, $\sigma \neq \sigma'$. This contradicts the assumption.
$Z=G\cdot (-k)$ can be written as $Z=-G\cdot k$. We then compute $Y=G\cdot k$ and eventually get $Z=-Y$. We simply have to negate the point $Y$. As $Y = (y_1, y_2)$ is a point on an elliptic curve, we get $Z = -Y = (y_1, -y_2) = (z_1, -z_2)$. The negation only affects the second point component and thus $\sigma = \sigma'$.

Question

Obviously, the first interpretation is not correct. But why? Is $\sigma = (r, -s)$ a valid signature, because it is only mirrored at the x-axis? The fifth step of the verification algorithm would still return true, because it takes only the x component of $Z$ into consideration? What prevents me to interpret $G\cdot (-k)$ like in the first way?


texts:
I understand that it is necessary to use the same IV for both encryption and decryption in the CTR mode. I'm thinking about the case when I concatenate the secret key along with the IV after generation, and the resulting byte array is sent to the receiver side in secure manner.

Is it practical to create a 32 byte array such that the first 16 byte is used to store the secret key and the last 16 byte is to store the IV and send the result to the receiver side?


texts: RSA: Probalistic algorithm to compute $x$ from $y$ and $(n,e)$ with probability $\epsilon>0$ given set of weak ciphertexts?

texts:
Suppose there exists a set of ciphertexts $S \subset Z_n^*$ of size $\epsilon (p-1)(q-1) $ for $\epsilon>0$, that is easy to decrypt, i.e. there exist some algorithm $A_1 : \mathcal C \rightarrow \mathcal P \cup \{\text{void}\}$ that given ciphertext $y \in S$ and public key $(n,e)$ outputs correspoding plaintext $x$ and otherwise returns $\text{void}$.

I want to create a probalistic algorithm $A_2$ that given ciphertext $y$ and public key $(n,e)$ returns corresponding plaintext $x$ with probability at least $\epsilon$.

In the textbook a hint is given: Use $A_1$ as a subroutine and the RSA multiplicative property $$e_K(x_1x_2 \bmod n) = e_K(x_1)e_K(x_2) \bmod n$$

I've already proven that if $y\in Z_n \setminus Z_n^*$ then the secret key $(n,d)$ can be computed easily, which in turn yields the ciphertext $x$.

However, I'm stuck in the case $y\in Z_n^*$.

I've tried to consider how to split $y$ into prime factors $\prod_i p_i$, and then use the RSA multiplicative property, but this gets me nowhere.

Also, I've tried to consider picking plaintexts (or ciphertexts) at random, and then see if the product of their encryption their yields $y$.

Note:

For $y \in Z_n^*$, I cannot simply run $A_1$, because then the probability of returning $x$ would be $0$.


texts: Proving the security of a one-way function with partially known input

texts:
Let's say we have a construction like in this question: We have a OWF $h(.)$, a secret salt TXT, and a counter starting at 1, and we compute

H1 = h(TXT || 1)
H2 = h(TXT || 2)
...
Hn = h(TXT || n)

According to the linked question, this scheme is secure. However, I was wondering how to formally proove this.

My first attempt was to try to formalize the scheme a little: Given the OWF $h(x)$, we construct $h'(x) = h(TXT\ ||\ x)$. Now, we can do the usual dance of "Assuming $h'(x)$ is no OWF, a PPT algorithm A exists that inverts it with non-negligible probability." We now have to use $A$ to construct a PPT attacker $B$ that inverts $h(.)$.

However, $h'(x)$ clearly does not even properly represent what the scheme above is doing (we know that TXT is fixed, but have no guarantee that $x$ is increasing monotonically). Since the function does not match the problem, it's not interesting if it is an OWF.

In fact, since the scheme does not even have any parameters, any attempt to put it into the form of an OWF is doomed. It's more of a PRNG, with TXT being the seed. So, one way to phrase the security requirement of this scheme would be "no algorithm $A$ exists that can determine TXT in PPT with a non-negligible probability, given any number of consecutive outputs of the PRNG".

This is where my ideas end. I am not sure how one would go about prooving this, or if there is a more elegant way to perform this proof. I'd be interested in how you would solve this problem (and if it is even possible).

(Note that this is no homework assignment, just me being curious about how one would proove this. It's also related to another question of mine, where the security of the scheme could be prooven in the same way)


texts:
I am trying to deal with Bulletproof. I can not find confirmation or refutation of the following assumption:

  Bulletproof cannot work without the random oracle, which is a
  necessary part of the protocol.

Thanks in advance for your answers.


texts: Is this a good way extracting randomness from some physical process?

texts:
Let's say the system has a hardware randomness generator, generating random numbers using a proven truly random process. The distribution of the numbers though, is unknown.

Assume the randomness source generates data blocks $P_1$, $P_2$, ..., $P_n$. There is an one-way function $f(x)$. The output data blocks are $Q_1$, $Q_2$, ..., $Q_n$. There is an initialization vector $Q_0$. The length of $P_n$ blocks, $Q_n$ blocks, $Q_0$, input and output block length of function $f(x)$ are all equal.

For each output block $Q_n$, there is:

$$
Q_n = f(P_n \oplus Q_{n-1})
$$

Questions:

Can the process above extract the randomness from the hardware source, given a proper $f(x)$ and $Q_0$?
What is the requirement for the one-way function $f(x)$ and the initialization vector $Q_0$ for this process to work properly?
Can I replace the $\oplus$ with something else without breaking the randomness? (Replacing it can allow me to relax the block length restriction.)
Can I extend this method into combining multiple randomness inputs?


texts: How does Poly1305 in the NaCl library calculate a MAC?

texts: I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl.  My understanding of XSalsa20Poly1305 (in this implementation, at least) is that it prepends 32 zero-bytes to the clear-text, encrypts with XSalsa20 as per normal, uses the 32 encrypted zero-bytes as a the key for calculating a 16-byte Poly1305 MAC, and then discards the encrypted zero-bytes.  Do I understand this correctly?  Is this the standard way that Poly1305 is used?


texts: What's the name of this cipher? And how can it be broken?

texts:
Assuming that:

SHA-256 and SHA-512 are random and irreversible
the output appended to some random and long enough secret is just as random as any other data and will produce values that are just as hard to guess

Then one can conclude that a cipher can be constructed using those hash functions in the following manner:

let state and key both be 32 or 64 byte values
initialize state with a random IV and key with a random key
make v equal the hash of state + key, xor block of plaintext withv
update state with the cipher produced
repeat until all plaintext is processed
to decrypt do the same, but update the state with the cipher text

Now the question is, does such a cipher exist? Is it possible to discover the plaintext given a ciphertext without brute-forcing the key? If so, what techniques could be used for that?


texts: Can you help me understand the Common Modulus Attack in a Lucas Group?

texts:
I'm trying to decrypt a message that is encrypted using a LUC encryption scheme and running into roadblocks. I know that with RSA if Alice and Bob use the same public modulus but different encryption exponents, with $\gcd(n_A,n_B)=1$ then you can find the plaintext $M$.

I'm provided $R$ (public modulus), $n_A$ (Alices public encryption exponent), $n_B$ (Bob's public encryption exponent. I am also provide two lists of packets that contain the same message sent from a third user, Carol, to both Alice and Bob. Lets call the first packet with the same message $c_{1A}=(x_A,y_A)$ (Alices packet), and $c_{1B}=(x_B,y_B)$ (Bob's packet). I assumed that I could then use the extended euclidean algorithm to find $r$ and $s$ such that $rn_A+sn_B=1$, which I did. Then shouldn't I be able to find the plain text by, $(x_A)^{-r}(x_B)^{s} \mod{R} = M$ where $x_A$ and $x_B$ are the ciphertext?

This is where I am running into problems.  Do I need to perform this operation in the Lucas group?  As it stands all of my values are scalar.


texts: Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?

texts:
For RSA cryptography, we know that the modulo $n$ is a product of two big prime numbers(say $p$ and $q$). However, in some documents I see an extension of $p=2p'+1$ and $q=2q'+1$ with $q'$ and $p'$ being huge prime numbers.

Why is it necessary to have $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ when we know that $p'$ and $q'$ are already prime numbers?

Could you please also provide any documents/resources, if available?


texts: One way shared key encryption with NaCl - is it safe to generate a throwaway keypair for the encrypting party

texts:
Libsodium seems to be a famous library so I'm not sure I need to introduce it but just incase: https://nacl.cr.yp.to/ (Edit: NaCl not Libsodium, oops!)

So, I need users to be able to pass me information that no one else can read, so I've generated a secret key. Using NaCl I create a keypair from that secret key and I share the publicKey of the keypair with my users.
Now, they encrypt their information with nacl.box() which requires their message, a nonce, my public key, but also their private key? In the past I've traditionally used asymmetric encryption like AES (edit: I meant RSA) and only needed my public key... so I just generate, on the user's end, a random keyPair for the user to use. I'll call this throwawayKey.
encryptedMessage = nacl.box(message = "foo",
                            nonce = 0,
                            publicKey = MY_SHARED_KEY,
                            secretKey = throwawayKey.secretKey());

Then they can send me back this encrypted message AND send me back the public key for the throwaway key I generated them... throwawayKey.publicKey()
Then, I can later decrypt on my end, using this:
decryptedMessage = nacl.box.open(message = encryptedMessage,
                                 nonce = 0,
                                 publicKey = throwawayKey.publicKey(),
                                 secretKey = MY_SECRET_KEY);

Is this a safe way to have users send their info to my securely... I'm not used to having to generate a throwaway keypair for generic one way asymmetric encryption, am I using NACL wrong? It feels wrong to just generate a random throwaway key haha...


texts: What is the difference between Poly-LWE and Ring-LWE?

texts: I am often confused by Poly-LWE and Ring-LWE, always thinking that they are different names for the same thing. In some literature, Poly-LWE is a simplified version of Ring-LWE? What is the difference?


texts:
How does bit-wise operation work for encrypting grayscale images?

In my Khan Academy course they encrypt an image with bitwise_and, bitwise_or and bitwise_xor. I have tried, without success, to replicate their results.

The Khan Academy write-up: https://www.khanacademy.org/computing/computer-science/cryptography/ciphers/a/xor-and-the-one-time-pad

My results: https://imgur.com/a/ltvj5os

The way I did the operation is this (Python code):

def get_bitwise_image(image, key, op):

    and_image = []
    row=0
    col=0
    while row < len(image):
        new_row = []
        col = 0
        while col < len(image[row]):
            # a bitwise and between say 243 and 1 is bitwise and between 2 intergers and not binaries. So, their constituent bits and and-ed together
            # ex: 1 => 00000001 and 243 => 11110011
            # 00000001
            # 11110011
            # --------
            # 00000001 => 1
            if op == 'and':
                new_row.append(image[row, col] & key[row, col])
            elif op == 'or':
                new_row.append(image[row, col] | key[row, col])
            else:
                new_row.append(image[row, col] ^ key[row, col])
            col += 1
        and_image.append(new_row)
        row+=1
    return and_image

My second image is grayscale with values 0-255, and my key is a matrix of the same dimensions as an image with random 1s and 0s.

Key is defined as: key = numpy.random.randint(0, 2, image.shape)

Why is the Khan Academy's result completely different from mine? How are grayscale images encrypted with bit-wise operations?


texts: Hash function as secure as one-time pad?

texts: We know that the one-time pad is provably secure as a cipher to encrypt some data. Is there an algorithm which does the same just as a hash function? Can we get a provably secure hash function? Maybe with some ridiculous properties like the one-time pad got them (really big key length, fully random key)?


texts:
I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign using NTRU (and the proposed method apparently leaks information about the private key).

My question is, why can't I just sign in the same way one would sign an RSA message, i.e. the sender "decrypts" a known quantity using his private key, so that the recipient can "encrypt" the signature and easily verify it? (With any required padding of course.)

Are there any flaws in doing this?


texts:
Shannon's idea of diffusion is fundamental to cryptography.

Besides being a descriptive idea, is there any work on measuring or expressing it? Saying something like "System A has more diffusion than B" or "The information in bit x is diffused 1/3 into bit y, 1/3 into bit z, and the remaining third among 11 more bits".

Is there a way to evaluate the diffusion of a transform? XOR does no diffusion, Add with carry does small diffusion, and a permutation may do a lot of diffusion.

In short: Diffusion is a great idea - how can we approach it mathematically?

UPDATE: For instance, we should be able to quantify the diffusion done by adding with carry.  This breaks both of the suggested answers: Adding may update the value of every bit.  Modifying one bit of the input may modify several bits of the output.  But adding still doesn't diffuse very well.


texts: Is there a need to encrypt data when send over https?

texts:
I was monitoring web traffic from my Android mobile using Man in the middle proxy. I installed certificate signed from my server in my mobile and I could see all applications sending sensitive information like passwords as clear text.

I understand that SSL protocol takes care of establishing secure communication, but that eliminates any need to encrypt data? I could read all passwords sent by any application just by installing my certificate in the mobile.


texts: Highest prime number calculated on a regular PC

texts:
The algorithm Sieve of Erastosthenes uses memory to do its work. The available memory determines the highest prime number, which can be found. On a regular PC, we have typically 4 GBbyte memory, which allows to store 32*10^9 bits. Therefore the highest prime number to be found with Sieve of Erastosthenes is 32*10^9-1 with 4GB RAM.

With Segmented Sieve Of Eratosthenes we can square this number, which then results in 10^21-1.

Another way to go further is to use the hard disk instead of RAM to store the bits for Sieve of Erastosthenes. A typical PC has 1 Tera Byte disk space, which is 8*10^12 bits, which then results in 8*10^12-1 as the highest prime number to be found. Using Segmented Sieve Of Eratosthenes we can square this and finally we realize that 64*10^24-1 is the highest prime number, which we can calculate on a regular PC.

But for cryptography key lengths of 1024 bit and more are common, which means that prime numbers of 10^300 are generated on a typical PC. How is this done ?
Are numbers randomly generated and then check whether they are prime numbers ?
Even checking whether a number with 300 digits is a prime is still a very extensive operation.

Please help me to understand this.


texts: Would it be easier to bruteforce the original data if given two hashes (from different hash functions)?

texts:
I have a chat server which uses public keys to identify their clients. But if the public key is known, then everyone can send a direct message (DM) to each other, which is annoying. The clients should choose who should DM them.

So I decided to get two hashes of the public key, one for user authentication and one for identifying the public key used to encrypt the direct messaging.

My question is: does having two hashes affect the probability of successfully guessing the original data?


texts: How can I encrypt a plain text of length l to a ciphertext of a different length

texts:
I'm trying to encrypt a plain text (of length l) and output a ciphertext of length t, where t does not equal to l.
How do i get a ciphertext that is shorter than the plaintext input?
How about if I want a ciphertext that is longer than the plaintext?

Also, assume if I already have a encryption function E, such that E takes l bit plain text as input, and outputs a l bit ciphertext. How can I use E to create a new encryption G, such that G solves the above problem?


texts:
Suppose we have the following El Gamal digital signature scheme variant: We fix a prime number $p$ and a generator $g$ of the group $Z_p^*$. We choose $x \in Z_{p-1}^*$, which is going to be our secret key and we compute $y = g^x \pmod{p}$, which is going to be our public key. For the signing algorithm, we choose a random varue $k \in Z_p^*$, then compute $$r = g^k \pmod{p}$$
 $$s = (m-kr)*x^{-1} \pmod{p-1}$$
and output $(r,s)$.

In order to verify the signature, it's easy to see that the following should hold:
                       $$y^sr^r \equiv g^m \pmod{p}$$
Now, as far as i can tell, the signing algorithm is faster than the one in the original El Gamal scheme, as we compute the inverse of $x$ once and forever, while in the initial scheme we have to compute the inverse of the new random $k$ every time we want to sign a message.

However, what about security? Can we say that the new scheme provides the same security as the initial one or it can be beaten in some way?


texts: Are stream ciphers no longer considered by NIST?

texts:
While reading NIST SP 800-90A, "Recommendation for Random Number
Generation Using Deterministic
Random Bit Generators", I noted that no stream cipher was included among the various specified solutions.

I also noted that, at least as far as I could tell from the list of other NIST SP 800 series publications, no stream ciphers seem to be currently approved or recommended by NIST.

On the other hand, a set of stream ciphers (MUGI, SNOW 2.0, Rabbit, Decimv2, K2) appear to be currently standardized in ISO/IEC 18033-4:2011.

So my question is:

What could be the reasons for NIST to apparently ignore stream ciphers?
Is it due to the past failure of any stream ciphers to pass the NESSIE project validation, or is it simply due to reduced interest in dedicated stream ciphers, as compared to stream cipher constructions based on block ciphers (CTR / OFB mode)?


texts: In finite field elliptical curve, is the addition of any two points on the curve guaranteed to land on the curve?

texts:
I've been troubled by this, given any random number as the number of times we'll multiply a point by itself, will we always be guaranteed to land on the curve again? Is there a case where we'll have a miss?

Also, is the question to above not always true unless we are in finite fields defined by specific curves? Is this part of the reason why we need to choose specific curves?


texts: What's wrong with this digital signature scheme?

texts:
With regards to user authentication...

The server sends Alice a randomly chosen number.
Alice signs the number and sends the signature back to the server.
The server checks the signature using Alice's public key. If it's valid, the server accepts her connection request.

Suppose that Alice uses the same private key to log in to the server and sign her emails. The authentication mechanism signs the bare challenge without hashing, while Alice signs the hash of the email message.

Apparently, the server can forge emails from Alice under this scheme? If so, how could this be prevented?


texts: Building adversary to show a PRF is not secure

texts:
Let $F(k,x)$ be a secure PRF over $(\mathcal{K},\mathcal{X},\mathcal{Y})$ where $\mathcal{K} = \mathcal{X} = \mathcal{Y} = \{0,1\}^n$.

Let $F'(k, x) = F(F(k, 0^n), x) \; \Vert \; F(k, x)$.

$a \; \Vert \; b$ means $a$ concatenated to $b$.

How can I show that $F'$ is not a secure PRF? I've been trying to build an adversary that could find some pattern but I couldn't. My  best guess was to initially use $x = 0^n$, so the output would be something like $F(k', 0^n) \; \Vert \; k'$ (where $k' = F(k, 0^n)$, which is the key of the left side) and I would be able to use $k'$ for the next calculations, but it didn't seem to be enought to find any pattern in the sequence of outputs.