texts: What's wrong with XOR encryption with hash and an iterated salt

texts:
Suppose you'd use the following algorithm to encrypt a message

Let $k$ be the key to encrypt with
Let $m$ be the message to encrypt
Split $m$ into groups of 512 bytes

Given a hash function with a 512 bit output.
For each 512 bit group in the message:

let $s$ starts at 0

let $l = hash(k + s)$
XOR the current group of the message with $l$
Append the result from above to the final result.
Increase $s$ by 1.
Repeat until there are no more groups in the message

How would one go about breaking such an encryption?
If the hash function is well designed then each bit in the input should have a 50% chance of being flipped in the output.

The only predictable relationship between the input and output should be the length of the message. In this case the length of the input and output would always be the same. But is that a security problem? If so, how would one go about exploiting it?

Edit:
This question was marked as a possible duplicate.
In contrast to the linked question, this question is not concerned with the specifics of the hash function used.
This question assumes that the $hash(m) \rightarrow m'$ function is perfect, and given that, if it is a secure method of encryption.


texts: Privacy and warrants to obtain information

texts:
How could a site issue a `warrant'*, a document which:
1) Others can verify was issued from that site
2) Contains a date stamp, a named site and instructions which can be presented to a third site by the named site as authority to carry out an action.

Of course, the problem is to make this secure, and I was hoping that someone could tell me where to look to find out how to do this. I suspect that this is very well known, so just a reference would do.

To explain more, I need to say why the name `warrant' was used. The idea is that a court can issue a warrant, and that a police officer can then take the warrant and police ID to a third party to obtain whatever (information..). The motivation is to increase privacy by requiring explicit and traceable authorisation for information collection, so the need for secure communication and identification is paramount. E.g., consider a monitoring system attached to a camera. The camera could be programmed to require authorisation from a higher entity in order to release data to the monitoring system, so the system has to give the camera a warrant. The procedure should be resistant to someone hacking into the monitoring system without the required authorisation...

Thanks and apologies for the low standards from a beginner here!


texts: What is the current time limit of Keccak inversion?

texts:
All sub-functions are referenced with respect to Keccak. It’s my understanding that the sub-function theta() would result in the largest resource allocation when attempting to invert Keccak. If this is incorrect please edit, comment, or answer. But for this reason I would argue it’s the most valuable sub-function to study if we are to determine the theoretical time limit of Keccak inversion. This question is asking specifically the estimated inversion time of theta^-1(o,n), when the inverting function is provided with some random output (o), and the number (n) of recursive iterations of theta(i,n) used to generate the output. Where theta(i,n) is initially seeded with what I will assume is some uniformly random 1600 bit input (i), and the number (n) of recursive iterations. See pseudo code provided.

def test_0(n):
    i=set_main_build(64,25)
    a_copy=list(i)
    for index in range(n):
        i=theta(i)
    o=list(i)
    return(o,'break',a_copy)

Now my serious curiosity is if someone can manage to execute theta^-1(o,n) where n > 10^6. But I fear finding theta^-1() in the wild is hard enough, but at last if someone has built a faster implementation I would most certainly like to see it. I'm trying to learn C, but even with the speed improvements over python I still think handling 5-bit pieces of information might prove to be be difficult in that language. If that is an incorrect statement please elaborate!

Use this script. Modify a single bit in ip (line 949-977)...then F5...it currently takes 2.1027 hours. I'll award the bounty to anyone silly enough to attempt this, and who posts their inversion.


texts: Can OTP be made practical by using stretched hash algorithms?

texts:
One of the main reasons for not using OTP in everydays life is that it is highly impractical - for encrypting 4GB of files we need a 4GB key that needs to be exchanged secure.

I've had an idea on how to get past this problem and want the opinions of experts (thats you!) about it. The main goal is to maintain the advantages of a OTP: Having perfect secrecy as the encrypted data can be decrypted to anything of the same length.

The main idea is to use a stretched hashing algorithm for deriving the OTP from a given password. This stretched hash iterates and adds the hash of the previous data to its content to create a new hash for the next data chunk making it unique.

This is my designed implementation in pseudo code.

Method createOTP ( CLEARDATA, PASSWORD, ALGORITHM )
    set OTP to empty
    set LASTSALT to derivation of given parameters
    While length of OTP smaller than length of CLEARDATA
        set LASTSALT to stretched hash of PASSWORD and LASTSALT using ALGORITHM
        set OTP to OTP and LASTSALT
    End While
    set OTP to OTP with length of CLEARDATA
    Return OTP
End Method

I do understand that the amount of possibilities is drastically reduced by using a hash algorithm. It should be impossible to verify that a given password is correct though as all passwords create an OTP with a different outcome producing possible legit words. The amount of computing power is also an advantage as the creation of such a big key can take a lot of time and is memory expensive.


texts: If I am about to generate one-time pad, where should I generate my pads from?

texts: If I want to generate a few one-time pads, is it OK to just read required number of bytes from /dev/urandom without weakening information-theoretical security?


texts: Where can i turn the unique hash result of SHA256 to bitcoin?

texts:
i watched on youtube from 3Brown1Blue channel about "how bitcoin works", it said what makes bitcoin valued is come from the unique hash result of SHA256. for example if someone put string to an argumen function SHA256 like SHA256("Hello World!") and consider the result of hash 000006d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e, there's 5 zeros at first which we can say unique result. Then that's result make bitcoin valuable.
Now what if i found another unique result hash of SHA256 with just SHA256 encryptor online manually? How to add it to blockchain so my identity is approved by blockchain watcher that i have it value and how i get the reward from it?


texts: How can I design a cryptographically secure, key-dependent s-box?

texts:
I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box.

What is the difference between the methods of S-box construction of “key-dependent s-boxes” and “random s-boxes”?


texts:
I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead.

However, it seems that (when used as a KEM) that any $\text{IND-CPA}$ secure scheme can be converted to a secure-in-practice scheme by hashing the exchanged key before using it.  The hash function seems to ensure that no information is leaked.  By using an AEAD for the encrypted data, and including the KEM ciphertext in the AAD, it seems that the scheme becomes $\text{IND-CCA2}$.

What is the flaw in this scheme?


texts:
If I create an RSA of 4096 bits, what would be the range of the length in bytes of the public key in DER format?

Also, will the private key always be exactly 4096 bits (512 bytes)? Does the public key length depend on the actual length of the private key, or the length you specified (4096)?


texts: How to generate a nonce for ChaCha20 Poly1305?

texts: I am using a self implementation of ChaCha20 with Poly1305. Since the nonce is only 96 bits it cannot be chosen at random. Can anyone suggest an efficient method to generate nonce from the key ?


texts: Could a 6502 CPU safely compute a SHA-1 hash in a reasonable length of time?

texts:
The 6502 is the CPU in a Tamagotchi (which can be hacked to run custom code). SHA-1 is the default hash used for TOTP (the algorithm used by two-factor authentication tokens and apps). Hopefully you now understand why I'm asking this.

(given this context, this would be a couple dozen bytes of input, and less than a second or so of time)


texts:
Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows:

$H = H(M)$, $H(M)$ being the SHA-256 of the message $M$
$S = H^d \bmod N$

Assume $N = pq$ is properly generated and $d$ is the RSA private key. And I verify the signature as follows:

$S^e \bmod N = H'$

where $H'$ is the SHA-256 of the message to be authenticated. Assume $e$ is the RSA public key.

Since I've not used any padding then are there any flaws with the above approach? What if $e = 3$? What if $e = 2^{16}+1=65537$?

Your guidance is much appreciated.


texts: Question regarding multiple SHA-256 rounds on a Bitcoin Brain Wallet passphrase…

texts:
I am attempting to come up with a way of memorizing a seed that could lead to any number of brain wallets for bitcoin.  I need multiple wallets because a) I don't want all my eggs in one basket, and b) I want to be able to import small amounts from time to time.

Let's say I came up with a passphrase, and assume it's long enough to be secure.  If I was to concatenate a value at the end of the phrase, and increment this each time, it could lead to an infinite amount of brainwallets, ie.

SHA256(passphrase.'1')
SHA256(passphrase.'2') etc...

The only disadvantage I see with this approach is that if somebody, at some point in the future was to stumble upon the seed to the private key (keylogger, brute force etc.), it would be trivial to access all the other wallets.

So I was considering using two rounds of SHA256 instead, but adding a second phrase to the hash value of the first round, like this -

SHA256(SHA256(passphrase.'1').'second phrase')
SHA256(SHA256(passphrase.'2').'second phrase')

I would the use the resulting hash as the input to the brain wallet.

This would mean concatenating ASCII text to the hex of the first SHA256 operation.  The reason that I don't want to use the actual numeric value is that I need something that can be done easily over a unix command line (I'm not sure how to do 256-bit math operations).  I don't want any custom software involved because there's not that much room in my brain. This would hopefully eliminate the worry that somebody could reverse-engineer the process by which I generate the brain wallets.

I'm worried that if I use the ASCII text to generate a second key, I'm somehow compromising the SHA256 process and making everything less secure.

Is there reason for me to be worried or is my approach secure?


texts: SHA1 usage for passwords, alternatives and advantages?

texts:
My application can authenticate via openid and oauth (facebook, twitter, etc) and also with its own authentication system. I previously switched hashing from MD5 to SHA1 and during migration I had to customize so that accounts could verify both with MD5 and SHA1 and now I've removed the MD5 completely.

I read here somewhere that for passwords in fact SHA1 should not be used and bcrypt or something else instead since SHA1 is not specifically a password algorithm and instead is a hash function implementation while a password algorithm would have other more specific features. Can you tell me more about this? Should I switch from SHA1, is it important or premature / paranoia since I never even had a production security issue that I know? I can think of some possible actions:

Staying with the current implementation (SHA1 and salt) since the main function of my service isn't user accounts anyway
Passing the algorithm as a parameter to the encryption and thus being able to authenticate with different and new algorithm i.e. now using SHA1 and later its easy to switch
Become an OAuth provider and then being able to add ourselves just like we add twitter, facebook and other OAuth providers
Does the issue of "real" and "fake" salt mean a lot in practice or just for highest security? Am I using real or fake salt in detail, when the following is the implementation:

def __encrypt(self, plaintext, salt=""):
    """returns the SHA1 hexdigest of a plaintext and salt"""
    phrase = hashlib.sha1()
    phrase.update("%s--%s" % (plaintext, salt))
    return phrase.hexdigest()
def set_password(self, new_password):
    """sets the user's crypted_password"""
    import datetime
    if not self.salt:
        self.salt = self.__encrypt(str(datetime.datetime.now()))
    self.crypted_password = self.__encrypt(new_password, self.salt)
def check_password(self, plaintext):
    return self.__encrypt(plaintext, self.salt) == self.crypted_password

Please tell me if you can comment.

Thank you


texts: Is my HMAC secure if I have a complete series of HMAC'd prefix strings

texts:
Let's say I have a long sentence, like "The quick brown fox jumped over the lazy dog." Let's further say that I need to keep this string encrypted, so I use an HMAC. Let's further further say I want to be able to do prefix searches for this string, so I also store all possible prefixes of this string, for example:

$\operatorname{HMAC}_K(\text{"T"})$, $\operatorname{HMAC}_K(\text{"Th"})$, $\operatorname{HMAC}_K(\text{"The"})$, $\operatorname{HMAC}_K(\text{"The "})$, etc. where $K$ is the key.

I recognize there are some weaknesses between rows here involving overlap, but what I'm interested in is whether having this one row's set of HMAC values is enough to make things insecure. Could an adversary work out the key, or any part of the plaintext, given a series of HMAC values for all of a given input's prefix values?

Feel free to use any flavor of HMAC if it'll help you argue that there's a weakness.


texts: Undefined $E_y(1,r_{i,j,1})$ notation in cryptography paper, suspect ElGamal-like

texts:
I'm trying to understand a paper that uses the notation $E_y(1,r_{i,j,1})$ (full text available in link, used just once on Page #35, 6th page of pdf, Section 3.3, Step 1c) in the context of an encryption similar to ElGamal.  I don't understand why/how $E_y()$ takes two inputs.

The $r_{i,j,n}$ part is well defined (series of random numbers).  I've figured out $E_y(x)$, which isn't defined in the paper, but used as an ElGamal-like encryption with previously defined public key $y$ (not to be confused with the $E_{k,i}$ or $E_k$ terms which aren't functions and are just lists of cards for the $k$th deck of cards), though I had originally thought $E_y(x)=xy^r$, based off the proof of theorem 2 on the very last page I think it is the ordered tuple $E_y(x)=(g^r,xy^r)$.

What could two arguments represent? I'm guessing one is the message to be encrypted, and the other is specifying the $g$ or $r$ term.


texts: Testing the Fortuna random number generator?

texts:
I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at http://www.seehuhn.de/pages/fortuna .

My question: How can I test my implementation?  Or more specifically:

Are there any known-correct test vectors for the Fortuna generator available?
Are there automated tests for the cryptographic properties of the output?
(I know how to test the statistical properties of the output, but I don't know how to test the cryptographic properties.)
Any other testing methodologies I should consider?


texts:
Although this has been extensively discussed around here, I'm curious whether my approach makes sense, or I should just stick to "the standard version".

I'm implementing some homomorphic encryption primitives (Paillier, Okamoto–Uchiyama etc) and, at the moment, I'm using GMP as the big number library (this may change in the future). GMP has a function called mpz_nextprime and I generate random numbers, after which I call this function on them, to get prime numbers. Is this a good approach? The other alternative would be to just generate random numbers in a loop, until mpz_probab_prime_p(number, 10) says that they are prime. This latter approach seems rather wasteful though, from a programmer's point of view.

How do you generate prime numbers with GMP or OpenSSL (or other crypto libraries like cryptlib, crypto++, etc)? I am unsure how the mpz_nextprime function works or if other libraries provide such functionality... Ideally, I should be able to just swap various big number libraries in my implementation, without changing the prime generator wrapper.


texts: Why do we use groups, rings and fields in cryptography?

texts:
I'm a student of Masters in Cyber Security. I have a habit to understand things from their first principles (at the very beginning). Kindly use any simple mathematical example to answer because I have read plenty of technical answers but they aren't clear to me. For example, we use primes because we know factoring them is extremely hard. Furthermore, we use injectives because we don't want one to many relations in encryption because it will be a disaster on the decryption side. Same like my examples can you provide me an example of using groups that makes sense as primes and injective do?Kindly, let me know what was the actual problem which leads us to use groups in cryptography?
I know what a group is and its properties, I know about abstract algebra, but I don't know why we use them and what happens if we don't use them.


texts: Computational Randomized Encoding in the hybrid proof

texts:
A computational randomized encoding scheme $(\textrm{RE.Encode}, \textrm{RE.Decode})$ works as follows:

$\textrm{RE.Encode}(1^\lambda, C, x, r)$: takes as input the security parameter $\lambda$ in unary, a circuit $C$, the input string $x$, and the randomness $r$. It outputs a randomized encoding $\widetilde{C}(x,r)$.
$\textrm{RE.Decode}(\widetilde{C}(x,r))$: it outputs a value $y = C(x)$

The security property of computational randomized encoding requires that there exists a PPT simulator $\textrm{Sim}$ that takes input $C(x)$ and security parameter $\lambda$, then it output $\textrm{SimOut}_{C(x)}$ such that the the distribution $\{\textrm{SimOut}_{C(x)}\}$ is indistinguishable from the distribution $\{\widehat{C}(x,r)\}$ for any PPT adversaries.

Consider the following scenario: If we prove something using this randomized encoding in the hybrid argument, it is nature we replace $\widehat{C}(x,r)$ with $\textrm{SimOut}_{C(x)}$ due to the security of randomized encoding in the hybrid. However, if we use it to prove, for example, function (circuit) privacy, the first step which is also nature is to replace  $\widehat{C_0}(x,r)$ with $\textrm{SimOut}_{C_0(x)}$.

My question is the second step, can we change $\textrm{SimOut}_{C_0(x)}$ into $\textrm{SimOut}_{C_1(x)}$ immediately and in turn into $\widehat{C_1}(x,r)$ ? where $C_0$ and $C_1$ are functionally equivalent.


texts: In a lattice, how can one define a good basis and a bad basis?

texts:
When it comes to lattice based cryptographic systems, all the literature talks about, good bases and bad bases.

How does one define what a good basis is and what a bad basis is?


texts: Proving that Perfect Secrecy implies Adversarial Indistinguishability wrt. probabilistic adversaries

texts:
In their book Introduction to Modern Cryptography, chapter 2, authors Katz and Lindell ask the reader to show that perfect secrecy is equivalent to adversarial indistinguishability as an exercise. I am self-studying their book, and I tried tackling the proof on my own.

I succeeded in showing that adversarial indistinguishability implies perfect secrecy by using Lemma 2.4 from the book and constructing a probabilistic adversary with advantage $\neq 1/2$.

I could not figure out how to rigorously prove the other direction, so I googled a solution. This pdf gives a proof of both directions. Rosenberg's proof that adversarial indistinguishability implies perfect secrecy is essentially the same as mine (although he appears to have left out quite some details), but his argument for showing that perfect secrecy implies adversarial indistinguishability is too shallow for me to fully understand it, although it is undoubtedly sound.

Rosenberg says "We can consider the adversary is deterministic, because there is no gain to randomizing its guesses" (sic). Using this assumption, I managed to rigorously show that perfect secrecy implies adversarial indistinguishability, this appears easier than showing the converse like Rosenberg does. But how is this assumption justified? The proof I worked out after reading Rosenberg's notes critically depends on the deterministic behaviour of adversaries, but his justification, "(...) there is no gain to randomizing its guesses," mystifies me.


texts: Point-at-infinity in the scalar multiplication

texts:
Is it possible to hit point-at-infinity while performing scalar multiplication in Weierstrass curves?

According to this reply this is only possible when the scalar k is bigger then the order of the curve n. Is it so? If yes why?


texts: The sensitivity in differential privacy with deep learning

texts: In differentially private deep learning, the sensitivity is determined by clipping gradient norm (see Abadi et al.'s paper). In this paper, when the clipping gradient norm is $C$, the sensitivity is $C$. Why is the sensitivity $C$? I think the sensitivity should be $2C$.


texts:
Suppose $f=x_0x_2(x_1+1)+x_1x_3(x_0+1)$, annihilator is such function $g$, so that $gf=0$ for all $x$

Intuitively solution(for some reason) is obvious - $g=x_0x_1$, which holds true. (Cloud sagemath online script)

It bugs me, that I can't explain this "intuitively". How to arrive at solution properly, not guessing?

PS: We can skip trivial solution $g=0$, function $g$ should depend on $x_n$ variables, at least some of them. Of course $\mathbb{F}_2$ is meant here.


texts: With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key?

texts:
A key pair has a private key $D_A$ and a public key $Q_A$.

$D_A$ is an integer less than the curve's $n$.

Is there any (boolean) function of the private key $f(D_A)$ which can be transformed into a function of the public key $f'(Q_A)$?

i.e. are there any relationships between private keys which can be calculated knowing only the public keys?


texts: An example of an appropriate use case for AES-CBC encryption without authentication?

texts:
I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community.

Recently in this question AES in CBC Mode Is totally unsecure if no defense is provided for padding oracle attack, right? I learned that CBC is secure against chosen plaintext attacks even though it isn't secure (by itself) against chosen ciphertexts attacks or padding oracles attacks.  That makes sense to me.

From what I have learned so far, I would think that there are no cases where using a CBC encryption mode would be wise unless it were paired with some kind of authentication algorithm like HMAC.  But from the answers for the linked question above I get the impression that perhaps that's not true, and there are cases where such use might be reasonable.

What is a specific example of where using CBC mode encryption (ex. AES-CBC) without pairing it with validation would be an appropriate and reasonable choice?


texts: I am using AES/CTR/NoPadding to encrypt while downloading files in one of my application. The encryption is done along with downloading. When the internet is not available in the middle of downloading, I need to pause the download and resume it when the network is available. Since the iv gets initialised to 0 state on resuming encryption, my resulting file gets corrupted. Is there any way to move the counter/iv to the previous state so I can resume encryption properly?


texts: does SHA* collide more or less than a random function?

texts:
There were several questions here regarding how surjective SHA-1/2 is, how many values don't have a pre-image from a fixed size input. I and others answered when modelling the relevant hash function as a random function.
The question is can we venture if common hash functions are likely to collide more or less often than a ideal random function. Are there other cryptographic hash functions where we know exactly which direction such a weakness lies?


texts: Avoiding collisions by combining MD5 and SHA-2

texts: It is often suggested that hashing of long character columns can be used for indexing in databases, but the possibility of collisions is an issue for Unique indexes. Whilst I know that both MD5 and SHA-256 can (rarely) produce collisions, I was wondering what the possibility of them both clashing at the same point with the same input? In other words, if I produce a Unique key by running both MD5 and SHA-2 against the same character field and combining them to make the Unique key, is this collision free.


texts: Authenticating Very Short (Sub-Block) Data

texts:
If I'm encrypting very short/small data - like an int or a long (32 or 64 bits), does it make any sense to authenticate the ciphertext, when using an "online" mode of operation (like EAX)?

Essentially, guessing the plain text would (assuming no weaknesses in either the encryption or the authentication) be easier than forging the authentication tag if the plain text is shorter than the block size of the cipher - or equally hard if truncating the tag to the same length as the data when using EAX.

Are there any scenarios in which tags longer than the data would be useful? (Or are there any actual research results on this?)

Does any of this change if the key with which the individual ints are encrypted changes?


texts: Do I really need to use the same private/public key pair in RSA?

texts:
So I'm making an Android application, I need my application to be only able to scan my own generated QR codes, and I want to make sure that nobody else can generate fake ones.
The data isn't sensitive, it's very okay to be read by anyone, and even be in plaintext.
The problem comes is that, I need to verify the source of the QR code, I've been suggested to digitally sign it, thus, I have my private key, and I ship my application with a public key, and the application then uses the public key to check the QR code
Some of the things I don't get:

Am I encrypting the whole message using the private key? or I just generate some separate signature that sits next to me message?
As far as I know, with RSA, for example, everytime I encrypt a message, a new private and public key are generated, right? So how is the application going to verify/decrypt the message if the public key is constantly changing per QR code?

Simply said:
My QR code data are something like:
{"a": 1, "b": 2, "c": 3}

And I want my application to make sure that this data comes from an authorized source, and not generated by anyone else.


texts: Using Euler's theorem.. how can I get appropriate x..?

texts:
The question is this...

  $x^{29}\equiv4\pmod{91}$. Note that $91 = 7*13$. Compute an integer $x$.

Since 91 is not prime number, I know I need to use Euler's theorem, not Fermat's. So I get

  $a^{72} = 1 \bmod{91}$, $a \in Z_{91}^*$

I don't know what to do next...


texts: Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?

texts:
The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key.

Is using AES-CBC sufficiently secure if used in conjunction with RSA?

Or must the files be authenticated with AES as well using CBC-MAC, in addition to encrypting the symmetric key with RSA and the data with CBC?

It may be assumed that integrity is required for both the symmetric key and the data.


texts: The number of cipher texts possible for each plaintext

texts:
This is from Dan Boneh's book
Theorem 2.1. Let X = (E, D) be a Shannon cipher defined over (K, M, C). The following are
equivalent:
(i) X is perfectly secure.
(ii) For every $c \in C$, there exists $N_c$ (possibly depending on c) such that for all $m \in M$, we have
$|\{k \in K : E(k, m) = c\}| = N_c$
(iii) If the random variable k is uniformly distributed over K, then each of the random variables E(k, m), for $m \in M$, has the same distribution.
Proof:
For every $c \in C$, there exists a number $P_c$ (depending on c) such that for all $m \in M$, we have Pr[E(k, m) = c] = $P_c$. Here, k is a random variable uniformly distributed over K. Note that $P_c = N_c/|K|, where N_c$ is as in the original statement of (ii)
(Partially copied, not the full thing)

Point (ii) is not clear to me. What exactly is $N_c$? If is the number of ciphertexts possible for each plaintext, then it's always equal to 0 or 1 for perfect secrecy, right. Or can it be something else?


texts: How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

texts:
Note: This question was reposted from Bitcoin Stack Exchange, where it received alike answers.

You can see a little background about this on this bitcointalk post by the late Hal Finney.

$\beta$ and $\lambda$ are the values on the secp256k1 curve such that:
$$\begin{align}
\lambda^3 &= 1 \mod N \\
\beta^3 &= 1 \mod P \\
\end{align}$$

As seen here, in hex, $N$ and $P$ are:
$$\begin{align}
N &= \mathtt{FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFE\ BAAEDCE6\ AF48A03B\ BFD25E8C\ D0364141} \\
P &= \mathtt{FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFE\ FFFFFC2F} \\
\end{align}$$

The actual values of lambda and beta are easily verifiable and are:
$$\begin{align}
\lambda &= \mathtt{5363ad4c\ c05c30e0\ a5261c02\ 8812645a\ 122e22ea\ 20816678\ df02967c\ 1b23bd72} \\
\beta &= \mathtt{7ae96a2b\ 657c0710\ 6e64479e\ ac3434e9\ 9cf04975\ 12f58995\ c1396c28\ 719501ee} \\
\end{align}$$

The question for me is, how do you derive this? Can someone show me step-by-step how you can figure out these values?


texts:
On reading about block chain technology, it was observed that it leverages the distributed ledger technology through P2P, here integrity is ensured through hash computed by miners, and then is validated by all peers in the network and then added to the block chain permanently if validation passes.

Questions:

If the block chain is ever growing chain, doesn't it run out of storage? Can't this chain be removed permanently?

Does the validation require all peers to agree that the chain is valid or only the majority?

What if a malicious peer joins the group and gives false validation that a valid block is invalid? Does this break the entire chain?


texts: What do people use non-extractable WebCrypto keys for?

texts:
I understand that non-extractable keys are secure because they cannot be exported. But I think many people would WANT to export their keys at some point if they don't want to risk losing everything.
For example, if you stored all your app data encrypted using a WebCrypto non-extractable key and can't export the key, this means you lose access to all your encrypted data when your indexedDB gets wiped out for some reason, or even worse, if your entire computer gets wiped out or the disk gets corrupted (This is not an impossible scenario. For example when you send off your problematic macbook to Apple for repair, they say I should back up everything in case something goes wrong)
This is just encrypt/decrypt scenario, but I'm sure there are same types of issues with sign/verifying messages. If I want to use crypto as my identity by signing messages, why would I want to use a key that even I cannot access and export myself, so I can only use that key on that specific browser on that specific device?
So I guess this is a four part question:

What are the actual use cases for non-exportable keys? Why would people want to go that far while risking key losses?
Don't most people want to be able to reuse and back up their keys, especially since they're used for identity and encryption purposes?
If #2 is true, and there is no way to securely store extractable keys inside a browser, how do people build a secure app using WebCrypto?
Finally, isn't storing keys on the browser fundamentally insecure whether extractable or not? Even if the key cannot be exported, a website sign a message on behalf of the user (or decrypt a message intended for the user and send it to their server) without the user knowing, and that's a huge security issue.


texts: CAPTCHA like mechanisms : Impact on confidentiality of Info

texts:
Humans have  sensory and cognitive skills for solving simple problems that prove to be extremely hard for computer software. Such skills include, but are not limited to processing of sensory information.

One example of the above is randomised distortion of a text image so that it is easily recognisable by humans through their advantage in identification of objects and letters within a noisy graphical environment. This poses a sort of one way function ; where solution by a human is almost instantaneous but that by a computer takes a  lot of effort.

The preceding of course describes a CAPTCHA.

The questions are:

What kind of 'confidentiality' are we looking with such mechanisms? Simply put we have a text which is confidential to a machine. There is no key exchange involved.
Are their any tangible gains in using such a method and then enciphering the text through a deterministic crypto function (RSA, DES, etc.)
Any references in this regards?


texts: What are the consequences of a MAC tag collision?

texts: I've seen some proofs of MAC security that are based on the extremely-unlikely event that two MAC tags collide (ie, they are equal for distinct messages).  Suppose that this extremely unlikely event occurs, then what?  Can we forge arbitrarily more messages with this same tag?  With ANY tag?  Or even better, do we get the MAC key?


texts: How to improve long-term duration of standard checksum for authenticity purposes?

texts:
Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like paper, CD, DVD, etc. And, this is valid as legal proof for decades...

But the checksum is not valid for decades, and the CPU-cost to compute a checksum in this context is not the first problem... So, the question is

  how to improve standard checksums, with minimal impact on the existing workflow?

Examples: (so alternative question is "what is the best?" or "why not?")

use the truncated form of "the best of the best" (ex. truncated SHA256 instead SHA1).
use two checksums instead of only "the best of the best" (ex. SHA1+MD5).
use two checksums, the second after some "file conversion", such as gzip, imagemagick (eg. png2jpg), some pandoc (eg. pdf2text), that preserves main content.

CONTEXT AND EXPLANATIONS

The SHA1 is a cryptographic hash that has been  used as checksum with aims of integrity and authenticity... So, the context of the question is this tradition of use cryptographic checksums for authenticity comprovations, there are no alternatives for a tradition, please not insist :-)

Let's give the name "authenticity-checksum" to this tradition and the methodologies it uses.

The theme gained more appeal last week with the first practical attack, with the discovery of an algorithm that can build a PDF document with the same SHA1 of other distinct PDF... You can check by yourself in a Linux terminal:

  wget -c https://shattered.io/static/shattered-1.pdf
  wget -c https://shattered.io/static/shattered-2.pdf
  # open each file with your PDF-viewer, see how much distinct they are.

  sha1sum shattered-1.pdf shattered-2.pdf
     # 38762cf7f55934b34d179ae6a4c80cadccbb7f0a  shattered-1.pdf
     # ...
  # look at your terminal! the same SHA1 for both files!

The SHA1 was published as a standard by NIST in 1995, gaining popularity and intensive in the 2000s. The first real and published attack was last week, 2017 (when standard was 22 years old). The first published "attack in theory" demonstration was in 2005, so 10 years after launch.

MD5, its precedent, published as RFC in 1992,  with theoretical demonstration in 2008 and real attack in 2012.. It has had a similar timeline in its life-cycle.

We can use the standard's timilines as good time-scale reference, decades, and the historic facts (and Moore's law) as clue that SHA256 will survive less than a decade.

... So, about the use of authenticity-checksum in important digital repositories and digital preservation with horizon of decades context.

Imagine a CD-ROM with a big list of file-names and its checksums, a CD recorded in the year 2004, when we still believed in the durability of SHA1. For this "Use Case in the past", what the best practices, what can we suggest to improve?

(is impossible to test hypothesis with the new standards, as SHA256, but we can in an imaginary use cases, testing the old standards, truncated hashes, and extrapolating results)


texts: Missing step in Schnorr's proof that an attack on blind signatures requires solving ROS?

texts:
In Security of Blind Discrete Log Signatures Against Interactive Attacks C.P. Schnorr defines the ROS Problem and claims that a $(l+1)$ attack against his blind signature scheme is equivalent to solving this ROS problem. (As an aside, some years later Wagner found a way to solve the ROS problem for typical groups, so unfortunately this represents a break on these blind signatures, though an expensive one which practically only allows forging one signature for every 512, which may represent an acceptable loss in many applications.)

A $(l+1)$ attack on a blind signature system is an attack where an attacker interacts $l$ times with a signer, possibly in parallel, and obtains $(l+1)$ distinct signatures from these interactions. In typical applications these signatures represent some asset whose scarcity the signer maintains, but he should not be able to tell which assets are assigned to which participants in the system. This attack allows an attacker to violate the signer-controlled scarcity and e.g. steal money from a Chaum bank.

The ROS (Random Overdetermined System) problem is defined in the paper by equation (1):
$$ a_{k,1} c_1 + \cdots + a_{k,l}c_l = F(a_{k,1}, \ldots, a_{k,l}) $$
where $F$ is a random oracle function. If an attacker can find $a_{k,i}$ and $c_i$ which satisfy $l+1$ instances of the above equation he has solved the ROS problem.

The particular instance of ROS in the paper is defined by equation (2)
$$ H(f_k, m_k) = \sum_{\ell=1}^l a_{k,\ell}c_{\ell} $$
where $f_k$ is some collision-resistant function of the coefficients, $m_k$ is chosen by the attacker, and $\{a_{k,\ell}\}_\ell$, $H$ is a random oracle hash function. Already the presence of an attacker-controlled $m_k$ means that this isn't really an instance of the ROS problem as described above, but let's modify equation (1) to give the attacker a family $\{ F_\sigma\}$ of independent random functions rather than just a fixed $F$, and let him choose any $\sigma$. My first question is whether this modification makes sense and is actually necessary.
More seriously, while Schnorr demonstrates an attack based on solving $l+1$ instances of the above equation (2), and Theorem 2 claims that any attacker must do this, his prove actually forces an attacker to solve the following equation (3):
$$ H(f_k, m_k) = -a_{k, 0} + \sum_{\ell=1}^l a_{k,\ell}c_{\ell} $$
which differs from equation (2) by the addition of this extra attacker-controlled coefficient $-a_{k,0}$. $f_k$ is modified to be a function of $a_{k,0}$ as well as the other $a_{k,i}$'s, so this problem still appears to be "hard", but it's definitely not an instance of ROS. My second question is whether equation (3) can somehow be recast as an instance of equation (1), and how. If not then it appears Schnorr's proof is wrong (or rather, that ROS needs to be defined differently).


texts:
Can CFB mode of block cipher be used as a commutative encryption?

Is it possible to use CFB mode of AES block cipher to create commutative encryption?

With CTR it is possible but not secure.


texts: Is there an effective way for public key generation in homomorphic encryption schemes?

texts:
Is there any way to effectively generate valid distributed public key in schemes like ElGamal or Benaloh for a number of participants? There's no need in private keys since there's no intent to decrypt messages at all, only to encrypt them securely.

As far as I know, there's no effective way to generate distributed key pair in Benaloh.


texts: Encryption scheme with high complexity encryption over decryption

texts: I need an encryption operation be 1000-1000000 times more complex than decryption operation. Is it possible to achieve with EC cryptography?


texts: BGV for three multiplication level/depth

texts:
Can BGV homomorphic encryption scheme support three multiplication level/depth with the help of key switching and modulus switching?

If Yes, how does one set up the parameter to achieve that?


texts: Could a quantum computer recover files from ransomware if the attacker doubly encrypted them with RSA-4096?

texts:
How would a quantum computer decrypt a file (or find the keys to such a file) if it were encrypted with standard RSA 4096 encryption, but encrypted two times with different keys? The keys are known by only one party. They could be different lengths and complexities.

And theoretically, how long would it take (with a general estimated Quantum PC's amount of power)?

Note: The incompetent fools at geek squad 'accidentally' ran a ransomware on my clients computer while trying to restore the files from a ransomware. Then, they did a faulty windows backup and charged him a thousand bucks. He won't take "it's just gone" for an answer, so I need numbers and proof that it's completely unrecoverable. Also, this is a very good question in regards to the future of computer encryption if you can't afford to switch to quantum right away...


texts: Chain several RSA encryptions without increasing the message size

texts:
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.

In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = \mathrm{RSAencrypt}_{K_1}(D_0)$. Then, I would like to be able to encrypt $D_1$: $D_2 = \mathrm{RSAencrypt}_{K_2}(D_1)$, and so on, until $D_n = \mathrm{RSAencrypt}_{K_n}(D_{n-1})$. I want the successive messages not to grow in size: $|D_1| = |D_2| = \ldots = |D_n|$.

Since I obviously want the process to be secure, I suppose I should use some padding. It actually works with RSA_NO_PADDING but as soon as I add some padding, the output is the maximum size which is too large for adding padding for a next round of $\mathrm{RSAencrypt}$.

I was wondering if there was a way to make sure the output does not exceed the size required for another encrypt (e.g modulus - 11), through a specific padding for instance.

I am going to try to explain better what I am trying to accomplish. I've read a paper (http://research.microsoft.com/pubs/102086/key_regression.pdf) about key rotation which consists in taking a RSA key, $K$, and rotate a number $N$: $\mathrm{encrypt}_K(N_0) = N_1$, $\mathrm{encrypt}_K(N_1) = N_2$, etc. I'm basically trying to implement it.

At every step, one can deterministically determine an information based on the number $N_x$.

Now given the RSA key pair, we can imagine the owner keeping the private key which is used for rotating $N$ while the public key is disclosed to a set of users.

Any of those users could therefore derive the previous versions of $N$ by applying $\mathrm{decrypt}_K(N_x) = N_{x-1}$. One would however be unable to determine the future versions of $N_x$ since only the owner of the private key is capable of rotating $N$.

Hope it helps clarifying the use case :)


texts: Security concern about reducing hash value using modulo operation

texts:
As stated in the title, what I am looking for is information about a  "technique" that I would like to use in some of my algorithms.

Sometimes I need to map a hash function's result into a range of numbers that is not as large as the hash function's codomain; to do so I use the modulo operator. I take the hash function's output and treat it as an integer; then to this integer I apply the modulo operation
$$h(x)\bmod n\text,$$
where $n$ is the excluded upper bound of the allowed numeric range $\{0,\dots,n-1\}$.

Now what I would like to understand is if this leads to some security risk, other than the fact that the obtained "hash" size is smaller (so a brute-force attack is easier), for instance that a modulus operator could break randomness of the hash function in some way.

Thanks in advance for clarification.


texts:
I've been reading about safe primes and their use in: Cryptography Engineering by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno.
Having a safe prime $q$ with $q=2p+1$ where $p$ is a Sophie Germain prime
They claim that the elements of the subgroup $p$ are the elements that are preferred to be used. Why?
Why not the elements in $2p$?


texts: Is this distributed random oracle scheme safe?

texts:
This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)?

Is the proposed random oracle model safe when trying to output a distinct and random $m \times G = M$ value?

Doing the interpolation for $t$ compromised shares $m^{'}_i$ results in: $l_0 \times M_0 + \sum^t_{i=1} l_i \cdot m^{'}_i \times G = m \times G$ that reduces to $(m - \sum^{t}_{i=1} l_i \cdot m^{'}_i) \cdot l^{-1}_0 \times G = M_0$, where $M_0$ is always different for each signature. So, I suppose we can't reuse previous values to perform the attack.

How do you solve to a wanted $m$ value without resolving the DLP? Searching for $m^{'}_i$ and $m$ for some unknown $m_0$ is brute forcing the DLP, even in the k-sums context!

What I have seen in the k-sums/generalized birthday problem is a way to solve for $x_1 \oplus ... \oplus x_n = 0$. Mapping this approach to our problem, we should try to solve for $x_1 \oplus ... \oplus x_n = m_0$ equivalent to $x_1 \oplus ... \oplus x_n \oplus m_0 = 0$. The issue is, $m_0$ has a specific value but it is unknown to the solver due to DLP. How can we solve for something we don't know? If such solution were possible, won't this be solving the DLP?

I need a math clarification to explain exactly how this attack is performed?

Edited1: Expanded math proof:
Trying to follow @Aman Grewal logic, lets try to attack in a k-sum scenario.

All variables marked in the form $c^*$ are controlled by the attacker. The attacker's objective is to sign a random $B^*$ for a submitted $B$ such that $B^* \neq B$. The attacker has access to $M_0$ and $c=H(Y||M||B)$ for this or any previous messages. Assume the attacker has knowledge of $t$ shares of $y_i$.

We remove the Lagrange coefficients $l_i$ from the math, since they are public and doesn't affect the final proof. For a single signature we have:

For a set of randomly selected $m_i^* \times G = M_i^*$ one can derive $\sum_{i=1}^t M_i^* + M_0 = M^*$
Then $c^* = H(Y||M^*||B^*)$ and the output of a single signature is $(m_0 + c \cdot y_0) + \sum_{i=1}^t (m_i^* + c_i^* \cdot y_i) = m^* + c^* \cdot y$. Assuming $m_0 + \sum_{i=1}^t m_i^* = m^*$ and $c + \sum_{i=1}^t c_i^* = c^*$ (this last one is not totaly correct, since we removed the Lagrange coefficients, but this is even easier to attack)

One cannot solve for $c_i^*$ in $\sum_{i=1}^t (m_i^* + c_i^* \cdot y_i) = (m^* + c^* \cdot y) - (m_0 + c \cdot y_0)$. Even assuming that $m^*$ is equal to some previous result and that $c^*$ is directly dependent on $c_i^*$. There are $t + 3$ unknowns corresponding to $(c_i^*, y_0, y, m_0)$. So... lets expand it to $j$ signatures:

The real equation we need to solve is:
$\sum_{j=1}^n \sum_{i=1}^t (m_{ij}^* + c_{ij}^* \cdot y_i) = \sum_{j=1}^n [(m_j^* + c_j^* \cdot y) - (m_{0j} + c_j \cdot y_0)]$

Assuming somehow you can have a lot of equalities in this system of equations between signatures $j$, you are still left with $(t + 2) + j$ unknowns for $(c_i^*, y_0, y, m_{0j})$. For every new equation, you have a new unknown $m_{0j}$ that you can't catch up. $m_{0j}$ is distinct for every new signature by the definition of the threat model.

Edited2: Eq public version:
The public version of the equation is:
$\sum_{j=1}^n \sum_{i=1}^t (M_{ij}^* + c_{ij}^* \cdot Y_i) = \sum_{j=1}^n [(M_j^* + c_j^* \cdot Y) - (M_{0j} + c_j \cdot Y_0)]$

In this case there are only the $c_{ij}^*$ unknowns, but we have the DLP. If there is an efficient way to solve this, are we breaking the DLP?

If any one can contest this math logic to come up with a successful attack, I will accept your answer.


texts:
I tried for about 1 month to understand ABE and know I am confusing about access tree. In paper "Attributed-based encryption for fine-grained access control of encrypted data" the author explained the generation of keys with access tree for KP-ABE which I attached the picture of it here.

I found an example for this but some parts in paper are not clear for me.

1) what is the meaning of "threshold value"? Based on the top example, how can I determine this for different nodes?

2) What is the meaning of the index (x)?

Thanks a lot. I appreciate your helps.


texts:
Lets say p = str and  h = SHA512(p) i send the h which is the SHA512 of p to a friend using via email my friend in order to be sure that I'm the right person ask me to prove that I know the p. How can I can prove that I know p without disclosing it ??
As I have read so far its possible via zero-knowledge proof. Any pseudocode or python example are welcome.


texts: How is HKDF-Expand better than a simple hash?

texts:
Why do we need HKDF-Expand  if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say:

  The second stage "expands" the pseudorandom key to the desired
  length...

Is it only to allow for longer keys? So that if all we need is, say, 32 bits - we can simply use SHA256? Or is there another need to it?


texts: Do PBKDF2 keys generated at a lower iteration count leak information?

texts:
Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 bit key for the user.

The key is then split in half: the first half is kept locally as the encryption key, and the second half is sent to the server as the user's "password".

key = pbkdf2(password: inputted_password, salt: some_salt, cost: 50000, size: 512)
encryption_key = key.first_half
server_password = key.second_half

server_password is sent to the server to authenticate.

Assume now that on some subsequent login session, the client is tricked by some irrelevant means into computing server_password using a lower iteration count of 3,000 instead of the real value of 50,000.

So the client is tricked into using a lower cost:

key = pbkdf2(password: inputted_password, salt: some_salt, cost: 3000, size: 512)
server_password = key.second_half

and this server_password is sent to the server.

My question is, does this "weaker" derived password leak any information to the server on what the nature of the user's original inputted password is?


texts: Trying to understand Keybase's key model and replacing PGP with device keys

texts:
I am exploring Keybase and I thought it was merely a wrapper for gpg and connecting its public key with social accounts (e.g. github, twitter, etc...). But after reading the very short and unclear post in https://keybase.io/blog/keybase-new-key-model it seems that Keybase now by default generates 2 key pairs (one is curve25519 for encryption and the other is probably ed25519 for signatures) for each installation/device per user and use these 2 key pairs by default for keybase sign and keybase encrypt commands.

My question is more about the curve25519 key pair part. Is this design secure since, I think, they have to basically use static-static diffie-hellman for every encryption between any 2 users with same devices or key pairs? I mean if one of the 2 users has his private key compromised this means that every encryption between the 2, whether that user was the sender or receiver is compromised. That imposes a risk on the other user even if he is keeping his private key secure. Am I missing something here?

Woudln't it be better to generate an ephemeral curve25519 key signed by the static ed25519 or whatever the signing key alg is and do ephemeral-static DH? I know it still won't give forward secrecy but at least if the the compromised party is the sender the attacker won't be able to read these messages since he doesn't own the other party' static private key.


texts: Proofs of collision resistance by reduction

texts:
I'm looking for examples of a proof by reduction. For example:

Let $A=(Gen, H)$ be a hash function. We define a new Hash function $A'=(Gen',H')$ with $Gen=Gen'$ by $H'_s(x)=H_s(H_s(x))$.
It should be shown that if $A$ is collision resistant, then $A'$ is collision resistant too.

I am  not  looking for a solution for this question.
I'm looking for an idea of how to construct a reduction so that I can solve this problem on my own.


texts: Computational Complexity - When is it really exponential time?

texts:
I'm currently working on the discrete logarithm problem and the relevant attacks. I'm fine on the mathematical side of things, but when it comes to estimation of running times I run into problems. More specifically: if we take a generic square algorithm like Baby Step Giant Step for a cyclic group of size $n$, we usually arrive at $O(\sqrt{n})$ necessary operations to find a discrete logarithm. With the argument that the input of the algorithm is measured in bits, we arrive at a running time of $O(2^{b/2})$ where $b$ is the bitlength of $n$. So far so good.

But this argument does not work for say, matrix multiplication. Let's take $A,B \in Mat(n \times n, \mathbb{Z})$, so computing $A \cdot B$ obviously takes $n^2$ operations in $\mathbb{Z}$. This is, in contrast to the above, considered efficient. So why can't I argue as above and say that matrix multiplication takes exponential time as well?

On a more general level, I often encounter the argument that some algorithm requires $O(p(n)$ (p(n) being some polynomial) operations that themselves can be computed efficiently and thus the whole algorithm is considered efficient. This runs counter to my intuition I gained from looking at Pollard's Rho etc.

I know I'm probably making a stupid mistake somewhere, but I'm not seeing it at the moment.

Thanks for any help!


texts:
We're all aware of the Logjam attack, which is known as "FREAK on discrete logarithms". The attack works by doing a large pre-computation step, which needs only to be done once per field and then quickly computes discrete logarithms. As this seems to be a special property of the GNFS version for discrete logarithms I asked myself if the same property applies for the GNFS version for factoring.

Question: As the GNFS performs a large pre-computation step, can intermediate results be re-used for distinct factorizations?


texts: If $G'(s)=G(s0^{|s|})$ and $G$ is a PRNG, is $G'$ necessarily a PRNG?

texts:
I argue it is because there should be no more correlation between the outputs $G(s0^{|s|})$ than between the outputs $G(s)$. Thus we can say the $G'(s)$ is a PRNG that satisfies $|G'(s)| \geq 4|s|$. If we let $s' = s0^{|s|}$ and denote the set of all $s'$ by $S'$, then $s'$ should be chosen uniformly at random from $S'$. Since, as I stated there should be no correlation between $G'(s')$ for any $s'$, then effectively we are only increasing the expansion factor $l$.

Disagree? Please tell me why.


texts: How to make cookies tamper-proof and secure by using encryption and hash / MAC

texts:
Our company has decided to ditch server side sessions in favor of storing authenticated information such as user id and access privilege information in a cookie.

Before everyone jumps up and down about this approach, given that this is a business decision - how would I do this right? The basic need is to prevent user from tampering the cookie to avoid promoted privileges / or pretend to be a different user and also hides the information. Assumption is all systems are running HTTPS hence let's pretend we won't have cookies being hijacked and replayed etc.

I've read Should we MAC-then-encrypt or encrypt-then-MAC? but I just want to know if this naive approach can work: (plaintext below is my cookie in json format).

// where only 1 secret for AES is used
aes-ctr((plaintext || sha2-256(plaintext)) || iv

Or do I have to do this?

// where 2 secrets are used, one with HMAC and one with AES
let E be: (aes-ctr(plantext) || iv)
then E || hmac (E)

Or are both approaches insufficient?

There are a few key difference between the 2 approaches:

1st approach: In the digest part, we are doing the simple sha256 without the use of nonce or key.

2nd approach: We are using HMAC with one key and another key for AES.

Based on my limited understanding, the listed arguments against a plain digest as oppose to HMAC is due to opportunities for length-extension based attacks. However in my case, given I've AESed the digest, there should be no such opportunity.

Other attacks listed in here: http://www.thoughtcrime.org/blog/the-cryptographic-doom-principle/ appears to be applicable for block mode only, where we are using CTR.

Apologies if this question appears naive - I am a newbie in cryptography.


texts: Formal modeling and automated verification of a remote attestation protocol

texts:
I'm involved in the design of a communication protocol that requires mutual
remote attestation of both communicating parties prior to exchanging any other
data. We found several tools for symbolic security analysis of cryptographic
protocols such as ProVerif, Tamarin or Verifpal.
However, we barely have any experience with formally analyzing crypto protocols.
The manuals of the previously mentioned tools already provide some
examples. Are there any other good sources that concretly explain how to
formalize a secure communication protocol in a machine checkable way? Are there
any other tools that are better suited for this task considering the focus on
remote attestation?


texts: Is there an asymetric encryption whos output size is quite equal to the input size

texts:
I want to send a verifiable chunk of data (around 16 bytes) by simply encrypting it with a private RSA key, providing the public key in the source code for the verification. This was my initial thought. (I now know that this is not the same as signing the data, but this does not matter now.)
I tried RSA and ECC to determine that the length of the output data relies on the length of the keys. For this small amount of data, even the much smaller ECC keys produce a heavy amount of data overhead. So the question is: Are there any asymmetric encodings that don't have so much overhead, or is this per se impossible with asymmetric encryption/signing?
I found the possible solution of using message authentication codes. Still, I don't like that I have to provide the security with the software, which is (if I understand correctly) the case for every symmetric encryption. But maybe I'm wrong, and this is not such a big issue?


texts: Is there any advantage on encrypting the CMAC together with the message?

texts:
I'm reading a protocol specification where the procedure is to generate a CMAC, take the first 4 bytes of it, append this authentication tag to the message and then encrypt the message + CMAC together with another key using CTR mode encryption.

Both CMAC and CTR mode are defined to use the AES-128 block cipher.
A separate key is used for CMAC authentication and CTR encryption.

Does encrypting the MAC add any extra security? Shouldn't CMAC be already "secure" by itself?

Is this a typical approach for doing encryption + integrity verification?


texts:
in short I'm learning GUI programming in python and thought it could be interesting to make a small GUI for symmetric encryption. Not being mad/mathematical/experienced (take your pick) enough to try to implement ciphers myself I figured I could create a GUI that just sits on top of an existing program (on Linux). So I found gpg and mcrypt.

I have been googling like mad but finding very little information about mcrypt other than it is "a replacement for the old crypt program in Linux". Also mcrypt seems to list Rrijndael in stead of AES (so guessing it is the Rrijndael cipher rather than the AES implementation of it?)

Now, save that mcrypt has an implementation of Serpent and gpg comes with the ability to sign/verify the encrypted file, is there any great differences or advantages/disadvantages to one or the other? currently finding mcrypt fascinating.

Any thoughts would be appreciated.


texts: Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other?

texts: I know the garbled circuit solution, but is there any more efficient method?


texts: Difference between semi-honest and malicious adversary using Ideal Real Model Paradigm

texts:
Would you please explain to me why in the security definition of ideal/real model paradigm which is described in the efficient secure two-party protocol book(Hazay, Lindell), the simulator tries to simulate inputs and outputs of a party(in the semi-honest model), but the simulator just tries to simulate outputs and not inputs in the malicious model?

Would you please explain the difference between the security definition of idea/real model in the semi-honest and malicious model which is described in that book(page 21 and 25)?

Malicious Adversary

Semi-Honest Model


texts: ECDSA: Is it possible to generate from known signature (Key, message) valid signature (-Key, message)?

texts:
Let Alice has private key $R_1$ and known to Bob public key $P_1$. She generates signature for some message $M$ and shows it to Bob.

Could Bob generate signature for the same message $M$, but for different key-pair, exactly $R_2$ and $P_2$, such as

$R_1+R_2=N$, where N is order.

($P_1=-P_2$)


texts: Can a message and one time pad each encrypted with separate ciphers be weaker than the stronger of either cipher?

texts:
Assume you have:

A truly random one time pad, $P$
A plain text message, $M$
Two symmetric ciphers, $C_S$ and $C_W$, where $C_S$ is always more secure than $C_W$

Assume the keys have already been securely exchanged and the attacker intercepts everything Alice transmits.

In theory, can $C_S(P \space \oplus \space M)$ and $C_W(P)$ taken together be less secure $C_S(M)$?

Also, is $C_S(P \space \oplus \space M)$ and $C_W(P)$ always more secure than $C_S(M)$.

In longer form, if I XOR a message with a one time pad and encrypt that with one cipher and encrypt the one time pad with a different cipher, can that be less secure than just using the stronger of the two ciphers? Is it the case that it would always be stronger?


texts: AES with a longer key instead of key expansion?

texts:
What are the disadvantages of using AES-256 with 240-byte key (which scrypt/bcrypt/argon2/pbkdf2 can easily output) instead of an expanded 256-bit key?

The only disadvantage I can think of is "no more hardware acceleration". This is not important for a fair comparison, are there other disadvantages?

EDIT: This is about replacing round keys.


texts: Could be generated a symmetric key for every message?

texts:
I would like to use IES (x25519 and AES-GCM), but every message used a new session key, does that affect the performance of the system?
do I need to used session key to refer to the key that used by previous session?

For example,

Assume Alice knows Bob's public key.
Alice would like to send a message to Bob.
Alice generates her public and private keys,
Then, she derives a session key k by using her private and Bob's public keys.
Then, by using AES-GCM provides authentication for her public key and encrypts the message.
She sends her public key and encrypted message to Bob.
Bob drives the key and decrypts the encrypted message.
Bob replay by encrypted the message by using the k.
Then, if Alice would communicate with Bob, she repeats generates her public and private key.


texts: How hard is the following q-Strong Diffie-Hellman problem?

texts:
From On the $q$-Strong Diffie-Hellman Problem, the following problem is well-known to be hard.

  For an randomly chosen element $x \in \mathbb{Z}_p$ and a random generator $g \in \mathbb{G}$, the exponent $q$-strong Diffie-Hellman Problem is, given $(g, g^x, g^{x^2}, \dots, g^{x^{q-1}}) \in \mathbb{G}^{q}$ to compute an element $g^{x^q} \in \mathbb{G}$.

Here, I want to ask how hard is the following problem:

For an randomly chosen element $x \in \mathbb{Z}_p$ and a random generator $g \in \mathbb{G}$, given $(g, g^x, g^{x^2}, \dots, g^{x^{q-1}}, g^{x^{q+1}}, g^{x^{q+2}}, \dots, g^{x^{2q-2}}) \in \mathbb{G}^{2q-2}$ to compute an element $g^{x^q} \in \mathbb{G}$.

Can it be reduced to other well-known Diffie-Hellman problem?


texts: How do the following new (2013) ECC curves compare in security or efficiency?

texts:
I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves.

I need a curve for signing or encryption, (or both) but not sure how to choose from the following:

M-221
E-222
Curve1174
Curve25519
E-382
M-383
Curve383187
Curve41417
Ed448-Goldilocks
M-511
E-521

Questions:

Are there performance, size, or power efficiencies from one curve to another?
Perhaps more important, are there security improvements over a given curve?


texts: How to detect duplicate values of sensitive data that needs to be encrypted

texts:
This was a question that was posted on the information security exchange but was suggested I may get a better answer here.

The link suggested in the original post is similar, but I think a search index for a simple comparison here is potentially not efficient.

I have a scenario where text values that are considered sensitive (not passwords) need to be encrypted for persistence onto a database.

The key requirement here is being able to identify if a value being received has been received in the past.

One solution that is being considered is to Encrypt the each value using the AES encryption algorithm with the same key and IV to generate the same cipher for each value received making it easy to detect if this value has been received in the past. However I have concerns regarding the strength and security of this solution.

The amount of data to be encrypted is quite small, < 50 characters

So the question is, what other options are available to meet these requirements in a better way?


texts: Is there any examples of information-theoretic secure MPC for dishonest majority against malicious adversary?

texts:
My research is to propose highly secure MPC protocol with some conditions.
Especially, I want to consider that

security against malicious (active) adversary
dishonest majority setting
information-theoretic security

I know SPDZ family that achieve 1 and 2 above and some protocols that achieve 1 and 3 above.
Could you tell me the MPC that achieves 1, 2 and 3 above?
I want to know this type of MPC as an example, however, I cannot find it.
I think this type of MPC cannot exist if it doesn't have very strong conditions.
The answer "I don't know this type of MPC" is also welcome.


texts:
I'm working with a Cortex M0 SoC that integrate an "RNG" (not specifically claimed as TRNG), that is however claimed to be "suitable for encryption". It works using thermal noise measurements.
Knowing the whole SoC retails for less than $10, my wonder is: if it is that good, why isn't it more widespread? In particular, why is it not available on the PC platform. I read that Intel used something similar, but it is no longer in use.
Since the whole RNG should probably be analyzed to determine if it's any good, my question is more like: "Can thermal-noise be used for a TRNG ?"


texts:
I tried to calculate the sum of two Points on an elliptic curve in a finite field. The Curve is defined as following:

$$y^2 \equiv x^3 + x \mod 257$$

So the curve parameters are $a = 1,b = 0,p = 257$.I want to add the two points $P = (1|60)$ and $Q = (15|7)$:

$$60^2 \equiv 1^3 + 1 \equiv 4 \mod 257$$
$$7^2 \equiv 15^3 + 15 \equiv 49 \mod 257$$

To add this two points, I calculate the slope $s$, $x_r$ and $y_r$:

$$s = \frac{y_q - y_p}{x_q - x_p}$$
$$x_r = s^2 - (x_p + x_q)$$
$$y_r = s(x_p - x_r) - y_p$$

for my points $P$ and $Q$ I get:

$$s = \frac{7-60}{15-1} = \frac{-53}{14} = -3.7857142857$$
$$x_r = (\frac{-53}{14})^2 - (1 + 15) = 14.3316326531 - 16 = -1.6683673469$$
$$y_r = \frac{-53}{14}(1-(-1.6683673469)) - 60 = -70.1016763848$$
$$R = (-1.6683673469|-70.1016763848)$$
However:
$$x_r^3 + x_r = -6.3121837787$$
while
$$y_r^2 = 4914.2450319648$$
So $R$ seems to be outside the curve. Even if I calculate everything modulo 257 I get weird results.

What I don't understand:

since I defined the curve on a finite field, I expected integer results
I expected $R$ to be part of the curve
the definition of $x_r$ is the difference between $s^2$ and the sum of the x-coordinates of the two added points. Why can $s^2$ be interpreted as an x-coordinate or even a length?
in reference to wikipedia, the addition of two points of an elliptic curve is commutative. That seems to be true for $x_r$, but why should it be true for $y_r$?

Notes:

I looked for an answer to this questions and all I did find were this and this. Both questions looked similar to mine but I still don't understand addition on elliptic curves.
I'm really new to elliptic curves, sorry if I did huge mistakes by calculating these values


texts: Protection of Nonce in CCM Block Cipher Mode of Operation?

texts:
CCM mode of operation combines CBC (for integrity and authentication) and CTR mode (for data confidentiality)

The inputs to the CCM are

A Valid Nonce N which is used in CTR mode
Valid Payload P
Valid Associated data A which will be authenticated but not encrypted
A Vlaid Key K

The CCM Algorithm works as

Apply formatting function on (N,A,P) to make blocks such that B0||B1||B2....Bn = B
AuthenticationTAG = (CBCk (B))LastBlock Truncated to Desired Length of AuthenticationTAG
CiperText = CTRk,N (P || AuthenticationTAG)

Why do we need to include the Nonce N in Authentication? What implications does it have if N is not made part of the authentication tag?

Why do we use same key for both authentication and confidentiality? Why not two separate keys?


texts: How GGH/HNF public key cryptosystem encryption process works

texts:
I'm reading paper Lattice based cryptography which at section 5 page 14 it describes GGH\HNF scheme that i can not quite get it and i need help.

The private key is a “good” lattice basis $B$. Typically, a good basis
is a basis consisting of short,almost orthogonal vectors.
Algorithmically, good bases allow to efficiently solve certain
instances oft he closest vector problem in $L(B)$, e.g., instances where
the target is very close to the lattice.
The public key $H $ is a “bad” basis for the same lattice $L(H) =L(B)$. In
[47], Micciancio proposed to use, as the public basis, the Hermite
Normal Form (HNF) of $B$. This normal form gives a lower triangular
basis for $L(B)$ which is essentially unique.
The encryption process consists of adding a short noise
vector $r$(somehow encoding the message to be encrypted) to a properly
chosen lattice point $v$. In [47] it is proposed to select the
vector $v$ such that all the coordinates of $(r+v)$ are reduced modulo the
corresponding element along the diagonal of the HNF public basis $H$. The
vector $(r+v)$ resulting from such a process is denoted $r \; mod \; H$, and it
provably makes cryptanalysis hardest because $r \; mod \; H$ can be efficiently
computed from any vector of the form $(r+v)$  with $v \in L(B)$. So, any attack
on $r \; mod \; H$ can be easily adapted to work on any vector of the form $r+v$ by
first computing $(r+v) \; mod \; H = r\; mod \; H$. Notice that $r \; mod \; H$ can be computed
directly from $r$ and $H$ (without explicitly computing $v$) by iteratively
subtracting multiples of the columns of $ H $ from $r$. Column $h_i$ is used to
reduce the $i'$th element of $r$ modulo $h_{i,i}$.
The decryption problem corresponds to finding the lattice
point $v$ closest to the target ciphertext $c= (r \;mod \; H) = v+r$ , and the
associated error vector $r=c−v$.

my questions : lets define $H' = diag(h_{11}, h_{22}, ...)$

I cant understand part i wrote in bold and how to pick $v$ that
implies $(r+v) \bmod H  = r \bmod H$

is $\mathcal{P}(H')$ a fundamental region?

Is $r \bmod H $ same as $r \bmod \mathcal{P}(H')$ ,Then if its why
should there exist a $v$ such that $v \bmod H = 0$? .

I think the main problem is i do not understand $\bmod H$ operation and "are reduced modulo the corresponding element along the diagonal of the HNF public basis H".
PS : in [47] $B$ is upper triangular so $B^*$ is diagonal. and $r \bmod B$ is defined as $r \mod \mathcal{P}(B^*)$.


texts: Stream cipher vs OTP, with /dev/urandom and secure key exchange

texts:
My application will work in an office setting where a user can directly and securely collect a long One Time Pad.  For example, it may be 16Gb on a USB drive.  This would fill me with joy except that the OTP will be generated from /dev/urandom and therefore is not 'truly random'.
I understand that /dev/urandom is acceptable for most cryptographic uses, but my OTP would no longer be information-theoretically secure.
In this circumstance, should I continue down the OTP path, or use a stream cipher instead?  Are there other factors to consider?  (Note: I believe the staff can store their OTP securely).


texts: How to determine the maximum number of times the DES algorithm needs to be run?

texts:
I am only a beginner in cryptography and I am getting confused by the following:

Question

Consider a known-plaintext attack performed on a double-DES cryptosystem.

(a) Determine the maximum number of times the DES algorithm needs to be run when
using the brute-force strategy.

(b) Determine the maximum number of times the DES algorithm needs to be run when
using the meet-in-the-middle strategy.

My Answer

These are what I think is correct, please let me know if i am wrong, Thank you!

a) Double DES uses a key length of 112. Therefore brute force will take maximum 2^112 attempts to break double DES.

b) DES has a key space of 2^56. Double DES has twice the security of DES, therefore it will have 2 * 2^56 = 2^57 security.


texts:
Is elliptic curve point multiplication semantically secure? I'd like to know if there are some sets of elliptic curve parameters (e.g. NIST curves) that are proved to be semantically secure or that are not disproved.

By "elliptic curve point multiplication is semantically secure", I mean the following:

Suppose an elliptic curve over a finite field $\mathbb{F}_p$ where $p$ is a prime number. The equation is $y^2 = x^3 + ax + b$. $G$ is a base point and it generates all the points $E = \{G, 2G, ..., (q-1)G, \mathcal{O}\}$ in the curve. Here $q$ is prime and it is the order of the curve. We have the following cryptosystem:

The encryption of a point $P$ ($P \ne \mathcal{O}$) is $sP$ where $s$ is a random secret key and $1 \le s < q$.
The decryption of a point $Q$ is $s^{-1}Q$ where $ss^{-1} \equiv 1 \mod q$

Suppose there is a set of $n$ distinct points $\{P_1, P_2, ..., P_n\}$ and their encryptions $\{Q_1, Q_2, ..., Q_n\}$ with a secret key $s$. The orders are not necessarily the same, i.e. $Q_1$ might or might not be the encryption of $P_1$. If it is infeasible to determine which encryption belongs to which point better than random guessing, then this cryptosystem is semantically secure.


texts: What are SNFS-safe limits for an RSA moduli optimized for simple modular reduction?

texts:
I consider $n$-bit RSA moduli $N$ having high-order bits starting by with $k$ bits at 1, then $k$ bits at 0, then $m-2k$ bits at $1$ for as large an $m$ as possible, with $n\in\{2048,3072,4096\}$ and $k\in\{8,16,32,64\}$.

For example, with $k=32$, the hex for $N$ would be FFFFFFFF00000000FFFFFFFFFFFFFFFF...

Otherwise stated, I want $2^n-2^{n-k}+2^{n-2k}-2^{n-m}<N<2^n-2^{n-k}+2^{n-2k}$.

How large can we confidently make $m$ while having a rationale that SNFS (or optimizations of GNFS made possible by the special form of $N$, or any other technique applicable to classical computers) won't make the factorization of $N$ sizably easier than for more conventional choice of $N$?

Assume $N=p\,q$ with $p$ and $q$ below $2^{n/2}$ and otherwise essentially random primes within the constraints on $N$.

Motivation: I'm thinking of making a tiny portable (C99) RSA signature verification function, to prove it can be done (context). There's no secret manipulated, thus no need for side-channel leakage protection, which is a huge simplification. The largest remaining potential simplification is in quotient estimation for modular reduction, which I guesstimate accounts for nearly 1/3 of the code size, and a lot of the complexity. The special form of $N$ allows to cut down on that, while leaving a large choice of $p$ and $q$ of $n/2$ bits (which is desirable to maintain compatibility with classical implementations for the private-key side).


texts:
A variant of RSA cryptosystem is given as following:
$$N=p*q$$
$$ed=1 \space \space mod \space \space (p^r-1)(q^r-1)$$
$$c= m^e \space \space mod \space \space N $$
$$m= c^d \space \space mod \space \space N $$
where $r$ is an a small integer and $p , q$ are primes , $e$ is public exponent , $d$ is private exponent
Trivial Q. Does replacing $\phi(N)$ with  $(p^r-1)(q^r-1)$ produces a vulnerability?


texts:
I just started to study lattice Cryptography.

I'm now studying worst-case to average-case reduction for SIS.

In  previous question, "worst means any and average means random".

And I wonder why the Shortest Independent Vectors Problem(SIVP) is the worst-case problem.

And, does SIVP means that

"For 'any' given lattice basis B, it is hard to find n linearly independent short vectors in L(B)"?

The definitions that I saw didn't have the word 'any'.

Does the word 'any' is involved in the sentence even though it is not explicitly mentioned?
I'm guessing that SIVP is a worst-case problem because of 'any'.

If it is correct,  does

"For a given 'randomly' chosen lattice basis B, it is hard to find n linearly independent short vectors in L(B)"

is an average-case problem?


texts: Finding if two points on elliptic curve are related

texts:
On a given elliptic curve I have some points that are defined like this:
Where
$$A=a*G$$
$$B=b*G$$
$$C=(a+b)*G$$
$$D=d*G$$
$$E=(a+d)*G$$
So finally I have two equations like below:
$$A+B=C$$
$$A+D=E$$

Given the values $(C,E,A)$, is there any way I can prove that point $A$ is common in both the points $C$ and $E$?

Or can I also prove that point $A$ is part of the $C$ and $E$?


texts:
Alice and Bob need to share public keys to sign/verify ephemeral keys. They have a secret key $K$.

Alice generates a 32 bytes random number $A$, computes $\operatorname{HMAC-SHA256}(K, M||A)$ and sends Bob the hash and plain $M$, $A$
Bob computes $\operatorname{HMAC-SHA256}(K, M||A)$ to check the hashes
If hashes match, Bob computes $N=\operatorname{HKDF}(A||K)$
Bob encrypts his public key $E_N(\mathit{PubKeyBob})$ using AES 256 GCM, and sends the cipher to Alice
Alice computes $N$ and decrypts the cipher, encrypts her public key $E_N(\mathit{PubKeyAlice})$, and sends Bob the cipher
Bob decrypts the cipher and they both have each other's public key

Is this a safe way to share public keys?


texts: what method of transposition does AES 256 encryption use

texts:
I'm interested in learning how to use AES-256 encryption in C/C++. I'm still a beginner in Cryptography but I'm confident in my abilities to program.

There is still a lot for me to learn about this topic so please don't respond telling me that I shouldn't be implementing the algorithm or that I should be in college. I'm not, and never will be.

My question is just on the method of transposition used after you send the function a message and a key. I don't fully understand how to use the key but I understand enough to know that the message chars go though a function that gets called a minimum of 10 times. I also understand that the function goes through a processes of Substitution -> Transposition -> Substitution -> XOR

My question regards Transposition. I understand two methods(I don't know their name) One where you draw your message bit by bit on a line alternating top and bottom, eventually combining the top half with the bottom half. The other method I understand is where you have say a number and use the number to encrypt ex:

3612
hell
othe
rexy

cipher text: lhxleyhorete

Which methods are used in AES-256? Does it use more than one?


texts: Taking advantage of one-time pad key reuse?

texts:
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel.  Alice and Bob have a shared key $k$; however, both messages are the same length as the key $k$.  Since Alice is extraordinary lazy (and doesn't know about stream ciphers), she decides to just reuse the key.

Alice sends ciphertexts $c_1 = m_1 \oplus k$ and $c_2 = m_2 \oplus k$ to Bob through a public channel.  Unfortunately, Eve intercepts both of these ciphertexts and calculates $c_1 \oplus c_2 = m_1 \oplus m_2$.

  What can Eve do with $m_1 \oplus m_2$?

Intuitively, it makes sense that Alice and Bob would not want $m_1 \oplus m_2$ to fall into Eve's hands, but how exactly should Eve continue with her attack?


texts:
This is not a question about whether I should encrypt or sign first, as I've read here.
Rather, it's about whether I should sign, then encrypt, then sign again.
Because as far as I know, there is no way of knowing a sender identity before decrypting. And if a malicious party were to encrypt some virus, only after decryption would I know that what was sent is a virus. Which by then would already be too late, in some cases, especially if the virus is exploiting a bug present in the decryption method to execute code.
However, this problem could be circumvented altogether if I know in advance the sender identity, and strictly decrypt only from trusted signatures.
This protocol then required a double signature. First to sign the content itself to prove ownership (of course with the content containing the intended recipient's name). Second to encrypt it so that only the intended recipient may see the content. Third to sign the encrypted message for the recipient to decide whether to even bother decrypting the message.
So my question is if this, double signing (before and after encryption), is an over complication, or if this is a legit method of security?


texts: no speedup from preprocessing in blynn's PBC library

texts:
I am implementing some pairing-based cryptography protocol using blynn's PBC library.

I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to measure only a very tiny speed up.

Question: Could someone tell me if this is normal and if not if there is a problem with my code ?

Here is my code: http://pastebin.com/5atzBGya
As you can see it's pretty simple:
I make a thousand pairings, either using preprocessing or not
depending on the PP compiler macro.
If that helps I use the PBC params d159.params
(see PBC manual on params)

Here are the timings I get, in user time, for 1000 words:

    PP ON : 21.376s, 20.736s, 21.443s
    PP OFF: 22.052s, 22.788s, 22.771s

As you can see the difference is extremely tiny.


texts: How is digital signature different from a message authentication code (MAC)?

texts:
I know the definitions of both but can't specifically tell how they are different and if one is better than the other.
Please help.


texts: Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?

texts: Ed25519 secret and public keys can both be represented in 32 bytes. Why does NaCl use 64 byte signing keys?


texts:
I think this should be a simple question and I might be missing something fairly fundamental, but I haven't been able to find the answer.

Basically, suppose there are parties $A$ and $B$. Party $A$ gets a secret input $s$. Party $B$ has no input. They wish to securely compute the function $f(s) = (\bot, \bot)$ so nobody learns any information.

Suppose the protocol they use goes as follows: $A$ sends $s$ to $B$ in the clear. Clearly, this 'should not' be considered secure, as $B$ wasn't supposed to learn anything but she learned $s$. However, by the simulator-based definition of security, I don't understand why we can't efficiently simulate $B$'s view.

I.e. if we generate a simulated transcript just by picking a random $s$ and sending it to $B$, how can he distinguish between that and a real transcript?


texts: (Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?

texts:
I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special importance here, as otherwise, the simple algorithm below wouldn't apply.

The principle is quite simple and reuses some logic from Chow et al: transform all inner block (formed by a series of 8 quarterround() functions looped 10 times) into a lookup table that takes the nonce as input. Notice that here, again, I am not considering more than one block of input, otherwise what I am proposing here wouldn't make sense, as a second round of the algorithm would have different x[0]..x[3].

In other terms, this is what I am trying to do. As in RFC 7539, instead of:

      chacha20_block(key, counter, nonce):
         state = constants | key | counter | nonce
         working_state = state
         for i=1 upto 10
            inner_block(working_state)
            end
         state += working_state
         return state
         end

I am willing to do something like:

      chacha20_1st_block(nonce):
         return lookup_tables(nonce)
         end

precomputing lookup tables where the counter is always 0 (or any other constant), and dimensioning the nonce such as the table size doesn't get too long, complementing the other bits with zero. For instance, if we consider nonces consisting of 13 bits, it is possible to generate 8192 tables containing 16 words of 32 bits, or exactly 512kB. Other sizes may be obtained by adjusting the nonce size.

I'm afraid I am making obvious questions here, but:

Am I considerably reducing the complexity of finding the original key this way?
Am I increasing attack chances?

EDIT 1:
I left an implementation of the algorithm above in https://github.com/balena/chacha20-whitebox.


texts: Are there encryption systems that are both homomorphic and commutative?

texts:
If so, which ones are?

If not, is it known whether or not these are mutually exclusive?

Is there a page that exhaustively lists encryption systems and properties such as these? I could not find a resource to help me find these answers on my own.


texts: Security estimation of LWE using "On dual lattice attacks against small-secret LWE and parameter choices in HElib and SEAL"

texts:
I recently found this paper eprint which estimates security of LWE instantiations using an improved Dual attack.
However, I got confused looking at their example in this site.
For example, in the case of NewHope their example gives states that minimum operation (rop) using dual attack is $2^{371}$, whereas the minimum $\beta$ is $1168$. So following the NewHope paper the securty of NewHope should be $2^{.2075*1168}\ =\ 2^{242}$. Which indeed increases the security of the NewHope. I am wondering which should I take as the bit security?

Another question is definition of $\alpha$, in their paper they define $\alpha=\sigma*\sqrt{2\cdot \pi}/q$ whereas in the example they have taken $\alpha=\sigma^2/q$ (NewHope parameter).


texts: Should signature verification work using two different RSA libraries?

texts:
I am new to the forum, so forgive me if this question is out of place or lacks adequate detail.

I am working on a project that involves allowing discreet clients to upload content to a central host. The host is expected to verify ownership and data integrity by testing the signature of the content against a user's supplied public RSA key. For some reason, signatures provided by a test client I have written can not be verified by the host. Signatures created by the host for the sake of testing pass with no problem. (That is the host uses the client's private key to create a signature based on the same content, and test's that signature against the client's public key).

The host is written in Go and uses Go's native rsa package to verify a PKCS1v15 signature of a SHA256 sum. The client is written in Node.JS and uses a third party package, forge, to sign the data, also using PKCS1v15 and a SHA256 sum. I have also tried PSS in place of PKCS1v15 on both sides. The results appear to be the same. Can this sort of pattern (create signature on platform-A and verify it on platform-B) be implemented practically, or is RSA public key encryption open to the interpretation of the stack implementer?

NodeJS Implementation

The following is the client written in NodeJS. Here, the user's private key is read from the file "test-client-rsa." The variable "hex" is the hex-encoded SHA256 sum of the test file being used, hard-coded here for simplicity.

var fs = require('fs');
var forge = require('node-forge')

fs.readFile('test-client-rsa', (err, data) => {
   if (err) throw err;

    var key = forge.pki.privateKeyFromPem(data);
    var hex = 'dac1f3853c1e4c6579692f59af0a30aacb86820d5ad331c792987c4dae047595';
    var md = forge.md.sha256.create();
    md.update(hex, 'utf8');

    var signature = key.sign(md);
    var buf = new Buffer(signature);

    console.log(buf.toString('base64'));
});

The client's output (encoded to Base64) resembles the following:

  JShQKsKAVcKow4HCnMKMw7MXwp3DhhAPXGhGPsOow4U9DQg3acOmIEjDoFR6eCUCwpZ4wq7CmBB7dsOrSMKOw6fDlDfCs8OKwonCm8KVLjMrIsKSwqTDkmnCgcKlRsO4QQrCiWDDjBbClcOTwqfDn8KDw57DgG0Qw7gcHsKSwr57w4rClyrDqkgrwo5owoAHBMOGwq/DpMKDwoVhw5bDtD9zw4NYCxwLwrLCoTp7wo3CtsOqPjFKwrdWw63CpMKQFcOcwpnCpMKhwrDCisOkBCZrw4wkwoYVwotWw7/DrBYSIsKjbXF9wqfDnRTCk0kTE8KTVMOSw6wicElvw45rwolbwpNgS8O+bSwhwqFHw5ICTcKRZcO0w7YOwoTCncOow4pBwo1ow7bCisKYwrRRMiTDpTLDnsKjQcOBwpgPw7rCokRtOcKTP8KiwppLwp3Dn2QYwqZvDEsRw4LCuiYbM8K5w6fClF98EW/CmUTCjcOjMcOHwqLDqsKpwqfDvcKgNA==

Go Lang Implementation

The following is the server implementation, written in Go. The code has been simplified to keep the example focused, and so lacks proper error handling and logging routines. In the method, the object "u" represents the user's identity, or RSA credentials in this example. The variable "u.pkey" is the user's RSA public key represented as bytes, while the input parameters "sig" and "data" represent the signature provided by the test client for the test file, and the content's of the test file itself respectively.

func (u User) VerifySignature(sig []byte, data []byte) bool {
    if !u.IsValid() {
        return false
    }

    hash := sha256.Sum256(data)

    if err := rsa.VerifyPKCS1v15(u.pkey, crypto.SHA256, hash[:], sig); err == nil {
        return true
    }

    return false
}

The server's output is consistently false with the call to "rsa.VerifyPKCS1v15" returning the error "crypto/rsa: verification error."

I've run through both layers of code several times now, and I am not able to spot the problem in the logic. Is there something incorrect in this pattern? Any help that can be provided would be greatly appreciated.


texts: Whats the most secure way to encrypt a string without the use of a computer?

texts: I want to decrease attack surface by preventing the plaintext string or encryption key from ever being typed or otherwise entered into a computer. Ideally the decryption key would be something that the user can generate and store in their head. But encryption should still be as strong as possible. I don't need to be able to decrypt without a computer, though that would be cool.


texts: Is there a proxy re-encryption algorithm for Elliptic Curve ECIES?

texts: I was wondering if there is a way to perform proxy re-encryption for ECIES public-key encryption (i.e. given a message encrypted with Alice's public key, re-encrypt it using Bob's public key). Is that even possible?


texts: Key size of a repeating key XOR-encrypted message using Hamming distance

texts:
To find possible key sizes for an encrypted message, I break the message into blocks with length s,

blocks :: String -> Int -> [String]
blocks s n = (take n s) : blocks (drop n s) n

for each such partition find the average Hamming distance (normalised by the block's length) between any 2 of the blocks and find the key for which this average is the smallest

Some helping functions that I use

--unpack :: ByteString -> [Word8]

packStr :: String -> B.ByteString
packStr = encodeUtf8 . T.pack

toBin' 0 = []
toBin' n = let (q,r) = n `divMod` 2 in r : toBin' q

toBin 0 = [0]
toBin n = reverse (toBin' n)

toInt s = map (\n -> read n :: Int) (map show s)
-- to built all possible pairs
combs :: Int -> [a] -> [[a]]
combs _ []     = []
combs 0 _      = []
combs 1 x      = L.map (:[]) x
combs n (x:xs) = (L.map (x:) (combs (n-1) xs) ) ++ combs n xs

Normalised Hamming distance(s): (count amount of '1' in binary code. the famous "this is a test" "wokka wokka!!!" distance is 37)

-- normalised (by keysize) hamming distance
nHamming :: String -> String -> Double
nHamming s t = (fromIntegral (length $ filter (\c -> c == 1) $ concat $ map toBin . toInt $ zipWith
xor (B.unpack (packStr s)) (B.unpack (packStr t)))) / (minLength s t) where minLength s t =
fromIntegral $ min (length s) (length t)

-- returns list of normalised (by keysize) hamming distances for all possible pairs of blocks for a
given keysize (which is the length of blocks)
alham :: [String] -> [Double]
alham ss = map (\[x, y] -> nHamming x y) (combs 2 ss)

-- calculates the average = sum of hamming distances / amount
edham :: [String] -> Double
edham [] = 0.0
edham s  = (sum (alham s)) / (fromIntegral ((length s) * ((length s) -1)) )

and choose  n for which this average is the smallest:

keyLengths s = let n = fromIntegral (length s) in take n [1..]

-- returns keys with their result in ascending order
posKeys :: String -> [(Double, Int)]
posKeys s = L.sortBy (on compare fst) $ zip (map edham (map (blocks s) (keyLengths s))) [1..]

Now, if I, for example, encode a message with a key "key", the logic says that if I apply posKey to the encrypted message the result should have 3 at least between 3 smallest. Yet it is not so - I keep getting some bug numbers as 66 or 54 (at least they are divisible by 3 :) ). I cannot understand what I have missed in my solution. Would appreciate your help!

The algorithm:

Cut the message into blocks of length n, for all n from 1 to (length of the message)
For each such partition, calculate the Hammering distance (divided by the length of  block) for any 2 blocks from that partition
Sum the values from the previous step and divide by m*(m-1), where m is the number of blocks in the partition.
Choose the n with the smallest result for step 3.

The way I understand what is going on, this algorithm should work. Yet it doesn't, and the n corresponding to the actual key does not give the smallest result.


texts: ECDSA Compressed public key point back to uncompressed public key point

texts:
From the ECDH demo here, if I generate a private key for Alice I can get _

P = 1175846487558108474218546536054752289210804601041

Which gives the following public key point.

X = 583857549063195252150226340830731484791130788759
Y = 1195037839477751118658084226553581900533276838164

For ECDSA public key compression the above coordinates would be prepended by 02 and the X coordinate would be used. So the compressed key for the above (based on X9.62) is:

02583857549063195252150226340830731484791130788759

If I only have the compressed key given above, how would I derive Y i.e. the uncompressed point?


texts: What advantage does Pairing using Legacy Pairing (BLE 4.0,4.1 devices) give me over a simple connection between 2 devices?

texts: BLE 4.2 uses something called LESC (LE Secure Connection) for significantly enhancing the link encryption between 2 devices (using public private key pair model). But prior to that the way devices would pair with each other, what advantage would that give me over a normal connection as the data exchanged between the 2 paired devices (BLE 4.0,4.1) is easily sniffable and if the pairing method is 'Just Works' then it's even highly prone to MITM attacks. So, what good is pairing in devices using BLE v.4.0 or 4.1 ?