texts:
I am encrypting multiple messages using a 256 bit key with AES in GCM mode, generating a random 96 bit nonce for each message.

The small nonce size combined with random values is worrying me:

  AES-GCM takes a 96-bit nonce and NIST says that you can only encrypt $2^{32}$ messages under a single key if using random nonces. This is because if you throw $2^{32}$ balls at 2$^{96}$ buckets then you have roughly a $2^{-33}$ chance of getting two in the same bucket and NIST drew the line there. That probability might seem either high or low to you. It's pretty small in absolute terms and, unlike a work factor, an attacker can't spend resources against it, but it's a very long way from the safety margins that we usually use in cryptography.

Is this an issue? Is there something else I should prefer? For example, AES/CBC with encrypt-then-MAC construction would have a more reasonable IV/nonce size of 128 bits.


texts: Likelihood of signature collision with EdDSA

texts:
Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload,
what is the probability of a collision where there is another 512-bit value that is also a valid signature?
With symmetric crypto we know there is only one single key in the entire space that will validly decrypt data encrypted with the same key.
Can we provably state that for a given payload and given private key, there is only one valid signature in the 512-bit signature space? That is, no other signature exists that could be validated with the public key counterpart to the private key that created the signature.


texts:
There are 3 properties offered by a cryptographic digital signature scheme:

Integrity guarantee of the message signed.
Authenticity guarantee of the message signed.
Non-repudiation of the message by the signer.

Property 1 and 2 are also offered by MACs and can be described in one word. The 3rd property is a bit special - not only is it only meaningful in cryptographic sense as non-repudiation in legal sense has whole another range of requirements, but also (as you might have guessed it), it's described in 2 words (one of which is a negation).

So I have the following questions in my mind:

Is the "non-repudiation" property ever described using other terms in any literature? Such as the that in the title of this post - "identity-binding"?
Does using such terminology change the semantic function of digital signature?


texts:
i am thinking about building a public crypto service, yet at the same time, I am still quite new to crypto and therefore prone to snake-oil inventions I guess.

My plan is to build a website which allows encrypting a document for a certain time.

The current scheme I came up is as follows:

choose the time at which you want the document to be publicly available (e.g. 2 weeks from now).
locally on your computer create a password to be used to encrypt the document, based on the hash of the datetime-stamp for the release, plus an unique salt value (e.g. hash of document)
hash that encryption password in order to hide the original password and load the hash up to the website, along with the selected target date
the website starts a unique timer for you which generates passwords every second, based on the current datetime-stamp and the salt provided, then rehashes the resulting hash to see if it fits the specified hash for the encryption password
if so, the point in time for decryption has been attained

I am not happy about the scheme as I am looking for a perfect solution in that the server should not know anything specific about the password used to encrypt the document, as well as never produce it itself.
Also, the encryption should stay secure even in the event of the server being compromised...

I am grateful for any feedback.


texts: Does concatinating mutliple digests of hashes from CSRN result in a CSRN?

texts:
Kind of a noob question. Suppose;

We generate 1,000 cryptographic-ally secure random numbers & store each of them in an array1.
For each number in this array1, we take the hash sha256(CSRN) then store the digests in array2

For simplicity, lest say array2 has 3 digests,

array2 = [a22110a41f165b6b0f3cc053b50214b284add1b0f8628f78c7522906c8f78da0, d160c64b851dfa1606283ce84799c83c237e0cebfc8e210eb2eaf5ba24f845cb,
35bf775fe6ff7c97520d76665059e21023d9f8de094a3b6c351143241cc7649b]

My question is, if I concatenate the items in array to to form a longer hex such as;

longhex = a22110a41f165b6b0f3cc053b50214b284add1b0f8628f78c7522906c8f78da0d160c64b851dfa1606283ce84799c83c237e0cebfc8e210eb2eaf5ba24f845cb
35bf775fe6ff7c97520d76665059e21023d9f8de094a3b6c351143241cc7649b

Is longhex also considered a CSRN?


texts: Suppose I encrypted a homophonic substitution cipher at the level of syllables, trigrams, digraphs, and individual letter with a Vigenere cipher using the keyword cryptography. I would then encrypt the resulting complex ciphertext with an ADFGVX cipher in addition to using a code. How strong can a multiple-encryption be?


texts:
I am currently designing a hashing function based on a mathematical formular to calculate the size of an arc on a circle with the radius 1.

From that I made a small hashing function which works kind of like this:

f(n) = n² * π / 180

Then I only take the decimal places and convert them to hex. I remove the first three letters / numbers and take the next three places.

I then tried to find collisions by brute force because it would not take too long.
I started with 1.

f(1) = 553

Then I tried to find collisions and I found the following:

123, 4755, 8313

I expected the last two ones because they exceed the range of the hash-length.
The first one however was unexpected and I simply cannot explain it. Is it because of bad chance or is it because of the function?

(I know about the other flaws of this design)

I greatly appreciate any answer which helps me in this endeavour.


texts: Strength and weaknesses of this JavaScript charCodeAt based login script

texts:
I know of a company on their website who are using this very basic password login page written in JavaScript. This doesn't seem very secure at all, because in the html source code it shows where the script comes from: http://www.dynamicdrive.com/dynamicindex9/password.htm and also you can see how it works as it's JavaScript and you can just view the source in a browser.

It seem pretty simple, it takes a value entered in an input field by a user works out the char unicode interger value of each character in the passcode and then times this value by the previous value and loops this until it has done this for each character in the passcode. It then compares this with an answer value saved in JavaScript which the user has already converted from the right answer in the same manner using the tool on  http://www.dynamicdrive.com/dynamicindex9/password.htm and then if these two match the JavaScript redirects you to the secret page which is a html file with the same name of the clear text password.

My question is knowing how this method works to convert what the user inputs into a charcode value, how can you reverse this process to find out what the original plain text password was? I have changed the usercode and passcode value below to what is featured on this companys website.

I have thought of two methods to change 16978476480 back to plain text. One possibility I guess would to get a word list of common passwords, convert each to a number value using the same method and then seeing if any match 16978476480. The other similar method would be to pick random characters to form a string between 4 and 8 characters in length, the usual password lengths, times all the unicode values to together and then keep looping until we get lucky and hit a match for 16978476480. Can anyone think of any better of faster ways?

The script is as follows:

//Encrypted Password script- By Rob Heslop
//Script featured on Dynamic Drive
//Visit http://www.dynamicdrive.com

function submitentry(){
password = document.password1.password2.value.toLowerCase()
username = document.password1.username2.value.toLowerCase()
passcode = 1
usercode = 1
for(i = 0; i < password.length; i++) {
passcode *= password.charCodeAt(i);
}
for(x = 0; x < username.length; x++) {
usercode *= username.charCodeAt(x);
}
//CHANGE THE NUMBERS BELOW TO REFLECT YOUR USERNAME/PASSWORD
if(usercode==12211815000&&passcode==16978476480)
//CHANGE THE NUMBERS ABOVE TO REFLECT YOUR USERNAME/PASSWORD
{
window.location=password+".html"}
else{
alert("password/username combination wrong")}
}

<form name="password1">
Enter username:
<input type="text" name="username2" size="15">

Enter password:
<input type="password" name="password2" size="15">

<input type="button" value="Submit" onClick="submitentry()">
</form>


texts: What is this problem called and is it hard? given $g^x$ output ($g^y, xy$)

texts:
Assume that $G$ is any cyclic group where the discrete log problem is hard, such as the elliptic curve group. Let $g$ be some generator of $G$.
The problem is as follows:
Given $(g, g^x)$ for unknown $x$, output any pair of the form $(g^y, xy)$ for $y \neq 0$.
This seems awfully close to the discrete log problem but I could not find any reference for it, nor prove the equivalence myself.
Some things are clear: That algorithm cannot know $y$, since it cannot know $x$ (because the discrete log problem is hard). Also, the algorithm cannot use the same $y$ for different $x$, since that would also reveal $y$, and thereby, $x$.
For this case, we may assume that the Decision Diffie-Hellman problem in $G$ is hard.
However, a hardness proof for non-DDH-hard groups will be nicer.


texts: Cost of asymmetric signature checks vs password hashing

texts:
This is a question about standard every day web authentication.

I have the following assumptions:

one of the reasons public key user authentication is not used as bread and butter on the web is that it is expensive for the server to verify signatures (the other is that it is not convenient for the client, but let's ignore that for now and in practice server operators have bigger role in decision making)
on the other hand massive password breaches in the last years and quickly growing computing power available for cracking hashed passwords pushes the state of the art towards more and more expensive KDFs - more rounds of PBKDF2, argon2 with high parameters etc
established public key schemes are secure against direct cracking

My question is: what is the proportion of computational cost (burden) on the server for verifying signatures on a supposed challenge (say, with ed25519) versus the cost of stretching passwords according to the up to date standards.


texts: Given a particular $1600$-bit output $Y$, is it feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f[1600](X) = Y$?

texts:
I have read this answer on Crypto.SE and I want to clarify a few details.

Does this property of $\text{Keccak-}f[1600](x)$ imply that if we know a particular $1600$-bit output $Y$, it is feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f[1600](X) = Y$?

If yes, then consider the following situation.

An adversary $A$ has access to the full $1600$-bit state before the final truncation.
The original message $M$ has the length $L$ equal to, say, $552$ bits, and $A$ knows the exact value of $L$.

In this situation, will $A$ be able to find $M$?


texts: AES GCM mode and the message is the same as the password

texts: In a case of using a password and get AES key using KDF to encrypt the same password (The password and the message is the same), How secure is that algorithm ?


texts: Why do we only encrypt nounce + counter in Counter Mode?

texts:
I do not understand, what the advantage is in only encrypting the nonce + Ctr and XORing this to our plaintext, instead of encrypting everything. (If our block cipher can be easily decrypted)

What would be the other downsides of turning

$c_i = E_k(n + i) \oplus m_i$

into

$c_i' = E_k((n + i) \oplus m_i)$

This should prevent flipping a bit without destroying the entire block, right?


texts: Which cryptographic operations can be optimized with a GPU? When shouldn't it be done?

texts:
I'm under the impression that GPUs are only used to optimize some (not all) of a given cryptographic operation.  Furthermore, I've only seen this GPU optimization done in Bitcoin.

This observation unleashed a number of rhetorical questions that relate closely to each other.

Rhetorical questions (answer if you like)

Outside of Bitcoin, are general purpose cryptography operations offloaded to GPUs in general when native CPU instructions don't exist (CMUL/PCLMULQDQ)?
Which cryptographic operations?  (BigInt^BigInt? * BigInt)?
Is only some of the cryptographic work offloaded, or is all of the work? E.g. an entire AES/PGP runtime embedded in the GPU?
What prevents security risks? E.g. WebGL might be isolated from other processes.
Is the physical RAM in a GPU different? Exploits in the past describe how neighboring CPU banks can have their value inferred by the active process.  Not to mention physical shielding of the RAM.
If any of the above could cause a security risk, is there any benefit with a platform that restricts access to the GPU?  For example, the Metal graphics API is constrained in function and doesn't expose a "raw" GPU mode. (I think)

Real Question

As a hobbyist, should I explore porting cryptographic code to Apple's GPU?  This is the Bouncy Castle function that is slowing me down: StackOverflow -- How can I improve performance of BigInteger as compiled to Objective C by Xamarin.iOS / Mono?

What would a professional do to make that effort worthwhile and more secure?


texts:
Assume there is a secret-IV (hash-based) MAC scheme, i.e. $MAC_k(m) = H_k(m)$, where $H$ is a hash function, $k$ the secret key that initializes the hash function, and $m$ the message to protect with the MAC.

When using a Merkle-Damgård construction, length extension attacks can be performed trivially.

Let us further assume the MAC is instantiated with a weak hash function that has several weaknesses. I would like to focus on MD4. There exist several practical collision attacks, some semi-practical (second-)preimage attacks and obervations on MD4's onewayness.

Are there more critical attacks on the MAC in this case due to the weakness of the MD4 hash function? In practice, the above mentioned length extension attack can be mitigated by including the length of $m$ in $m$ itself.

I guess the most powerful attack would be to recover the secret-IV $k$ (maybe by exploiting weaknesses in MD4 onewayness). But I do not know if this is even possible.


texts: Is only one shared secret generated by ECDH per key pair?

texts: I'm confused about ECDH. Using their public keys and private keys, two entities can arrive on a shared secret. But from the equations I've seen, it looks like ONLY the numbers present in their key pairs are used to do this, so it would seem that if the shared secret is compromised, then they that particular pair of key sets can't be used again because they would arrive upon the same number as before. Do I have this right?


texts: Garbled circuits: How can the sender safely retrieve the output?

texts:
I've read a few papers about how Yao's Garbled Circuit protocol can be made secure against malicious adversaries, but I haven't seen any mentioning how the sender safely retrieves the output of the function after the receiver computes it.

Suppose Alice is the sender, that is to say she garbles the circuit and sends it to Bob. Now suppose the whole protocol goes fine and at the end Bob outputs the right answer. In the context of two-party secure computation, both parties should be able to obtain the right output of the function, but what if Bob is malicious and doesn't simply send back the answer to Alice?

At that point, Bob could either stop the protocol or send a wrong answer to Alice. Does there exist a mechanism which can both prevent Bob from knowing the output until Alice knows it too, and ensure that what Alice obtains is the right output?


texts: Rejection Sampling reasoning for Lattice Based Signatures

texts:
I'm new to lattices.
According to Lattice Signatures and Bimodal Gaussians in the Rejection Sampling section.
In Schnorr, GQ you can simply commit to $y$, use it to hide a secret key $s$.
But this doesn't work in lattices. You need to hide the secret key with a small $y$. Turns out, a lot of old lattice-based signatures leaked a part of the secret keys. Instead, we must choose y from a narrow distribution and then perform rejection sampling so that $s$ is not leaked when we add $y$ to it.

Now:

What does there mean to be a narrow distribution?
What does it mean for $y$ to be small?
Why is this a problem in lattices specifically?


texts: What's the difference between symmetric and asymmetic multilinear map?

texts:
In pairing-based cryptography, we have 3 types, namely Type-I, where $\mathbb{G}_1 = \mathbb{G}_2$, and in Type-II and Type-III we have that $\mathbb{G}_1 \neq \mathbb{G}_2$, however in Type-II we have an efficiently computable homomorphism between $\mathbb{G}_1$ and $\mathbb{G}_2$, however in Type-III, we do not have this homomorphism.

Now, going over the definition of multilinear maps here [BWZ14] (pages 4 and 5), the authors define two multilinear maps, where one is called asymmetric. Where the asymmetricity come in this situation? As in the first definition (which I just called symmetric for a lack of a better name), do we have to consider that all the $n$ groups $\mathbb{G}_1,\ldots,\mathbb{G}_n$ are the same group? Because, there the definition does not say this. And why the use of integer vectors for indexing in the asymmetric case?


texts: Weakening of Paillier cryptosystem due to ciphertext equivalence and order in CryptDB

texts:
The Paillier cryptosystem is probabilistic in nature and IND-CPA secure. By design given two ciphertexts one cannot distinguish whether decrypting those two ciphertexts will result in same or different plaintexts.

But in certain situations like Onion-layered encryption in CryptDB. There are other onions like DET and OPE that reveal whether two ciphertexts map to same underlying plaintext or whether the plaintexts are greater or less when compared to each other.

For example , in CryptDB the plaintext is encrypted using multiple schemes and stored separately. So two different plaintexts $m_1,m_2$, assuming both are numbers, would look in the tables as below

HOM Onion : Paillier_Enc($m_n,k_1$) = $c^h_n$ , $h$ denotes the homomorphic layer
DET Onion : AES_Enc($m_n, k_2$) = $c^d_n$, $d$ denotes the deterministic layer
OPE Onion : OPE_ENC($m_n, k_3$) = $c^o_n$, $o$ denotes the order preserving layer

Now although $c^h_1 , c^h_2$ do not reveal whether $m_1, m_2$ are equal because the Paillier scheme is probabilistic . There are other onion layers revealing whether the $m_1,m_2$ are same or less or greater to each other.

My hunch is these inferences from other layers weaken the Paillier cryptosystem's security guarantees, but I could not come up with a way to weaken them. So how can we take advantage of other onions leaking inferences (about equality, comparison) to break the Paillier system in some way?


texts: Finding missing bits mathematicaly in a DLP situation (full problem)


texts: Methods of making ASIC/GPU resistant encryption?

texts:
Is there way to make encryption scheme ASIC and GPU resistant, besides using a lot of memory?

And what is there ciphers or modes of use for such purpose? Including public keys algorithms maybe too, if there is any methods for them.

Or it's only worth to defend key derivation function? (Like scrypt, but it obviously failed in the case of litecoin.)

Clarification: 'encryption scheme' is protocol and/or system using cryptography to encrypt text. It's meaning opposes single algorithm, like AES or whatever. And it should be resistant against ASIC/FPGA/GPU/crypto-hardware optimized algorithms, like brute-force, or whatever algos there is for such hardware. It should make such attack not orders faster than on standard CPU or orders more expensive.


texts: Why Elliptic curve cryptography are not popular in practice

texts: RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide the same security with smaller key sizes?


texts: What is a Non-Interactive Zero Knowledge Proof?

texts:
I understand the concept of a Zero Knowledge Proof thanks to the easy to understand analogy of Alibaba's cave. However, this seems to require interaction between the verifier and the other party.

I have not found an explanation of non-interactive zero knowledge proofs (NIZK). The wikipedia article is way too complex for someone without advanced training to understand.

https://en.wikipedia.org/wiki/Non-interactive_zero-knowledge_proof

Can someone explain the concept of non-interactive zero-knowledge in a simple way?


texts:
It seems that the acceptable "security margin" for ciphers is set to be between 25% and 30% as a target by designers, where this number represents the number of rounds that remain "unbroken" for a certain worse-case attack.   It is all too eerily empirical from a field that dislikes that sort of thing considering that the security margin tends to decrease over time as attacks improve.

Is there a historical reason for picking this arbitrary number or is there just a consensus that better than 25% is good enough?


texts:
I have some very sensitive family files that I want to store in the cloud on multiple providers for maximal reliability and redundancy. It's essentially a large archive of all our family photos, documents, and confidential photos. I'll be needing them in about ~20 years, but I won't access them or update them during this interval. These files must not be accessed by anyone but myself.
I am skeptical about AES being able to last for that long, because there could be advances in cryptanalysis. Instead, I'm considering ChaCha20, because it's a modern cipher and was sought for by security engineers at Google.
Supposing that I encrypt all files offline, use a secure key (along with Argon2), and ensure integrity (Poly1305), will my data theoretically be able to last for that long (the best attacks on ChaCha20 only break 7 rounds)? If not, is there a possible cipher that could? There will only be one copy, preventing chosen-plaintext attacks.


texts: Is it possible to sign OpenPGP key without consent of a key owner? If yes, can unsolicited signatures be removed from a key?

texts:
For example, I have my key listed on a key server. On one day a key issued on the name of Julius Caesar signs my key. Obviously this key is a fake key and I want to remove its signature from my key can it be done?
Can I block unsolicited signing of my key? Can I make signatures appear on my key only when I have validated them?


texts: generate RSA public key having public modulus and exponent

texts:
i want to generate an RSA public public key file using openssl (or other tools) having public modulus and exponent, so i can use it later to encrypt files

i have this:

the modulus:

"BEB90F8AF5D8A7C7DA8CA74AC43E1EE8A48E6860C0D46A5D690BEA082E3A74E1"
+"571F2C58E94EE339862A49A811A31BB4A48F41B3BCDFD054C3443BB610B5418B"
+"3CBAFAE7936E1BE2AFD2E0DF865A6E59C2B8DF1E8D5702567D0A9650CB07A43D"
+"E39020969DF0997FCA587D9A8AE4627CF18477EC06765DF3AA8FB459DD4C9AF3"

the exponent: 0x10001

so how can i generate the public key from those, so i can use it to encrypt some data, or maybe there's a way to use these directly for encryption ?


texts: How is a generator found for a group, both in case of DH & ECDH?

texts: First step in DH & ECDH is to choose a random prime $p$. Then you choose a generator $g$ for the group $\mathbb Z_p^*$. How do you find a generator? Likewise in ECDH, you would need to find a generator which generates all the points in the elliptic curve? How is this done?


texts: Would SHA-256(SHA-256(x)) produce collisions?

texts:
Was reviewing some Bitcoin public-key hash literature and the use of RIPEMD-160 and the SHA-256 as below:

 RIPEMD160(SHA256(ECDSA_publicKey))

The Proof-of-work on the other hand uses SHA256 two times (instead of RIPEMD-160).

There is some notes on why RIPEMD160 was chosen (here).

Considering the 256-bit output space of SHA256, what would happen (theoritically) if one were to use SHA256 on a SHA256 output? For example:

SHA256(SHA256(x))

Would this be a bijective mapping? or Surjective mapping?

Can such mapping be used, in any way, to break the SHA-256?

Since SHA-256 is supposed to be a one-to-one function, there is no way the SHA256(SHA256(x)) could be injective function (since the input space and output space are both 256-bits). But if it is not injective, then SHA-256 cannot be one-to-one function for longer message (>256-bit input). How is this contradiction being worked out in the algorithm?


texts: Are the following functions pseudorandom?

texts:
Given a PRF $F $, such that for each $k \in \{0,1\} \ ^ n$ , $F_k:\{0,1\} \ ^ n \to \{0,1\} \ ^ n$ , is the function defined by $W_{k_1,k_2}(x) = F_{F_{k_1(0 \ ^n )}}(x) || F_{k_2}(x)$ also a PRF?

I'm almost sure the answer is yes.
I'm trying to assume $W$ is not a PRF and conclude that $F$ isn't either but I dont see how.

Let F be as in (1). Now $H_k(x) = F_k(x) || F_{F_{k}(1 \ ^ n)}(F_{F_{k}(1 \ ^ n)}(F_{k}(x)))$.
I think $H$ is not a PRF.
The polynomial distinguisher I thought about is the following:

$D$ on input $1 \ ^ n$ and orcal asses $O$ , asks for $O(1 ^ n)$ and writes $O(1 ^ n) = \alpha || \beta$ for $\alpha,\beta \in \{0,1\} \ ^ n$.
Now $D$ checks if $\beta = F_{\alpha}(F_{\alpha}(\alpha))$. if yes, outputs 1 otherwise outputs 0.

If $O=H_k$ then $D$ outputs $1$ so $Pr(D \ ^ {H_k()}(1 \ ^ n)=1 ) =1$.
If $O=h$ for a truly random functon then $D$ outputs 1 iff $F_{\alpha}(F_{\alpha}(\alpha)) = \alpha$ for $\alpha$ which is a random number in $\{0,1\} \ ^ n$.

I want to say that $Pr(F_{\alpha}(F_{\alpha}(\alpha)) = \alpha) = v(n)$ for a negl. func. and this will conclude the proof but i can't find a way to prove it. someone can help?

Thanks for the help.


texts: Known plaintext attack without knowing the location of the plaintext

texts:
I'm trying to understand known plaintext attacks and since I best learn by doing I broke out Python and did the following:

I have a plaintext string s and a key k:

s = 'Lorem ipsum dolor sit amet'
k = 'key'

As I'm doing this with xor, this is my xor method:

def xor(s, k):
  return ''.join(chr(ord(a) ^ ord(b)) for a, b in zip(s, itertools.cycle(k)))

So to get a ciphertext I do this:

c = xor(s, k)

And I can get the plaintext back by doing this, so I know it works:

xor(c, k)

Now for the exercise, let's say I have the ciphertext and know the word "dolor" is in there. How would I attempt to get the key?

My first thought was to do xor(c, 'dolor') but since I don't know where the word is I guess I'll have to try every location?

I found that using the word dolor as the key and starting with a different character kinda seems to work. So I attempt this:

xor(c, 'dolor')
xor(c, 'olord')
xor(c, 'lordo')
xor(c, 'ordol')

etc.

Using the last one (ordol) I spot keyke in the result. Since I know what the key is I know that I found it. But how would I know if I didn't know the key?
Is there also some other way to do this instead of trying every possibility?


texts: In some research work in 2001, it is stated that test vectors were not publicly available at the time. Then in this ESSS1v2 standard under IEEE1363 here , the appendix B mentions that the test vectors will be added in future versions. I haven't found any. Where could I get the test vectors for NTRU?


texts: How exactly was the finalist chosen in the NIST AES competition?

texts:
I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen:

Unfortunately the NIST site is down so I can't gain further information about the approval process so I was hoping someone here would know in more detail.

Who or what decided on the numbers in this table which ranks each
algorithm? I.e. can the exact analysis process be described?
Who created that process? People in NIST or an equally divided group of government, industry and public cryptographers?
What is included in "Design Features"? I.e. What were those features that were important?
"Performance" analysis could have been done with benchmarks but "Implementation Difficulty" sounds subjective. How was that quantified?
Could the numbers in that table been tweaked to skew the results in favor of a particular algorithm?

Those questions aside and assuming the magic numbers above were arrived at a fair and equitable process without bias or hidden agendas, it seems to me this table or ranking system is still missing a "weighting" criteria. All categories seem to be weighted with the same importance. That is "Smart Card Performance" is equally important as "General Security". That seems incorrect. I would argue that security is of the utmost importance so that should have a higher weighting relative to the other criteria which would be secondary concerns. A good quote would be:

  Security at the expense of usability, comes at the expense of security.

I wondered what would happen if I applied a high weighting factor to security and left the other points as they are. For example:

Now Serpent is first equal with Rijndael with Twofish coming in a close second. Interesting.

What about if I am developing a software product, I don't care about about hardware performance or smart card performance so I can rule those two out completely in my decision. The table might look like this:

Now Twofish is the winner and Rijndael is second equal with Serpent and MARS. MARS might even be more attractive with its variable key size up to 448 bits.

My overall point is that Rijndael, Serpent, Twofish and MARS all appear to be within the same ballpark quality range as far as block ciphers go and this rating criteria. There might be a more accurate mathematical way to apply a weighting factor. If I was revamping the security on a project and concerned about NSA involvement in weakening encryption standards then I could re-weight some of the criteria and priorities to suit my project's specific goals. I might decide on a different algorithm from Rijndael. Back in 2000 Rijndael might have suited the US government's purposes and planned surveillance agendas but not my project's. I would compare it to selecting an algorithm just like TrueCrypt gives you the option of choosing between 3 different algorithms. Would that be a reasonable call?


texts: Which symmetric cipher is best for studying?

texts: I would like to study a modern symmetric cipher (I have never studied a cipher before) and I was wondering which would be the best cipher for studying purposes of the following: AES (Rijndael), Blowfish, Twofish, Threefish or Serpent. Basically I am asking which of those ciphers is the most simple to study.


texts: Given Seed, keyfragment and cipher text, how to get actual text using LFSR?

texts:
$\text{seed = 1100010001101001}$

$\text{key fragment = 110001010000101011001011111101100}$

$\text{cipher text =  0xa50b839547f7fe7cf882}$

What is the actual text and how to evaluate it? I would like to know the exact procedure to do it.


texts:
I am reading Differential Attack from Stinson-Cryptography: Theory and Practice on a toy example of S-box(block Cipher) with Nr=n=m=4.

I am mainly confused in the following definition

  Definition 3.1 : Let $\pi_S:\{0,1\}^m\rightarrow \{0,1\}^n$ be a S-box. Consider an (ordered) pair of bitstrings of length $m$, say $(x,x^*)$. We say that input XOR  of the S-box is $x\oplus x^*$ and the output XOR is $\pi_S(x)\oplus\pi_S(x^*)$.

Now, the point of confusion is how can the output of the S-box be separated as $\pi_S(x)\oplus\pi_S(x^*)$ when the input is $x\oplus x^*$?

For eg:
We choose the two plaintexts $x_1$ and $x_2$. Then we have $x_{12}=x_1\oplus x_2$
Now, we have round $1$ key $K^1$, we get $^1u^1=x_1\oplus K^1$ and $^2u^1=x_2\oplus K^1$
Then, we apply $\pi_S$ on the above, we get $^1v^1=\pi_S(^1u^1)=\pi_S(x_1\oplus K^1)$ and $^2v^1=\pi_S(^2v^1)=\pi_S(x_2\oplus K^1)$
Therefore, $^1v^1\oplus\enspace ^2v^1=\pi_S(^1u^1)\oplus \pi_S(^2v^1)=\pi_S(x_1\oplus K^1)\oplus \pi_S(x_2\oplus K^1)$

Now, I don't understand that How, $^1v^1\oplus\text{ }^2v^1=\pi_S(x_1)\oplus\pi_S(x_2)$?

Also, I don't know whether I got the definition or not?

EDIT: Notation Explanation:
$^iu^j$ denotes $i$th plaintext( either plaintext if j=1 or cypertext after $j-1$th round) XOR-ed with $j$th Round Key $K^j$
Also, note that $^iu^j=\pi_P(^iv^{j-1})$ if $j>1$, where $\pi_P$ is the permutation i.e diffusion layer.


texts: Cipher Block Chaining (CBC) encryption in SSL

texts: Is cipher block chaining (CBC) mode used in SSL encryption? If block reordering is already protected by SSL and TCP sequence numbers, what added advantage does CBC provide?


texts: Concatenating a hash function for generating one hash for multiple files

texts:
Assuming we use SHA256 as hash function. In practice you see that a Merkle tree is used to concatenating multiple hashes together to one single root hash.

A Merkle tree is a binary tree which always takes two SHA256 hashes and concatenate them in a recursive manner.

My question: Is it insecure to hash more than two hashes together? Say for example you want to create a unique hash of a folder structure. Each folder can contain an huge amount of files which are separately hashed. If we now concatenate the hashes in a sorted way:

SHA256(concatenate(sort(SHA256(file 0), SHA256(file 1), SHA256(file 2), [...], SHA256(file n-1))))

Does this increase the risk of a collision?

Explanation: You can imagine that an attacker wants to prove that a file was part of the hashes (through the root hash) which it was not. So he can choose n-2 hashes freely and try to calculate the root hash (collision). Does this (dramatically) increasing the chance of a collision?

I can not find precise information about that online. My stomach feeling points me to the birthday problem. And kind of the existence of a Merkle trees is pointing in the same direction. Or am I wrong? I would be really happy for any hint. Thanks!


texts: What is the best way to put a backdoor in an encryption system?

texts:
How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key?

I am looking for practical examples encryption schemes that have backdoors, because they were designed to or new techniques exposed them. It is my understanding that you can use a lack of entropy and diffusion in block ciphers which will reduce the necessary time that it takes to break a key. This is especially true with s-boxes, which can be designed to not increase the strength of the key. As for one-way algorithms, using none-primes can make it easier to reverse keys. What are other decisions that can be made to make a broken encryption algorithm?

The goal is find examples that can be used for encryption pedagogy, by collecting a sample of weak ciphers to practice on.


texts: Using an alternative to shamir's secret sharing

texts:
I was wondering about the following as an alternative to secret sharing(shamir): Assuming that in order to gain access to some theoretical system, we'd be saving secrets on the system and we will monitor all the access attempts, in the following way: Every participant will get a different "secret", and the system will check if the conditions are valid.

For instance: If 3 out of 5 participants from a level 1, or one from level 1 and one from level 2 and similar.

Cryptographically speaking, what are the disadvantages of it? Isn't it a simpler way instead of shamirs secret sharing?

It would help me the most if you could explain it to me mathematically, so I can understand the how and why to better understand the words.

Thank you for helping me understand it better.


texts: Are there any symptoms of a side channel attack on the target chip?

texts:
I would like to know if there are some symptoms that let me detect if  my integrated circuit is actually subject to a side channel attack.

For example, are the following potential indicators?

Energy consumption becomes too high
Temperature becomes too high


texts: How often is Ratchet key pair changed in signal protocol?

texts:
At first I thought the new ratchet key is created with each first incoming message. After that I believed it depends on the implementation. But after closer look at the signal documentation and following picture, I am left even more confused.

The picture above shows Alice sending message A2 and after that receiving message B2 from Bob, which uses his old key. How is this possible?
Shouldn't Bob update his key on receiving Alice's A2 message. Message A2 features a new ratchet key, and should trigger DH ratchet on Bob side and update his Receiving and Sending chain, thus his next message (B2) would use a newly created key?
What I am missing here?


texts: Optimising Pollard's Rho algorithm for large semi-primes

texts:
I have programmed an implementation of Pollard's Rho factoring algorithm using C++ and the GMP library.

It is reasonably fast with large numbers, however I haven't implemented any form of cycle detection (I just try and avoid the problem, see below), and it struggles with small numbers.

Here is the pseudo code of my implementation:

input n
x = 2
y = 2
d = 1
c = 1
z = 1
failed = 0
temp = 0

while d == 1 or d == n
    z = 1
    failed = failed + 1
    if failed = sqrt(n)
        c = c + 1
        failed = 0

    repeat 100 times:
        x = x^2 + c mod n
                repeat twice:
                    y = y^2 + c mod n
        temp = abs(x - y)
        z = z * temp

    d = gcd(z, n)

I was wondering how I could improve the efficiency of this algorithm? If I'm using large semiprimes, do I need to worry about cycle detection?


texts: Correctness of Propagating Cipher Block Chaining mode of operation (PCBC)

texts:
I was looking at the Wikipedia article about Block cipher mode of operation and I was wondering how can you from the encryption $C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})$ get the decryption $P_i = D_K(C_i) \oplus P_{i-1}\oplus C_{i-1}$ ?
Is there even a way to get decryption from encryption  (and vice versa)  or not?


texts:
In an article on password hashing security, Anthony Ferrara suggests using bcrypt to hash passwords and then using a "strong cipher (AES-128-CBC) with a key rotation policy".

This seems like a good suggestion which would help to counter ASIC attacks on bcrypted passwords. However, this could be circumvented if the secret key (or key rotation system) was compromised along with the password hashes.

The Question:

is the suggestion to cipher the password hash a good one, or could it actually weaken security?
would it be appropriate to use a public key cryptography algorithm like RSA, generate a public and private key pair, and then 'throw away' the private key to prevent the ciphertext from being reversed?


texts: Assuming you only modify the key schedule so that each of a 128-bit key is used at least once, would DES be about as secure as other ciphers such as AES? I am not talking about 2DES/3DES or other drawbacks like performance etc.


texts: Message length limit induced by block counter size

texts:
Wikipedia reports the following information about the ChaCha20 algorithm:

  An implementation reference for ChaCha20 has been published in RFC
  7539. The IETF's implementation modified Bernstein's published algorithm by changing 64-bit nonce and 64-bit block counter to 96-bit
  nonce and 32-bit block counter[34]. The name was not changed when the
  algorithm was modified and it could be the source of confusion for
  developers. Because of the reduced block counter, maximum message
  length that can be safely encrypted by the IETF's variant is 2^(32)-1
  blocks of 64 bytes (about 256 GiB). For usages where this is not
  enough, such as file or disk encryption, RFC 7539 proposes using the
  original algorithm with 64-bit nonce.

My questions are:

In this sentence

  ... maximum message length that can be safely encrypted ... is
  2^(32)-1 blocks of 64 bytes (about 256 GiB)

I've got the following related questions about this:

Is it being implied that that using the same block counter repeatedly is a risk?
How is that risk calculated? What is the formula for the risk?
If it is a question of repeating blocks counters, then shouldn't the block size be the same as the nonce? 96 bits = 12 bytes?
If it is not repeating block counters that is the source of risk, then is the risk just based on the total length of encoded data?  What is the formula for that risk?


texts: Why Crypto++ library's AES definition is so fast

texts:
I am trying to compare the CPU cycle required for two encryption algorithms. One algorithm is AES and lets the other algorithm is B(code name). I implemented algorithm B and having fewer and simpler operations than AES and expected to take much less time/CPU cycles per encryption than AES
I am using an Intel i3, 10 gen processor, with 4MB cache. I am running both algorithms individually (with random 16-byte input) for $2^{20}$ times and taking the minimum and maximum required CPU cycles.
I see that for algorithm B CPU cycles are minimum=2707866 and maximum=4767402. But, for crypto++ definition of AES, the CPU cycles are minimum=2724 and maximum=29978194. I have performed the test multiple times and the results are almost similar. It is clear that the maximum time required for AES is much higher(7x) then algorithm B, but the minimum time for AES is much less.
I then recorded required CPU cycles for all $2^{20}$ AES encryption. I found that the first encryption is taking maximum cycles (29978194) and then the required CPU cycle reduced drastically and after 10-15 encryption it took almost same(approx 3000) CPU cycles for each encryption. For algorithm B every encryption took almost the same CPU cycles.
I do not understand the drastic reduction(10000 times) of CPU cycles for AES encryption(crypto++ library). Is there any voodoo of AES-NI? Can someone tell what kind of optimization is being done there?


texts: How can I determine the number of times I have to reapply the Scytale until the original plaintext comes back?

texts:
Given "①②③④⑤⑥⑦⑧⑨⑩⑪⑫" as plain text and a 4 rows Scytale inscription with 3 as the length of the longest row, the original plaintext is back after 5 runs:
①④⑦⑩②⑤⑧⑪③⑥⑨⑫
①⑩⑧⑥④②⑪⑨⑦⑤③⑫
①⑥⑪⑤⑩④⑨③⑧②⑦⑫
①⑤⑨②⑥⑩③⑦⑪④⑧⑫
①②③④⑤⑥⑦⑧⑨⑩⑪⑫
Given "Juliet is still alive!!!" as plain text and a 4 rows Scytale inscription with 6 as the length of the longest row, the original plaintext is back after 11 runs:
J iiuilvlslei  !esa!ttl!
Jlia v !il tis!tulelies!
J iel!slii!ialte  usvtl!
Jsau llsiitveietl! l!i !
Jle ssilaie!uiti tl lv!!
Jiullli eatl iivse !s!t!
Ji  i i!ueislav!ltstlle!
Jilsi!at uvl e!liile st!
Ja liteel ! sulsivit!li!
Jesiaeut ll!l sli!iit v!
Juliet is still alive!!!
So, my question is: how to determine the number of runs until the ciphertext matches the plain text without having to run them and testing for the match at each run?


texts: Does Identity-Based Encryption actually solve any problem?

texts:
Identity-based encryption schemes[*] seem to have great potential in high-latency, delay-tolerant and mobile, ad-hoc networks since they apparently seem to avoid the need for key negotiation and exchanges. Used solely for key exchange, they allow any pair of members in the same group (however you choose to define it) to establish a unique pairwise secret that can be computed by each member up-front and as a function of their respective identities.
However, since each pairing based scheme - that I'm aware of - is predicated on a pre-distribution of some shared secret (e.g., the hashed ID of the agent raised to some secret integer), do any of these schemes offer any significant advantages over, let's say, a simple authenticated Diffie-Hellman (at least for purposes of symmetric key establishment)?
[*] Including pairing-based symmetric-key establishment schemes.


texts: Does having a known plaintext prefix weaken AES256?

texts:
I plan on storing data, encrypted with AES256, where the first dozen bytes are known plaintext.  ('Hello World!' for example.)

Does having this known plaintext prefix weaken AES256?

I do not care about modifications being made to the ciphertext, which result in modifications to the decrypted plaintext.

I do care about an attacker being able to decrypt any plaintext beyond the known plaintext prefix.

I expect to use counter mode, as random access is required.  Does GCM have any advantage?


texts: DLP based crypto systems with multiple independent generators

texts:
One example of a DLP based crypto system (or rather DDH based crypto system) where the public key parameters include two independent generators of the subgroup, is Cramer Shoup. Since the security proof of this scheme is based on DDH, it seems at least one of the two generators has to be uniformly chosen anew for each public key, and made part of the public key, rather than made part of domain parameters that are shared between multiple key pairs.

This seems a bit impractical, assuming you want a crypto system where the public key parameters are shared between multiple key pairs, and the individual public keys contain no more information than necessary. Furthermore it is a bit discomforting that e.g. Cramer Shoup does not include a method for verifying the validity of the generator choices, even though implicit verification is entailed by the trust model - you can e.g. test that the prime parameters are indeed prime, but it is harder to test if the generators have been deliberately chosen to facilitate discrete logarithm calculation.

Does this matter in the case of Cramer Shoup? I don't know, and that's not really my primary question interest. It might be noted that the relation between the two generators $g_1, g_2$ is not retained as part of the private key, and that the owner of the private key at no point in the normal operation of the scheme gets to prove that these generators have been correctly generated, but that might be insignificant. Rather, I am asking whether other schemes exist that also make use of more than one generator, and which might include those generators in domain parameters rather than include them in the individual public key.

Just a crazy idea: Suppose, for instance, you choose a prime $p$ and a prime $q$ such that $p = 2kq + 1$ and such that the calculation of $\log_23 (\mod p)$ and $\log_32 (\mod p)$ is conjectured to be DLP-hard in $Z_p^*$. In such case the generators $g_1 = 2^{2k}(\mod p)$ and $g_2 = 3^{2k}(\mod p)$ might be deterministically generated (which has its own advantages with respect to assurance of validity) and included as part of the system parameters, provided that the security proof for the crypto system is such that it is sufficient that the relation between the generators $g_1$ and $g_2$ is DLP-hard.

Does there exist any public key crypto system for which choosing such public key parameters would make sense, i.e. one that rests on the assumption that $\log_{g_1}g_2$ and $\log_{g_2}g_1$ are DLP-hard, rather than the assumption that the $g_2$ element in $(g_1,g_2)$ is indistinguishable from random?

In order for such a crypto system to exist, the following four criteria have to be met:

To begin with, the crypto system obviously has to use certain operations, such as modular exponentiation in $Z^*_p$, and have certain parameters, such as use multiple generators for a suitable subgroup.
Finding $log_23\mod p$ and $log_32\mod p$ have to be hard problems. If $p-1$ e.g. is divisible by a smooth number, they might not be hard problems. There might be other criteria I am not aware of.
The crypto system has to be based on a hard problem that is reducible to DLP, such as REPRESENTATION. There might be other hard problems that qualify.
There has to be specific reasons, either practical reasons or security reasons, for using deterministically generated generators instead of random ones (such as storage/time/bandwidth requirements, or inclusion of the generators in domain parameters). As pointed out in one of the answers below, in some cases such reasons do not exist. That doesn't however entail that such reasons can't exist in other cases.


texts: Is it possible to reduce the size of an RSA key?

texts:
The details about what an RSA key is made up of are explained succinctly here.

Is it possible to reduce the amount of data that's usually packaged with the (private) key and then derive it later?


texts: Proper encryption algorithm to use when encrypting data before backing it up to untrusted hosts?

texts:
I'm writing a (non production/proof of concept) backup program that takes files from your computer, splits them into blocks, and then has other peers store those blocks to create an offsite backup.

Those peers could be other parties that you would not want to disclose the contents of your backup to.

These peers work in a peer to peer fashion, allowing them to get a copy of a block from anyone who has a copy. This means that a peer that is replicating a backup could connect to the machine that is being backed up and request a block from the middle of the file.

So, it seems like it would be good for the machine that is being backed up to locally encrypt, with a symmetric cipher, the data before it is sent off as a block to a peer.

Normally, I would think "use AES". But I'm vaguely aware that there are modes, like CBC. And I'm thinking that chained modes like that would make it very hard to efficiently open a file, seek to a position somewhere near the middle, read a piece of data, encrypt it, and come up with the same cipher text as if it started at the beginning of the file and encrypted all the blocks in order up to that position.

How do the people who do whole disk encryption do this? Is something similar to what they use available for Python (3.x if that matters)?


texts: Yukel's Sieve - Factorization of Numbers into a Square Sieve

texts:
https://www.youtube.com/watch?v=liTTGeitpGQ

https://www.youtube.com/watch?v=2nOwgiweyqc

https://www.youtube.com/watch?v=rGwFsOG27DQ

I came across these videos explaining a pattern that is found in numbers over $27,000^2 = 729,000,000$.

The author claims that because he found the solution for prime numbers, that all current security keys will become obsolete:

"Interference Pattern over 30 revealed. Basis for New Factorization and Prime Finding Algorithm. 64 sets of two 900 by 900  modulo and remainder grids are all you need to find the factors to any number. The pattern repeats every 27000 or over a surface of 30^6"

"Basically all you need to find all the factors of every number are 64 grids of 900by900"

The author basically mapped the ideas expressed in this video, onto a plane: https://www.youtube.com/watch?v=V0CL7bv-UDk

From what I understand, this forms a fractal of prime numbers.

Can anyone view and verify his claims?
I am not a security / cryptography expert, however I would like to find out more.

Thank you.

The Author's Channel:
https://www.youtube.com/channel/UCfLDFyvPLNv2M8mHOMjDxuw/videos?view=0&sort=dd&shelf_id=0


texts: Difference between computationally and perfectly hiding (binding) properties

texts: I am new to Cryptography and has a trouble of understanding the difference between perfect and computationally hiding (binding) properties of a commitment scheme. I also would like to ask what does it mean to be a computationally bounded (unbounded) adversary? I tried to look at these through Google search but none provides a clear difference between these terminologies.


texts: Does $(u_1=r_1\cdot x,\ \ w_1=r_1\cdot z, \ \ u_2=r_2\cdot x,\ \ w_2=r_2\cdot z)$ Leak Information?

texts:
Consider we have a fixed value $x$. We pick values $ r_1,r_2,z\leftarrow \mathbb{F}_p$, where $p$ is a large prime number, and it is public. So $r_1,r_2,z$ are uniformly random values.

We compute four values as below:

$u_1=r_1\cdot x,\ \ w_1=r_1\cdot z$
$u_2=r_2\cdot x,\ \ w_2=r_2\cdot z$

Question: Do $u_1,u_2,w_1,w_2$ leak information about values $x,r_1,z,r_2$?

In other words: can an adversary learn about the values $x,r_1,z,r_2$ when given $u_1,u_2,w_1,w_2$?

Edit: $u_i, w_i\neq 0$


texts: Length of key: symmetric vs asymmetric algorithms

texts:
I am studying the fundamental concept of cryptography. I found the following statements:

You can compare symmetric algorithms based on the key (e.g., CAST-128 bit “weaker” than AES-256)
You cannot compare asymmetric algorithms based on key length.
More importantly, never compare asymmetric vs. symmetric key lengths!

The third point seems obvious. Can you explain me the other two?


texts: Misuse-resistant ephemeral key exchange?

texts:
This recent question had me the idea to ask: is there a "misuse-resistant ephemeral key exchange"?

At first sight, this seemed self-contradictary - ephemeral implies there's a random part, while misuse-resistant often implies determinism. But when went through the definitions, this may be workable.

 I may be mistaken but this is generally the purpose of an ephemeral key exchange.

  An ephemeral key exchange is one in which keying material is generated such that compromise of master key would not lead to disclosure of past exchanges.

So there's 3 questions that can be considered:

Had there been a formal definition of a "misuse-resistant ephemeral key exchange?
Had there been a proposed instance of one?
Would the interface of a misuse-resistant ephemeral key exchange fit with a regular key exchange?


texts: The following exercise is given in our book and I don't know how to solve it. Could somebody show me how to do it?

texts:
$\textbf{13.10 (Probabilistic full domain hash).}$ Consider the following signature scheme $\mathcal{S} = (G,S,V)$ with the message space $\mathcal{M}$, and using a hash function $H: \mathcal{M} \times \mathcal{R} \rightarrow \mathbb{Z}_n$:
$$\begin{equation}
\begin{split}
G():= \{(n,d) \xleftarrow[]{R}\operatorname{RSAGen}(l,e), \ pk:=(n,e), \ sk:=(n,d), \ \text{output} (pk,sk)\};\\
S(sk,m) := \{r \xleftarrow[]{R} \mathcal{R}, \ y \leftarrow H(m,r), \ \sigma \leftarrow y^d \in \mathbb{Z}_n, \ \text{output} (\sigma, r)\};\\
V(pk,m,(\sigma,r)) := \{y \leftarrow H(m,r), \ \text{accept if }\; y = \sigma^e \; \text{and reject otherwise}\}.
\end{split}
\end{equation}$$

Show that this signature is secure if the RSA assumption holds for $(l,e)$, the quantity $1/|\mathcal{R}|$ is negligible, and $H$ is modeled as a random oracle. Moreover, the reduction to inverting RSA is tight.

$\textbf{Disscusion:}$ While $\mathcal{S}'_{RSA-FDH}$, from Section 13.5, also has a tight reduction, the construction here does not use a PRF. The cost is that signatures are longer because $r$ is included in the signature.

It is the Exercise 13.10 from the book "A graduate course in applied cryptography".


texts: In DGHV Security How to get reliable oracle for least significant bit and then uses binary GCD algorothm that uses reliable oracle to find secret key p.Also what is oracle. Is this a turing machine.How we get Least Significant Bit from it. Please giude. Thanks


texts: Attack on DSA modification with bad hash function

texts:
Given a (bad) modification of DSA where the hash function is the identity ($H(m)=m$), I am now supposed to design an attack. So $(m, (r,s))$ are given and I should be able to create a legit signature $(r',s')$ for a chosen $m'$ (of course $m'\neq m$).

Since retrieving the private key $x$ doesn't work. My new approach is to choose $m'$ as a modification of $m$ such that $m'=t \cdot m$. Then I want to calculate $(r',s')$ to be a legit signature of $m'$. So I was doing the verification step with $m'$ in order to see how to modify $r'$:

$v'=g^{m' \cdot w} y^{r \cdot w}=g^{m' \cdot w + xrw} \mod q$ now $v'$ is supposed to equal $r'$. This means $g^{m' \cdot w + xrw}=g^k$ so $m'w+xrw=k$. But I can't just choose k, can I (because it's already $k=mw+xrw$ ? And I don't know to modify $r$ in order to make this work...


texts: Decrypted RSA 64 bit encryption using modulus and private exponent. Got gobbledygook [Verify]

texts:
As part of an experiment, I was given a .enc RSA (encrypted) file that was most likely generated using openssl. I had the public key, I factored it, obtained the private exponent, and decrypted the .enc file in chunks of 64 bit. What I got as a result, was nonsense hex. I was supposed to get a password or secret key.

What I have so far:

 Factors: 3917781347 x 4215069449
 Private exponent: 9440767265896423601
 Modulus: 16513720463601767803

I have used xxd to extract the hex data from the ciphertext file: xxd -p > enc.hex

This created a hex dump of the file called 'enc.hex'. The contents of this file begin like this:

 7d4554292d7b9f980ed049cea0f968cf438b6fc312cf2028ce5ce2fe9f38
 387b72a01bf6564f25884a2cacd187c2eeccd0cf78c2a74785f18d5e72b5
 270ac3e45b6f7505347b38ec7684b1af206d73ea4a84cd59b50be56d7abf
 74a569868406ab2b17846c9e448fe1392b21dac0b10fbb733536c99e598b
 683be7400a1ad55c42faa171becd803b8b8f4a1fa512a33222ec042486c5
 672f6200d4f00e2994b6d247a44edb6ce90795bde7ccda4433cf6fca8362
 f87c68f9df6418c4f0b8fb9da39a1d173fea2b1466e646f01e2dc7fb0499
 311d35ec75c15c5910b2d3e0c662de0b3b1716bab44faa2a36538bb44f6a
 3c3abd37692cf95fa075b58485ad983533782d7bf51e10c0e3b18ccec972

My Python code:

#!/usr/bin/python
d = 9440767265896423601
N = 16513720463601767803

file = open('enc.hex', 'r')
c = file.read()
n = 16
c = c.replace('\n', '').replace('\r', '')
m = [hex(pow(int(c[i:i+n], 16), d, N)).rstrip("L") for i in range(0, len(c), n)]

f = open('decrypted.hex', 'w')
f.write(''.join(m))
f.close()

Where, 'c' is the ciphertext, 'd' is the private exponent, 'N' is the modulus and 'm' is supposed to contain the plaintext hex bytes.

Output of my python script:

  0x2f2f7656414141410x41414141615155410x41416741414130670x6f414142464a4636
  0x39746d3641414b530x4c3137624e3041410x41424a44414141410x412f365758484676

When I convert this to ASCII, I get nonsense:

//vVAAAAAAAAaQUAAAgAAA0goAABFJF69tm6AAKSL17bN0AAABJDAAAAA/6WXHFv

Also, '2F 2F' is not a Magic Number and does not indicate a file type. As I said, I was supposed to get a password one way or another after decryption.

I have spent weeks over this experiment, and I'm on the verge of crying now if I don't decrypt this and get the password to the next level.

Could someone please quickly verify what I've done is right, and they are getting the same hex sequence after decryption? Here are the files in a tarball:

http://www.filedropper.com/chaltar

Contents:

.enc encrypted file
.uyu (was a hint that .enc is encrypted in RSA 64 bit chunks; you can ignore it)
.pem (a public key from where I extracted the modulus and public exponent)

UPDATE:

I understand what I need to do now, and I know what to expect. However, my Python code seems to be messing up the 64 bit block decryption somewhere near the end as I'm not getting the two '==' signs (3d 3d) at the end after decryption. This is the trail (end) hexdump of my decrypted file:

   002ACD50  33 30 34 31  34 31 34 31   34 31 34 31  30 78 34 31   3041414141410x41
   002ACD60  34 31 34 31  34 31 34 31   34 31 34 31  34 31 30 78   414141414141410x
   002ACD70  34 31 34 31  34 31 34 31   34 31 34 31  34 31 34 31   4141414141414141
   002ACD80  30 78 35 61  35 31 33 64   33 64 34 31  34 31 34 31   0x5a513d3d414141
   002ACD90  34 31 30 78  30                                       410x0

The file unexpectedly ended with one byte (30). Could someone point out what is wrong with my python decryption code above?


texts:
Body of question

Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along.

I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is generated only for every new message, but not for every block.

Second question is whether this method is not safe at all, or, it could be safe for odd block number, or perhaps for even block number?

What I've tried myself

I can see myself that in even block number case, the key is cancelled out at last (thanks to CBC), so what I get is $IV \oplus P_1 \oplus...\oplus P_n$, but can't think of a way to distinguish two messages with the IND-test for CPA.

Basically I can calculate the blocks of each $m_1,m_2$ that I use for the test, but the randomized IV will prevent me from knowing what message is the ciphered text retrieved from the test...

And what about the odd case?

Any ideas?


texts: Why is it OK for secretbox to leak the message length?

texts:
Most block cipher implementations expect users to pad so that the message matches the cipher block size. I understand the purpose of the padding is to make the input match the cipher block size. It also has a the possibly beneficial effect of hiding the actual message length from the observer.

With NaCl secretbox, the documentation is explicit in stating "Note that the length is not hidden.". What exactly does that mean?


texts: finding the basis of a kernel in a lattice

texts:
Given a parity check matrix $A$ we define the $q$-ary lattice
$$\Lambda(A) = \{x \in \mathbb Z^m\;:\;Ax\equiv0\pmod q\}$$
How to find the basis of the lattice and how to find its hermite normal form?


texts: What is the forward cipher function of AES-XTS?

texts:
We're using OpenSSLs EVP_aes_265_xts encryption on data (with unique, random, IVs for every new message encrypted) - which is working well.

But, I've been asked; what is the forward cipher function of this algorithm? I was going to say it's AES256, but am having doubts as to whether that's what the actual forward cipher function is defined as and/or encompasses!

Can someone give a little more of a precise answer as to what the forward cipher function is defined as for AES (256 bit) XTS?

Thanks!


texts: Where to get AES GCM NIST-like test cases

texts: I'm implementing AES GCM 256 bit at the moment.  Now I'm finished with copying the content of the standard as a program and now have to make it actually work.  With the test cases in the official NIST specification (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) and the original one (https://luca-giuzzi.unibs.it/corsi/Support/papers-cryptography/gcm-spec.pdf) I immediately found out – not surprisingly – that my implementation was wrong.  Now I'm trying to debug it like I did successfully for AES (without GCM) and SHA previously, but now my problem is that I couldn't find any suitable test cases.  The original specification has some, but since I implemented it with the NIST one I don't understand what the symbols mean and others I found online had not enough  intermediate steps for me to figure out where the problem(s) lie(s).  Where can I find working test cases with many intermediate steps using the convention of the NIST specification (or alternatively is there anywhere a translation between the two notations)?


texts: Is deriving the IV from the password secure?

texts:
I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below:

salt = scrambled_file.read(16)

key_and_iv = OpenSSL::PKCS5.pbkdf2_hmac(password, salt, 50000, 48, OpenSSL::Digest::SHA512.new)
key = key_and_iv.byteslice(0,32)
iv = key_and_iv.byteslice(32,16)

cipher= OpenSSL::Cipher::AES256.new(:CBC)
cipher.decrypt
cipher.key = key
cipher.iv = iv

decrypted_data = cipher.update(scrambled_file.read(...))

It basically takes a password and a 16-bytes random salt and pushes it through PBKDF2 (SHA512). Afterwards, the key is taken from the first 32 bytes and the IV from the 16 bytes following it.

Is it secure to derive the IV from the same hash as the key?


texts:
Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 bits of entropy or the entropy is reduced to 64 bits? (I mean another 64 bits of entropy probably lies in the second 128 bits of the output hash).

I am confused because in the definitions of cryptographic hash functions that I have read in the past it was said that if one bit of input is changed then every bit of the output changes with a probability of $1/2$. It seems from this we can deduce that our truncated output still has (almost*) the same entropy as the input. Is that right?

*: I added 'almost' to mean ignoring the possible hash collisions.


texts: Proof of work scheme with one and only one correct answer

texts:
I need a problem that has one and only one solution, such that the solution is hard to find but easy to verify. I need to be able to generate the problem deterministically from a random seed.

So essentially, I want to be able to do this:

A random value is produced.
One can then search for the "correct answer" to the random value.
There is one and only one "correct answer".
That a particular answer is correct can easily be verified.

Ideally, the amount of work required would be tunable. The problem with most proof of work systems is either that they don't ensure that there is one and only one correct answer or they require some entity to generate the problem and withhold the solution.

For example, I could require someone to produce something that HMACs with the random value to a very low result. But then there wouldn't be one and only one correct answer. I could multiply two primes together and the lowest factor could be the correct answer. But I have no agent that can do that multiplication. Steps one and two are set in stone, though I can adjust the size of the random number.

Update: It must not be possible to do all of the work before the random number is generated. Ideally, there would be no significant benefit to any precomputation. The random number being revealed must enable you to do the work.


texts: Is whirlpool vulnerable to length extension attack?

texts:
Is whirlpool vulnerable to length extension attacks?
I did not find anything on the topic and hardly anything interesting about whirlpool at all. I am trying to build some HMAC for a program and consider using whirlpool to do so.


texts:
El Gamal is a malleable homomorphic encryption system, so is Rabin. Are all homomorphic encryption systems malleable? Or are there any that are not malleable?
Thanks!


texts: Why do fully homo-morphic constructions use 'ring' or 'lattice' structures?

texts: Is there a significantly advantage to these data structures, or is it simply the status-quo and the easiest to use for describing constructions?


texts: Can I use ECC for encryption/decryption, just like RSA?

texts:
I'm familiar with RSA for asymmetric encryption. I also understand it's only supposed to encrypt small amounts of data (smaller than the key) so for encrypting arbitrary data I would typically generate a one-time random key, encrypt just that random key with asymmetric encryption, and then encrypt the actual data using AES with the random key (and then throw away the plaintext key)
Can I also use Elliptic Curve Cryptography for this? And if yes, can I use any common type of curves / keys?
For example, can I create a Ed25519 or Secp256k1 or Secp521r1 keypair, and then encrypt something with the public key so it can only be decrypted with the corresponding private key?
I sometimes read things like 'Ed25519 is only for signatures, not encryption' or 'ECC is only for authentication'.
Suppose I have an RSA keypair MyPrivateRsaKey.pem and MyPublicRsaKey.pem and a small data file secret.txt.I can encrypt secret.txt using MyPublicRsaKey.pem, and then the encrypted data can only be decrypted with MyPrivateRsaKey.pem.
Now if I have a keypair MyPrivateEd25519Key.pem and MyPublicEd25519Key.pem for example, can I do the same? Or am I mistaken and are elliptic curve keys fundamentally unsuitable for this?
P.S. note that for the context of this question, I'm not dealing with key exchange or signatures or certificates or authentication. Just asymmetric encryption+decryption.


texts: Converting Ed25519 public key to a Curve25519 public key

texts:
I understand that:

$$x_{montgomery} = \frac{1 + y_{edwards}}{1 - y_{edwards}}$$

Using the libsodium ed25519 implementation, I have tried to write the following:

void keypair_2(unsigned char *pk, unsigned char *sk)
{
    ge_p3 A;
    int i;

    sk[0] &= 248;
    sk[31] &= 63;
    sk[31] |= 64;

    ge_scalarmult_base(&A,sk); // generate ed25519 public from sk.

    fe one;
    fe u, v, vinv;
    fe montx;
    fe_1(one);
    fe_sub(v, one, A.Y); //v = 1-y
    fe_add(u, A.Y, one); //u = y+1
    fe_invert(vinv, v); //vinv = v^(-1) = (1-y)^(-1)
    fe_mul(montx, u, vinv); //montx = u/v = (y+1)/(1-y)
    fe_tobytes(pk, montx);
}

And I have compared this against the curve25519 implementation, but I am getting differing results.

I am unsure as to my error.


texts: Is AES secure for java application licensing?

texts:
I have to license a java application and want to code a quick implementation, the scheme I came up with is:

The Application calculates a string X which we assume to be the md5 sum of the computer's mac address, the current date and some other information.
the application returns a string Y equal to the last 16 digits of X to the user
the user contacts the Software Support office giving Y and the office encrypts Y using AES with a secret key and returns a string Z equal to the last 16 digits of the encrypted Y
the user inputs Z in the application and this checks that Z is equal to its own Z which is calculated the same way as at the Software Support. If the two are the same the software unlocks.

Now I would like to know whether two assumptions are reasonably safe or not:

Assume a cracker knows how Y is calculated and can calculate it for its own copy of the software and uses this Y to request a Z to the support center and unlock his copy of the software. Is it possible he will be able to calculate for every possible Y he wants a matching Z to unlock any copy of my software?
Because my software contains the encryption key inside the application bytecode a cracker with enough knowledge can decompile the encryption key and create his own Z to unlock the program (assume I tried my best obfuscating the code). A solution would be to use public key cryptography, however this would be useless in my opinion because if a cracker is able to decode the compiled bytecode of the application he will totally bypass whatever encryption scheme I will put because in the end there will always be a part of the code checking for a condition and setting that condition always to true will bypass any encryption scheme I will come up with. is it true?


texts:
Does anybody know where I can find infos on cryto used in saltstack. I know it's AES but can't find info on key size (128/256/... ) and if it's possible to configure?

The source code seems to reference AES 128, 1024 key size, HMAC-SHA256 and AES-CBC but as I'm not fluent with python and it's not clear to me if and how I can do AES256.


texts: Why the light contrast of a set $\mathcal{E}$ of VCRG produced by an encryption scheme for a binary image B is defined as follows

texts:
In the paper “Image encryption by multiple random grids”, Shyong Jian Shyu, 42(7):1582-1596,· July 2009, the light contrast of a set $\mathcal{E}$ of VCRG produced by an
encryption scheme for a binary image B is defined as
$$c(\mathcal{E})=\frac{\mathcal{T}(S[B(0)])-\mathcal{T}(S[B(1)])}{1+\mathcal{T}(S[B(1)])}$$

My question is : denominator taken as $1+\mathcal{T}(S[B(1)])$ why?


texts: Applying multiple hash functions to improve security?

texts:
Possible Duplicate:
  Guarding against cryptanalytic breakthroughs: combining multiple hash functions

I'm a total newb to cryptography but after reading what I've read about it, I had a simple idea and I wonder if it has any merit. What if you encrypted using a selection of hash algorithms applied sequentially instead of one, or multiple iterations of the same one? Which hash algorithms to apply and/or in what order could be chosen randomly and recorded in a salt which would be supplied along with any other salt. In fact it could increase complexity further by adding an additional random salt string in between each hash function. The authentication program would take the salt(s) and apply the same steps in the same order.

Like I said, I'm a complete beginner to crypto and maybe this is a crappy idea for one reason or another, or maybe it or something like it is already a known technique. At least naively it seems like it would be an easy way to make something tougher to crack.


texts:
In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, two methods:

GetBytes which generates a sequence of random bytes, and
GetNonZeroBytes which does the same thing, except that the generated sequence will contain only nonzero bytes.

In every case I've seen where a salt is generated (for example for PBKDF2), the code similar to this is used, calling always the GetNonZeroBytes method:

var salt = new byte[128];
using (var rng = new RNGCryptoServiceProvider())
{
    rng.GetNonZeroBytes(salt);
}

I'm not sure, but from what I've seen, I believe that zero bytes are avoided in other languages/frameworks too.

Why GetBytes is always avoided? What's bad in having x00 in a salt?

Is there a limitation in one of the popular hashing algorithms (SHA512, PBKDF2, etc.) which prevents using the salt containing x00, or the zero bytes are avoided only by fear to having interoperability issues or the issues with the storage of the salt in some third-party database?


texts:
From Fundamental theorem of arithmetic, every integer greater than 1 either is prime itself or is the product of prime numbers, and that this product is unique, up to the order of the factors.

$$n=p_1^{e_1}p_2^{e_2}p_3^{e_3}\cdots p_r^{e_r}$$

Inorder to factorize, the worst case is if the composite number is a product of two large primes. (general statement)

In RSA key generation, it is stated as follows

For security purposes, the integers p and q should be chosen at random, and should be similar in magnitude but 'differ in length by a few digits'to make factoring harder.

In Paillier key generation, it is stated as follows

Choose two large prime numbers p and q randomly and independently of each other such that $\gcd(pq,(p-1)(q-1))=1$. This property is assured if both primes are of equal length.

My doubt is, what is the actual worst case for integer factorization problem?

1) $n=pq $ and $length(p) = length(q)$ $\ge$ k, for some $k \ge 1024,2048 \cdots $

2) $n=pq$ and $|length(p)-length(q)| \le k$, for some $k  \ge 1,2,3\cdots$

Provide reference stating the worst case for integer factorization with particular values of $k$


texts: Is Intel's RDSEED a true random number generator?


texts: Chosen Cipher Text Security for Double Encryption

texts:
If $E_k$ is a CCA secure encryption scheme then why is $E′_{(k_1,k_2)}(M)=E_{k_2}(E_{k_1}(M))$, $D′_{(k_1,k_2)}(C)=D_{k_1}(D_{k_2}(C))$ not CCA secure when $k_2$ is known. Is there a way I can make a new cipher with keys $(k_1, k_2)$ such that its CCA secure regardless of which key the adversary finds?
My confusion here is how can I use the fact that key $k_2$ is known to break CCA security and why would that matter, because don't we treat these schemes as black-box when performing attack? What if I had $k_1$ instead, would that make any difference? And I'm quite clueless about the second part about new cipher using $k_1, k_2$ and still a secure CCA. Any idea or hint would be greatly appreciated.


texts: TLS/SSL's usage of Non-Ephemeral DH vs DHE

texts:
These questions revolve around DH and ECDH vs DHE and ECDHE.  Specifically within the context of TLS/SSL.  There are three questions in total (and a fourth bonus question).

The goal of using Diffie-hellman at all in TLS/SSL is to avoid the case where the contents of the certificate are the sole source for seed value for generating symmetric keys.  In a non Diffie-Hellman TLS/SSL session (aka, an RSA key exchange), if an attacker where to capture all the traffic, then at some time in the future acquire the private key, they can decrypt the entire content of the previously captured data.

Using Diffie-Hellman, however, a compromised private key won't instantly allow the attacker to decrypt all the prior captured cipher text.  Which is why you'd want to use Diffie-Hellman for key exchange, instead of RSA.

But from my reading, DH and ECDH perform the diffie-hellman key exchange using values stored in the certificates.  My first question: is specifically which of the DH values are stored in the Public Certificate and Private Key?

Having said that, my second question is does using DH/ECDH provide forward secrecy?

Lastly, it would seem that there is a bigger security increase going from DH/ECDH to their ephemeral counterparts (DHE/ECDHE), than there would be from going from RSA to DH/ECDH.  Given that, my third question is what would the benefit be (if any) of using DH/ECDH instead of the ephemeral counter-parts?

bonus question:  Does DH/ECDH have much usage in present day SSL/TLS implementations?  Or is it mostly just RSA and DHE/ECDHE that are typically used for key exchanges?


texts: What quality of randomness is needed for randomized side channel countermeasures?

texts:
Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES bytes) and Masking (aka blinding).
Now I wondered about where symmetric cryptographic implementations, e.g. a 4-shared masked and shuffled AES implementation, get their randomness from given that "proper" cryptographic randomness strategies would require computing (something like) AES again which gives us a circular dependency (?).
So my question is:
What quality of randomness is needed to secure a proper randomized cryptographic implementation and how is that randomness generated (usually)?
An optional follow-up (if not answered I will simply ask a new question): Does the randomness generator need to have the same level of protection as the main protected implementation (and thus also requires per-run randomness)?


texts: What's the name of this random number generation algorithm?

texts:
I'm looking for the name of an RNG method or algorithm, described below. Combining multiple results of a non-uniform random number generator can produce a more uniform result. It seems like this would be a common method employed by RNG algorithms, and especially HRNGs, to produce more statistically random results.
It would be awesome if someone could help identify the math/stat/crypto name for this method
The code below demonstrates a simple implementation of this method, with the 'bad' RNG producing non-uniform results, and the 'good' RNG producing about 50/50 results.
import random

# Function representing a non-uniform random number generator
def bad_RNG():

    result = 0
    if (random.random() > .99):
        result = 1

    return result

# Function that repeatedly applies an RNG function to create a more uniform result
def good_RNG():

    result = 0
    for i in range(100):
        if (bad_RNG() != bad_RNG()):
            result = 1 - result

    return result

# Tests RNG functions by running them 100 times, and printing the distribution of their results
def test_RNG(RNG_func):

    zeros = 0
    ones = 0

    for i in range(100):

        result = RNG_func()

        if (0 == result):
            zeros = zeros + 1
        else:
            ones = ones + 1

    print(zeros, end="|")
    print(ones)

print("bad_RNG result:")
test_RNG(bad_RNG)
print("\ngood_RNG result:")
test_RNG(good_RNG)

Alternative English Explanation
Assume an RNG function F() that returns either 0 or 1. F() results are non-uniform, as it usually returns a 0. By summing several F() results, and applying modulus 2, the result approaches a 50/50 uniform distribution.


texts:
In some papers,
server generates keys for users as follows:
$$sk_i=msk+H(ID_i)v_i\ (mod \ p)$$
where $msk=$ the secret key of server

$v_i$ is randomly selected from $Z_p$ for i-th user , $p$ is a prime number

$ID_i=$ the identity of i-th user

$sk_i=$ the secret key for i-thuser

$H$ is the hash function

If there is a user who knows more than one secret key, does that key generation scheme prevent to reveal the value of $msk$ from users.

How to prove the security?

I have forgotten paper references. Sorry for that.


texts: Is FFT for power-of-two cyclotomic rings possible if q is not 1 modulo 2n?

texts: For RLWE (Ring Learning With Errors) scheme, we use $R_{q} = \mathbb{Z}_{q}[x]/(x^{n} +1) = \mathbb{Z}_{q}[x]/(\Phi_{2n}(x))$ where $n = 2^{d}$ for some $d$. Since there exists $2n$-th root of unity in $\mathbb{Z}_{q}$ (which is the generator of the cyclic group $\mathbb{Z}_{q}^{\times}$), we can do FFT with the choice of the root of unity $\omega$ and do polynomial multiplication in $O(n\log n)$. Is there a way to apply FFT for primes $q \neq 1\,(\mathrm{mod}\,2n)$, so that there's no $2n$-th root of unity mod $q$?


texts: Size of a MAC for a quickly checked message?

texts: Let suppose that we have to check a message that was written one second ago. The message is discarded immediately after having being checked. What "minimal" size for such a MAC is secure?


texts: Including a "purpose" designation in a digital signature

texts:
A signature of some data can mean many different things, such as: This is a message I sent, this is a certificate I validated,... So I was surprised that common signing schemes don't include a "purpose" parameter as part of the signature. In particular I didn't find such a parameter in the schemes from PKCS#1.
Other methods such as PBKDF2 include a way to include a purpose designation that prevents interactions between different applications. In the case of PBKDF2 the purpose is simply concatenated with the salt.

Why is there no such purpose designation of a signature?
This would make it possible to use a single private key for multiple purposes, as long as the same signature scheme (such as RSASSA-PSS) is used in all of them. It would also help if a key is reused for different purposes accidentally.

Are there any existing workarounds?
This was one of the first things I ran into when looking at digital signatures, so I'd expect other people to have had the same problem. I'd prefer reusing an existing scheme here, instead of inventing my own.

What kind of workaround would be possible?
My first instinct is to sign the result of HMAC(message, purpose) and make sure this is the only kind of data ever signed. Would this be secure?

BTW: I'm talking about a signature-only key used with a single signature scheme here, since I know that it's bad to use a single key with different schemes or for encryption+signature.


texts: Can a large file be hashed down to 32 bytes, and then reconstructed from the hash?

texts:
We can hash a file or data using multihash or SHA-256, but can we retrieve the original data or file from the hash?

Are there any methods to retrieve the original file or data from a hash of it without using IPFS?

Or is there any encryption method which encrypts a 5 MB file and outputs a hash-like content of 32 bytes so that we can retrieve the original file from that 32 byte content?


texts: How multiplicative property of RSA can be exploited

texts:
It is known that RSA has the multiplicative property

$E(m_1) \cdot E(m_2) = E(m_1 \cdot m_2)$

because

$m_1^e \cdot m_2^e = (m_1 \cdot m_2)^e  \pmod n$

But how can this property be used to break the RSA system?

What are the attacks that use this property?


texts: What does AES round reduce in attacks mean?

texts: I am reading about some cryptanalysis attacks on AES. Most of the attacks reduces AES to 4. 5 or 6 rounds. What does that mean?


texts: Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

texts:
In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; $g^{ab}$ is their shared key. But this is vulnerable to man-in-the-middle attack.

To overcome the man-in-the-middle, suppose Alice and Bob use RSA signature scheme with their public keys signed by certificate authority. That is, Alice signs $g^a$ and Bob signs $g^b$. But if they're going to use RSA anyway, why even use Diffie-Hellman in the first place? Alice could just generate a random number (to be their shared key), sign it, encrypt it with Bob's public key, and send it to Bob.

Thank you!


texts: Why does TLS 1.3 use random-looking nonces for AEAD?

texts:
In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-looking and cannot be reused as the sequence number monotonically increases.

Why not just use the sequence number? Is there an advantage of having a random-looking nonce for AEAD? If not, how to explain this implementation choice?


texts: Is this a correct way of use symmetric encryption?

texts:
If I want to encrypt some block of text in AES, but at the time of decryption I don't have a way to check if the symmetric key is the correct one. So I:

Generate a randomKey, and use that to encrypt the text.
Encrypt the randomKey plus its hash using the user provided Key.
Save everything to a file.

Encryption

var userKey;
var plainText;

var randomKey256 = generateHexString(256);
var hash256 = sha(randomKey256);
var signature512 = concat(randomKey256, hash256);
var header = AES256_encrypt(signature512, userKey);

var cipher = AES256_encrypt(plainText, randomKey256);

var encryptedFile = concat(header, cipher);

Decryption

var userKey;
var encryptedFile;

//split encryptedFile in header|dataCipher
var header = encryptedData.substring(0,512);
var dataCipher = encryptedData.substring(512, null);

var signature512 = AES256_decrypt(header, userKey);

//split signature512 in RandomKey|Hash
var randomKey256 = signature512.substring(0,256);
var hash256 = signature512.substring(256,256);

if(SHA(randomKey256)==hash256){
    //valid key

    var plainText = AES256_decrypt(dataCipher, randomKey256);
}
else{
    //invalid user key
}

Obviously this is not real code. I understand that I will not be implementing my own security. I'm assuming that the whole thing would be encrypted in a safe environment. The user key is NOT going to be transmitted or stored anywhere.


texts: What machine learning accuracy is assumed to be predictable for TRNG/PUF application?

texts:
In regular machine learning (ML) applications, usually an accuracy of greater than 95% is desired.

In an ideal TRNG/PUF applications, unpredictable behavior (50% accuracy with ML models) is desired. How do we define the predictability in these applications? For example, is 60% predictable TRNG/PUF still a good one?
If it depends on the application, it will be so helpful if application examples  with their features can be named.


texts: What are the possible applications of fully homomorphic RSA algorithm?

texts:
As far as I know, RSA is not used for encrypting large files. Instead some symmetric key algorithm like AES or DES is being used for encryption with a random key and that random key is then encrypted with a public key. So, all operations in cloud will be performed on data that is encrypted using the symmetric key algorithms.

Then why would someone want RSA to be fully homomorphic? Are there any specific application for that? in cloud computing?


texts: How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting?

texts:
In a special ElGamal encryption scheme, every user has an ElGamal encryption key-pair using the same cyclic group $G$ and generator $g$.

The system has a special function :

$$ \mathrm{ShuffleEncrypt}(m_1, m_2, h_1, h_2 ) = \text{RandomPermutationOf} ( \operatorname{Enc}( h_1,m_1) , \operatorname{Enc}( h_2, m_2) ) = ( a, b)$$

$m_1$ and $m_2$ are plaintexts.

So given two public keys $h_1$ and $h_2$ and two plaintexts the function encrypts them and shuffles the resulting ElGamal ciphertexts ($a$ and $b$).

I want to prove in zero knowledge that $\mathrm{ShuffleEncrypt}$ was correctly done:

$m_1$, $m_2$ and the ElGamal randomization values must be kept hidden.
The ZNP must prove that $m_1$ and $m_2$ were known to the party doing $\mathrm{ShuffleEncrypt}$.

The verifier knows $h_1$, $h_2$, $a$ and $b$.

The ZN proof probably involves hiding both base an exponent values.
Since there are many users, they cannot jointly compute a master shared key nor any other shared secret.

Any idea?
(Maybe another public key cryptosystem is better suited for this kind of ZNP.)


texts: Given a message and signature, find a public key that makes the signature valid

texts:
Given a message $M$ and a signature $S$, is it feasible to find a RSA public key $(n,e)$ such that $S$ verifies as a valid signature on $M$ (using this public key)?

What if we're given one public key $(n,e)$ where the signature verifies (presumably, the public key of the original signer), and we want to find a second public key $(n',e')$ that also makes $S$ verify as a valid signature on $M$?  Is there an efficient algorithm to construct such a public key, and if so, how would you do it?  (We'll probably want $n'$ to be the same length, in bytes, as $n$.  Assume the RSA signature algorithm is using proper padding, e.g., PKCS #1.)


texts: Does hashing a hash of a password over and over again increase its security?

texts: I've heard of password cracking attacks using a list of commonly used passwords. Suppose in my situation, I can never be sure about the strength of the password, that a user inputs to my interface. So if I compute the SHA 256 hash of the user inputted password, then hash the hash again n times will that increase its overall probability of NOT being cracked ? If so what should be a reasonable value of n.  Thanks everyone in advance!!!


texts: Dan Boneh's Cryptography lecture - problem with 802.11b

texts:
I am going through Dan Boneh's Cyprography lectures on Coursera.

In Lecture 6
https://class.coursera.org/crypto-010/lecture/6

At 7:30 minutes, he discusses the problems with 802.11b design.
I understand his critique. However, he then moves on to what would be better design at 12:55 minutes.

He says that they could use a PRG to generate a very long key from the key and then use segments of the PRG(K) to encrypt each frame.

Even if you generate a very long PRG(K), considering the amount of traffic exchanged, wouldn't key still get repeated every few hours or so - i.e. you come to the end of the PRG(K), you have to start reusing first segment of PRG(K) again - which will lead to the key reuse problem. So what am I missing here?


texts:
I'm trying to implement DES from scratch using the NIST paper and the Wikipedia article on DES.

I got 16 round DES done, but I can't seem to get 8 round DES working. I figure it's because I got the rotation table wrong. The rotation table I'm using for the 16 round version is straight off of Wikipedia's DES Supplementary Materials, while the 8 round version is the same with a few 2's in the middle taken out to make the length 8. { 1, 1, 2, 2, 1, 2, 2, 1 } for encryption and { 0, 1, 2, 2, 1, 2, 2, 1 } for decryption, which uses inverted key scheduler for decryption. Apparently, that's wrong, and I can't find a table or a algorithm for creating a rotation table.

If anyone can point me to either, it'd be much appreciated.


texts:
In zero knowledge proofs, would it make a difference if the prover is deterministic or probabilistic?

As the verifier can simulate the prover's interaction with him, I assumed that the prover would need to be deterministic. Maybe this is a misunderstanding on my part?


texts: Pseudo Random Generator (PRG) from Rabin function

texts:
I'm trying to make a PRG using the Rabin function. The code (in Java) I wrote to implement the function is:

poublic static int rabinFunction(int m, int publicKey) {
    return (int) Math.pow(m, 2) % publicKey;
}

A trivial usage (using the numbers from the wikipedia link) would be:

int m = 20;
int pq = 7 * 11;

// output will be 15
int output = rabinFunction(20, 77);

I'm using this one way function to create a pseudo random generator. Basically, I run the Rabin function and use the least significant bit from the function output as part of my pseudorandom value. I use the return value from the previous execution as the seed for the next execution and I repeat this process until I've generated enough bits to encrypt my message. The issue I'm having is that the Rabin function returns the same values after 4 iterations:

rabinFunction(20, 77); //==> 15
rabinFunction(15, 77); //==> 71
rabinFunction(71, 77); //==> 36
rabinFunction(36, 77); //==> 64
rabinFunction(64, 77); //==> 15! Back to where we started, etc

I'm assuming that using the output from a previous execution of the Rabin function as the seed for a new one isn't correct. Can someone explain why this is wrong? Thanks in advance.


texts: Can I use M1 straight away and get rid of IV in Merkle–Damgård?

texts: In Merkle–Damgård is there any reason why we use a fixed $IV$ at the beginning? Can we use the first block ($M_1$) right away instead of $IV$ and feed it through the compression function with $M_2$.


texts: RSA Key Generation Parameters - public exponent, certainty, string-to-key count

texts:
I want to know what values are appropriate for the public exponent and certainty when generating an RSA Key (for example using Bouncy Castle RSAKeyGenerationParameters function).

What is the significance of the the string to key count (s2kcount) which appears to be optional input for the BcPBESecretKeyEncryptorBuilder bouncy castle function?

Is there an authoritative source that has a simple and answer to what to enter for the public exponent, certainty and string to key count? I have checked the RFC 4880 and other posts but have been unable to understand them to work this out.


texts:
Let $E$ be an elliptic curve defined over a finite field $F_q$ with prime order $n$ and $P,Q \in E$ and $k$ be private key such that $kP=Q$. Since $n$ is prime, $E$ is isomorphic to $Z_n$. Suppose $\psi$ be a map that
$$\psi:E \to Z_n$$

Also, let $a,b\in Z_n$ such that $\psi(P)=a,\psi(Q)=b$. Then we have:

  $$k=ba^{-1}$$

All recommended NIST elliptic curves(P-192,...,P-521,K-163,...) have prime orders.

Also When $\#E(F_p)=p$ we have polynomial time for computing such map. This is well known attack that is called anomalous curve attack.

What is the reason for confidence to them? Are computations speed enough?


texts:
Assuming I encrypt data with AES-128 and a random 8-byte key x in the following way:

ciphertext = AES_128_ECB_ENC(plaintext, x||x)

So basically taking the 8 byte key twice to form the 128-bit AES key. Would it make it easier to guess x than the naive (max) $2^{64}$ tries, assuming you know a single plaintext-ciphertext pair?

Would it somehow be possible to reduce the key expansion steps of AES, due to the symmetry in the key?


texts: Is there an efficient 2 out of 3 secret sharing scheme based on XOR?

texts:
I want to know if there is an efficient secret sharing scheme based on XOR such that a share of the message is given to three people and at least two must combine their share in order to construct the message?

What I have tried so far:

Suppose I got a message $M$, and three people A, B and C. Then what I do is

A gets
$a_1 = M \oplus \alpha$ and $a_2 = \beta$
B gets
$b_1 = M \oplus \beta$ and $b_2 = \alpha$
C gets
$c_1 = \alpha$ and $c_2 = \beta$

Where $\alpha$ and $\beta$ are two randomly generated bits the size of the message.

This works fine (with some modification), but the problem is that each person have to store twice the size of the message. Is there a more efficient one?


texts: How to prove a pseudo-random function has certain expansion factor

texts:
How should I answer the following problem:

Let $F = F0 \times F1$ be a pseudorandom generator with expansion factor $2n$ such that for
    all $x \in \{0, 1\}^n$
    $$F(x) = (F_0 (x) || F_1 (x))$$ and $$|x| = |F_0 (x)| = |F_1(x)|.$$
    Prove that
    $$F'(x) = (F_0 (F_0 (x)) || F_0 (F_1 (x)) || F_1 (F_0 (x)) || F_1 (F_1 (x)))$$
    is a pseudorandom generator with expansion factor $4n.$

Here I am not able to understand how expansion factor changes?

I am more interested in general proof structure for solving similar proofs.

I am beginner so more detailed explanation will be helpful.


texts: Multiple Rainbow Tables and their Success Probability

texts:
I am trying to understand the calculations for the success probability of finding an unknown key using rainbow tables.

Basically, I have a target success probability, a known keyspace of size $N$ and want to derive the neccessary table building parameters: the number of chains $m$, and the length of each chain $t$, and potentially the number of tables $l$ (see below).

The original paper by Oechslin gives the success probability of a single $m \times t$ table for finding a key in a keyspace of $N$ keys as
$$
P_{table} = 1 - \prod_{i=1}^{t}\left(1 - \frac{m_i}{N}\right)
$$

with $m_i$ recursively defined as $m_1 = m$ and $m_{n+1} = N\left(1-e^{\frac{-m_n}{N}}\right)$.

The appendix in the paper gives an explanation of this formula, which I can mostly follow. However, with $m_i$ defined like above, I cannot see how one could derive the parameters $m, t$ except by just evaluating the function, which is quite computationally expensive.
These posts suggest, that one just fixes $m$ to the available amount of memory and then scales $t$ to achieve the targeted success probability. This post links to a paper discussing this problem, but as far as I can tell perfect tables are assumed and the computations do not get much simpler.

It is argued, that the rainbow tables have a similar success probability to multiple Hellmann tables (each using a different reduction function), totaling to the same size as a single rainbow table. However, I could not find a proof for this claim anywhere.

Additionally, in Section 4.3 of Oechslin's paper, multiple rainbow tables are used to achieve a higher success probability than with a single table.

In what way do these multiple rainbow tables differ from each other?
How does using multiple tables differ from just constructing a single larger table?
How does using multiple rainbow tables increase the success probability?