texts: How to change the policy value of a CA identity in apple keychain?

texts:
According to this guide, I made an intermediate CA, and successfully used it to sign app in Windows. However, after converted it into a Apple keychain (by this guide), this CA become having an "iChat" policy, which cannot be used to code signing:

$ security find-identity -p ichat /path/to/my_keychain
Policy: iChat
  Matching identities
  1) XXXXXXXXXXXXXXX "my_identity" (CSSMERR_TP_NOT_TRUSTED)
     1 identities found

  Valid identities only
  1) XXXXXXXXXXXXXXX "my_identity" (CSSMERR_TP_NOT_TRUSTED)
     1 identities found

So, how to make it to have "codesigning" policy? Thanks for a lot!

====

Yesterday I tried some more works. After reading the x509v3_config manual, I modified the CA generation, and the resultant intermediate CA has following attributes:

$ openssl x509 -in my_cert.pem -noout -text
Certificate:
    ......
    X509v3 extensions:
        X509v3 Subject Key Identifier:
            ......
        X509v3 Authority Key Identifier:
            keyid:......

        X509v3 Basic Constraints: critical
            CA:TRUE, pathlen: 0
        X509v3 Key Usage: critical
            Digital Signature, Certificate Sign, CRL Sign
        X509v3 Extended Key Usage:
            Code Signing
......

And I re-generated the keychain file:

$ rm my_keychain
$ certtool i my_cert.pem k=`pwd`/my_keychain r=my_private_key.pem c

However, the CA in keychain is still recognized to only have iChat policy.


texts: The relationship between the key length and encrypt time in Xor algorithm?

texts:
I did work on the encryption algorithm and the decryption using the XOR method noticed that when more the key length, the less time spent on encryption and decryption.

I have two questions in particular:

Why the greater the key length less time?
in encryption algorithms using the XOR. Is the key should be a certain length or not?


texts: Sigma-Protocol to prove a commitment to a commitment

texts: Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (c_1, X, r_1, r_2): c_1=Com(X,r_1) \land c_2=Com(c_1,r_2)\}$? Zerocoin has a similar but not the same protocol as the $X$ known to the verifier in that protocol.


texts: What is the exact meaning of revocationWarning and revocationNotification in RFC 3161?

texts:
The RFC 3161 (Internet X.509 Public Key Infrastructure Time-Stamp Protocol) specifies that a time-stamping response has a PKIStatusInfo and, optionally, a timeStampToken. In turn, the PKIStatusInfo contains a PKIStatus, which is an integer in [0, 5]. For the values 4 and 5, the following descriptions are provided:

  revocationWarning      (4),
  -- this message contains a warning that a revocation is imminent

  revocationNotification (5)
  -- notification that a revocation has occurred

Both descriptions refer to "a revocation". What is this revocation referring to?

My guess is that it refers to the revocation of the TSA certificate... Is this correct? May any other revocation cause this response?


texts: Is the concatenation of one-way compression functions one-way?

texts:
Given two independently keyed compression functions $h_1$ and $h_2$:

$h_b(x): \{0,1\}^{3n} \to \{0,1\}^{n}$, where $b \in \{1,2\}$.

Let $h(x) = h_1(x) \| h_2(x)$.

Given at least one of $h_1$ and $h_2$ is a one-way function, is $h$ one-way?

Attempt at proving the statement

Assume we have an adversary $\mathcal{A}^{OW}_h$ breaking $h$.

Then, to prove $h$ secure, we must to construct adversaries $\mathcal{A}^{OW}_{h_b}$ breaking both $h_1$ and $h_2$:

We attempt to construct $\mathcal{A}^{OW}_{h_2}$ (breaking $h_2$), playing the game $OW_{\Pi,\mathcal{A}_{h_b}}$ where the challenger sends a $y = h(x)$ (and the key for $h$) and expects an $x'$ such that $h(x) = h(x')$.

Unfortunately, during the construction we cannot draw on $\mathcal{A}^{OW}_h$, since we only get $y_2 = h_2(x)$, and can therefore not construct a $y = h_1(x) \| h_2(x)$, which $\mathcal{A}^{OW}_h$ would expect.

Attempt at refuting the statement

To refute the statement we must find a (not necessarily one-way) compression function, that concatenated with a one-way compression function yields a non-one-way function.

We cannot use the solution for this question, since we have compressing functions and only one function is required to be one-way.

We've tried constructing a function that leaks $\frac{1}{3}$ of its input:

$h_1(x) =
\begin{cases}
x' & \text{if } x = 0^{2n} \| x'\\
1^n & \text{otherwise}
\end{cases}$

However, since we only receive a third of the input, we would have to guess the remaining two thirds, which leaves us with a negligible probability of succeeding.

Conclusion?

We've attempted to prove and refute the statement, but didn't succeed at either task - did we miss anything?

I don't think we can just assume an adversary $\mathcal{A}_{h_1}^{OW}$ during the proof?

Thanks a lot in advance!


texts: Is there a secure cryptosystem that can be performed mentally?

texts:
I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely.  However, I can think of many practical situations in which mental cryptography would be useful.

Is there a secure cryptosystem that is simple enough to be performed mentally?

Clearly, one of the challenges is remembering >100 bits of entropy to leverage, but I am assuming that this can be done beforehand.

How susceptible would any such system be to side channel attacks (like trash rummaging)?


texts: Reverse Java seed using outputs generated from nextInt(6)+1

texts:
Given a set of numbers within the range of 1-6:
[3,4,3,4,5,6,2,3,1,5,2,3,6,2,2,3,3,6,6,4,5,2,5,3,5,2,4,4,2,6,3,6,1,5,1,3,6,1,1,2,2,4,5,3,1,2,3,4,4,6]
generated using Java's nextInt(6)+1, is it possible to reverse engineer this to find the seed?
Upon investigating Java's source-code I understand this is how the nextInt() method works:
public static int nextInt(int n){
        if (n <= 0)
            throw new IllegalArgumentException("n must be positive");
        if ((n & -n) == n) // i.e., n is a power of 2
            return (int) ((n * (long) next(31)) >> 31);
        int bits, val;
        do
            {
                bits = next(31);
                val = bits % n;
            }
        while (bits - val + (n - 1) < 0); //do, until its a positive number
        return val;
    }

Since n in this case is 6, it is not a power of 2 so it carries out this part of the code:
do
  {
    bits = next(31);
    val = bits % n;
  }
  while (bits - val + (n - 1) < 0); //do, until its a positive number
  return val;

it now calls next(31) and this is the code where it essentially runs through a linear-congruential generator
public static int next(int bits){
  seed = (seed * 0x5DEECE66DL + 0xBL) & ((1L << 48) - 1);
  return (int) (seed >>> (48 - bits));
}

this 31bit number is returned as an int and assigned into bits
Finally we do bits % 6 and this gives the final value.
I have a few questions:
(1) what is the purpose of this line of code?
while (bits - val + (n - 1) < 0);
(2) How does one reverse engineer and find the seed from a set of numbers generated from this procedure?


texts: What is standard email encryption practice?

texts:
So I've recently got an email client set up with an encryption plugin, but I'm not sure what's happening behind the scenes.

What I haven't been able to find anywhere online is what is the standard way to encrypt emails? Do I encrypt with my private key, then your public key? The other way around? Do I encrypt with your public key, then sign with my private key? There's so many different options, and I can't seem to find what people consider the 'standard'.

While setting up the plugin, it automatically detects my keys stored with GPA and associates those with email addresses. I can also import keys from keyservers for contacts. However, if I email someone that I don't have a public key for, it warns me and wants me to download their public key before proceeding, so I know that it is using it in the encryption process.

If I were to encrypt a message by hand, ie using GPA, what steps would I need to take?


texts: Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm?

texts:
NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A:

Hash_DRBG (based on hash functions)
HMAC_DRBG (Based on Hash-based message authentication code)
CTR_DRBG (based on block ciphers)

If I need a 256-bit key for AES encryption, by using one of the above mentioned DRBGs and getting output from it as K, can I use K for AES encryption directly? or I must use K as an input of other algorithm that is called key generator and the output of key generator will be key?


texts: Dynamic accumulator with only non-membership witness

texts:
Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct.

Consider a group $Z_p$ where $p$ is prime number. Consider the set $S=\{c_1, c_2,\cdots, c_m\}$ where $c_i\in Primes(Z_p)$. Consider the following accumulator:
$$
A = \left(\prod_{c_i \in S} c_i\right) \text{mod } p.
$$

Addition: To add a new element $c \in Primes(Z_p)$,
$$
A \longleftarrow \left(A\times c\right) \text{mod } p.
$$

Non-Memerbship witness $(x,y)$: To show $c \not\in S$, we use the fact that $c$ is co-prime with all the elements in $S$. We use Bezout coefficient $(x,y)$ to show that
$$
cx+Ay=1 \text{ mod } p.
$$

Security: $\forall c\in S$, there exists no algorithm $\mathcal{A}$ such that

$$
(x,y) \leftarrow \mathcal{A}(c,S),\; cx+Ay=1 \text{ mod } p.
$$


texts: Is SHA-1 secure when used to implement a PRNG

texts:
I read SHA-1 is still a secured hashing function with no collision found as of now. However, it's just a matter of time for someone to come up with such a collision or attack. Therefore, in new projects, it is recommended to use SHA-256. SHA-512 is even better.

In Java, we still use the "SHA1PRNG" algorithm in the SecureRandom class for the purpose of generating IV (let's say for CBC).

Is SHA-1 secure enough as hash function within a PRNG to generate an unpredictable IV for CBC? Or is SHA-256 recommended, even for a PRNG?


texts: Is it possible to perform one-way Diffie-Hellman MITM?

texts: Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot verify his fingerprint. Despite that, we have a secure channel over which he can send me one bit of information - whether my key was valid or not. Can I trust the OTR session if he successfully verified my key and sent me this confirmation or is there still a risk of a man-in-the-middle attack?


texts: Multiplication instead of Key Derivation Function?

texts:
context
In a one message communication.
We are right after 2 DHKE (instead of one). Both users then have 2 secret numbers, J and K.
question
Is it a risk to replace the use of a Key Derivation Function with a multiplication of the form S=J**K, creating a big number and only use the bits we need to exchange the only message that conversation needs using a xor operation between S and the message?
Thanks
edit:
After generating the arrays of solutions, that idea is definitely BAD for even values of J and if you don't truncate the first bits. Many numbers have a bias and large contiguous 0s are happening.
Other than that, it really seems random.
edit2:
"Other than that, it really seems random.". Let me rephrase it: if you are not using even values, no bias occur and the generated number really seems random and completely unrelated to previous values.


texts:
I'm recently reading Berry Schoenmakers's Lecture Notes Cryptographic Protocols (page. 53) and confused about this following question:

  Let $g$, $h$ denote generators of a group of large prime order $n$
  such that $log_gh$ is unknown to anyone. Design Σ-protocols (and prove
  correctness) for the following relations:

  {($A, B; x, y, z$) : $A = g^xh^y,B = g^{1/x}h^z, x \neq 0$};

My prove intuition is using Okamoto's protocol for $A = g^xh^y$ and $B = g^{1/x}h^z$, then how to prove the relation between $x$ in $A$ and $1/x$ in $B$?
Or is there any other way to prove it?


texts: Can Winternitz be easily converted to a many-time encryption scheme?

texts:
The Winternitz scheme is typically cited as being an OTS scheme. Can it also be used as a one-time encryption scheme?

If it can be used as a one-time encryption scheme, then is it possible to easily convert it into a many-time encryption scheme that uses either a single key or different keys that may be generated in some deterministic way from a single key i.e. only a single key needs to be stored and cyphertexts provide some sort of IV to allow the appropriate key for that cyphertext to be generated and decrypted?


texts: What is necessary for generating an elliptic curve?

texts: Let's say I want to generate my own elliptic curve with an order whose bit length is $n$ (specifically 2048, 4096, and/or 8192)? How would I do this? What needs to be done? What software can do this? How long would it take for a given size?


texts:
I have been thinking recently about inherently sequential functions. In trying to wrap my head around them, I tried to come to the simplest possible function that looks inherently sequential to me. For didactical purposes, I'd like some feedback.
Consider two sequences of 64-bit integers: $a_1, \ldots, a_N$ and $b_1, \ldots, b_N$. Now, consider the sequence of 64-bit integers $x_0, \ldots, x_N$ defined by
\begin{align}
x_0 &= 0 \\
x_{n + 1} &= (x_n \oplus a_{n + 1}) + b_{n + 1}
\end{align}
where I use $\oplus$ to denote bitwise-XOR and $+$ to denote the sum modulo 64 bits. Intuitively, $x_N$ is obtained by a long sequence of alternating XORs and sums. I am wondering: is the computation of $x_N$ inherently sequential?
I cannot seem to easily see how one could achieve $x_N$ faster than just going through each operation. But, I realise that I might be missing something.
Here I am interested about both theory and practice: I'm curious to know if this function can be proved to be inherently sequential, but also if this function could be safely assumed to be inherently sequential, just like, e.g., cryptographic hash functions are safely assumed to approximate well a random oracle.
More specifically
I'll try to be more specific. What I am wondering is whether or not all bits in $x_N$ can be computed by a polynomially-sized boolean circuit whose critical depth is smaller than that of the trivial circuit, sequentially applying XORs and sums.


texts: Why do some people believe that humans are "bad at" generating random numbers/characters like this?

texts:
I'm not even sure if they are serious, but I've heard many times that some people refuse to not only trust their computer to generate a random string (which is understandable) but also don't trust themselves to do it. So, instead of simply typing/writing down:
fcC540dfdK45xslLDdfd7dDL92

And then randomly changing a few of those to other ones a few seconds later, such as one in the beginning, one in the middle and one in the end, they use dice which they roll again and again to generate random numbers, which are then treated as "truly random" and thus "truly secure".
Why would a dice roll be "more random" than simply coming up with a sequence in your head, and then changing some of them?
I simply don't believe that this could possibly be "not secure". Why the need to do the very tedious dice rolling? It feels like a ritual that they go through, based not on logic and reason, but on some sort of delusion that their brain is going to generate the same sequence as others who guess it, or a computer, even though they also change some of them after the phrase is "done".
I don't understand this. Is there anything that speaks for this practice as being "more random"/"more secure"?


texts: How does fully homomorphic encryption compare to partially homomorphic encryption in terms of security?

texts:
I found some questions and answers about the performance of Fully and Partially homomorphic encryption. I am interested in a comparison in terms of security guarantees (of any kind, formal or informal). I understand that there are various schemes for both and so a comparison between specific schemes is equally useful to me.

Is, for instance, Paillier/Elgamal more/less secure than FHE (both allow additions and multiplications)?

Is DET/OPE/ORE more/less(probably) secure than FHE (both allow equality and order comparisons)?


texts:
I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value.

From this 128-bit seed, we run SHA512 to derive a 256-bit key, 128-bit IV and 128-bit file identifier used to find the file on the server. The key and IV are then used to encrypt the file with AES in GCM mode. Only the file identifier is sent to the server at any point, encryption is done completely client side.

The only point at which I'm concerned here is the SHA512 of the 128-bit seed. Would there be any benefit to going to an HKDF based key expansion? It seems to be designed for this purpose, but considering we're able to achieve everything we need with a single invocation of SHA512 I'm unsure of the benefit. As far as I can tell, HKDF is still relying upon hash functions to randomly distribute entropy.

I understand there may be some theoretical benefit here, I'm just looking for details on how this benefit may work, what a theoretical attack might look like and if there's anything practical which could be used to exploit this today.


texts: PBEWithHmacSHA512AndAES_128 and AES Modes like GCM

texts:
I've asked this question on stackoverflow

And I think one gentleman has already answered the first part of question

  a) In my code i am keeping IV and salt with ciphertext. I wanted to use AES/GCM to check integrity of entire IV + salt.

I've got the following answer and I'm fine with it:

  PBEWithHmacSHA512AndAES_128 does not come with flexibility of
  specifying mode like GCM

Can you please help me with the next question:

  b) Why the byte [] of key is 9 bytes? (When I give input as Pree@2017 the key generated is 9 bytes - I have check the length of
  pbeKey.getEncoded() and its 9.

Can anyone from the community help please ...


texts:
Recently I found the sagecipher project, which uses ssh-agent's signing operation as a way to produce a symmetric key and encrypt data with it. It appears to work with ssh-ed25519 keys, but my question is: Is this guaranteed to work?
That is, are signatures always deterministic with the key and signature algorithms supported by OpenSSH, or could there be a situation where sagecipher's result is not decryptable because the tool always gets different signatures from the same input?
(Second question being, are there any obvious security problems with this method?)


texts: Revocation of users in encrypted storage system?

texts:
How can you design an encrypted storage system, that allows adding and removing users without sharing a common secret and having to re-encrypt everything when a user is removed?

My partial idea is:

Each user has a RSA key pair. Shared folders have an encryption key (EK1), that is encrypted with each user's public key. If a user uploads a file, an HMAC-SHA using EK1 is calculated over the file contents. The file is then encrypted using a random nonce (RN), random key (RK) and AES256-GCM(RN, RK, data). The RK is then encrypted using EK1 and prepended to the encrypted file, together with the RN. The encrypted file is then stored under its HMAC-SHA (this also enables deduplication).

If you remove an user from the shared folder, you can generate a new shared folder encryption key (EK2) and encrypt that new key with the public keys of the remaining users.

Problem:

If a user tries to upload the same file again, it now has a different HMAC-SHA because of the new EK2 which is different from EK1. And decrypting is now also impossible, as EK1 has been replaced by EK2.

Question:

How can you model such a storage system, that enables removing users without re-encrypting everything?


texts: Never design your own crypto...how to design a PRG

texts:
As a new learner of cryptography I have learnt from online tutorials and lectures not to design your own crypto.

What I am trying to understand is the fundamental to designing PRGs to a given context or scenario.

My question specifically is how does one design a PRG for a random compression function for example? I looked at a previous example post (PRG Theory Design) and was trying to design a PRG for their random compression function: $f:\{0,1\}^{2n} \rightarrow \{0,1\}^n$ but didn't get how to. I got something like $G: \{0,1\}^n \rightarrow \{0,1\}^{n/2} * 2$ but please forgive me I am new to it all. I am simply interested in designing PRGs as I know I can never develop my own crypto. I just like finding problems on this forum and trying to solve it.

Any help, more than happy


texts: Does there exist a compression function (from four 32-bit words to one 32-bit word) that always detects any modification of a single word?

texts:
I need a compression function $F$ that uses only bitwise operations (AND, NOT, OR, XOR, shifts, rotations) and outputs one 32-bit word $W$ from four 32-bit words $w_1 \mathbin\Vert w_2 \mathbin\Vert w_3 \mathbin\Vert w_4$. The function is required to satisfy one special property: if two 128-bit blocks

$$\begin{array}{l}
B_1 = w_{1.1} \mathbin\Vert w_{1.2} \mathbin\Vert w_{1.3} \mathbin\Vert w_{1.4},\\
B_2 = w_{2.1} \mathbin\Vert w_{2.2} \mathbin\Vert w_{2.3} \mathbin\Vert w_{2.4}
\end{array}$$

differ only in one word (that is, there exists only one number $x$ such that $w_{1.x} \neq w_{2.x}$), then $$F(B_1) \neq F(B_2).$$

But if we have a set $S$ of $y$ different 128-bit blocks

$$S = \{B_1, B_2, \ldots, B_{y-1}, B_y\}$$

such that for any pair $(B_m, B_n)$ of elements, $B_m$ differs from $B_n$ in two or more words, then the probability of
$F(B_m) = F(B_n)$ is the same as for any standard cryptographic compression function (that outputs one 32-bit word from four 32-bit words).

Is it possible to construct such a function? If yes, can anyone give an example of a function that fits the above description?

EDIT

The connection to cryptography is that some attacks on EnRUPT and XXTEA use the fact that the round function does not satisfy the property described above:

  The round function of EnRUPT is not bijective for the given key word

and

  XXTEA’s $F$ is not bijective for either neighbor


texts:
It seems to me that signing the hash of the public key with ECDSA should be a sufficient non-interactive proof of knowledge.

In my use case, I only need the guarantee that "someone even had knowledge", not that the proof is linked to a specific transmitter.

Is there a good precedent for using ECDSA in this manner?

Since ECDSA is part of the openssl library, and ECDSA is, effectively, a proof of knowledge I though it would be better to choose this technique over building it from scratch.


texts: Leak-proof protocol: is such a thing possible?

texts:
Is it possible to design a protocol that by itself guarantees that a malicious implementation cannot leak secret data without breaking the protocol?

Setting:

Alice and Bob have a pre-shared secret key K. Using this key, Alice encrypts a bunch of plaintexts and sends them to Bob as a collection of files. The plaintexts are short-ish texts in a natural language.
Each plaintext is encrypted independently of others, and must be decryptable independently. Some sort of authenticated encryption is used.
Eve receives a copy of the collection. This is the only data she gets (i.e. no timing or other side channels). She does not communicate with Alice (but can have a previous arrangement with her, e.g. pre-share some secret keys). Alice cannot communicate with Eve directly, or otherwise send out any data except as defined by this protocol.
We want to ensure that Alice cannot manipulate the encryption, without consequences detectable by Bob, in such a way that Eve can obtain information about the secret key. We assume that transmission is 100% reliable, so if Bob can't decrypt some of the files, he will conclude that Alice is a bad actor.
Also, obviously, we don't want Eve to obtain the plaintexts. It's tolerable if Eve can detect multiple copies of the same plaintext.

It seems that any kind of randomness in the protocol has to be excluded.

For example, if we use an encryption scheme with random IV which is prepended to the ciphertext, Alice can just encrypt the secret key K using another secret key known to Eve, Ke, and apply it instead of IV (IV := E(Ke, K)). Instant leak!

If our protocol adds randomness to the plaintext itself (before encryption), Alice still can manipulate the encryption result by choosing the random value. In the worst case she will have to use brute force, changing the random bits until specific bits of the ciphertext assume the values she wants. On average, she will need about 2n iterations to leak n bits of data. If, say, 1000 encryptions is a small enough number to be unnoticeable on any modern equipment (even "weak" such as a smartphone), then Alice would be able to leak ~10 bits of data per encrypted file.

The next thought I tried is to use deterministic encryption with Synthetic IV based on plaintext (similar to SIV-CTR construct). Besides obvious drawbacks caused by the low entropy of the natural-language plaintexts, this scheme still does not preclude Alice from leaking if she can manipulate plaintexts in a way not obvious to Bob. For example, she can try adding spaces at the ends of text lines, or insert some non-spacing Unicode chars, until she gets desired bit pattern in the ciphertext. (I don't know how to estimate the effort she'll need to leak n bits per ciphertext. Is it still O(2n), as in previous case?)

The last option seems better than others, because the manipulations are detectable by Bob, at least potentially. But this detection happens outside the domain of the protocol, and is not reliable. Are there other possibilities?


texts: Privacy and Integrity in Public Cryptography

texts:
I'm trying to figure out which is the best way to get privacy and integrity together in public cryptography.

Alice needs to send multiple files $f$ (may be big) to Bob.

I've thought:

Alice computes the hash of the file $h(f)$.

Alice signs $h(f)$ with her private key.

Alice encrypts with Bob's public key $f$ and $Sig_a(h(f))$ resulting in the ciphertext $Enc_b(f, Sig_a(h(f)))$.

Only Bob can decrypt with his private key: privacy guaranteed.
Once Bob decrypted, can verify Alice's signature.

In my opinion this protocol provides privacy and integrity together, right?

Update

So, according to your answers, here's what i've understood:

The protocol is terribly inefficient because it encrypts a large file using public cryptography. This would require to split the file in n chunks ($f_1,f_2,...f_n$) and to send to Bob $Enc_b(f_i, Sig_a(h(f_i)))$ for i = 1 to n. This may require a padding.
A bad guy (Charles) that receives $Enc_c(f, Sig_a(h(f)))$ could decrypt it and re-encrypt it with Bob's public key and send it to Bob. No confidentiality.
In order to fix this, Alice should perform $Enc_b(f,A,Sig_a(h(f),B))$

At this point we can say that:

This protocol (as it is) MAY (depends on how it is implemented in practice) guarantee integrity.
I would use Diffie-Hellman key-exchange protocol (the ephemeral version) to estabilish a secure channel and use symmetric cryptography.

Update 2

Not even integrity is guaranteed. I've seen the so called "message malleability".


texts: Why does AES have exactly 10 rounds for a 128-bit key, 12 for 192 bits and 14 for a 256-bit key size?

texts:
I was reading about the AES algorithm to be used in one of our projects and found that the exact number of rounds is fixed in AES for specific key sizes:

$$
\begin{array}{|c|c|}
\hline
  \begin{array}{c} \textbf{Key Size} \\ \left(\text{bits}\right) \end{array}
 &\begin{array}{c} \textbf{Rounds}   \\ \left(\text{number}\right) \end{array} \\ \hline
128 & 10 \\ \hline
192 & 12 \\ \hline
256 & 14 \\ \hline
\end{array}
$$

Why these specific numbers of rounds only?


texts:
TLS session keys are derived as a result of authenticated key agreement.

Is being able to decrypt a record at an endpoint after receiving change_cipher_spec sufficient guarantee that the endpoint is accepting record from the authenticated peer? I believe 'yes'.

I understand that the verification of TLS finished message ensures that the handshake messages were not tampered by MITM. The decryption of TLS record containing finished message proves the record arrived from authenticated peer.

In the case of extended-master-secret extension, the master secret (and hence session keys too) are derived as a function hash of handshake message (i.e. transcript hash). Therefore, if extended master secret is used, being able to decrypt records after change_cipher_spec should prove both authenticity of peer & non-tampering of handshake messages.

In this case, can the handshake protocol do away with finished message without compromising on the security guarantees?


texts: RSA-CCA security of $m || H(m)$ as input to modular exponentiation

texts:
If we encrypt a message $m$ as $m || H(m)$ using textbook RSA encryption algorithm, $H$ is random oracle modeled. In this case the message can be recovered.

Is this encryption CCA secure? If so how can we prove it or not?


texts: Safely using ciphers that take small key sizes

texts:
Is it feasible to use triple encryption for block ciphers with the maximum keysize being the only significant security issue? I mean $C = E_{k_1}(E_{k_2}(E_{k_3}(P)))$ and $P = D_{k_1}(D_{k_2}(D_{k_3}(C)))$ where $E$ is encryption, $D$ is decryption, $P$ is a plaintext block, and $C$ is a ciphertext block. $k_1$, $k_2$, and $k_3$ are mutually independent keys, each individually of a size vulnerable to exhaustive search. I know that 3DES uses encrypt-decrypt-encrypt for efficiency in hardware from this question.

What about stream ciphers? If a stream cipher has a  small key size, would it be feasible to do $C = P \oplus K_{k_1} \oplus K_{k_2} \oplus K_{k_3}$ and $P = C \oplus K_{k_1} \oplus K_{k_2} \oplus K_{k_3}$ where $K$ is the keystream?

My naive interpretation is that these would be secure ways to use ciphers that take small keys, with the only downside being a meet-in-the-middle attack reducing the effective keyspace to $2^{2n}$ where each of the three keys are of size $n$. Is this interpretation correct? Do any other attacks exist?


texts: can we know the sign of a ciphertext (homomorphic)

texts: Is it possible to know the sign (positive or negative) of an homomorphic ciphertext particularly under paillier scheme ?


texts: How to normalize data of a generic HTTP request for the purpose of signing

texts:
I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the solution is the HTTP request normalization. (Use of HTTP is a condition, since this is the most realistic usage scenario these days.)

Basically, I need to answer the question "How do I turn any incoming HTTP request into a normalized signature base string so that I can compute a signature?" (my current approach is here).

Are there any standard ways to solve this task?

If not, how would you go around the issue? Should I include HTTP headers or focus only on URL, method and body? Should I pay attention to the corner cases, such as duplicate GET parameters? etc.


texts: Is there a standard way to determine a complexity of the specified SAT problem? I'm researching algebraic cryptanalysis and came to solving multivariate quadratic equation systems using CryptoMiniSat. However it would be nice to evaluate a complexity of the full cipher equation system. Does it only depend on the number of polynomials and variables? And is there a way to estimate the time needed for solving the equation system and what parameters do I need to know to find that out?


texts: Can TLS be used simply to exchange keys using the handshake protocol?

texts:
From what I understand, in general, TLS consists of two protocols:
1 - Handshake protocol: uses public-key cryptography (ECDH, DH) to establish a shared secret between the client and server.
2 - Record protocol: uses the shared secret established in the handshake protocol to protect communication or application data between the client and server
Let's say I want to encrypt data and then use steganography to hide the encrypted data in an image, then I want to exchange the key used with the server using the handshake protocol BUT I do not want to send the steganographic image using the record protocol because it would defeat the purpose.
So, can I simply complete the handshake protocol and then drop the connection?


texts: What could be the problem with this TLS 1.2 Client Finished Message approach?

texts:
Can someone make sure I'm creating my Client finished message properly as I've been working at this for days and keep getting a Bad record MAC error and I have no idea what I'm doing wrong.

First step is creating the 12 bytes of verify data. This is created using the PRF with the master secret, the label "client finished", and the sha256 digest of all the previous handshake messages. (The cipher suite is TLS_RSA_WITH_AES_256_CBC_SHA256).
The 12 bytes are then placed in the finished handshake record with a handshake type field and 3byte length field.
These 16 bytes are then passed through the sha256 HMAC, which has as input:

the sequence number (for a finished message this is number 3 as the previous 3  messages were the client hello, the client key exchange, and the change cipher spec)
the type - 0x14
the version - 0x0303
the length -16
the 16 bytes of 'plain text data'

This produces 32 bytes of hash which are tagged onto the 16 bytes of data, creating 48 bytes before padding (49 if you include the padding length field). And so we add 15 bytes of padding with value 0x0F. This takes the total length to 64 bytes (a multiple of the block size 16).
The 64 bytes are then encrypted with using the IV and the client write key.
The 64 bytes, preceded by the 16 byte IV are sent to the server - 80 bytes in total.

What am I doing wrong?

EDIT

Thanks for the pointers guys! Don't know why I hadn't thought of debugging another implementation to find where I was going wrong. Turns out the library I was using for calculating my SHA256 HMAC (I was using Nettle) was a bit buggy. I imported another library and managed to get it all working!


texts: Purpose of repeating a 16-byte key for Salsa20

texts:
The core of the Salsa20 family of stream ciphers is a hash function that takes a 64-byte block, using it to generate a pseudorandom 64-byte output. The 64 bytes contain space for

a 32-byte key
a 16-byte constant
an 8-byte counter
an 8-byte nonce

These ciphers are intended to be used with 32 byte keys, but they can also be used with smaller keys. Using a 16 byte key involves changing the constant so there are no equivalent keys between the different sizes, and repeating the 16-byte key so it fits into 32 bytes (i.e. the input is $k \mathbin\| k$ for a 16-byte $k$ and just $k$ for a 32-byte $k$).

Why is this done? Why is the key not simply zero-padded? If cryptanalysis (but not exhaustive search) of the keystream can be made easier when a key without uniform distribution is used, the scheme is broken.

From section 4.1 of The Salsa20 family of stream ciphers:

  The diagonal constants are the same for every block, every nonce, and every 32-byte key. As an extra (non-recommended) option, Salsa20 can use a 16-byte key, repeated to form a 32-byte key; in this case the diagonal constants change to 0x61707865, 0x3120646e, 0x79622d36, 0x6b206574.


texts:
I'm trying to understand the different between AES-CCM and AES-CCM* (as defined in IEEE Std 802.15.4™‐2011, Annex B).
I see that there are more restrictions on L and M and also M=0 is allowed:

L = 2
M = [0,4,8,16]

Is it correct that the max message length is 2^16 = 64K (since L=2)? Isn't it too short?
The encoding of M is quite different since M=0 is allowed. Are there other differences in the calculation?
Is it secure for variable-length messages? How?


texts:
So, as an exercise to greater understand some things about cryptography, I decided to try and implement GOST 28147-89, which uses eight 4x4 S-Boxes. I can grasp the concept of putting 4 bits through the S-Box and getting four out, but how would one reverse this?

Furthermore, how would one reverse uneven S-Boxes, such as DES's 6x4 S-Box, when multiple inputs give the same output (e.g., for DES's S-Box S5, where inputs of 100011, 101110, 011101, and 010000 all give an output of 1000).


texts:
Suppose we have classic RSA scheme. Let $n=pq$, $e$ public, $d$ secret.

Then message(M), not empty(not 0), is encrypted by choosing random $r$ and computing $A=(r^e)^e$ and $B=(Mr)^e$

$(A,B)$ is then cipher text.

Why is this not IND-CPA secure? Have trouble grasping IND-CPA concept.. well concept is clear, but how to prove it?

Given above scheme, my thoughts are, since we are able to feed $M=1$ to oracle, we receive $r^{e^2}$ and $(r^2)^e$, but that thought leeds me absolutely nowhere.


texts: Can a random permutation be restored / decrypted?

texts:
Say you have a 1,000,000 random bytes file and you split it into 1000 x (1000 bytes) pieces.

You then pick two random pieces and swap them writing down the position of the pieces (eg. swapped piece 34 with piece 457).

You repeat the process 1000 times at least.

Is it possible for somebody else to recover the original file without any other information but the scrambled file ?

What if multiple files encrypted like this (using the same permutation) are intercepted, how difficult is it then to decrypt them ?


texts: Is there much difference in a RSA-4096 over RSA-3072 for support/speed and security?

texts:
I am in the process of created a signing certificate and i have an option of RSA-4096 or RSA-3072.
Is there much difference in security between the two? I know people say RSA-3072 should be good until 2030. But people may also prefer the high security.
But if it makes a big difference on speed, they may not.
So do you think it is worth using RSA-4096 for the next 10 years?


texts: Are well designed crypographic codes unbreakable? (NOT ciphers)

texts:
Codes are not to be confused with ciphers. It is known that all known ciphers are theoretically breakable except the one-time pad and this isn't what the question is about.

Some cryptographic codes are akin to inventing one's own secret language, along with new words, new expressions, and new grammar. I'll refer to these strong codes as "secret languages". Note that when all speakers of an ancient language dies, it becomes a secret language.

It seems to me that cracking secret languages is beyond the realms of cryptanalysis. After extensive search, I haven't found a single secret language that was ever cracked without any known plaintexts such as finding available translations. Are there any ways to crack or even crypto-analyze secret languages only using raw text written in that secret language? It is obviously possible with ciphers because they operate on the syntax level, but secret languages operate on abstractions and high-level meanings.

If the answer is yes, then why is cracking some ancient secret languages is a really hard thing to do unless one finds a translation? I challenge you to crack the The Na'vi language only by reading excerpts written in Na'vi. Also, can you point to one example of a secret language that was cracked only by looking at the text of that language?

If the answer is no, why isn't this used in modern computer cryptography? I presume it's because computers have a hard time manipulating meanings, abstractions and grammar and are better suited for manipulating syntax, letters and bits, and hence only ciphers are practical. But any more info would be appreciated.

A similar question was asked here but the two answers were contradictory, and it was closed, probably because it was focused on ancient languages and was considered a history question.


texts: How do mix networks work with server downtime?

texts:
I am looking for an analysis of practical mix networks with server downtime.

For example, if a message is supposed to go from A -> B -> C -> D, what happens if B wants to send the message but C is offline temporarily?

This could be a stop-and-go mix network so holding onto a message longer is OK, but I am wondering whether there's any paper analyzing this sort of thing? For instance, how does it affect anonymity, how does B know when to retry sending it, etc?

Or what if C goes offline permanently, is the message lost? Is there a mix network protocol for resilience in this case?


texts: Is it safe to use a MAC as iv for CTR encoding?

texts:
I have devised the following encryption algorithm and would like to know if it is safe. The goal is to use it to encrypt cookie values. I thus want to keep the encoding overhead as small as possible.

The encoding steps are as follow:

Append 3 to 5 random bytes to the value. The number of random bytes is encoded in the two less significant bits of the last random byte. The number is picked so that the value length plus random number and MAC is a multiple of 3 bytes. This is to simplify base64 encoding.
Compute the hmac(md5) value and append it after the random bytes. It might also be hmac(shaX) but md5 yields 16 bytes which is the block size of AES.
Cipher the last 16 bytes of the constructed byte sequence with AES and use the product as iv to cipher the other bytes with CTR AES. The product must have a byte length multiple of 3.
Encode the cipher text with base64.

The MAC cumulates all bit variations in the encoded value. The random bytes add some randomness in the produced digest which can be assumed to be pseudo random.

The only weakness I see is the risk to get two identical iv. But the iv should be assumed to be random because it is an encrypted MAC.

The resulting encoding is quite compact because the overhead is limited to the 16 hmac bytes and the 3 to 5 random bytes.

Do you see any problem or defect with this encoding ?

EDIT:

my question differ slightly from the other question Can I use MAC as CTR mode nonce if my messages are non repeating in that I suggest to use the encrypted MAC instead of the MAC.

The question may also be a duplicate of Using HMAC as a nonce with AES-CTR Encrypt-and-MAC. But still differ in that I cipher the MAC, and thus conceal it and randomize the iv.
My algorithm differ from the SIV algorithm defined in RFC 5297 by using hmac instead of CMAC-AES defined in RFC 4493 and by using the encrypted MAC as iv. Appart from that the algorithms are equivalent. This indirectly proves the validity of my algorithm. The advantage of SIV over my algorithm is that is uses only the AES encryption primitive and no hashing primitive.
The 3 to 5 random number is another difference between SIV and my algorithm. SIV doesn't have this and thus doesn't conceal data equality and length. The user may add random padding bytes to its plain text when this is critical for its application.

Regarding the number of random bytes, this still needs investigation. What is relevant here is the probability that two same cipher text encode the same clear text. I tend to think that it's not the same as the probability that two identical plain text yield the same cipher text.


texts: When I learn PBKDF2, I found out most of the articles say that the PBKDF2 use HMAC as PRF. Why is HMAC? Can I use other pseudorandom functions? Is HMAC safer than any other functions for PBKDF2?


texts:
I am working on a multiplayer game.

I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to the server, those actions are checked and the consequences are pushed to all clients.

I am looking for a way for the server to confirm whether the request came from authorised client (a specific player).

I originally planned to use RSA, but it's too computationally expensive, and is an overkill since I don't need really need request data encrypted.

What should I do/use for this purpose?


texts: Securely testing the presence of an item in a list without exposing the list

texts:
Not even sure what terms would describe what I'm looking for, but the general idea:

  Given a list of strings of a finite length, determine whether or not a test string belongs to the list. Then, produce a new list of strings containing the difference of the original list and the test string.

In pseudocode, this would probably look something like:

def list = envelope(["string1", "string2", "string3"])

def validate( collection, test ) {
    if ( contains( collection, test ) ) {
        return remove( collection, test )
    } else {
        throw Exception
    }
}

// In Use
validate( list, "string2")
-> envelope( ["string1", "string3"] )

validate( list, "string4")
-> Exception

One person told me this sounded like the way a blockchain works, but given everything I've read and my rudimentary understanding of blockchain, I'm skeptical. Is there another process or protocol available that I can use to make the above function?


texts: Is it possible using homomorphic encryption (or some other technique)

texts:
Is the following possible with homomorphic encryption (or some other technique)?

Suppose the cloud server keeps a key-value list for a user with each value field encrypted (prv key with user). Now, the cloud server needs to include some of its own key-value pairs to this list and sign the whole list homomorphically and return the list to the user. The major objective is to keep the user values hidden from a cloud server.

$$\{ K_1: \{V_1\}_{U}, K_2: \{V_2\}_{U} \}$$
Or

$$\{ \{K_1: V_1\}_{U}, \{K_2: V_2\}_{U} \}$$

is turned to

$$\{ \{ K_1: V_1, K_2: V_2 \}_{CS} \}_{U}$$

$$
$$
Let me rephrase...

Party 1 (user) encrypts few items $V_1, V_2, V_3$ using homomorphic encryption key $U$ to yield $\{V_1\}_{U}, \{V_2\}_{U}, \{V_3\}_{U}$ and sends them to party 2 (cloud server).

Since, it is homomorphic encryption, party 2 can multiply ciphertexts
$\{V_1\}_{U} × \{V_2\}_{U} ×\{V_3\}_{U}$ to obtain $\{V_1, V_2, V_3\}_{U}$. Right?

My question is, can it do something more with the available ciphertexts?

Can party 2 compute $\{\ \{V_1, V_2, V_3\}_{P2}\ \}_{U}$ ?


texts: How to derive formulas for addition and multiplication in Jacobian coordinates

texts: Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself?  How could I have derived these formulas by myself?


texts: R-LWE key exchange why using FFT instead of Karatsuba

texts:
In the paper Post-quantum key exchange for the TLS protocol from the ring learning with errors problem one of the authors, Douglas Stebila, uses the FFT algorithm for polynomial multiplication but he never explains why he did not use a much simpler algorithm such as Karatsuba for polynomial multiplication.

The Ring-LWE (RLWE) parameters choices are (according to Singh, Vikram):

For 128 bits of security, n = 512, q = 25601, and Φ(x) = x^512 + 1
For 256 bits of security, n = 1024, q = 40961, and Φ(x) = x^1024 + 1

So in the worst case: we are multiplying two polynomials of degree 1024 with coefficients at most 40961 with each other. This does not make sense considering that FFT method should be used only for multiplying polynomials with large coefficient:

  In practice the Schönhage–Strassen algorithm starts to outperform
  older methods such as Karatsuba and Toom–Cook multiplication for
  numbers beyond $2^{2^{15}}$ to $2^{2^{17}}$ (10,000 to 40,000 decimal digits).

Question: what was the reason behind it? Am I making a mistake by saying that Karatsuba would outperform FFT considering parameter choices for R-LWE key exchange? Or did the author use this method to make R-LWE key exchange process look overly complicated?


texts: Complete Set of Test-Vectors for ECDSA secp256k1

texts:
Although there are several implementations of ECDSA secp256k1 public available over the internet (the most popular being OpenSSL), it seems that there are no complete set of test-vectors available.

The few test vectors I could find always miss some important information:

do not provide the hash integer or the secure random integer k.
do not provide the (r,s) signature pair, instead only provides some hash of it according to bitcoin protocol format.

A complete set of test-vectors would require the following information:

private key
public key x-coordinate
public key y-coordinate
hash
secure random integer k (see note bellow)
r signature
s signature

Example:

1. private key: D30519BCAE8D180DBFCC94FE0B8383DC310185B0BE97B4365083EBCECCD75759
2. public key x-coordinate: 3AF1E1EFA4D1E1AD5CB9E3967E98E901DAFCD37C44CF0BFB6C216997F5EE51DF
3. public key y-coordinate: E4ACAC3E6F139E0C7DB2BD736824F51392BDA176965A1C59EB9C3C5FF9E85D7A
4. hash: 3F891FDA3704F0368DAB65FA81EBE616F4AA2A0854995DA4DC0B59D2CADBD64F
5. secure random integer k: CF554F5F4224223D52DC9CA784478FAC3C1A0D0419FDEEF27849A81846C71BA3
6. r signature: A5C7B7756D34D8AAF6AA68F0B71644F0BEF90D8BFD126CE951B6060498345089
7. s signature: BC9644F1625AF13841E589FD00653AE8C763309184EA0DE481E8F06709E5D1CB

Note that a set o test-vectors without the random integer k might also be helpful for validation purposes:

first validate the signature verification code
than use the validated signature verification code to validate the signature generation code

The reason I consider important to include the random integer k is because with it you can validate different parts of the code independently of each other, therefore reducing the risks of hidden bugs.

Question
Is there any public available test-vector with the aforementioned set of information?


texts: Authenticating PBKDF2 params from the server

texts:
In my app, I use PBKDF2 to stretch a user inputted password. I split the result in two: the first half is stored locally as an encryption key (and never sent to the server), and the second half is sent to the server as a regular "password".

Rather than hardcoding a fixed cost for PBKDF2 on the client side, I allow the client to choose a cost, then send it to the server with user registration for storage. Then, when a user wants to sign in, a query is made to the server to retrieve the public parameters, which includes the password cost and salt.

I've discovered however that if the server is hijacked, it can send a cost back to the client of 0 or 1, and trick the client to returning an easy password.

What I need to do is authenticate the parameters returned and make sure they are valid. The way to do that is to generate an auth_hash by taking the HMAC of the cost and salt with an auth key derived from the user's input password.

The problem is that I already have existing users. This solution would be easy to do for new users, but I'm unsure how to transition existing users to this system. Existing users will not have an auth_hash associated with their account. They will need to upload one on their next sign in. Which means, I will have to allow a single sign in, which means trusting the parameters from the server. And even if the user did actually have an auth_hash, the server can send back a nil auth_hash to trick the client into thinking the user doesn't have an auth_hash and is permitted a one time sign in to upload one.

You can see it's quite a tricky problem.

One possible solution is to hardcode a minimum cost of 3,000 on all clients. This way a server couldn't get away with sending a 0 or 1 cost. The question with this is: if a user's actual cost is 10,000, but the server deceptively sends back 3,000, does this leak information? Recall that only the second half of the PBKDF2 output is sent to the server, not the first half. Obviously if the user's actual cost were 10,000 and the client instead received 3,000, and I sent back the beginning of the result, that would be no good. But do I gain any advantage here by only sending the second half of the output?


texts: Is it possible to enhance white-box cryptography security by homomorphic encryption?

texts:
Background:

Let's discussed based on published symmetric white-box crypto only, such as Chow's white-box AES.
I only know basic concepts/objectives of homomorphic encryption, such as PHE and FHE. Bring ciphertext into calculation instead of decryption.
Without proper implementation design for real applications, white-box crypto may reveal its own vulnerabilities, such as code lifting (call whole WB function instead of unboxing WB).

Question:

I am thinking (just brainstorm first) how to bring the homomorphic feature into white-box crypto design. For examples:

A1. Use encrypted plaintext P_IN as white-box crypto encryption input to generate encrypted ciphertext C_OUT.

A2. Use encrypted ciphertext C_IN as white-box crypto decryption input to generated encrypted plaintext P_OUT

A3. Treat white-box as an API module. Use encrypted input/output for further calculation steps.

Or

B. Apply homomorphic features on the intermediate values of white-box crypto, in order to prevent cryptoanalysis.

Remark: PHE or FHE supports limited operations (e.g., addition, multiplications), which could be the potential challenges for white-box crypto.


texts: Difference between ε-differential privacy and (ε, δ)-differential privacy

texts:
I don't understand the necessity of introducing the additive term δ in the differential privacy definition. Moreover, reading different papers and blogs they say that because of the δ term the mechanism is "broken" (whatever that means).

I would really appreciate some help in understanding the role and the effect of the δ term.

Many thanks in advance!


texts: In ECDSA, how many field operations are used for signature verification?

texts:
I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things concrete, assume ECDSA in a field $GF(p)$ per FIPS 186-3 (which refers to ANSI X9.62:2005 (webstore)), using parameters as in appendix D.1.2.

I'm interested first in the straightest standard-abiding method with a cost in the right ballpark; then in the most worthwhile refinements of that. I have identified (by name, but not quantitative effect, especially for the first one):

projective coordinate systems, said to allow replacing inversion in the base field (as used in straight point addition in the elliptic curve group) by fewer operations than standard inversion algorithms, e.g $x\mapsto x^{p-2}\bmod p$ (or the more efficient extended euclidian, but that does not quite match my "multiplications in the base field" evaluation criteria);
Shamir's trick, where $a*P+b*Q$ is computed by adding either $P$, $Q$ or $P+Q$ (on the elliptic curve group) when scanning the bits of integer multiplicands $a$ and $b$;
sliding window techniques when scanning the bits of a multiplicand.

I'm not interested in the cost of verification of a certificate introducing the public key, or the cost of hashing; and only marginally by savings enabled by pre-computations, or techniques applicable only to $GF(2^n)$, or using the special form of the $p$ parameter (which allows speed-up of modular reduction $\bmod p$, but leave the number of operations in the base field unchanged).


texts: How can I calculate the avalanche effect in symmetric algorithms?

texts:
I am working with symmetric algorithms in Java with javax.crypo and Bouncy Castle libraries and I need to calculate the avalanche effect of different symmetric algorithms such as DES, 3DES, Blowfish and AES.

I have read about the avalanche effect and means that when an input text is changed slightly (for example, flipping a single bit) the output changes significantly. To calculate this, I made some test by creating a new text changing the first word in the original text and later encrypting both texts. After this I compared the bits that had changed between the original text and the new text.

To this tests I used the four algorithms in CBC operation mode and with PKCS5PADDING. As I know, the change between the encrypted texts must to be high although the changed word is only in the first block of the text, because the input in CBC mode is the encrypted text generated by the previous block, so all blocks are used to generate the final text. So, I think that the change must be considerable.

I read that the 50% of change is a satisfactory value because it means that a change of a word or a single bit in the input changes the output with a 50% probability, and it is strong. The problem is that the results in my tests are about 50% for the four algorithms, and I think that it is no correct, because the difference will be higher and I suppose that AES that works with S-boxes as substitution for encryption must have more change. I have been searching a estimation of avalanche effect result values for these algorithms, to contrast with my results, but I haven't found a estimation. So, I don't know if I am calculating the avalanche effect correctly.

I calculated the avalanche effect in the resulting ciphertexts, not in each round during the encryption process.

I was looking for information and I have found few articles on this subject in which they show: the password used, the original ciphertext, and the encrypted text on it that has made one change. The comparison is performed by bitwise between the two ciphered texts, and so I understand, not in the ciphertext during rounds in the encryption process. It is not like this? Some of these articles are: link and link

Am I calculating the avalanche effect correctly in the symmetric algorithms?

Is there some estimated values about this effect in the algorithms?


texts: Would A5/1 with a much larger state be a good choice of stream cipher for hardware?  Assume that a reasonable choice of MAC is made such as GMAC, with the first 128 bits of the stream cipher output used as $H$ and the next 128 bits used to encrypt the auth tag.


texts:
I'm wondering if it is still secure.

I know TrueCrypt closed its doors but I continue using it because the cryptoaudit didn't find any huge bugs or security issues in TrueCrypt.

But I have a bad feeling about Brute Force and Ripemd-160. I've read that it only uses 3000 Iterations. So I ask myself: How long would it take to Brute Force the password of the encrypted disk?


texts: What are the qualities of a good block cipher? Beginner, Intermediate, Advanced, Expert

texts:
Notice: I'm doing this to learn.  I know not to use a homemade cipher for anything that requires security.  I also have heard before I'm not supposed to be trying this, but I learn best through trying to make things from scratch, even if I fail.

Ciphers are incredibly complex, to the point most people probably don't appreciate them, myself included.  Trying to make one from scratch might help with this, so I'm looking for a list of qualities/achievables that can be worked towards for years to come.

This is the list so far, for a good block cipher at different learning levels:

Beginner :

Encrypted output can not be broken by hand.  The level of encryption during WW1 or so.

Intermediate :

Changing a single bit in the input should have a 50% average chance of changing each bit of output.
Each byte should have a 1/256 chance of not changing (basically #1 ^ 8)
The number of bytes found in similar by search should be very few (I need to write down the math, but my estimate is around 5%)

Advanced:

Not sure yet?

Expert :

Immune to Differential cryptanalysis?

This list is very incomplete, but gives an example of what I'm looking for.

What is your list of achievable qualities for block cipher at different skill levels?


texts: Breaking a XOR cipher of known key length?

texts:
For a challenge, I need to find the key that enciphered a text.

I know that the key is of length N (invariable). There is no assurance that the key is only alphabetical or alphanumeric, but it could be a reasonable assumption.

I know that the original text is alphabetical only, no number, but there is no assurance that the text is lowercase or uppercase only. It would be a reasonable assumption that the text has lowercase and uppercase characters.

The actual encryption is similar to the one of a Vigenere cipher, in that it uses a rolling key to XOR the input, character by character going like (pseudo code, don't try to run this in any language) :

ciphertext = ""
n = 0 ; //key iterator
for character in input:
    ciphertext += key[n] XOR character;
    n++;
    if(c >= N) { // reset key iterator when reaching the known length of the key
        c = 0;
    }
return ciphertext

The output is not directly usable as text and the input has both uppercase and lowercase characters.

How should I go about breaking the encrypted text ?

What I thought about:

Extract from the encrypted text the characters encrypted by the same letter of the key, for example, isolate all characters encrypted with key[0], and run statistical analysis on it.
My problem is that the presence of uppercase and lowercase letters makes statistical analysis difficult, being unable to differentiate the same letters in uppercase or lowercase. We now have 52 possible letters instead of 26, on a text that is too short to use this method. (around 450 characters, for a 8char long key, it means only 56char by set)

Go the known plaintext way, trying to find commonly used words. The problem is that he text is most likely either in french, or english, and the longer the word, the most likely it is that it's not present in the text. I think this is a last resort solution.

Simply bruteforce the text. Assuming a key length of 8char, with a charset of 0-9a-zA-Z, we've got 62^8 (several hundreds thousands of billions) possible permutations, which is impossible to cover.

What could I do to resolve this, or reduce the time it would take to solve ?
I was wondering is there was a way to know if the input text is either in lowercase or uppercase from the encrypted text, or if there is a way to manipulate the encrypted text to put it all in uppercase ... That would help with the statistical analysis a bit, even if I won't most likely have not enough data for a quality analysis.


texts: Lower Bound on the Probability an LWE Matrix is Primitive

texts:
For positive integers $q, n, m>n$, how do we derive the lower bound $Pr[A\cdot \mathbb Z_q^m = \mathbb Z_q^n] \geq 1 - \frac{1}{q^{m-n}}$ for a uniformly random matrix $A \in \mathbb Z_q^{n \times m}$?

I know this probability is equivalent to the probability that each row has gcd 1 with q, $gcd(a_{i,1}, \dots, a_{i,m}, q) = 1$. Also, there is a lower bound on the totient function, $\varphi(q) \geq \sqrt q/\sqrt 2$, but this hasn't led me to a solution for the bound we want.


texts: Coppersmith's method for small public exponent

texts:
Can Coppersmith's method be used to break RSA when we only have access to public key and one ciphertext?
For e.g. suppose we have N and ciphertext c both are 1024-bit numbers and the public exponent e = 5. Armed with only this information can we use Coppersmith's method to decrypt c? In all the literature that I have come across regarding this topic, either some part of plaintext is known or some bits of private key are known. But if none of this is available, is it possible to decrypt c using Coppersmith's method? If not, is there any other way to solve such a problem?
References that I went through:
https://www.cis.upenn.edu/~cis556/lattices.pdf
https://web.eecs.umich.edu/~cpeikert/lic13/lec04.pdf


texts: For Diffie-Hellman, must g be a generator?

texts:
Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator?

Recall the mathematics of Diffie-Hellman:

Given public parameters $p$ (a large prime) and $g$ (always referred to as a generator of $\mathbb{Z}^*_p$).

Alice chooses $a$ at random and sends $A \gets g^a \mod{p}$ to Bob.
Bob chooses $b$ at random and sends $B \gets g^b \mod{p}$ to Alice.
Alice computes $S \gets B^a \mod{p}$
Bob computes $S \gets A^b \mod{p}$

From the math above, I don't see anything that would require $g$ to be a generator, so the math should work even if $g$ is not a generator.

As far as security goes, clearly having $g$ be a generator is best as $|g|$ (or the order of $g$) will be greatest when $g$ is indeed a generator. Is that the only reason for choosing $g$ to be a generator?


texts: Time gap between Diffie-Hellman Key Exchange and ElGamal encryption?

texts:
I'm looking into the Diffie-Hellman key exchange paper (New Directions in Cryptography, 1976) as part of a series of classic papers in Cryptography for my Ph.D and I was wondering if someone could give a reason for something that has always seemed very strange to me.

ElGamal seems like a natural thing to immediately try, so it seems odd that there was a nine year gap between this paper and the introduction of ElGamal (to the best of my knowledge, 1985). Was there a theoretical reason for this? Or was it simply "not spotted".


texts:
I'm new to lattice-based cryptography and have trouble understanding if the GSW13 (Gentry, Sahai, Waters) scheme works only on single bits. But is it also possible to encrypt integers with this scheme and add them together?
Thank you


texts: Do you really need a KDF when you have a PRF?

texts:
My understanding is that a KDF is like a PRF, except that it has a preliminary step that "extract" entropy. It is thus needed when the entropy is non-uniform (for example the output of ECDH is modulo a number that is not a power of 2, and is thus non-uniform if represented as a bit-string).

Yet, I am not sure there are modern symmetric algorithms that require the secret to be uniformly distributed. Sure their security might be defined with a uniform key, but using a KDF feels a bit like a cheat since there is no new entropy added, and it's not slow either. Am I missing something?


texts: Fully Homomorphic Encryption: Going from an integer to bits

texts:
I was answering this question Computing Logarithm using homomorphic encryption and I came up with a solution if you had encryptions of the bits of the number that you wanted to take the log of.  But in that situation all they have is a fully homomorphic encryption of the number itself.

I was curious if there was a way to compute encryptions of the bits from an encryption of the number.  i.e. is there some $f$ such that $f(E(x)) = (E(x_1),E(x_2),...,E(x_n))$ where $x_i$ is the $i$th bit of x?


texts: Could a code be developed where one uses intentional errors  say in english, as a text to encode? For example someone might have a message 'Agent X must report to station 5'. This could be distorted to 'A Gentex missed repaired 2 stationS.' The distorted message then encoded. If the distortions are recognizable to the deciferer this might throw off any attempted interceptions. Also aren't decoding methods usually based on the 'regular' use of english (if english is being used) ? I've never heard of anybody trying to use intentional mistakes in a code. Is this idea useful?


texts:
The POODLE attack uses the way block ciphers in CBC mode are decrypted in combination with the packet's padding to determine some byte's value.

From what I understand, even TLS 1.1 can be vulnerable (when using a suite such as DES with CBC). Why aren't other cipher suites that use CBC vulnerable?

From the following table it looks like CBC mode is still used in some cipher suites in TLS 1.2.
https://en.wikipedia.org/wiki/Transport_Layer_Security#Cipher

The table states that TLS with AES in CBC mode is secure. Is this true? And why isn't TLS 1.2 vulnerable to POODLE?


texts: Why is the polynomial in AES MixColumns multiplied modulo a reducible polynomial?

texts:
I know that the AES MixColumn step is calculated as follows

$b(x) = (a(x)c(x)) \mod l(x)$

with $a(x)$ being the column to encode, $c(x)$ the fixed polynomial $c(x) = 3x^3 + x^2 + x + 2$ and $l(x) = x^4+1$ which is reducible over $GF(2^8)$ since $x^4 + 1 = (x+1)^4$.

I wondered about the purpose of the reducibility property of $l(x)$ and so I looked it up in my text book as well as on the internet but I could not find any further explanation on this. As it is my understanding only an irreducible polynomial $f(x)$ would be able to create a field $GF(2^8)[x]/(f(x))$. So my question is:

Is there a particular reason why l(x) must be reducible over $GF(2^8)$ in AES MixColumns?


texts:
Let's consider such process:

Two emitents emit two (integer) secret numbers independently
They encrypt (encode) these number in such a way that no-one (except emitent) can decode these numbers. Emitents also cannot decode/know numbers of each other.
Now having two block of decoded numbers we need to find the sum of these numbers

So, I need algorithms for achieving above

Number decoding (point 2 above)
Sum calculation (point 3 above)


texts: Does AES-128 have the same strength as AES-256 with a padded key?

texts:
When I use the same 128-bit key for AES-128 and AES-256 with a known/public padding for the latter,

is there some weakness in AES-256 that is not present in AES-128 with essentially the same key?

This might be the case when I'm receiving the key from an

algorithm which just doesn't produce enough bits (128 or less).

Is it better to use AES-128 in this case or can I use AES-256 with an one-size-fits-all attitude?

I feel like the answers in this question answer my question,

but don't explicitly state the effectively used key size.


texts:
I want to implement AES-CBC mode with PKCS#7 padding, along with a way to validate a correct padding given the ciphertext. My initial understanding was that for an input of size n (where n is less than 16) PKCS#7 pads 16-n until the input becomes divisible by 16 (or equal to 16 in this case). But later I realized that this would make it impossible to validate a correct padding.
Then I found out that you always pad at least 1 byte when doing PKCS#7 padding (with byte 01 if length of input is divisible by the desired amount). Is this understanding correct? If so, should I divide my input into blocks with size of 15 bytes (with 16th byte being the pad byte)?


texts: Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

texts:
With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and $m_1$ and two signatures $(r_0, s_0)$ and $(r_1, s_1)$may recover $D_A$ trivially (as in fail0verflow's PS3 private key recovery).

Does there exist a way of using this weakness to make a signature system where each private key can only be used once, with the deterrent that if the private key is used a second time, everyone can calculate and use it?

This would require an extra verification step to prove that $k$ was deterministically generated from $D_A$ (in a prescribed manner) so that signings would only be valid, if they used the single, known way of calculating $k$ (without revealing $k$).  Otherwise, if a malicious signer were to use different $k$s for the same $D_A$ there would be nothing to deter it, so $k$ must be a deterministically generated from $D_A$.

(This is different from RFC 6979 which uses a hash of the message and $D_A$ to ensure a good pseudo-random value for $k$.)

From answers to With ECDSA is there a way for the verifier to calculate any properties of $k$? and With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key? it looks like this is impossible.

Is there a way of making a single-use signature scheme, where a second use of a private key discloses that private key to the world?


texts: Choosing a suitable prime for accumulators

texts:
I am trying to work out accumulators and generate $S = \{ e_1,e_2 \ldots, e_n \} $ from this (Section 3.4 - Choosing a Suitable Prime).
For each element of $e_i$ compute its representation $x_i$.(This I want to calculate).
To compute representation($x_i$) use following
( According to the paper $x_i$ should be calculated like this and this part I need help with. Please help me understand this)
We are interested in obtaining a prime solution of the linear system, that represents a Universal-2 hash function.
Lemma:
Let H be a universal-2 family from $\{0,1\}^{3k}$ to $\{0,1\}^k$. Then, for all but a $2^{-k}$ fraction of the functions $h \in H$. For every $e \in \{0,1\}^k$ a fraction of at least $1/ck$ of the elements in $f^{-1}(e)$ are primes, for some small constant c.
We accept a prime inverse only if it is greater than $\sqrt{2^{3k}}$. Since domain of H is $\{0,1\}^{3k}$. So, by the results of prime number theory, the density of big prime numbers that are less than $2^k$ is about $1/2k$ for all but a $2^{\Omega(k)}$ fraction of functions in family H.*
Please help me, how can I calculate $x_i$ as a representation of $e_i$?


texts: Group in the context of elliptic curve crypto

texts:
I understand that the discrete log problem is defined as

$G^y \bmod p = x$

Speaking generally, $G$ here is a generator for the group zp*, where $G$ is able to generate each element in the group for a given prime modulus.

My question is, in the context of elliptic curve cryptography, is the group the entire set of points that lies on the curve being used?

Assuming this is correct, does the prime used for the modulus have to be larger or smaller than this group of points, or even reside in it?


texts:
Can anyone tell me the name of this cipher please?
I know it's a simple substitution cipher, I just don't know the name of it.

Cipher Key:

help

Cipher alphabet:

a|b|c|d|e|f|g|h|i|j|k|l|m|n|o|p|q|r|s|t|u|v|w|x|y|z
h|e|l|p|a|b|c|d|f|g|i|j|k|m|n|o|q|r|s|t|u|v|w|x|y|z

Text:

this is a test

Cipher text:

tdfs fs h tast

I think I have found the answer: a Caesar variant, a "Mixed Alphabet" substitution cipher.
Does it have a specific name?


texts: Why are $\lceil 1/\operatorname{entropy-per-bit} \rceil$ number of bits not sufficient to generate an unbiased bit?

texts:
Consider a biased RNG badrand() generating 1 with probability $0.9$ and 0 with probability $0.1$.
This excellent answer explains that we need 849 bits of badrand() to generate 1 bit of betterrand() with less bias than the NIST recommended $2^{-64}$.
The minimum entropy per bit of badrand() is 0.152 bits/bit.
Considering the additive nature of entropy, 7 bits of badrand() contains 1.064 bits of entropy.
Why, then, do 7 bits of badrand() not suffice to get 1 bit of betterrand()?
If a quantitative answer is difficult, a qualitative one would also inspire deep gratitude in me.


texts: Practical attack on md5 hashing algorithm?

texts:
I have the following conditions:

String which consist of "STRING+key+ID+key" is hashed with md5. I have a knowledge of STRING (10 chars), ID is probabilistic (int 15), key is 15 chars long (a-z A-Z 0-9) and it's same on both occurrences. I can produce multiple hashes but without knowledge of key.

I guess collision is not going to work in this case as STRING is appended at the beginning and ID between keys. Is there actually any other option then brute force.

Produced hash is used as some kind of integrity check so you cannot alter the parameters. Key is hardcoded on the both sides (frontend and backend)

POST:
{"STRING":"ASDFGHJKLM","ID":"123456789012345","hash":"md5hash"}


texts:
How would we go about building a scheme for Shamir secret sharing for vectors?
I have already tried to use a vector of secrets and random distribution of the secrets to $n$ parties and then use $t$ of them to get the data, where $t<n$.


texts: Is it possible to reduce the tail's file of accumulators for large data set

texts:
I am working on a proof of concept around cryptographic accumulators. The following is my understanding so far

delta : the current size of the tails file in the accumulator.
witness : the current value of the accumulator when the entry of your number was made.
index : the actual index that is added to the accumulator.
tails file :list of all witnesses.

When an index is added to the accumulator, the witness and delta are shared with the prover.

When the prover wants to prove to a verifier that the index is part of the accumulator he updates the witness using the delta(and tails file) and shares the updated witness with the verifier which allows for verification.

My question is: Wouldn't the tails file become very large as the number of entries increase slowing down the process of proof and verification?

Is there a solution to this?


texts: Can Hill Cipher be considered as Asymmetric?

texts: I know hill cipher is a block chipher ,We produce decryption key by inverse of key matirx but we still use different key for decryption. Therefore Can we say that Hill cipher is asymmetric chipher?


texts: Why have Nonce and why encrypt everything in step 2 for Needham-Schroeder?

texts:
Here is the protocol outline I am looking at (source: Foundations of Computer Security, Lecture 60: The Needham-Schroeder Protocol)

  $$
\begin{array}{ccl}
   1.& A \to S \colon& A,B,N_a
\\ 2.& S \to A \colon&
              \left\{ N_a,B,K_{ab},\{K_{ab},A\}_{K_{bs}} \right\}_{K_{as}}
\\ 3.& A \to B \colon&
              \{K_{ab},A\}_{K_{bs}}
\\ 4.& B \to A \colon&
              \{N_{b}\}_{K_{ab}}
\\ 5.& A \to B \colon&
              \{N_{b}-1\}_{K_{ab}}
\end{array}
$$
  Where $N_a,N_b$ are nonces.

My questions are:

Why do we need nonce $N_a$ in step 1?
Why do we encrypt everything in step 2? Surely $S$ could instead send message to $A$ like $K_{as}\{K_{ab}\} || K_{bs}\{K_{ab}\}$?
Why $S$ can't send $K_{ab}$ to $B$?


texts: GoofyCoin question -- why pk, why not sk?

texts:
At 45:43 in this video (from the Princeton Coursera Bitcoin and CryptoCurrency Course), they talk about GoofyCoin and show the image below.

My question is, why does it say "signed by pk"... isn't the actual signing done using the "sk", and the verification done using the "pk"?

Update: I think I figured out what's going on here, and am leaving this here for future reference. signed by pk(goofy) means "signed by the identity of goofy" because as mentioned in an earlier video, pk = identity


texts: How much faster in symmetric cryptography compared to asymmetric cryptography?

texts: I know that symmetric cryptography is faster than asymmetric, but on average how much faster would it be if you were encrypting and decrypting a 2MB file?


texts: Random Number Generator based on AES CTR

texts:
I've just about done tinkering with an open source DRBG, and I sure would appreciate a bit of advice from this community. Here's the link to the project, hosted at codeproject.com.

It is written in C#, the code is clean and well commented.

The design criteria:

The same seed must generate the same random output each time.
It must be fast.
It must be extremely difficult to unwind.
It must produce excellent random output.

In its simplest form, it is an AES CTR using block chaining. To address criteria #3, I have added methods that reset the state of the key/iv/counter by whitening them and then using the SHA256 hash value.
An example of 'whitening' the data:

private byte[] ExtractArray32(byte[] SubBuffer)
{
    UInt32[] tmpNum = new UInt32[8];
    UInt32[] arrNum = new UInt32[16];
    byte[] data = new byte[64];
    Int32 ct = 0;
    // copy first array in
    Buffer.BlockCopy(SubBuffer, 0, tmpNum, 0, 32);
    // get the first buffer table index
    UInt16 iter = ExtractShort(tmpNum[0], 10);

    // randomize the bits
    for (int i = 0; i < 8; i++)
    {
        arrNum[ct++] = ~tmpNum[i] ^ SEED1024[iter];
        iter = ExtractShort(arrNum[ct - 1], 10);
        arrNum[ct++] = tmpNum[i] ^ SEED1024[iter];
        iter = ExtractShort(arrNum[ct - 1], 10);
    }

    // copy it to byte array
    Buffer.BlockCopy(arrNum, 0, data, 0, 64);
    // get the hash
    return ComputeHash64(data);
}

I know some people don't like it when someone posts code here, but it makes it so much easier to explain with a visual representation…

So what's happening here, is a 32 byte value, say the original key, is copied to a uint32 array (8 * 4 bytes), then copied into a new uint32 array (16 * 4 bytes), on the first interval, the value is reversed, on both, the value is XORed with a uint32 from a 1024 * uint32 table of random values. The table index is the last 10 bits of the previous value (0-1023). This is how I whiten and expand the array so that it aligns with the 64 byte block size of SHA256. The return is the hash value, which becomes the new value.

Questions:

Is this a good way to whiten the data? Is there a better way?

I do realize that flipping a single bit will give me a completely different hash value, but this goes towards criteria #3, make it difficult to unwind.

There are 4 different prototypes, their primary difference being how and when a state reset occurs; one is configurable via a property (10Kib default), another resets after every 4 block transforms (64 bytes), another resets at random.
Is there an ideal interval at which an AES CTR generator should be reseeded? Is reseeding too often introducing patterns that might be exposed by some form of differential analysis?

I think the best way to get a handle on what I've done, is to just check out the article, nothing too complex, but it really could do with some scrutiny before people start using it in the wild, which leads me to my last question..
How can this be made stronger? How would you improve upon this? ..and are there any serious flaws in the implementation?

I think the most important criteria is that, should an attacker get a portion of the random output, say message data from an xor cipher, it must be as difficult as possible for the attacker to unwind it back to the initial state, given that any changes do not seriously impede upon the other criteria..

Here's the new algorithm:


texts: Which block cipher modes of operation allow a predictable IV?

texts:
Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique (i.e. generated from other data known to the "receiver" and also the adversary, and not stored/transmitted with the ciphertext) rather than random.

What options do I have as a cipher mode? How do I choose between them? Which is the main difference between OFB and CFB?


texts:
Assume that you use this function: SHA-256(key_1 + SHA-256(key_2 + SHA-256(key_3 + special_key))). First, second and third keys are long random strings of 64 bytes. A special key is a short string (from 5 to 12 bytes).
Also, assume that an attacker has:

the special key;
16 bytes from the beginning of the function result.

How realistic is it for an attacker to obtain the keys 1, 2 and 3? Is there any vulnerability, except brute force? And if the attacker has multiple pairs of key/result string?


texts: Can you make a hash out of a stream cipher?

texts:
A comment on another question made me wonder about something:

  Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, but you do have access to a simple stream cipher; say, RC4 or one of the eSTREAM ciphers.  What other crypto primitives can you build out of that stream cipher?  In particular, are there any practical ways to build a cryptographic hash function and/or a MAC out of just a stream cipher?

We already have questions about turning a hash into a stream cipher and about turning a stream cipher into a block cipher, but this particular transformation doesn't seem to have been covered yet.

Obviously, if the platform constraints permit it, one could ignore the stream cipher and just implement a standard hash function from the ground up.  What I'm wondering is whether having the stream cipher available might let one do better than that in terms of code size, memory usage and/or speed.

While a construction that treats the stream cipher as a black box would be nice, schemes that only use parts of the stream cipher (like RC4-Hash, which, alas, has practical collision attacks) would be interesting too, at least if they're simple enough.


texts: Relation between Threshold Cryptosystem and Secure Multiparty Computation ?

texts: Is there any relation between secure multiparty computation and threshold cryptosystem ?


texts: Good entropy source for generating openssl keys

texts:
I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan:

gather entropy from multiple sources (saving individual files): FreeBSD Yarrow, Linux (with haveged daemon while entropy_avail is 4096), ANU QRNG, something else (e.g. wifi capture file encrypted with a random password, other suggestions)
mix all random files into a single one
use the result to seed openssl -rand [myrndfile] when generating the keys

If my plan sounds ok:

what size should the random files be?
what would be the best method to mix the files into a single one?


texts:
I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is to eliminate "weak keys" of the AES. The authors call weak keys those in which all bits are 1 or 0, or those in which the first half of the bits is 1 and the second is 0 (or vice versa). When the key to be expanded shows patterns (as in the weak keys) it is still possible to see these patterns in the first subkeys.

They consider these keys weak, because when they are expanded, you can see lots of patterns in the round keys, these patterns come in the form of repetitions of bit sequences.
I wanted to test my algorithm, so I wrote a script to find repetitions in all the round keys and count them, this is an example of the script execution:

Block Size: 4
Pattern: 1110    repeated 24 times
Pattern: 1101    repeated 9 times
Pattern: 0000    repeated 3 times
Pattern: 0101    repeated 1 times
Pattern: 0110    repeated 0 times

I am having some trouble in grouping results, this had as entry a single bit sequence to be expanded, but if I want reliable results, I should use as sample thousands of keys with my algorithm and then see the results.

Suppose I have a second entry using the same key schedule (the one I want to test) and the result is:

Block Size: 4
Pattern: 1100    repeated 19 times
Pattern: 1001    repeated 15 times
Pattern: 0001    repeated 3 times
Pattern: 0000    repeated 1 times
Pattern: 0111    repeated 0 times

How do you think I should group these two results? taking an average of the patterns that had more repetitions? In this case it would be 21.5. Adding the repetitions for a result of 43? None of these seem right to me, what do you think?


texts:
Let's say I am given to CSPRNGs: RNG1 and RNG2.
I want to select the best one of the two for cryptography.
How should I do it?
Any of the two RNGs can be initialized with a secret key during
tests and any number of bytes can be generated from each RNG.
Are there statistical test suites already out there for this purpose?


texts: Is the statement true in the context of AES-256 encrypted data stored on a hacked server?

texts:
I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to allowing some to be). I am certain of that statement, however I would like encryption specialists to confirm, infirm or precise it. This is the statement:

  Important note: as long as the data on the server (name of platform) is encrypted and the decryption key safely stored elsewhere according to protocols established, it does not matter (from an access to the data perspective) if the account on the server is hacked. In that case the real protection for the data is the encryption, not the server itself, although it does act as an additional layer of security.

Context: The data is encrypted on a local device and submitted (encrypted) on to the application on the server. It is then downloaded by users (still encrypted) to be decrypted locally using the key. We are talking about AES 256 bits encryption using CFB. The statement does not concern data management by users (e.g. their handling of the key, as it does state that it assumes this is done properly) and does not concern the mobile devices used to created/encrypt/submit the data (this is addressed separately).

I am aiming at being as precise as possible (e.g. I don't want it to be generic hog-wash more aimed at protecting the writer than helping), but I want to be certain of what is written.

So the question is: Is the statement true in the context defined? If it is not or should be nuanced/modified, what should I change?

EDIT: (The reworded statement according to provided answer below):

  Important note: as long as the data on the server (name of platform)
  is encrypted and the decryption key safely stored elsewhere according
  to protocols established, it does not matter from a data confidentiality
  perspective if the account is hacked, although in that case data
  integrity is not guaranteed. The real protection for confidentiality of the data  is
  the encryption, not the server.


texts: If Blum Blum Shub is modified to use a prime modulus, is it still secure?

texts: The definition of the Blum Blum Shub cryptographically secure pseudorandom number generator is $x=x^2 \mod N$ where $N=p \times q$, $p \in \mathbb P$, and $q \in \mathbb P$. Supposedly, the security comes from an attacker not knowing the factors of $N$, but why can't I simply use a single prime number?


texts: The Inhomogeneous Short Integer Solution (ISIS) problem with a clue

texts:
The Inhomogeneous Short Integer Solution (ISIS) problem is as follows: given an integer $q$, a matrix $A \in \mathbb Z^{n\times m}_q$, a vector $b\in \mathbb Z^n_q$, and a real $\beta$, find an integer vector $e\in \mathbb Z^m$ such that $Ae = b \mod q $ and $||e||_2 \leq \beta$.

Now assume $e_0$ is a solution to the ISIS instance $(q,A,b,\beta)$, so $A e_0 = b \mod q $ and $||e_0||_2 \leq \beta$. A clue to this solution is provided to me, so I receive $M e_0$, for a matrix $M \in \mathbb Z^{m\times m}_q$ of my choice. How could I choose $M$ in order to be able to retrieve $e_0$ from the clue $Me_0$, or more generally, to compute some short solution $e$ for $Ae = b$?

Solving ISIS on $(q,M,Me_0,\beta)$ doesn't help me, since that only finds a $e_1$ so that $Me_1=Me_0$, but not necessarily $Ae_1=b$ (and assuming I am able to solve that instance of ISIS...).

A possible solution, If I were able to solve ISIS, would be to solve $\begin{bmatrix}A\\ M\end{bmatrix}e = \begin{bmatrix}b\\ Me_0\end{bmatrix}$ , but if I could solve that... I could just solve $Ae=b$, right?

A trivial solution could be to choose $M = I$, so I receive $I e_0 = e_0$, which is a valid solution, since $Ae_0 = b$. However, in that case the clue would be "trivial", and I am interested in knowing other possible choices of $M$. Permutation matrices are also considered trivial (the identity is a particular case of permutation matrix).

My question is: What choices of $M$, different to permutation matrices, would enable me to calculate a solution to $Ae=b$, assuming I receive a clue $Me_0$?


texts: Questions about future and session key generation in DUKPT process

texts:
As I understand this process is done in the client device for generating a unique key per transaction:

inject generated IPEK to client device;
generate set of future keys (actually 21 future keys) using IPEK+KSN and delete the IPEK;
generate session key using transaction key + KSN;
use this session key per transaction and for next transaction use increment KSN and use next future key.

My questions:

Why we need session key? While future key itself is a unique key and if we encrypt each transaction by a future key, actually we used a unique key per transaction.
Why we generate only 21 future key? Then after 21 transaction we need new future key and because of deleting IPEK, then we need to inject a new IPEK to device and as I know, from security point of view this is not good idea to transmit device master key in short cycle like every 21 transaction. Why do we not use a bigger cycle like thousands?
How we transmit new IPEK to device after 21 transaction? there are no description about this? Does IPEK encrypted with any other key and then send to device or it sent plain?
EDIT:

session key is coming from here :

  The swiper usually encrypts these tracks using one of its generated
  future keys (called the "Session Key") along with its current KSN.

Assume this situation:

IPEK is injected to device and 21 future keys are generated
first future key + KSN is used to encrypt 1th transaction and KSN was increased
do this until using 21th future key for 21th transaction.
know for 22th transaction do we used 1th future key + increased KSN or new future keys are used ? If first state then does this means 1th encryption key and 22th encryption key are only differs in KSN ?

EDIT2:
dave_thompson_085 describe sequence of generation and using of future keys(thank about it ),the only section which is still unclear to me is detail of generating future keys.I mean assume we want to generate 21 future keys in initial steps,of course we derive this keys from IPEK by 3DES?but do we use IPEK as message and KSN as key for all 21 step future key generation?and after that e.g. for 3th transaction ,when we want to generate and store key in FK21 do we use 3DES encryption with IPEK and KSN for generating FK21?


texts:
So a zero knowledge protocol (ZKP) is a protocol for which there exists an algorithm, called the simulator, which can produce, upon input of the statement(s) to be proven, but without a witness for the truth of the statement, transcripts indistinguishable from those resulting from interaction with the real prover.

My question is this:

How is this good?

Indeed, one advantage is that the protocol leaks no information of the prover (I guess that's why it's called zero knowledge) since it produce what the prover would have produced without passing through him.

But, that exactly means that any can pretend to be the prover. Which isn't very good.

Am I getting something wrong?


texts: Cryptographically Secure Hash Algorithm with Very Specific Property

texts:
First of all, I apologize if this is a stupid question, but I don't have any background in cryptography.

I'm looking for a secure hash algorithm $H$ with the property $H(K_1+n)\oplus H(K_2+n)=H(K_1\oplus K_2 + n)$.  Would it be feasible to implement a hash algorithm like this, and could a hash algorithm even be secure if it had this property?  If not, would a hash algorithm with the property $H(K_1\oplus n)\oplus H(K_2 \oplus n)\oplus H(K_3\oplus n)=H(K_1\oplus K_2\oplus K_3\oplus n)$ be any better?

Thanks in advance for any comments.


texts:
As we know, intercepted ciphertext created by a one-time pad only reveals the length of the message. That is the only information the attacker can get since this ciphertext is unbreakable without the key.

I understand that for a file 1GB in size we need a key that is 1GB long. My question is: why is the one-time pad not more widely used in encryption for communications that use a small bandwidth?


texts: How to detect changes in data while preserving confidentiality (under constraints)?

texts:
Suppose party $A$ has two pieces of data, $X$ and $Y$, either of which may change separately, or they may change together.

Given the following constraints:

$A$ knows its current $X$ and $Y$ but has no further knowledge about its previous or future values, nor can it store anything else
There is only one-way communication, from $A$ outward
$X$ can be publicly shared (yet doesn't need to be), but $Y$ needs to be strictly confidential
$Y$ comes from a limited set $S$ of possible values; therefore even from a hash $H(Y)$ it would, in theory, be possible for $Y$ to be determined (see 6.) $X$, in contrast, is infeasible to brute-force.
$A$ does not know $S$
$A$'s algorithm/method $M(X,Y)$ cannot be kept secret

Is there a way for party $B$, receiving messages from $A$, to track exactly which of the values changed?

Changes in just $X$ are trivial, because $X$ could be transmitted in the clear.

Changes in $Y$ are also easy if and only if it is known that $X$ has not changed. In that case $A$ would not send $X$ in the clear, but $H(X)$ and $H(Y||X)$. This way, $B$ knows that if $H(X)$ has not changed, but $H(Y||X)$ has, the change must have been because of $Y$. By not knowing the actual $X$ ($B$ doesn't need to), $B$ can't brute-force $Y$.

However, when $X$ did change, $H(Y||X)$ changes too, at least because of $X$. Yet, $B$ needs to know whether $Y$ also changed, without being able to brute-force it. If $H(Y)$ were sent as well, $B$ could then try different $Y$s and see if $H(Y)$ matches, because it knows the design of $A$.

The question therefore mostly concerns detecting changes in $Y$ when it is known that $X$ has changed. I fear this is theoretically impossible, but I'd like some extra eyes on the problem to either confirm that or (preferably) prove otherwise.


texts: Dependence of a Pseudorandom Function's Security on its Input/Output Spaces

texts:
Let $n$ be a security parameter and $F:\{0,1\}^{\ell_{key}(n)} \times \{0,1\}^{\ell_{in}(n)} \rightarrow \{0,1\}^{\ell_{out}(n)}$ be a keyed function which forms a family of Pseudorandom Functions (PRF) as Defined in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz (Definition 3.25). I am interested in the case that the function is not length-preserving.

In particular, what if $\ell_{in}(n)$ and $\ell_{out}(n)$ are fixed based on the problem at hand, e.g.,  $\ell_{in}(n) = 64$ and $\ell_{out}(n) = 32$? The $\ell_{key}(n)$ can be anything depending on the required level of security. I am wondering how such restrictions on the input/output spaces $\ell_{in}(n)$ and $\ell_{out}(n)$ would affect the security of the PRF?
If the above results in lack of security: Is it OK to enforce, say $\ell_{out}(n) \geq 32$, and then just take 32-bits by somehow reducing the output? Also, assuming that all inputs are 64-bit, what techniques can be used to expand the input size?
In an extreme case, is it OK to have $\ell_{out}(n) = 1$?

Also, I'd be thankful for any suggestions on references which argue such details about the security analysis of PRFs.