texts: What are the benefits of using AEAD algorithms as MAC

texts:
I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report).
And I see 2 problems with this:

An AEAD algorithm requires a nonce - something that doesn't fit well into the interface of $\text{MAC}_K(M) \rightarrow T$.

Most (and the correct) API for AEAD implementations (e.g. Web Crypto, Apple CryptoKit) receives input all-at-once - they are not progressively updated.

On the other hand, HMAC has several more application than authenticating messages - HMAC_DRBG, HKDF, to name a few. And they seems to be specifically instantiated from HMAC and cannot use other MACs, whether artificial like GMAC or associated with the algorithms they come with such as KMAC from SHA3/Keccak or keyed BLAKE2.
So to summarize, MACs derived from AEAD: 1) needs nonce, 2) needs different API (init-update-final) from that of AEAD (all-at-once), and 3) lacks usefulness.
So the questions:

Is there any benefit using an AEAD as a MAC (edit: specifically as a building block in constructs that expects one that behaves like a PRF such as HMAC) other than "it reduces code/circuit size"?

And what is (or was) NIST thinking when they acknowledge(d) using AEAD as MAC?


texts:
I've been taught that one-time pads are the only perfect encryption since the only way to recover the message is by knowing the key.

For example, for a target bitstring of 100 bits, I cannot scan all bitstrings of 100 bits and XOR each with the target, hoping to recover the message.  This approach will produce all messages that can be expressed with 100 bits.

However, not all bitstrings are random, e.g. 11111111111111 is less random than 01101001001101.  This observation seems to contradict the idea of an unbreakable one time pad.

We know two random bitstrings are independent of each other, as well as independent from non-random bitstrings.  So, knowing a random bitstring will not allow you to shorten the description of a second bitstring and vice versa.  Thus, if we randomly generate a bitstring BS1, then when XORed with the key BS2 it will produce a third bitstring BS3 that is not compressible.

Proof: If BS3 is compressible, then knowing BS1 would allow us to describe BS2 with a short description (i.e. BS3).  Then, either BS1 and BS2 are not both random or are not independent.  The only case where they are random, but not independent, is if one is a part of the other.

This means that if XORing BS1 with ciphertext BS4 results in a compressible BS5, then BS1 is at least part of BS2 or contains part of BS2.

So, at least in theory, it seems that one-time pads are breakable, although this approach is not computable since we'd need to compute that a bitstring is truly random.

This argument contradicts what I've been taught, and I'm wondering if OTPs are only said to be perfect because randomness is not computable.


texts: Negligible probability of failure in correctness definition (predicate based encryption)

texts:
I would like to understand why some definitions of correctness allow a negligible failure probability. i.e. the probability that decryption reverses encryption is 1 minus a negligibly small amount.

I have noticed in the Katz, Sahai, Waters Predicate based encryption scheme that when defining correctness in the two cases where either the predicate is satisfied when trying to decrypt or when the predicate is not satisfied, there is a small failure probability only in the case when the predicate is not satisfied (I have attached an image of this).

What is the reason for the negligible probability of failure in the second case?


texts: Why MQV is said to be an “authenticated Diffie-Hellman” protocol? The process in the picture shows nothing about authentication. Besides, a man-in-middle can impersonate B to negotiate with A, because A does not verify the identity of B.


texts:
I need to implement an authentication mechanism in an embedded environment which does not support floating point operations but has an AES accelerator module which allows for encyption/decryption operations.

Currently, I'm thinking of using the following approach:

Compute the ciphertext of the message using a secret key k1.
In parallel compute the ciphertext of the same message using secret key k2(k1 $\neq$ k2). Upon the encryption of each block the current block is XOR-ed with the previous so that the length of the authentication code is always equal to the size of a block (i.e. 128 bits).
The message to be sent is obtained by concatenating the ciphertext with the authentication code.

Is this approach secure?


texts: Complexity of arithmetic in (the integer ring of) a number field?

texts:
What is the running time complexity (average or worst case) of common arithmetic operations in number fields?
In fact, I'm only interested in the integer ring of the quadratic extension $\mathbb{Q}[\sqrt{5}]$, although if there's an answer that quantifies the complexity well and is applicable to a more general class of extensions or integer rings that would be great as well.
In particular, I'd like to know what is the complexity of checking divisibility $\alpha \vert \beta$ for $\alpha, \beta \in \mathbb{Z}[(\sqrt{5}-1)/2]$.
What are some good resources to read up on relevant results?
Answers to this question describe the running time complexity of common arithmetic operations in finite fields.
This publication describes the complexity of division in quadratic field extensions. Unfortunately, I wasn't able to access this publication.


texts: Would this hash functionality fall under pre-image resistance or collision resistance?

texts:
I understand that there are three main security requirements for hash functions, pre-image resistance, second pre-image resistance and collision resistance.

I need to write about a hash function that allows the user to identify if the original hashed items are identical, but I am a little confused to which security feature this falls under. I understand that its best that no hashed items create the same digest, but in this case its a requirement.

Would this fall under pre-image resistance, since often this is when the random salt is added? Or simple collision resistance? As collision resistance stops hashed values from equaling the same value.

I am a little confused since I do not want different inputs equaling the same output, only identical ones.


texts:
When designing pseudorandom generators what should one consider? Here is an example pseudorandom generator $F^t : \{0,1\}^n \rightarrow \{0,1\}^{4n}$. I have no idea what it means, so what does it kindly mean? It is one proposal written in a book for the truly random compression function $t : \{0,1\}^{2n} \rightarrow \{0,1\}^n$

Like how would I design one for truly random compression function such as $t : \{0,1\}^{2n} \rightarrow \{0,1\}^n$?


texts:
I've been looking into elliptic curve cryptography, and have been trying to understand how I can and can't use it. Note that this is a hobby project and I am not making my own crypto systems for anything serious.

I am attempting to create an elliptic curve key pair that is dependent on outputs from other cryptographic functions. As far as I understand it, an key in ECC is based on a single point on the curve, as opposed to RSA which uses a pair of primes.

Does this mean that I can use random bits (or hash outputs) of the correct length as the private key of a curve such as Curve25519?

I've struggled to find information on this topic, but I do know that the soon-to-be released system SQRL (https://www.grc.com/sqrl/crypto.htm, "SQRL's underlying crypto technology") mentions using such a system. If I haven't understood it right, how is this working?


texts:
Let V = $[x_1,\ldots ,x_n]$  be a binary vector of length $n$, and let $E(V)$ be the entrywise encryption of this vector.

Suppose I want to give to another player, $E(V)$, but also let him have the ability to verify that the plain vector contains  m values that are equal to 1, and they are  consecutive.

For example, n=5,m=2:

Valid V = 0,1,1,0,0;
Not valid V = 0,1,0,1,0.

Note that: If the requirement was without the consecutive property, I've just used an homomorphic encryption. (to see if the multiplication of the values are equal to the encryption of $m$).


texts: Collision resistance of partial SHA-256 hashes XOR'ed

texts:
My hashing algorithm computes the SHA-256 for each of 12 input strings and XORs them to get the final hash.

Is there a risk of an attacker being able to forge 2 sets of inputs that yield the same final hash?

To avoid trivial attacks by feeding in the same input twice and make this scheme order-dependent, I prepend each input with its index (binary 0 to 11).

For the case of 256 inputs there is an easy attack (as each hash can be used to control a single output bit using matrix calculus), this makes me wonder whether there are similar attacks for just 12 inputs.

I'm aware that there are more secure alternatives such as Merkle trees but I really need maximum performance especially for when just a single input is modified.


texts: How can I estimate the amount of entropy (with JavaScript) that I'm seeding a CSPRNG with?

texts:
I am trying to determine how much entropy is going into a specific CSPRNG in JavaScript, but I can't seem to find a pure-JS client-side implementation of an entropy estimator.

So, I need to find a way to estimate entropy locally with pure JavaScript.

If it helps, the entropy is in an array which should be easy to manipulate.


texts: Zero-knowledge-proofs on committed value

texts:
Assume user $A$ with corresponding public-private keys $(pk,sk)$ and a public information $r_1$ and $r_2$.

Let $r_{1s} = Sign(sk, r_1)$ be the signature on $r_1$ generated using $sk$ and $c = Hash(r_2 || r_{1s})$.

Now given $r_1, r_2$ and $c$ are publicly available can user $A$ produce a zero-knowledge proof that $c$ is generated correctly without revealing $r_{1s}$ and $sk$ ? If so how?

Thanks in advance.


texts: Are all commitment schemes pseudo-random functions?

texts:
I am interested in understanding whether or not we can use commitment schemes that are both hiding and binding as pseudorandom functions.

My reasoning is that if a commitment is hiding, then an attacker cannot distinguish between two commitments. Does this imply that a commitment is also indistinguishable from randomness? hence that commitment schemes are also pseudo random functions?

More concretely, can one use pedersen commitments as pseudo random functions?

Thank you for your time!


texts: How to perform homomorphic multiplication in ElGamal?

texts: How can I compute homomorphic multiplication in ElGamal? That is: Given two ciphertexts $(R_1,c_1)$ and $(R_2,c_2)$ corresponding to plaintexts $m_1$ and $m_2$ under some public key; how can I compute a ciphertext $(R,c)$ that is an encryption of $m_1\cdot m_2$ under that same public key?


texts:
I recently studied the LPN problem and BKW algorithm for solving LPN problem. Several papers deal with the concrete parameters of LPN to be secure against BKW algorithm, but I cannot measure the concrete complexity of BKW algorithm. The papers provided the concrete parameters when the memory space is bounded by $2^{60}$ or $2^{80}$ while I cannot understand how to set those parameters.
Is there a LPN estimator? or estimator of BKW algorithm? If not, how to measure the concrete parameters of BKW algorithm?


texts:
I'm not even sure of the appropriate terminology to use to describe my problem so bear with me if the explanation is not exactly formal.

Imagine I have a simple digital calculator, with a screen and some buttons. I bring this calculator into a room full of people. I ask them each one by one to take the calculator and accumulate their age on the calculator, such that after everyone is done the calculator screen reads the combined age of everyone in the room.

The trick is that there is a lot of people in the room, and some of them are liars. I need to solve two problems relating to this:

I need to know if some user(s) has lied about their age
I need to know if some user(s) double counts their age

It's enough for me to recognise and throw away a bad result, not necessarily know who messed with the result.

We can assume that the calculator is rather large (ex. has a 256-digit display), but not arbitrarily large. This means that I can punch in a number that contains some identity information as well as my age, but I don't have enough digits to just have everyone's signature side by side.

Assume I've been given a value to verify.


texts: Can you obtain private key d and compute plaintext from El-Gamal?

texts:
Given an Elgamal encryption scheme with public parameters  $k_{pub}=(p,\alpha,\beta)$ and an unknown private key $k_{pr}=d$.
Due to an erroneous implementation of the random number generator of the encrypting party, the following relation holds for two temporary keys:
$k_{M,\,j+1}= k^{2}_{M,\,j}$   mod p
Given $n$ consecutive ciphertexts
($k_{E_1},y_1)$,($k_{E_2},y_2), \ldots,(k_{E_n},y_n)$
to the plaintexts ${x_1},{x_2}, \ldots,{x_n}$.
Furthermore, the first plaintext $x_1$ is known (e.g., header information).
With this, I concluded that:
I believe it is possible to compute the private key $d$ from the given information. To do this, we can solve for private key $x$ in $\beta = \alpha^x \bmod p$.
But as my understanding of the topic is naïve, I may not have come to the right conclusions.


texts: Is this a good choice of a digital signature scheme?

texts:
This is a concrete instantiation of Rabin-Williams signatures.

Specifically:

The private key is 2 primes $p, q$.
The public key is their product $N = pq$ and is approximately 3072 bits long.
the hash function is Skein-512 with 3072 + 512 = 3584 bits output (Skein allows arbitrary output lengths).
The padding scheme is deterministic full-domain-hashing, using the 3072 low-order bits of the Skein output.
The two high-order bits of the Skein output, which are not otherwise used, are used to select which of the four square roots to output.

Example applications are CA signatures and distribution package manager signatures where signature verification speed is critical.

Questions:

Is Rabin-Williams with 3072 bit keys faster or slower to verify than EdDSA?
Is the scheme I gave secure?  I think that it is an instantiation of a scheme that was proven secure in the random oracle model by Bernstein in this paper.  While Skein is less used than other secure hash algorithms, it was an SHA-3 finalist and underwent a substantial amount of cryptanalysis.


texts: I am currently implementing oauth2 bearer token authentication and am storing the tokens bcrypt encrypted. My question is how long should the tokens be to achieve maximum security. E.g. at what length would longer tokens be useless since a bcrypt collision is as likely as guessing the token.


texts: Known plaintext attack on ElGamal encryption

texts: Assume that Alice uses Bob’s ElGamal public key $(\alpha=2, \beta = 8, P= 11)$  to send two messages $M = 17$ and $M' = 37$ using the same random integer $k = 9$.  Eve intercepts the ciphertext and somehow she finds the value of $M = 17$.  Show how Eve can use a known-plaintext attack to find the value of $M’$.


texts: Implementation specific differences between RDRAND and RDSEED

texts:
I've read Intel's The Difference Between RDRAND and RDSEED and Intel Digital Random Number Generator (DRNG) Software Implementation Guide, but I have some open questions that are specific to usage in an application. I work with Wei Dai's Crypto++, which is a C++ class library of crypto algorithms and schemes. The library provides access to Intel's RDRAND and RDSEED instructions.

The Crypto++ library applies Maurer's randomness test for TRNGs to the output of both RDRAND and RDSEED. RDSEED consistently provides a value at or near 1.00000, while RDRAND often provides a value at 0.997 or above (1.00000 on occasion, but not consistently).

My first question is, why do the numbers produced by RDSEED appear to be of better quality then the numbers provided by RDRAND with the Maurer test?

The Crypto++ library provides two additional tests. First, the library attempts to fetch 10,000 bytes. Second, the reads and discard bytes (which is really just the first test over again). Both attempt to ensure the generator can produce a steady stream.

Now, in the two tests above, the library retries a failed operation 8 times. A failed operation means a random number was not produced by the generator, and it is signaled by the Carry Flag (CF). If RDRAND or RDSEED reaches the failure limit of 8, then the API call fails. RDRAND always fulfills the request (I've never seen it fail), but RDSEED fails on occasions (because the maximum number of retries were reached).

My second question is, why does RDSEED suffer depletion when it appears RDRAND does not (it also appears RDSEED is a simpler generator than RDRAND)?

I realize the Maurer test is a statistical test, and future runs a years from now might turn the results on their head. But I also feel I should not be seeing these trends in repeated random samplings over days and weeks.

I also understand there's little difference between 1.00000 and 0.99700 in practice since I can grab extra bytes and run it through an HKDF to extract the entropy. Its more a morbid curiosity to me.

The Crypto++ source files are available at rdrand.cpp. The C++ file calls into routines provided for Microsoft Assembler (MASM/ML). We found we could get greater throughput by providing hand tuned assembly for bulk requests (i.e., avoid intrinsics).

The RDRAND routine can be found around line 185 of rdrand.asm, while the RDSEED routine can be found around line 430 of rdrand.asm

An example of tests applied to generators (including RDRAND and RDSEED) under Windows is shown below:


texts:
I've seen ciphers (usually in spy drama shows) that involve taking a book and writing down an index to individual characters. Essentially it's a keyed substitution cipher, where the key is the name and exact edition number of the book.

Example:

Imagine a book that has 500 pages, with approximately 60 lines per page and 80 characters per line. We might write 238:4:64 to specify that we're on the 238th page, 4th line, 64th character. A five character message might be encrypted into 114:25:22 374:41:46 182:17:62 63:53:8 50:8:18.

Without knowing what the book is, I would imagine this is provably secure as long as the person encrypting never re-used an index. Am I correct in this assumption?

For fun, you could try this out:  12:9:3 183:15:7 238:14:11 310:9:38 194:11:17 7:1:1

I'm using a page:line:character format, ignoring titles, spaces and punctuation. The book is Charles Darwin's On The Origin of Species, 6th edition.

N.B: I'm not trying to get you to crack this, just adding it because it nicely demonstrates the way this works :)


texts: Is it secure to use ciphertext feedback with RC4?

texts:
Consider the following modification of RC4 to give some "ciphertext feedback"

i ← 0
j ← 0
C ← 0  -- We will remember the previous output ciphertext byte.
repeat
    i ← (i + 1) mod 256
    j ← (j + S[i] + C) mod 256  -- Use the previous ciphertext byte
                                -- for "ciphertext feedback".
    S[i] ↔ S[j]
    input P                     -- Read the next byte of plaintext
    C ← S[(S[i] + S[j]) mod 256] xor P
    output C                    -- Output the next byte of ciphertext

It would be nice to be able to use RC4 in some sort of plaintext-dependent mode like this, to avoid various stream cipher weaknesses while still having a cheap cipher that is easy to implement.

Is there something obvious (or non-obvious) that goes wrong here? [Edit: Other than my ability to write appropriate pseudocode on the first try.]


texts: Do companies like CipherCloud really have the option to use homomorphic encryption?

texts:
I was reading How is CipherCloud doing homomorphic encryption? and was wondering:

Is there a technically feasible way for companies like CipherCloud to use homomorphic encryption (HE) while preserving full functionality in a third party SaaS app (e.g. Salesforce)? Furthermore, can it be done without requiring that the third party SaaS app be modified?

I believe is not completely possible because of the use of “Top n” functions (e.g. customer charts) and the common use of the SQL distinct keyword.

For example, suppose the application uses the top 10 customers (global sales) this month. For the DB query it would imply something like select top 10 customerField from sales order by orderTotalField desc. Issue here is that 2+ different customerFields can be the same customer if we use HE, and that would result in incorrect values, maybe not even 10 different customers.

Let me elaborate a little more: HE Database has a table with 3 fields customerName, dailySales and date. John is the customer with most sales but has, say, 8 HE equivalent values. The application ask for the top ten sales, by customer, by year. The query is then, Select cutomerName, sum(dailySales), Year(date) from datatable group by customerName, Year(date) order by Sum(dailySales) descending. As you see, the database needs to group in this case depending on sales for each customerName, and will fail for this example. Hope I'm clear here to establish the problem with HE in first instance.

What do you think, do they have a choice? If so, please elaborate :)


texts: Is the output of ISAAC still secure if I take the 32 bit number mod 8?

texts:
I'm using ISAAC for encryption but only need an 8 bit number.  So, if I use N mod 255, I presume the output would be only a random sequence of 255 numbers... but is it still secure?

I could of course copy the 8 bit number to be encrypted into the first 8 bits of a 32 bit number and then fill the rest of it with random numbers and then mod it with the 32 bit ISAAC output.


texts: Best model for client software encryption / decryption

texts:
I would like to develop a small solution (c#) that must secure data exchange with an untrusted server.
The model is that this software will run on a Windows client then Encrypt data before pushing it to the server and then decrypt data when query back from server.
Encryption and decryption will happen locally on the client (inside the software c# code)
In other words, we want to protect the data against the server in this scenario, and not against clients because they are knowing these data and could be share between them.
For the moment, I have considered to use a Certificate issued by my organization and deployed to each client computer.
Then, from my small software, I will use this certificate public key to encrypt and private key for decrypt, by using RSA algo.
I would consider to set this certificate as private key non exportable, in order to secure it ?
That's works well but I feel that it's maybe not the right way of using asymetric encryption in my scenario... So my questions are :

Is it necessary to use asymetric RSA in my scenario, since the public and private key are known from the client... ? Is it perhaps better to use symetric encryption with AES and a single key ?

Can I fully trust to the fact of setting certificate private key as non exportable ? Is it means that my client user would be really not able to export this key ? I guess no since my program is able to do it :)

Finally, what could you advice to me in order to satisfy this specification by keeping in mind that we want to protect the data pushed to the non trusted server ?
Thx a lot guys !


texts: Is there a cryptographic scheme that allows joint encryption using a shared secret?

texts:
I'm looking for a type of algorithm that could be used to encrypt text with a shared secret $S$. What I would like to have is the secret to be broken up in three pieces, where any combination of two pieces can be used to reconstruct shared key $S$ in order to decrypt the text.

Is there any mathematical or cryptographic scheme of approaching this? Physically breaking up shared secret $S$ is one approach but what about others?


texts: Using Diffie-Hellman secret key to encrypt/decrypt data?

texts:
My end goal is to encrypt data with AES-128, send it to other process and decrypt it there. While using DH key exchange protocol.

I have used DH to generate a 256 bytes shared secret, but I can't use that key to fit the 128-bit encrypting function.

I read that the secret needs to be fed through a "Key-based key derivation function" (KBKDF), but as I understand that gives you a hash which then you won't be able to dehash... so how does the other program can decrypt the message?

Can I just truncate the secret message to 128-bit? (I don't think this is the right solution though).

How would the encryption and decryption of the hashed secret work?

Side note. I am trying to do all this with OpenSSL library in C

Thanks.


texts: Why use a timestamp and how can someone know it's the correct one?

texts:
Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message message|timestamp|E(A_private_key, Hash(message|timestamp))

What are the benefits of timestamp? How can a person who gets the message know that it's the correct timestamp? Why just not send message|E(A_private_key, Hash(message))?


texts: Suppose that you knew that a plaintext was encrypted with DES and consisted only of 16-bit Unicode letters, numerals, and punctuation marks available on a standard English-language QWERTY keyboard.  How could you use this knowledge to attack the DES-encrypted cipher?


texts: What encryption shoud I use for single char encryption?

texts:
I'm very new to encryption and I wanted to know if it is secure or just possible to use encryption on single chars. I did some research, but nothing to clear and i'm a bit confused.
The modes I think it is possible to do it with are one-time pad, RSA and AES in counter mode.

These are probably wrong ,but I have no idea why. So please explain me why these can't be used or maybe can be used.

EDIT: since I'm building a keylogger I could just buffer up and encrypt the whole buffer, encrypting a single char is not necessary.


texts: What values constitute failing for ENT tests?

texts:
The dieharder tests give a clear PASSED, WEAK, etc and I'm wondering what those thresholds might be for the ent tests. While I'm sure a subjective and holistic reading of results is also helpful (especially for someone who knows a lot about RNGs and their tests), are there values that could be considered passing?

I know, for example, that the Monte Carlo Pi test should ideally be 3.143580574, but would a 4 be considered passing?

Edit: the question is better worded as failing the tests, rather than passing (see answer below).


texts: Different inputs but able to generate consistent outputs across different SHA engines

texts:
Say I'm feeding in few thousand bits data (INPUT AAAA) into both SHA256 & SHA3 256 engines at the same time. (Both engines using different hashing architecture) and hence it will generate different 256-bits of output, lets say SHA256 generate ABCD while SHA3-256 generate EFGH.
I'm curious about if we can try to find the alternative input (INPUT BBBB) later that can generate the same HASH output like above (SHA256 generate ABCD & SHA3 256 generate EFGH).


texts:
Is a one-time pad still breakable on a depth of 2+ if the plaintext is completely random?

I'm assuming this idea is wrong, mostly because it occurred to me, but let me walk you through my logic so you can concisely correct me:

A one-time pad is unbreakable on a depth of 1 because a comprehensive
brute-force attack will yield numerous reasonable plaintexts.
Upon a depth of 2 or more (e.g., the same pad used with multiple
plaintext messages) it becomes breakable:

Brute-forcing message $A$ may result in (say) 10 plaintexts
Brute-forcing message $B_n$ may result in 10 plaintexts each
The key that commonly results in valid plaintexts is probably the one-time pad used.

If the plaintext is completely random, then this attack won't work, as there is no way to discriminate between "plaintext output" and incorrect outputs.

I was thinking of ways to pass encryption keys and IVs - which, if properly generated, should be very random data - between two systems.  Let's presume they have a trusted channel by which they can exchange the one-time pad, but wish to use an untrusted channel for exchanging more voluminous data.  They can use symmetric encryption to protect data across the untrusted channel if they have away to agree upon the keys used for the symmetric encryption.  If a one-time pad could be used to securely exchange symmetric keys across that untrusted channel, then the sparse use of the trusted channel (exchanging the one-time password) could enable encryption across the untrusted channel.

Would this, instead of a one-time pad, be a shared secret? A key derivation function?

Some "please don't beat me up" caveats:

Yes, I realize this sounds like I'm breaking the "never invent a new cryptosystem" rule, and I realize the importance of that rule.  Rather, I'm using this as a gedankenexperiment to understand encryption better, and/or as a way of identifying an existing model that describes what I'm suggesting.
Yes, I realize SSL is the appropriate model for what I'm suggesting - the certificate exchange and handshaking is the "trusted channel", enabling symmetric encryption of the general data over the "untrusted channel".  I have reason to contemplate lighter-weight solutions.

I humbly appreciate any edification you can give me.


texts:
I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability.

My question is why Denning-Sacco protocol choose to generate key on trusted third party and send it to Alice who then sends it to Bob.

Would it not be faster and easier if A could generate key from some randomized variable such as last few key strokes by user or date, time and current temperature or any other such parameters.


texts: Combining cascaded encryption keys into one key

texts:
Is there an encryption algorithm where it's possible to combine multiple encryption keys into one, so that:

$E_{AB}(Data) = E_A(E_B(Data))$

KeyAB should be computable from KeyA and KeyB, but it must not be possible to compute or guess KeyA or KeyB from KeyAB and/or Data.

The algorithm should be as secure as possible, ideally asymmetrical (but if that's not possible, a good symmetrical one will also do).

XOR meets the above criteria, like so:
$KeyAB = KeyA \oplus KeyB$
$Data \oplus KeyAB = (Data \oplus KeyA) \oplus KeyB$

But XOR is obviously not a good crypto scheme, let alone asymmetrical. Are there any good alternatives for this particular use case?


texts: Group description in pairing based cryptography

texts:
Suppose we have a public key encryption scheme, in which public parameter contains
$(p, G, G_t, e, g)$, where $p$ is prime number, $G$ is a (cyclic) group of prime order, $e:G \times G \mapsto G_t$. Now my question is, what is the meaning of $G$ which occur in the public parameter? Does it represent the group order (here $p$) and the operation (say $*$ multiplication)?

Thanks in advance.


texts: Is this "AND" implementation safe against side channel attacks?

texts:
I found out that the following is a working implementation of calculating an AND function between XOR masked shares, implementation at Github. It works by calculating parities, whose terms cancel each other out in a "lucky" way whenever an odd number of shares is used.
The primary advantage of this algorithm could be that parity has the property that it can be easily updated by XOR-ing any term to be taken out and add any new term needed thus decreasing the number of computations both in XORs and finally ANDs as well.
def masked_AND(shares, a_masked, b_masked, random):

    # calculate AND between shares...
    c_masked = [a_masked[i] & b_masked[i] for i in range(shares)]
    # ...with refreshing the output's mask
    c_masked = [c_masked[i] ^ random[i] for i in range(shares)]

    # calculating correction terms: some terms of the parities'
    # cancel out at the end in case of an odd number of elements
    for i in range(shares):
        parity_a = 0
        parity_b = 0
        # calculating parities of all corresponding Aj and Bj bits...
        for j in range(shares):
            # ...corresponding means all but the Ai and Bi bits
            if i!=j:
                parity_a ^= a_masked[j]
                parity_b ^= b_masked[j]

        # addig correction term to the particular output share
        # which is the "AND" between the parities
        c_masked[i] ^= parity_a & parity_b
    return c_masked

My primary concern is: is it safe to calculate the parities of all but 1 of the shares one after the other? Can you give me hints on other problems maybe - for example for some reason in the ISW-scheme $(a[i] \wedge  b[i])$ are not refreshed but every other combination $(a[i] \wedge b[j]) \ where \ i\neq j$ is?


texts: Black-Box Zero Knowledge vs Non-Black-Box Zero Knowledge

texts:
I'm confused about the definitions of black-box zero knowledge and non-black-box zero knowledge. I have searched and found explanations but still a bit confused about it. From the context, their definition (with auxiliary input) of black-box zero knowledge proof system between the prover $P$ and (malicious) verifier $V^*$ can be described as follows:

$\{\langle P(\omega), V^*(z)(x)\rangle\}_{(x,\omega) \in R, z \in \{0,1\}^{p(|x|)}}$

and $\{S^{V^*(z,x,\cdot)}(x)\}_{(x,\omega) \in R, z \in \{0,1\}^{p(|x|)}}$

are (perfectly/statistically/computationally) indistinguishable, Where $S$ is a simulator which has access to a oracle function $V^*(z,x,\cdot)$

In my opinion, the only difference between the definition of non-black-box zero knowledge and the definition of black-box zero knowledge is that non-black-box zero knowledge allows that for all $V^*$ there exists unbounded simulator $S$, is this correct?


texts:
Is there such thing as a keyed reversible hash function? This would be a hash function where computing H(x) is easy and requires no key, but computing x from H(x) is only feasible with the key.

Is this absolutely synonymous with digital signatures? Or is this something else and does such a thing exist? It feels like the inverse of public key cryptography: encryption is public, decryption (reversal of algorithm) is private.


texts: Verifying EdDSA signatures using xedDSA verify function.

texts:
I'm running into a problem where I generate signatures using a library like pynacl's (https://pynacl.readthedocs.io/en/stable/signing/) ed25519 implementation and then when I verify it using xedDSA's verify function (https://github.com/signalapp/curve25519-java/blob/master/android/jni/ed25519/additions/xeddsa.c#L45) it passes sometimes and fails other times.

This seems to be related to the priv/pub key pair that generates the signatures. Once a keypair generates a signature that the xedDSA function can verify, all subsequent signatures are also validated correctly from the same keypair. I'm converting the ed25519 public key that is given by pynacl into a curve25519 pub key (verify_key.to_curve25519_public_key()), which I then pass into the xedDSA function.

In the intro here: https://signal.org/docs/specifications/xeddsa/#curve25519

It is stated that an ed25519 signature will be correctly verified by a xedDSA verify function. But this is not the case here.

Can anyone tell me exactly why this is happening? I'm quite confident it has something to do with the key generation and the subsequent conversion of the ed pubkey to a curve pubkey. But I don't know enough about crypto to pinpoint the issue.


texts: What is the value of Q such that Q|P-1 where P is a prime number?

texts:
For my crypto assignment, I'm asked to enter a prime P and generate Q such that Q|P-1

Can anyone guide me what is Q|P-1?


texts: A question about elliptic curves and finite fields in bilinear pairings

texts:
Based on what mentioned in the paper "Pairings For Cryptographers"
http://www.sciencedirect.com/science/article/pii/S0166218X08000449
the two inputs of a pairing map are two members of two additive groups on elliptic curves, while the output is an element of a multiplicative group on a finite field.

I would like to know is there any mathematical or technical advantages for a multiplicative finite filed group (in compare with an additive elliptic curve group)? or is there any mathematical or technical disadvantages for an additive elliptic curve group (in compare with multiplicative finite filed group)?
The following image shows this question more accurate.

Please help me


texts: If H(m) = 0 for some m, how can a DSA signature be forged?

texts:
If we know for some message $m$ that $H(m) = 0$, how can we forge a DSA signature with only the public key?

I got that $g^s*r = (g^x)^r$ where $x$ is the private key, but that's one equation with 2 unknowns, and since discrete log is hard, I can't substitute a value for either $s$ or $r$ and find the other and satisfying the condition $0 < s$ and $r < q$ at the same time.


texts: Why do the discriminant and primality of the group order of an elliptic curve affect security?

texts:
In a book about cryptography and elliptic curves, there was a mention that not all curves are secure, and a statement than in order to pick a secure curve the curve must satisfy 3 requirements.

The curve's equation is $y^2 = x^3 + ax + b\quad\pmod p$
with $4a^3 + 27b^2 \neq 0\quad\pmod p $
and the order $\#E(\mathbb F_p)$ of the Elliptic Curve group is prime.

The third point is weird since in DLP like Diffie-Hellman modulo $p$, the order $p-1$ can be any number not necessarily a prime (maybe it can be extra secure if it's a prime I don't know).
I understand the first statement of course but I'm completely lost on why the other two statements must be true for an elliptic to be secure. So if someone can explain why statements 2/3 must be true for a good elliptic curve and what can happen if these two conditions aren't true. Any small example with small $p, a, b$ will be really appreciated so I can understand the mathematics behind it.


texts:
I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES.

What I understand is that they precomputed the distribution of Hamming distance for the input difference 1. It is observed that the Hamming distance values of 9, 12, 23 and 24 correspond to unique output vectors.

So as an attack you try various input vectors with difference 1 and when the output vectors have a Hamming distance corresponding to one of these values you have hit the jackpot because you know what input vectors (to the S-box) produce these unique output vectors. As an example, they have mentioned the Hamming distance 9 and they say that the only possible inputs for the S-box are either 0xE2 or 0xE3.

What I am unable to figure out is how they were able to calculate the values 0xE2 and 0xE3. The best way I can think of is by trying all possible values. This may work in this case because the output vectors have a unique Hamming distance, but I doubt it would work in other cases (say for output vectors with Hamming distance 5).

I want to know if there is a smarter way to figure out these values?


texts: Is there any encryption method (theoretical) that could process instructions on encrypted code?

texts:
Is there anything such as an encrypted Turing machine? More precisely, is there any (encryption) system such that given:

a Turing machine: T
a public/private key pair

there exists a Turing machine T' (or something Turing machine like) where the tape, states and so on are encrypted using (this method together with the) the public key and such that if, both T and T' are let run for the same number of steps, the state and tape of T' decrypted with the private key equals the state and tape of T.

ie. is there some encryption where one can apply basic operations on the encrypted data?...


texts: Identifying identical files without reading them completely

texts:
Imagine the following situation:

there are many "big" files (100Gb+) lying on 2 different remote servers
you have no direct access to these files
you can only read a small amount of each file (e.g. 10Mb) as well as it's general information (e.g. file size)
files can have different names and paths but same content/size
security is no concern - nobody will try to create fake data to force collisions
file contents are solely audio and video files in all kinds of different formats

What's the best way to tell if there are duplicate files between these 2 servers (with a certain confidence) with the data that's available?

Goals:

find file duplicates
the resulting hash has to be the same for the same filesize + contents everytime
create a database of hashes (?) to compare newly added files with already existing for duplication

My naive approach looks like this right now:

feed file size (as byte array) into sha256
read chunk at the beginning of file and feed into sha256
read chunk at middle of file (file size/2) and feed into sha256
read chunk at end of file and feed into sha256
use resulting hash for comparisons

The goal is not to 100% identify/verify those files but being able to tell with the highest possible confidence (provided the restrictions) that file1 on server1 is pretty likely file2 on server2 while providing good collision resistance.


texts:
Let's say I have an elliptic curve $E$ $y^2=x^3 + 486662x^2 + x$ over a prime field $GF(2^{255} - 19)$. My algorithm for computing $E(m)$ is as follows:

I take the bits 1 through 32 of the message and plug that for $x$ in the equation.

I then calculate the result, store it as $x$,

and calculate the sign of $y$ using the first bit of $m$.
Let $e$ be the encryption key, then we can set the encrypted value of $m$ equal to $$Enc(m) = E(m)^e.$$

My question is how can I decode the message if I know the encryption key? Is it always possible?


texts: How to measure brute force speed of a computer for a give cipher with given number of keys for second for a given key space

texts:
As I understood brute force attack is measured in number of keys which in turns give time required based on speed of computer

It is quite interesting find out how effective an arbitrary computer is and estimate to total time required to try all number of keys in a given key space.

Are there any tools available to practically estimate the effectiveness of a computer to try all number of key in a key space to brute force attack block cipher.

For example

key length: 32
key space:  2 ** 32
Time:
   10 ^ 9 keys/sec = 4 sec
   10 ^ 12 keys/sec = 4 ms

Theoretically we can calculate with all these assumption. But, is there any way/tool/application to measure speed of a computer and how many keys it can try per second without trying all number of keys in key space.


texts: What is this "finite field cryptography"?

texts: See RFC 5931 § 2.2.1 which talks about "finite field cryptography" as opposed to elliptic curve cryptography and it looks like it is describing the Diffie-Hellman protocol. But Diffie-Hellman is not a done over a finite field, so is this some different class of algorithm?


texts:
I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = x^3 + 2x + 3 \pmod 5$.  To find the list of all the points you run through $0 < x \leq 4$ and solve for $y$.

I know the output is the following:

x = 0 => $y^2 = 3$ => no solution mod 5
x = 1 => $y^2 = 6$ = 1 => y = 1,4 mod 5
x = 2 => $y^2 = 15$ = 0 => y = 0 mod 5
x = 3 => $y^2 = 36$ = 1 => y = 1,4 mod 5
x = 4 => $y^2 = 75$ = 0 => y = 0 mod 5

So the points are: (1,1) (1,4) (2,0) (3,1) (3,4) (4,0) and the point at infinity. But I have no idea what is happening here, for example at x=1 solving $y^2$ becomes 6 (mod 5) is one. But why does it say y = 1 and 4 for x=1?

I'm also having trouble understanding point doubling, I'm using the following algorithm:

compute $m$:

$$m \equiv (3x_1^2)(2y_1) -1 \pmod p$$
for the new x and y:

$$x_3 = m^2 - x_1 - x_2 \pmod p$$
$$y_3 = m(x_1 - x_3) - y_1 \pmod p$$

Though this doesn't seem to work. Can someone give me an example of point doubling for e.g. the following equation $y^2 = x^3 + 2x + 1 \pmod 5$ with point P(1, 3) and compute 2P?


texts: Is AES-XTS considered safe to encrypt multiple files with the same keys?

texts:
I was wondering if changing the cipher mode to AES-XTS in EncFS would be a sound idea. EncFS uses AES in CBC mode until the last 1KB block, and CFB mode for the last block if len(block) < 1KB. This ensures that len(plaintext) == len(ciphertext).

The design seems somewhat convoluted, but understandable considering those decisions were (probably?) made before any relevant standard was published.

My main concern is that AES-XTS seems to have been designed for data stored in block devices and not for a "user-space encrypting filesystem". In an encrypted user-space filesystem, each file would be a "block device" and each "block device" would use the same keys.

Apart from the obvious issue that encrypting the same file twice would result in identical ciphertexts (if not using per-file keys), how could we attack this design? :)

Thank you.

Additional clarifications/motivation

EncFS' default options

EncFS has several options when creating a volume. By default, files are encrypted using unique, unpredictable ivs; blocks are not authenticated (a per-block MAC option exists, but is disabled due to efficiency considerations); a "block" in EncFS defaults to 1024 bytes.

Why would anyone want to disable per-file ivs?

Disabling per-file ivs in EncFS raises several potential issues:

Watermarking attacks
Copy-paste attacks using blocks from different files
Since the last block may be encrypted with a stream cipher, the keystream may be reused. Or not, since some magic shuffle operations are used.
Additional information leaks

However, many people use EncFS with cloud-based storage solutions, such as Dropbox and Google Drive. Some commercial services exist there are/were based on EncFS, even disabling per-file IVs. I am not affiliated in any way with such companies.

When per-file ivs are disabled, data deduplication inside a specific volume will work very well. Identical plaintext on the same block offset will have identical ciphertext. From a bandwidth/space efficiency standpoint, this is a very desirable property. From a security standpoint, it is not.

So the question could be rephrased as: is using AES-XTS (which is less malleable than AES-CBC and more easily parallelizable, but it can leak more info since it does not chain) without per-file keys an acceptable security tradeoff, if trying to optimize a volume for a cloud storage service? Would enabling such a design be acceptable?


texts:
I (believe I) am aware of the general difference between a hash and a MAC; the former is used for integrity and the latter for integrity and authentication as it also takes a secret key as an input in addition to the message.

But what if I hash the message, encrypt it using the secret key (one that is separate from the one used to encrypt the message), and send that instead of the MAC? Does it not hold the same properties as sending a MAC?

In both cases, we input a message and a secret key to compute an encrypted hash / MAC, so it seems like both integrity and authenticity are provided.

If not, in what way would an adversary be able to break the authenticity of a scheme that sends, along with each encrypted message, an encrypted hash (using a separate secret key)?

Edit:

As mentioned in a comment below, this has already been answered here and here but I am unable to mark it as a duplicate as it is on a separate StackExchange.


texts: Building a hard to factor number without knowing its factorization

texts:
It is possible to find an efficient algorithm for constructing a provably hard to factor number $N$, together with a witness that shows that it is indeed hard to factor. EDIT, since it was not clear: I also want to be sure that even the person that constructed the number cannot factor it.

Of course, a random large enough integer is going to be hard to factor with high probability, but we might be unlucky.

There are also multi-party protocols for shared generation of RSA moduli (such as http://crypto.stanford.edu/~dabo/abstracts/sharing.html), but I would like a non interactive technique.

Motivation: This was suggested by Poncho's answer to Compare two hashes with different salt


texts: Why might SHA-384 throughput be lower than SHA-512 throughput in hashcat and more secure?

texts:
I found a hashcat benchmark results in the internet: hashcat results:

SHA-384 is 17065.4 MH/s
SHA-512 is 17280.3 MH/s

Why does SHA-512 take less time? SHA-512 is longer and I thought it therefore needs more time and computation resources to compute the hash?


texts: Multi-Linear Secret Sharing vs. Shamir Secret Sharing

texts:
I hope someone can help me. I read several papers including the original paper, "Multi-linear Secret-sharing Schemes," by  Beimel et al., and watched the following video https://www.youtube.com/watch?v=3GFdp7V_yog but still struggling with the concept of multi-linear secret sharing scheme. I know that in LSSS, the secret is an element of a field, and a dealer distributes shares to parties. Consequently, the parties can independently use linear mapping to recover the secret. I will use the same example in the video; a secret is shared in field, F_2, and the matrix is as follows:

My questions are:

The first and the second rows of the matrix are labeled to the same party, ie P_2, but how can you give different shares to the same party?
Only P_2 and P_4 can recover the secret because when they combine their shares, the r_2, r_3, and r_4 gets canceled, But P_2 already has r_2 in two different rows. What is the difference between row 1 and row 2?
what is the difference between Shamir's secret sharing and multi-linear secret sharing.

Thank you


texts: What are the security risks in making a passphrase-encrypted private key public?

texts:
I have a 4096-bit GnuPG private key.  It currently resides at ~/.gnupg/secring.gpg.

The private key is passphrase protected.

Is it necessary to keep this private key hidden from public access?

Or, for convenience purposes, can I depend on passphrase protection, and put it somewhere that is not very secure (like a Git repository or a drop box) for ease of distribution to my various devices?


texts: two public keys with same passphrase insecure? | can two hashes be compared?

texts:
Suppose someone had generated a 2.048-Bit RSA GPG/PGP key pair and published the public key on the usual key servers. Then he withdraws this key and generates a new one in 4.096-Bit RSA using the same passphrase again.

Theoretically, can the passphrase be cracked by mathematically comparing the two public keys or does that give away any security whatsoever, e.g. by the fact that both of them are out there?

I'm not a mathematician, so I'd be especially interested if 'comparing two keys' would make any theoretical sense at all and if so, what impact this would have on the integrity of the passphrase.

Edit: please note that this question is not about reversing a hash to its passphrase (or in this case reversing two hashes to eventually learn they were made from the same pass) but if there are mathematical methods to compare two hashes to

see if they might have originated from a single passphrase or even
obtain information about this common pass through this comparison


texts: Finding the LFSR and connection polynomial for binary sequence.

texts:
I have written a C implementation of the Berlekamp-Massey algorithm to work on finite fields of size any prime. It works on most input, except for the following binary GF(2) sequence:

$0110010101101$ producing LFSR $\langle{}7, 1 + x^3 + x^4 + x^6\rangle{}$

i.e. coefficients $c_1 = 0, c_2 = 0, c_3 = 1, c_4 = 1, c_5 = 0, c_6 = 1, c_7 = 0$

However, when using the recurrence relation

\begin{equation}
s_j = (c_1s_{j-1} + c_2s_{j-2} + \cdots + c_Ls_{j-L}) \mbox{ for } j \geq L.
\end{equation}
to check the result, I get back:

0110010001111, which is obviously not right.

Using the Berlekamp-Massey Algorithm calculator they say the (I believe) characteristic polynomial should be $x^7 + x^4 + x^3 + x^1$. Which, according to my paper working, the reciprocal should indeed be $1 + x^3 + x^4 + x^6$.

What am I doing wrong?  Where is my understanding lacking?


texts:
From this site: https://tls13.ulfheim.net/ and from https://tools.ietf.org/html/rfc8446#section-2 I can't find the part in which the exchange of keys is signed, isn't one of the parties "key_share" supposed to be signed using the server certificate's keys?
For example this:
https://i.stack.imgur.com/nsGeV.png
In the image above I can only see the x25519 which from what I have seen is ECDH (source https://en.wikipedia.org/wiki/Curve25519)
but is missing the authentication ECDH with RSA or ECDSA, unless it isn't specified under the assumption that anonymous key exchange isn't an option in TLS 1.3.


texts: Primality testing (deterministic vs. non-deterministic)

texts:
I noticed that non-deterministic primality testing algorithms are more commonly used in practice while there is a deterministic algorithm e.g., AKS which runs in polynomial time? I am right? if so, then why? is there any drawbacks of using AKS?

Thanks,


texts: How to argue to a paranoid that RSA is safe?

texts:
From today's standpoint, most people would claim RSA to be secure. However, to my knowledge, this is purely based on the speculation that no one knows a computational feasible way to find a $d$ for given $n$ and $e$, s.t. $ed \equiv 1 \mod \varphi(n)$ - which can be reduced to the factorization problem.

However, it is still an assumption that the factorization problem is hard to solve but nothing that has been proven mathematically. Worse, as far as I understand it, it is not even clear to which complexity class integer factorization belongs. And if the past year has thought us anything then it is that often the "paranoia argument" is not that paranoid at all.

So I always wondered how probable it is that indeed no one has found an efficient solution to the factorization problem yet. How would one know? Or, in short:  How do you convince a paranoid that RSA indeed is secure?


texts:
In the context of fully homomorphic encryption, what is the difference between bootstrapping and recryption, since both offer the same result which is trying to eliminate/decrease the noise budget.

Description of bootstrapping:

In certain homomorphic encryption schemes, arithmetic oper-
ations on ciphertext can be performed using basic gates (AND, OR, NOT, etc)
but arbitrary operations could reduce the available noise budget. Bootstrapping
is a technique to remove noise by passing a ciphertext and encrypted private
key into a circuit that represents the decryption algorithm of a FHE scheme. This
results in a new ciphertext that corresponds to the original ciphertext but with
no noise. In the TFHE library, after every gate-by-gate operation, bootstrap-
ping is applied on the resultant ciphertext and hence any number of arbitrary
operations can be performed.

Description of Re-encryption:

Recryption is a technique to re-generate the noise budget of a ci-
phertext that was depleted by arbitrary computations. Recryption boosts bounded-
depth homomorphism to unbounded-depth homomorphism. This implies that
the noisy ciphertext can be converted into a noise-free ciphertext (of the same
plaintext) without the secret key. Libraries that do not have recryption
functionality implemented, provide no means of converting a noisy ciphertext to
a noise-free ciphertext. They therefore limit the number of arbitrary computa-
tions on a ciphertext.


texts: Is AES/CBC/NoPadding vulnerable to padding oracle?

texts: If we used Cipher.getInstance("AES/CBC/NoPadding"), will it be vulnerable to padding oracle attacks?


texts: Is a PRG that reveals the first bit of the input secure

texts:
Let $G:(0,1)^n \rightarrow (0,1)^{n+1}$ be a secure PRG.
Define $G'(s):=s_1 ||G(s)_{2,...,n+1} $.
 ($||$ is concatenation, and the subscript $ _{2,...,n+1}$ means the last $n$ bits of $G$)
I claim that $G'$ is a secure PRG, and my intuition is that if a distinguisher, say $D'$, could distinguish its output on a random seed from a truly random string of length $n+1$, I could break $G$. My reduction is:

$D(x)$:
1) Choose $b \in(0,1)$ randomly.
2) Return whatever $D'(b||x_{2,...,n+1})$ returns.

Clearly, if $x=r$ is truly random, then $b||x_{1,...,n+1}=r'$ is truly random and:
$Pr[D(r)=1]=Pr[D'(r')=1]$
The other case is where I have problem.

I've divided the probability into two events:
$Pr[D(G(s))=1]=$$Pr[D(G(s))=1|b=s_1]\cdot Pr[b=s_1] + Pr[D(G(s))=1|b\neq s_1]\cdot Pr[b\neq s_1]=$${1 \over 2}(Pr[D(G(s))=1|b=s_1] + Pr[D(G(s))=1|b\neq s_1])=$
${1 \over 2}(Pr[D'(G'(s))=1] + Pr[D(G(s))=1|b\neq s_1])$
Where the final transition is true because when $b=s_1$, we have exactly the definition of $G'$.
However, I don't know how to handle the later addend. I noticed that when $b \neq s_1$, we give $D'$ an input of the form $G'(s) \oplus 10^n $.

Questions
1) Is my intuition correct?
2) If so, is my reduction/proof correct? I feel like I'm missing something obvious.


texts: On-the-fly computation of AES Round Keys for decryption?

texts:
The usual implementation of AES first computes all the Round Keys sequentially starting from the key, and stores them in RAM for later uses. However, when enciphering a single block with a key that will be used for that purpose only, or when RAM is very sparse, or perhaps in hardware, it is advantageous to use the Round Keys a they are being generated, rather than store them. Quoting the Rijndael submission to NIST:

  The key schedule can be implemented without explicit use of the array W[Nb*(Nr+1)]. For implementations where RAM is scarce, the Round Keys can be computed on-the-fly using a buffer of Nk words with almost no computational overhead.

It is said this also works for deciphering:

  The key expansion operation that generates W is defined in such a way that we can also start with the last Nk words of Round Key information and roll back to the original Cipher Key. So, calculation ’on-the-fly' of the Round Keys, starting from an “Inverse Cipher Key”, is still possible.

However, the how-to is left as an exercise to the reader. In particular: Can the last Round Key (the first used when deciphering) be computed directly, rather than sequentially?


texts: what does small scalar multiplication in ECC means?

texts:
I came across this table a lot in many articles, but I didn't understand what's the difference between Scalar multiplication operation in a group based on ECC and a Small scalar point multiplication operation in a group based on ECC ?
Source of table is from this article


texts: Can I use a deterministic NONCE for AES-GCM file encryption if I generate "fresh" keys for each encrypted file

texts:
The NIST specification states that the deterministic NONCE(IV) should be 96 bits. It should consist of two fields: fixed field of 32 bits and a 64 bit counter. The use of a random 96 bit NONCE is discouraged (https://eprint.iacr.org/2016/475.pdf).

My use case is encrypting files on disk. Each file is encrypted with a new key generated by a KeyGenerator, initialized with the default SecureRandom() implementation. My question is this: do I really need a fixed field, or can I make the whole 96 bit NONCE initialized to 0. As in a 96 bit counter. This way the NONCE is effectively deterministic and I don’t have to store it as part of the file. Since a new key will be generated for each new encrypted file, then I shouldn’t ever reuse a key/NONCE pair which would be detrimental for AES-GCM.

I’ve seen some suggestions that the fixed field is actually a 32 bit random integer, but I think this is not necessary as I’d never re-use a key/IV in my construct (http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf).

My only concern then would be to ensure that I never generate 2 identical 256 bit keys out of SecureRandom, but that proof seems impossible to me and the probability of such event seems negligible. The only way to ensure I never generate duplicate keys is to keep the keys or their fingerprint in a database, but this is undesirable. But then even if I do employ a 32 bit random integer in my fixed field I also have no guarantee that a probabilistic event won’t happen and create a duplicate key/IV.

Update

I have summarized my research on how to use AES-GCM correctly in a blog post.


texts: What do people mean when they talk about forward secrecy in ciphers?

texts: I've heard several people and websites talk about ciphers that have forward secrecy. I know about forward secrecy in key agreement protocols, e.g. RLWE, (EC/SI)DH, QKD, etc. This could be what they're talking about and it's a simple case of misused terminology (I've mostly heard it in articles about cipher suites), but I've also heard this used in the context of hash based signature algorithms so I'm wondering if people are using a special variation of a stream cipher or some other method.


texts: Statistical tests for pseudorandom permutations

texts: I'm implementing a format-preserving encryption scheme similar to those described in the literature. I want to sanity test my PRP using some statistical tests like TestU01. However, I'm not sure how applicable these kinds of tests are to PRPs since they are designed to test PRNGs. Are there statistical tests that are PRP-specific? If not, would the results of a PRNG test against a collection of PRP ciphertexts be a meaningful test of its statistical pseudorandomness?


texts: How would I encode RSA private key, given that I know the decimal representation of all of its components?


texts: Is it possible to have a PAdES signature with only a timestamp?

texts:
Is it possible to have a PAdES signature which only contains a timestamp from a TSA? Does this prove the content of the PDF was unaltered since timestamping?

Or is the timestamp calculated on a digital signature and does it only provide valid proof for time?


texts: Does anyone know of any programmes that can find a function from a known input and output?

texts: The outputs I'm getting are only 2x the length of the input strings so any kind of brute force programme would be fine. Thanks.


texts: If a single bit was known through all states in AES, which would cause the most information to leak?

texts:
This question is motivated by some bad Verilog.  Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule tied to a pin.  This was caught in my audit of the HDL; however, it's sort of a neat error.  Due to the nature of the hardware, I can get 10-bits of information about the key out of it as it's configured for AES-128 and it's a very parallel implementation (it's actually the LSB of the squaring module in the S-Box on the lowest byte of the key).  This got me thinking:

If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information?  I feel it would be a bit in the key schedule.


texts: Is it safe to compute HMAC(Base64(IV) || "," || Base64(CipherText)) instead of HMAC(IV || CipherText)?

texts:
Let || be the concatenation operator.

Let CipherText = AES(Key1, IV, Message).

Let us assume AES is used in CBC mode.

I want to compute an HMAC tag on the IV and CipherText.

Normally, one would do the following:

Tag = HMAC(Key2, IV || CipherText)

I want to know if the following would also be equally secure:

Tag = HMAC(Key2, Base64(IV) || "," || Base64(CipherText))


texts: How to compute secure sum using secure multparty computation?

texts:
Suppose there are three voters $P$, $Q$ and $R$, and each will vote only on one candidate out of $X$, $Y$ or $Z$, with a 6 bit vote vector corresponding to $X
$, $Y$ and $Z$ respectively (with 2 bits each for a candidate. E.g., $( 01, 00, 00 )$ signifies a vote for $X$).

How can any voter find out the total number of votes cast for each candidate without disclosing their preferences by the use of secure multiparty computation?

Each 6 bit vote vector is encrypted and sent to the some third party who will then take the product of ciphertext votes and then decrypt the product to yield a bit vector which shows the total number of preferences received by each candidate (Paillier cryptosystem).

What homomorphic property must be held by the cryptosystem in the plaintext and in the ciphertext space to satisfy the objective?

Finally, I need some theoretical explanation finding secure sum using SMP (with and without random seed) and SMC to sort the numbers.


texts: Why is a MAC verification algorithm required when we can simply create a new MAC and compare the received one with the one calculated?

texts:
The process of verifying integrity through MAC involves two separate algorithms (as mentioned here). On the server side, a signing algorithm runs which calculates the MAC of the message using the shared key, while on the client side, a verification algorithm runs which uses the secret key, the received MAC and the message to verify whether the message was altered in transit or not.
But we can simply dispense with a separate verification algorithm by simply calculating the MAC of the received message using the shared key. If the calculated MAC and received MAC are the same, the message has not been altered.
Is that what actually happens in all MAC verification algorithms?


texts: For public-key encryption, why does COA resistance imply CPA resistance?

texts:
My professor told me:

  If a public-key crypto-system is secure against ciphertext-only attacks,
  then it is also secure against a chosen-plaintext attack.

Why is this true? Is there a proof that confirms this?


texts: Non-repudiation and digital signature of a dishonest participant

texts:
Let's assume a dishonest Alice who sends, encrypts & digitally signs a message to Bob.

Bob stores the decrypted message and the digital signature in a database.

However, Alice is a bad girl and erases all data from her side, including her private/public keys. She then claims she never sent the message.

Is there a solution to this case?

In my case, Alice uses a communication tool that Bob has provided, where the private/public keys are generated within the context of the tool (with no 'public key' advertised anywhere else, hence making it even more difficult to prove anything).


texts: (Lightweight) Multicast one-way Authentication

texts:
Problem:
I'm thinking about a lightweight solution to provide source authentication (only one source) to multiple receivers (multicast message).

Context:
Taking the problem to ground, we can think of use cases like firmware update (one to many), or a command to turn on several lights 'on' (that command can be sent by one and only one source). In all cases I don't want to send many times the same message, but only once (multicast), and that the receivers can authenticate that comes from an authorised-trusted source (one-way authentication).

The scenario is similar to the one described on:
https://tools.ietf.org/html/draft-somaraju-ace-multicast-00
But there they have many senders, they use symmetric crypto, any member of the security group (same symmetric key) can send message to the other members of the group.

I know that with asymmetric cryptography the problem can be easily solved:  Digital Signatures.

But I was wondering:

Is there any established symmetric-cryptography-only solution to this problem?

To my (not extensive) knowledge I'm inclined to say No (due to the symmetric characteristics of.. symmetric crypto), but maybe there is a smart symmetric cryptosystem that can achieve source-authentication.

ps: this question is simmilar Digital Signature using symmetric key cryptography but not the same (and the answers do not provide a categoric answer)


texts: Calculating distance between two vectors using Paillier homomorphic encryption

texts:
I am basically trying to perform euclidean distance calculation in the encrypted domain (Paillier encryption). Using the homomorphic properties of Paillier, the squared euclidean distance formula can be written as (paper):

$\newcommand{\opn}{\operatorname}$
$$\underbrace{\opn{Enc}\left(\sum^d_{i=1}p_i^2\right)}_{\text{(I)}}\cdot \underbrace{\opn{Enc}\left(\sum^d_{i=1}q_i^2\right)}_{\text{(II)}}\cdot \underbrace{\prod^d_{i=1}\opn{Enc}(q_i)^{-2p_i}}_{\text{(III)}}$$

I tried implementing this in matlab using two sample vectors a and b but I seem to be getting a completely wrong distance when decrypted. The euclidean distance of the two vectors without encryption is 100.5883 but when applying the above formula and then decrypting the result I get 10118

%I'm using the variable precision integer toolbox (vpi) to handle large numbers in Matlab
a = [10, 58, 23, 59, 78, 11];
b = [87, 15, 12, 32, 41, 22];

p = 708481;
q = 708497;
r = 461563;

n = p * q;

% calculating (I) from above equation, i.e. a^2
encA =vpi(zeros(size(A))); %initialize vector for encrypted values
sumA = 0;

for i=1:length(A)
    encA(i) = PaillierEncrypt(A(i), p, q, random_r); %this will encrypt the value at index i in the vector
    sumA = sumA + (A(i))^2;
end

enc_sumA = PaillierEncrypt(sumA, p, q, random_r); %now encrypt the summed value

% below is for (II) and (III) in the equation i.e. b^2 -2ab
encB =vpi(zeros(size(B)));
sumB = 0;
enc_prodAB = vpi(1);

for i=1:length(B)
    encB(i) = PaillierEncrypt(B(i), p, q, random_r);
    sumB = sumB + (B(i))^2;

%the below block is to assist in determining the mod of a negative exponent, basically it allows for this to run without error: mod((encA)^(-2*vpi(B)), n*n);
    a2 = encA(i); %the encrypted base
    d2 = (-2)*vpi(B(i)); %the exponent that is a non encrypted scalar
    n3 = n*n;

    negpowermod = @(a,d,n2) minv(powermod(a,abs(d),n2),n2);

    result = negpowermod(a2,d2,n3);

    enc_prodAB = enc_prodAB * result;
end

enc_sumB = PaillierEncrypt(sumB, p, q, random_r);

dist = enc_sumA * enc_sumB * enc_prodAB;

Ive commented the above code as best I could to explain what I am doing. I'm sure I messed up the implementation somehow.

Some guidance would really be appreciated. Thanks


texts:
I'm crash studying the public key cryptography topic and I have a few questions about how signatures are created.

So are digital signatures just encrypted hashes? If that's the case then I can hash my symmetrically encrypted message, pass it with the signature maker with my private key, then it can promise authenticity and its data to be untampered (cause you'll have to recompute the hash on the other side)? Will the same private key and same hash give the same signature? On the other side what the verifier does is to create its own version of the signature and matches it with the received signature or does the public key have the ability to decrypt a message encrypted using the private key?

Sorry for all the questions i just started on this last night. Thanks in advance!


texts: Explanation of correlated randomness for garbled circuits

texts:
While studying Yao's garbled circuits I was mentioned that correlated randomness played some part in MPC. I looked for online documentation but everything I've found is far too complicated for me to understand.

Could anyone briefly explain the role (and functioning) of correlated randomness?


texts: What authentication techniques can be used by QKD Systems?

texts: As it is well known that QKD systems are prone to simple MITM attacks… what authentication techniques are being used in QKD to prevent those attacks in practice?


texts: RSA signature send signature with encrypted message?

texts:
What is the correct procedure in sending an authenticated message, I've been researching and have been getting different answers, such as hash-then-sign [1], [2]
, sign-then-encrypt [3] (but the link wasn't specific for RSA).

Do I send the hash-then-sign (with something like RSA-PSS PKCS#1) and attach it to the message or encrypted message?
Do I use sign-then-encrypt, I tried searching "sign then encrypt rsa", with no result on the scheme used, what cryptographic scheme would I use? Would I just use RSA-sign and RSA-encrypt?
Do I combine them and use hash-then-sign-then-encrypt and just send it as one, is there a cryptographic scheme for this?


texts: Secure method for encrypting 32 byte private keys

texts:
I am using 32 byte EC private keys on the client side of a web application. These keys should be securely stored on a server database. The keys should be encrypted (AES) before being sent to the server in javascript. The ciphertext will be given to the client when they have been authenticated with their login credentials. The client would then decrypt the ciphertext to obtain the private key.

Anyone with access to the database ciphertexts should not be able to derive the private keys.

On the face of it, it seems that ECB is actually fine because the private key data is pseudo-random, but ECB is generally not recommended for any purpose. What mode would be appropriate in this situation? CBC tends to be used often for similar purposes from what I can see.

If I used GCM, will the client always be able to authenticate the ciphertext? So if the client-side encrypted a private key with a particular encryption key and only retained the encryption key, the server cannot forge a combination of IV, authentication tag and ciphertext which would be decryptable using the same key?

I'm not sure if such authentication would be useful as already the client has to trust the downloaded client software, but I suppose it could be a matter of "why not?". In that case would there be downsides to using GCM? More data would need to be stored of-course but not a lot.

PBKDF2 is a reasonable method to derive the AES key for a password, am I right? Are there any weaknesses to PBKDF2 or advantages to any other algorithms?

Lastly I've read about the AES key wrapping algorithm, though I do not know much about it and there does not seem to be many open-source implementations.


texts: Why does OAEP have 2 rounds with 2 random oracles?

texts: I strive into understanding why OAEP has two rounds of computations and not just one. I.e: Wouldn't it be safe to hash the random number r and XOR it with the original message?What security risks if any that padding scheme violates?


texts: Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?

texts:
In a recent question I asked here on crypto.se, an answer was given that surprised me a bit.

As mentioned in the referenced question, I'm looking to derive encryption and authentication keys from the output of scrypt. Since I can use nearly any output size I'd like in generating the output from scrypt. This leaves me two options for deriving the encryption and authentication keys:

HMAC the output in two different ways, ie: hmac(output, "e", sha256), hmac(output, "a", sha256); the e key is for encryption and the a key is for authentication, unsurprisingly.
Generate a very long output from scrypt by asking for a 512-bit output, and then split it for the key derivation for encryption and authentication.

Does any one solution fare better than the other in key derivation? I personally like the idea of using an HMAC better because then both the encryption and authentication keys use the entire key output as an input.


texts: Is there any IND-CPA secure stream cipher with a "standard" hardness assumption?

texts:
I've read our recent question: "One-time pad using RSA and Diffie-Hellman functions" which asks about the security of a particular way to convert RSA and discrete exponentiation into a stream cipher. The approach didn't work out, as expected, knowing that it was an interview question.

Now, the following question came over me:
Is it (constructively) possible to create a stream cipher whose IND-CPA security can be directly reduced to a well-known number-theoretic assumption?

To be clear: I'd like to know (out of curiosity, no deployment intended) whether there exists a stream cipher which is as hard to break as CDH (or another assumption) with no other assumptions (no random oracles, no constructed PRPs like AES, no constructed PRFs like SHA-2, ...) and if such a stream cipher can exist , I'd also like to know how to build it (e.g. give a brief description please).

Example assumptions: "factoring is hard", "the RSA problem is hard", DLOG, CDH, DDH


texts:
Sorry for the newbie question, I'm new to cryptography and I have difficulty in understanding what the block is. For example for DES algorithm the block size is 64 bits and the key is equal to 2 to the power of 56.
Can someone explain this to me ? Maybe like I'm 5?


texts: Distributing shares in a particular monotone access structure

texts:
Consider 6 people, $A,B,C,D,E,F$ and a secret. Construct a scheme which enables the following subsets of people to retrieve the secret:

three players from the set $\{A,B,C,D\}$

two players from the set $\{A,E,F\}$

two players
from the set $\{B,C,D\}$ together with at least one player from the set $\{A,E, F\}$.

I want to know how I can distribute $6$ shares amongst these people so that the secret can only be obtained when three shares come together i.e a threshold of three. I've tried so many options but there always seems to be one unauthorised subset that gains access to the secret that causes it not to work. For example if I label the shares $1,2,3,4,5,6$ and distribute them like the following:

$A - 1$

$B- 2$

$C - 3$

$D - 6$

$E - 2,5$

$F - 3,4$

Then the unauthorised set $\{D,F\}$ for example will have three shares and be able to recover the secret. Is there a way to distribute them so that only authorised subsets can gain access to the secret?


texts: Encryption in popular compression file formats - 7zip, RAR, Zip

texts:
When encrypting a file say with Winrar you have to enter a password. I am under the impression that this password is not stored anywhere but instead the password together with some other attributes and an IV create a hash of some sort.Is that hash stored or attached to the encrypted file ?

Then when trying to decrypt the file by means of an user fed password, is the hashing process repeated to verify that the stored hash matches the generated hash for the decryption process to begin?

I mean,there has to be something stored in the encrypted file;maybe not the password but a hash...


texts: What's the difference between RSA and Diffie-Hellman?

texts: I've been reading on a lot of websites that same thing: RSA is for communication using the public and private key for both the server and client, where Diffie-Hellman is just for exchanging the same secret key that will then be used for both encryption and decryption, but they both depend on the same MATHS, e.g: that question on quoraThen I was confused when I also read that RSA shares a master and pre-master key, as well, like in this question:SO, the question here is, does RSA use the public and private key to encrypt the whole conversation, or is it used just to encrypt a key then the encryption depends on that symmetric key? And if it was used to encrpyt the key and it was the same MATH as Diffie-Hellman, so what is the difference anyways??


texts: How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?

texts: How are the weaknesses of the Merkle–Damgård construction (i.e. the Herding attack, multicollisions, length extension, expandable messages) avoided in the sponge construction?


texts: New quantum attack on lattices (or Shor strikes again)?

texts:
Lior Eldar and Peter W. Shor published a paper on arXiv.org in which they present a new quantum algorithm against a variant of BDD. They claim that their new algorithm can efficiently solve the following problem:

  Given a lattice $L$, a vector $v$, and numbers $b = {\lambda}_1(L)/n^{17}$, $a = {\lambda}_1(L)/n^{13}$ decide if $v$'s distance from $L$ is in the range $[a/2, a]$ or at most $b$, where ${\lambda}_1(L)$ is the length of $L$'s shortest non-zero vector

Moreover they state that

  improving these parameters to $a = b = {\lambda}_1(L)/\sqrt{n}$ would invalidate one of the security assumptions of the Learning-with-Errors (LWE) cryptosystem against quantum attacks.

Now, while I assume the authors refer here to Regev's original proposal, nowadays, there exists a zoo of LWE-type assumptions, used in lattice-based crypto. These assumptions mainly differ in the choice of parameters / used distributions.

My question is, does anyone have an idea how many of these or which class of LWE-type assumptions are broken by the proposed algorithm?


texts: Is it reasonable to assure that p-1 and q-1 aren't smooth?

texts:
I came across the requirement that, in RSA, $p-1$ and $q-1$ shouldn't be smooth, shouldn't consist of lots of small factors. Therefore my question:

How complicated is it to check whether $p-1$ is smooth? (And how is it done?)

Knowing the complexity of finding out, is it reasonable to actually check?
For instance, does OpenSSL perform this check?

I assume that the chance of hitting smooth $p-1$ among $512$-bit primes (for RSA1024) is pretty low to begin with. Is it?


texts: Zero-Knowledge proof with the paillier cryptosystem

texts:
For a paillier cryptosystem how can I perform a zero-knowledge proof?

Given a set of values:

0001
0010
0100
1000

This would be for use in a voting system where we want to ensure we where given a value from the set of acceptable ballots without knowing which if the values where selected.

I have found some information suggesting it is possible but I can't find a succinct set of steps or explanation for how this could be accomplished.


texts: Does proving security in the random oracle model ensure that using a hash function is secure?

texts:
In security proofs,

I have seen the random oracle model and the standard model.

If I prove security in the random oracle model, does this mean that if I use SHA-3, assuming sha-3 cannot be broken, that the protocol is secure under sha-3?

Are there any caveats to proving security in the random oracle model and real-life?


texts: Is a PRF applied to a secure MAC also a secure MAC?

texts: Suppose I apply a PRF to a secure MAC.  Do I still have a secure MAC?


texts:
It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides such as the SSH2_MSG_KEXDH_GEX_REQUEST to get g.

But in my machines, the 2 sides decided to use curve25519 to exchange the key.And When I using WireShark to capture the packages. I only find 2 steps between the c-s key exchange when using curve25519.

Diffie-Hellman Key Exchange Init(30) (with DH client e)
Diffie-Hellman Key Exchange Reply(31) (with DH server f and the signature H)

So I tried to look up the rfc,

  The key exchange procedure is similar to the ECDH method described in
     chapter 4 of [RFC5656], though with a different wire encoding used
     for public values and the final shared secret.  Public ephemeral keys
     are encoded for transmission as standard SSH strings.

So here is my question:

Is the curve25519 algorithm a special(implementation) one of ECDH? And why it need no common params for both sides to config?


texts: Given enough RSA signature values, is it possible to determine the public key value?

texts:
Given enough RSA signature values, is it possible to determine which public key is required to verify the values?

Could there be enough information to establish which key is required? Is there anything in the RSA scheme to retrieve the modulus, assuming the public exponent can be guessed?

Only padded RSA for signature generation with PKCS#1 v1.5 padding or PSS padding may be considered, not raw/textbook RSA.

This question is related to this one asking about the same question for RSA encryption.


texts:
By definition - $q(n)$ is a negligible function if for every positive integer $c>0$ there exist an integer $N_c$ such that for all $x>N_c$  :

$q(n)<1/x^c$

So for the function $1/x$, if we take the positive integer $c=1$ then we need to find some $N_c$ such that for every $x>N_c$:

$1/x<1/x$

$=>$ Definitely such $N_c$ does not exist then $1/x$ is not a negligible function.

Is that sufficient?


texts: How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?

texts:
In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about the signed attributes in zero-knowledge, i.e. proving to a third party verifier that the signed values are the opening of a commitment. For example if I have a credential which is a signature on my current income, it is valuable to be able to prove to a third party that a committed value opens to the same income, without disclosing my actual income.
Reading the Pointcheval-Sanders proposal for anonymous credentials, I cannot find any description for how to prove relations of the signed attributes to a commitment. Is there any publication describing such a procedure?


texts: How ROCA get the polynomial used with coppersmith


texts:
I have hard time finding introductory book talking about details of secure multiple party computation. Is there any recommendations? Thanks for the help.

Hope this is not off topic.


texts: Pros/cons of anonymity when messages are encrypted?

texts:
Let's say I'm making an end-to-end encrypted messaging app with the goal of putting "privacy first." The contents of messages are encrypted, but in the current model, it is still visible to the server who sends a message to who and when they sent it, as well as the general size of the message. Messages are retained indefinitely.

The model could theoretically be adapted so that after a transaction is complete, there is no unencrypted record of who sent the message (but when it was sent/who received it is still there). Additionally, it could be further adapted to encrypt [the equivalent of Facebook friendships]. These things would still be visible to the servers as the server has to moderate this process somehow, but the information wouldn't be retained.

For the purposes of this question, this app has an equivalent to Messenger groups, with all messages encrypted. These messages could be anonymous, but group membership would still be remembered.

To be clear this will launch initially as English-only and target the US/Europe (with the company based on the US, under US jurisdiction where possible). In the long term this could possibly spread wherever there is internet access and countries don’t block e2e encryption.

So far what I have gathered (from research + comments below) is that implementing this could potentially allow terrorists to hide their association, but on the flip side it could also allow states to pursue people they don't like.

Pros

More "privacy."
Could be a potential safe haven for people being pursued by their governments.

Cons

Could make it harder for Western law enforcement to pursue terrorism.
Could mislead people into thinking they have more anonymity than they actually do have.

The verdict

Putting this here since this question was put on hold.

So you guys have raised very good points (all credit to commenters below). I’ve decided to try to make things as anonymous as possible. That way if this app turns out successful it can help people who are targets of their own state. Plus the FBI, etc has other ways to investigate terrorism anyway.

Consider this question answered. Thank you all for opening my eyes.

If anybody has anything to add feel free to comment below.


texts:
In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve).

Hence, isn't it impossible to have a perfect hashing algorithm? Aren't MD5, SHA-*, all flawed in this respect?

Is an "ideal hash" impossible to achieve?


texts: Poor man's SSL - is this method as safe as SSL/TLS?

texts:
I need to send data between two applications. I've got requirement that says that data should be transmitted using secure protocol such as SSL/TLS. Data is sent using TCP sockets and I don't have built in SSL/TLS support. However, I'm able to encrypt content using AES and I'm also able to exchange small amount of data using https. I'm thinking of exchanging the key for symmetric encryption using https and then encrypt the data with AES before sending it over the network.

I'm in full control of both parties that exchange information. The keys are exchanged using SSL and I know that both parties are able to use AES. I guess there is no way anyone could decrypt the data without knowing the key. I agree that someone would be able to interrupt the transmission but it will be only noise since he would have to know the key to encrypt data with it.

Is this solution safe? Can it be compared to using SSL/TLS in terms of security? Is there some obvious security hole that I'm missing? Do you see any flaws in terms of security of the message (by it I mean that someone who is unauthorized sends his data as part of transmission or reads data from my transmission)?


texts: Plain text size limits for AES-GCM mode just 64GB?

texts:
Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB.

We've got 100+GB files in genomics that need to be GCM encrypted so are concerned about hitting this.

So two questions:

What's the source of this rather low limitation?
What happens (mathematically, not implementation wise) if you do cross this limit?


texts: Why would it be risky to let Huawei build 5G networks?

texts: I'm wondering why there is so much debate about letting Huawei build 5G networks in Europe and other countries. Shouldn't encryption which is used more and more on the web today make all communication unreadable? Are people just worried about metadata? Thanks.


texts: Establishing a shared secret over a unsecure channel

texts:
Is it possible to establish a shared secret between two devices if the devices have no prior knowledge and no secondary secure channel to exchange information?

Assume a Dolev–Yao model for the communication channel. After searching for an answer I came across this but they use a secure secondary channel to exchange information.

If it is possible, then how?
If it is not possible is there a paper or theorem that say that says why it is not possible?


texts: Bits of security vs collision resistance?

texts:
I have been doing some research on security, and I am confused on the bits of security vs collision resistance, and I was wondering if someone could clarify my understanding.
For instance, if you have an AES has a 128-bit block, being used with a 256-bit key, that provides 256 bits of security, because the key length determines the bits of security in this case.
But if you have SHA-256, that offers 256/2 = 128 bits of collision resistance. Does that mean that the bits of security of SHA256 is 128 bits? Or is bits of collision resistance just in a whole different category than bits of security?
I wrote down what I think captures bits of security based on the type of primitive being used:

Bits of security for a block cipher depends on the key length (so like the example above with AES 128 with a 256 bit key)
Bits of security for a MAC is min(key bits of security, hash bits of security)
Bits of security for a hash function is l/2 or l-bits?

My question is do we aim for bits of collision (when applicable) over bits of security?
Any help is appreciated!!! Thank you!


texts: How do I figure out the number of unique combinations

texts:
I am developing an algorithm that uses a lookup table to process the data, I want to know how many unique tables can be created. If I have a table of 256 values I know that 256! would tell me how many tables are possible, but the math of the algorithm moves forward or backward along this table based on the calculation so the tables are essentially circular with the first and last value sitting next to each other.  Because of this every table with the values in an order that would match exactly to another table except a different start/end would not be unique and not counted.

Without generating every possible table and testing it against others how do I figure out many tables are possible?


texts:
I have the following problem:
I want to put a document on a ipfs store. So it is accessible via a distributed network.
Now, at first only two persons (Alice & Bob) should have access on the file. So I need to encrypt it and give them a private key. But I don't want that both have the same private key, because when one of both shares the key with someone else, probably the other doesn't want this. If the private key is unique I always know, who has shared the key.
But later it should also be possible to share the document with other persons if both agree. But then also these others should get their own unique private key(s) to decrypt the file.

The following text should describe the scenario:

  Alice and Bob have a secret. Both have a different key for decryption of the secret.

  Later Cesar gets a copy of the secret from Alice.
  Alice gives Cesar an additional private key to decrypt the secret.
  Now we have three private keys for decrypting the secret.

  Later Jack gets a copy of the secret from Bob with an additional private key. Again different from the others.

Would something like this be possible in any way?


texts: Distributed Asymmetric Key Decryption with threshold

texts:
Threshold decryption of public-key encryption schemes allows the decryption key to be distributed among trustees. Then, to decrypt the ciphertext it requires at least threshold t trustees to run the decryption protocol in order to get the plain text.

Now, most of the literature is either based on generic multiparty computation (which I am not keen on for some reason) or based on distributed RSA decryption and sharing RSA functions.

Are there any other ways of achieving distributed asymmetric key threshold decryption?
Will elliptic curves be a good choice for distributing the decryption?


texts:
https://www.shoup.net/ntb/ntb-v2.pdf, page 523, algortithm IPT

I don't get the for loop, since "k" isn't used anywhere inside the loop. What am i missing?


texts: Explaining weakness of Dual EC DRBG to wider audience?

texts:
I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can take a max of about 10 mins in my presentation to address this issue - no more.

How can I explain the weakness in the EC_DUAL_DRBG to such an audience via Mathematical intuition (rather than hardcore math proofs)?
How do I establish the distinction between weakness in Dual EC DRBG from any weaknesses in EC in general (especially the NSA's Suite B EC curves - ironic, eh?). To me the weakness in Dual EC DRBG is clear (well, after the fact) with selection of the constant curve point. But the NIST EC curves also have constants although of a much different nature (the large prime modulo). Controlling paranoia is ... not easy.

Please note that the non-technical folks are very intelligent - just not security experts. So I'd like to respect that without dumbing it down too much.


texts: An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

texts:
I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. All I need is :

to protect parties secret values
to compute the product homomorphically and obtain the result encrypted
only the involved parties should be able to decrypt the obtained product

Is Elgamal secure enough for this context ?

As I have found from the description of the Threshold Elgamal pag. 64 and 66, it assumes an apriori distribution of the secret.


texts: Is there a more efficient C# CryptoStream implementation for streaming decryption of large files

texts:
I am using LibVLC and Unity to playback locally stored encrypted 360 videos. VLC's Unity package has a feature to play content via a C# stream. I am using a FileStream wrapped in a CryptoStream to get this working. This works for medium to small videos however, larger, high bitrate videos don't playback properly with my current implementation. The video plays for about 10 seconds before freezing, due to the cryptostreams decryption speed.

I am using the following code to create a decrypting CryptoStream which is passed to VLC. The path points to a properly encrypted file stored on device.

AesCryptoServiceProvider aesCryptoServiceProvider = new AesCryptoServiceProvider();
FileStream crpytoFileStream = new FileStream(path, FileMode.Open);
CryptoStream cryptoStream = new CryptoStream(crpytoFileStream, aesCryptoServiceProvider.CreateDecryptor(Key, IV), CryptoStreamMode.Read);
BufferedStream bufferedStream = new BufferedStream(cryptoStream, bufferSize);

I am using AesCyptoServiceProvider because I know it is the faster cryptostream implementation. I have also tried some different padding, block sizes and other options however I haven't seen much improvement over the default options for AesCryptoServiceProvider.

I've done quite a bit of research and I haven't been able to find definite ways of speeding up the CryptoStream. I don't know if there is a better way to wrap my streams or if there is something I am overlooking. Any help is appreciated, thanks.