texts: I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have some doubts. To encrypt the file I divide it in chunks and I encrypt them with AES generating a random nonce for every chunk. For key derivation I generate a random salt for every file. Do I need a different salt for every chunk or for every file it's enough? Do I need a padding with CTR mode? Should I follow other guidelines for a correct encryption? Thank you!!


texts:
I've checked a bunch of articles about machine learning and cryptography and derived from them three distinct possibilities:

Use ML to approximate a cipher as a function. Article "Neuro-Cryptanalysis of DES and 3DES" shows a way to approximate DES using only $2^{10}$ plaintext-ciphertext pairs with average error of 10% of bits in the test sample.

Although this result sounds pretty good, considering linear cryptanalysis needs $2^{43}$ text pairs to fully determine the cipher, this article doesn't have many references, so I have some doubts about importance of achieved result. And the chosen method has a considerable error of 10% which can happen on any bit of deciphered text. In other words, it is possible that every bit in deciphered text will be wrong, although pretty unlikely.
Side-channel attacks. This looks more promising, especially power analysis attacks, there are some very interesting articles where ML is used on power signal.
Machine learning on encrypted data. This one needs homomorphic encryption, as I see it, there is a bunch of articles too.

Are there any other applications of machine learning to cryptography? Are there any possible ML applications that can assist a cryptographer in their task?

(I can post links to articles if anyone is interested.)


texts: For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash?

texts:
When I say similar, I'm referring to the Hamming distance, the Levenshtein distance, or a similar string distance metric that measures how similar or dissimilar two strings are.

For instance, are there two plaintext strings with a Levenshtein distance of 1 which share the same MD5 hash? If not, do we know the smallest Levenshtein distance possible for a pair of strings which share the same MD5 hash? Is it even possible to determine this with certainty?

I'm asking about MD5 since it's a well-known and simplistic hash. But I'd love to know how this applies to SHA-2, bcrypt, or other common hash functions.

There's a similar question which is looking for the shortest length strings that can generate a collision, but I'm looking for the smallest string distance to generate a collision. The actual length of the source strings isn't important.

(Asking purely out of curiosity; I don't have a real-world use for this)


texts:
The WEP secure channel works by sending $$IV||(m||CRC(m) \oplus RC_4(K,IV)$$ where IV is an asynchronous initial vector, K is an encryption key and CRC is a cyclic redundancy check function.

I know there are lots of attacks on this scheme. I also know that this scheme does not protect confidentiality, integrity or sequentiality. However what is meant when we say that in certain way it protects authenticity? The text I'm reading says:

  Message authenticity in WEP is not specically protected by a message
  authentication code. It is protected in the sense that an adversary
  cannot push a message which makes sense with an unused IV without
  knowing K. It is enough to know one plaintext and ciphertext to reuse
  the IV.

Why is authenticity protected in some sense but not integrity? To be honest the last two sentences of the last quotation make no sense to me.


texts: Mismatch between NIST SP800-90A test vectors and CTR_DRBG output

texts:
I am testing my Python implementation of NIST SP800-90A CTR_DRBG https://csrc.nist.gov/publications/detail/sp/800-90a/rev-1/final (AES-256, no df) with the CAVP test vectors (https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/drbg/drbgtestvectors.zip), and have been stuck for the past couple of days.
The challenge I face is related to the CTR_DRBG_Generate function as specified in Section 10.2.1.5.1 (Generating Pseudorandom Bits When a Derivation Function is Not Used) of the above mentioned NIST SP800-90A standard.
[AES-256 no df]
[PredictionResistance = True]
[EntropyInputLen = 384]
[NonceLen = 0]
[PersonalizationStringLen = 0]
[AdditionalInputLen = 0]
[ReturnedBitsLen = 512]

COUNT = 0
EntropyInput = faf346c9c8afbc5ab6e33ce492247fac6db9a7ba4297557f587a42563ddf56c90e41c6afb56233815b74e091bac7d8e5
Nonce =
PersonalizationString =
** INSTANTIATE:
    Key = a9fccc320fea8ae31f80881556ef0c27a31ee7870ff73e115f348785872ccbd1
    V   = 7c21c56582c419f58ad6151fcfc1ed6b

This works, the Key and V values are correct after a call to my CTR_DRBG_Generate function.
AdditionalInput =
EntropyInputPR = dfc111252d7146922713720ae1e348a07ae403b5238fefb4e8592f6f6cc4a61c94828db84c6faecd1502261008011f2c
** GENERATE (FIRST CALL):
    Key = 59ab2aa229c17b2ccf5b633ad905aa4396d717cd7109c4396176b445e23b54b0
    V   = 9ac50e38805dab58baf6429436e00b39

This does not work, the resulting Key and V values from my implementation are different; so my first instinct was to look for an error in the design of my CTR_DRBG_Generate function. As a side note, would you agree that the EntropyInputPR is redundant and not needed at all?
AdditionalInput =
EntropyInputPR = 4528bac5b99c772347d44f4ece79bc811ca8ebea9483fa5f5040c02f77069dad1aec7adaa8a9a6a9ddabab045d328a90
ReturnedBits = bc013dc891db12c34ad11944805bf13dfd67ff2c23176d83f5b396b69e400042252e11816c3095421137181a5d0ee37c83a339c58d080946ca90aa437d50d9cf
** GENERATE (SECOND CALL):
    Key = 48f4632bbc79c4bde48a8588a5395afcdccc84f2a3b25b8be2715cd8f9dd8a6b
    V   = 24f485205e3baf899b8c226c2ffc73ce

As the first call to CTR_DRBG_Generate did not work, I tried to debug my design by simply emulating the second call to generate by inputting the resulting Key value from the GENERATE (FIRST CALL) (59ab2aa229c17b2ccf5b633ad905aa4396d717cd7109c4396176b445e23b54b0) and the "increment-by-one" (see Step 4.1 in 10.2.1.5.1) value of the resulting V from the GENERATE (FIRST CALL), i.e. (9ac50e38805dab58baf6429436e00b3a).
Based on my reading of the CTR_DRBG_Generate process, the first 128 bits of generated randomness should be the output of AES-ECB(Key, V) (Step 4.2). However, the AES-ECB of the above mentioned key (59ab2aa229c17b2ccf5b633ad905aa4396d717cd7109c4396176b445e23b54b0) and V (9ac50e38805dab58baf6429436e00b3a) is f237788641e684172275415827a3e87e, and not bc013dc891db12c34ad11944805bf13d which represents the first 128 bits of the "ReturnedBits" from GENERATE (SECOND CALL).
Am i misinterpreting the CTR_DRBG_Generate process or what can explain the mismatch between the test vectors and my output?


texts: Cryptographic accumulators and proof of immutability

texts:
I'm looking for a possible primitive representing an updatable accumulator with some features. Basically, I would like to perform in-place updates of an ordered list of elements and provide a proof that the new accumulator value encodes the updated elements leaving the others untouched.
In other terms:

$\alpha$ accumulates $v_1$, $v_2$, $\dots$, $v_n$ in this order.
I replace $v_i$ with $v^{\prime}_i$ and get $\alpha^{\prime}$.
I want to have a proof $P$ so that $\textrm{ACCEPT}(P,\alpha,\alpha^{\prime},i,v_i,v^{\prime}_i) = \textrm{YES}$ if and only if the $i$-th element changed from $v_i$ to $v^{\prime}_i$ in $\alpha^{\prime}$ and that $v_j$ (with $j\neq i$) are untouched w.r.t. $\alpha$.

I'm aware of techniques that allows one to append elements to an accumulator and proving that the new value is given by the old list with just the new elements appended (see Google's Certificate Transparency Initiative) but I've found nothing about the above features.
Thanks a lot!


texts:
This is a follow-up question to

HKDF: ikm, salt and info values

Based on the feedback, I have now decided to implement my key derivation for AES-GCM-256 file encryption roughly as follows:

Everything up to scrypt is run once, the HKDF-expand part is repeated for every file to be encrypted. The random salt and info values get stored (unencrypted) with the encrypted file.

My questions:

Do you see any serious flaws?
What is your opinion about the various bitlengths? In particular: Does it make any sense at all to blow up everything to 512 bits temporarily when, in the end, I use only 256 bits for the data protection key?


texts: Decode & Verify Base64urlUInt-encoded RS256 Public Key from Google

texts:
According to Google, to access the id_token it sends along with Access Tokens (for accessing their API), you must first validate the token using the RS256 Public Key available from this page. The public key responses look like this:

  {
   "kty": "RSA",
   "alg": "RS256",
   "use": "sig",
   "kid": "8c9eb968f73744eaed421e48010142bce51a067f",
   "n": "uweJ3hFY9wqZ6ZG-iSNhQwHtKCGl8G_jcQgGPjOrS-Rum3dyDjicqkAyfS8XDn480KD_TZ5m-lqBjqfimePu2_cH4URDPIwsqSzJI2_piEhaqnXRptIe5YB5imAL6iETKaOPjw284Fc7EdHK-ekHMn3AXjsy9AIErwAVw4-4ZXXwHbyQXJy1DyUB4ZzxiEvw_qkQmLdltmrNkLOw-Xh-C9UkTZ9NA58bYPBnxLwnAu_ggw_g_-hCAs6OvXZbAfFHhIGBLyjtdDLVrfXo1112QREB9d5sEds0bKZtJcD9afl4E7Ht6G-g3jNP2clAu6-6B-cIe4-j8Ph1uJDPkAmDfw",
   "e": "AQAB"
},

According to Google & RFC Specification 7518, this is a Base64urlUInt-encoded RS256 Public key. The "n" parameter is the modulus, and the "e" parameter is the exponent. The rest are simply for verifying the algorithm itself, not pertaining to use of the Public Key for decryption/vaidation.

My Issue stems from the fact that this is not, from what I've read online, a standard RS256 Public Key. When trying to verify my IDtoken, it spits back ValueError: Could not deserialize key data. (The technology isn't important, but I'm using the pyJWT module in python). I know the problem isn't with the ID token, because if I skip validation I don't have a problem. This of course isn't suitable for a production environment.

I've tried converting it to regular Base64 by replacing '-' and '_' with '+' & '/', respectively, along with adding '=' for padding. I even tried prefixing the '-----BEGIN PUBLIC KEY-----\n' string & appending the similar string at the end, but to no avail. I also tried appending the "AQAB" exponent to the end of the modulus, again without any success.

I've also tried playing around with other public keys generated online & those work fine. Even if I purposefully mistype them, I get a error stating it simply couldn't validate the token, instead of spitting back a weird ValueError.

So my question stands; Is there something wrong with the "public key" modulus/exponent Google is giving me, or in how I'm using/converting it? Am I missing steps? Any help is greatly appreciated as I'm new to this topic. Thanks in advance!!


texts:
I'm reading Bootle/Groth. I'm trying to understand how they are committing to a vector using Pedersen commitment. Here's my understanding of Pedersen commitment in the context of this paper:

We have a group $\mathbb{Z}_p^*$, $g$ as a generator.
The generator produces random group elements $(g_1,\dots,g_n,y)$.
We commit to the vector $\vec{m} = (m_1,\dots, m_n)$ by choosing $r$ randomly from $\mathbb{Z}_p^*$ and then $c = Com(\vec{m};r)$ is $c = y^r \prod_{i=1}^n g_i^{m_i}$.

The paper goes on to describe how $\vec{m}$ is actually a row of coefficients in a polynomial, and the verifier may send an input $x$ to be evaluated (without finding out what the polynomial is!). What I am wondering, though, is:

Does my understanding of this scheme make sense?
If so, what makes this scheme (computationally) hiding and binding? I don't know how to walk through a proof of this.


texts: Is the following crypto compatible so that I can use the same keys for both products (Wireguard & Libsodium)?

texts:
I am wondering if it is possible to use the public/private keys of two WireGuard peers also in another communication channel using libsodium?

According to the WireGuard Protocol documentation and the WireGuard paper, they are using:

  Curve25519 for ECDH
  ChaCha20 for symmetric encryption, authenticated with Poly1305, using
  RFC7539's AEAD construction

On the other hand, libsodium (which also supports a ChaCha20Poly1305 variant of the same construction) says:

  Sealed boxes leverage the crypto_box construction (X25519,
  XSalsa20-Poly1305)

Importantly, both are using DJB's Curve25519 but I am not sure if their keys are compatible, e.g. if they are using Weierstrass' or Edwards' notation. Can I use the WireGuard keys inside of libsodium, too? Do the two use compatible crypto?


texts: Does DDH hold in $Z_N^*$ where N is product of 2 large primes

texts: I know that DDH does not hold in $Z_p^*$ because given $g, g^a, g^b, x$, we can compute legendre symbols of $g^a, g^b$ and compare it with legendre symbol of $x$. The same attack doesn't work when we consider the group $Z_N^*$ where N is product of 2 large primes. This is because computing jacobi symbol without knowing factors of N is hard by Quadratic Residuocity assumption. So, does DDH assumption hold in $Z_N^*$?


texts: Supersingular Isogeny Key Exchange broken?

texts:
Found this report detailing a quantum algorithm for computing isogenies
between supersingular elliptic curves.

http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf

with the quote "recommendation
to avoid using base curves defined over Fp in De Feo-Jao-Plut type
schemes".

Is it correct then that 'Supersingular Isogeny Key Exchange' of De Feo is broken?

If so, as this is a fast moving field, are there any recommendations for alternate post quantum key exchange with reasonably good key size and speed?

Thank you.


texts: Does authenticated encryption add any protection to a signed digital envelope?

texts:
The general scenario of hybrid encryption is to use public key cryptography for the exchange of a one time session key that can be used for the encryption of the plaintext with a symmetric encryption algorithm. A digital signature attached to that structure is what I know as a digital envelope. Furthermore, some resources agree that sign-encrypt-sign can help to prevent certain unlikely but possible attacks.

On the other hand, for strictly symmetric scenarios, the use of authenticated encryption is usually recommended as a default good practice.

Does it make sense to bring these two approaches together? Especially, would authenticated encryption (as opposed to semantically secure but unauthenticated encryption) provide any protection against any scenario not covered already by the digital signature?


texts: RC4 in TLS is now broken. But the breaking seems to have a lot to do with how web transactions work in general. Is there any application outside of the web where RC4 is still used? I know that WEP is long out of the window. Any other widely used applications?


texts: How to construct Hash function in python3?

texts:
In many cryptographic protocols design like this one, I have seen the statement 'Choose a Hash function for example:
\begin{align}
h&:  \{0,1\}^*\times\mathbb G\to\mathbb Z_q^*\\
h_2&:  \{0,1\}^*\times\{0,1\}^*\times\mathbb G\to\mathbb Z_q^*\\
\end{align}
in which it takes as input a binary string and a random element of some group and outputs an element of multiplicative group of prime field. How could I construct such a hash function?


texts: Can we always find a key to map a given plaintext block to a given ciphertext block in AES?

texts:
I am revising for my exams and I have come across this question in a past paper and I am not confident about it at all.

Assuming that only the smallest permissible key and block sizes can be used I have derived the following:

Possible plaintext blocks: $2^{128}$

Possible ciphertext blocks: $2^{128}$

Possible mappings: $(2^{128})!$

Possible keys: $2^{128}$

My assumption is that it is true that you can find a key given a plaintext and ciphertext since there are significantly way more mappings than there are keys. But then again, are there even enough mappings for that to be possible?

I really feel like I am missing something important here. Are there any hints or suggestions you can give?


texts: why does TTLV encoding in KMIP require padding?

texts:
I study the KMIP in OASIS standard, I need some help.
Integers, Enumerations, and Intervals in KMIP length shall be padded with four bytes. the reason for padding in kmip is need to match the right size??


texts: Seeding the Fortuna PRNG for the first time

texts:
I am trying to understand how the Fortuna PRNG should be seeded correctly for the first time.

Let's assume that we do have a large-enough seed file available, but not any entropy sources during first boot. To my understanding, I would:

initialize the PRNG (section 9.5.4)
load the seed file (section 9.6.2)
produce random numbers (section 9.5.5)

The last step would produce an error: the check on the end of the pseudo-code in section 9.5.5 would assert that ReseedCnt is zero: PRNG not seeded yet.

When I track the usage of ReseedCnt, I observe the following:

ReseedCnt is set to zero during initializiation.
When reading the seed file, ReseedCnt is untouched.
When generating random data, ReseedCnt is incremented when enough entropy is available in Pool[0] and enough time has passed (not the case during first boot).

So, is the paper missing some steps on what to do in this situation? Section 9.6.6 about first boot explicitly states: 'Having an outside source of randomness to create the first seed file is probably the best solution.'


texts: What's the downside of using X.509 in SSH instead of PKI

texts:
ssh uses public keys for authentication and not signed X.509 certificates. Specify a drawback which would be the use of X.509 certificates instead of public keys.

I've tried to look up a lot of different things, but the certificate seems superior in every way.


texts:
Upon registration an user has to specify an access code of five digits. This access code is also used as a password for the encryption and decryption of certain strings.

The user types in "12345" (ACCESS_CODE).

Obviously, we don't want to save this access code on the device.

Now, when the user wants to decrypt he types in the access code, and if the code is correct, the decryption will happen succesfully.

However, preferably, I would like, before the decyrption takes place, check whether the access code is right, without saving it on the device.

How can this be achieved?

One way I was thinking is to encrypt a string "CHECKSTRING" with the access code. Then the check would be:

Decrypt the encrypted "CHECKSTRING" (ENCR_STRING) --> (DECR_STRING) with ACCESS_CODE
Check if DEC_STRING == "CHECKSTRING", then code is correct, otherwise not.

But this seems to me quite unsafe, as someone could simulate an encryption of the "CHECKSTRING" (which is known and visible in the code) for all combinations of 12345 and then cross match which code I used to obtain the ENCR_STRING.

What other alternatives are there?


texts: What does it mean in layman's term when it states that - "An algorithm running for polynomial time can break the scheme with probability p"?

texts: For example - let's say an adversary algorithm runs for $n^{3}$ time and can break the scheme with probability 0.001. Does that mean, even after running the algorithm for $n^{3}$ time, it will only succeed in 1 out of 1000 times? So, if my understanding is correct, then the adversary algorithm need to be executed for at most 1000 * $n^{3}$ times to be successfully able to break the scheme.


texts: What "Tag Length" should be used for the EAX MAC?

texts:
Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting any value for the length of the MAC, is there anything to take into consideration before setting for a value?

Is the length just "proportional" with collision resistance or are there also other more subtle consequences depending on the MAC length?


texts:
I have been working on a Bloom Filter implementation recently and after a discussion with a co-worker about how many hashing functions to use I told him I was limited with using hashing functions that are already implemented and didn't want to risk the loss of distribution if I derive hashing functions from them.

We can assume that the distribution of any hashing function is not 100% perfect. It's very good for many, but not perfect. Is there any existing literature that describes the loss of distribution? I am not using the hashing functions for cryptographic purposes directly, because in a bloom filter it's only used as an index, and it's the distribution is the most important for my needs - but I assume they are related.


texts: Does Composition of compressing Collision Resistant Hash Functions $H^{*}=H_2(H_1(x))$ is Collision Resistant?

texts:
I'm trying to solve the following problem:

Given two CRHF $H_1:2^{4n}\to2^{2n}$, $H_2:2^{2n}\to 2^n$, construct the following hash function $H^{*}=H_2(H_1(x))$ compressing from $2^{4n}\to 2^n$.
We want to demonstrate that if $H_1$ and $H_2$ are collision resistant then $H^*$ must be collision resistant too.

I made the following reduction

However I'm still unsure on how to calculate ”BAD event” in which $A^{H^∗}$ outputs a collision for $H_{s_1}$, in this case $x^∗=x′$ and the second part of the reduction doesn’t work.


texts: Can you help me understand this toy example of ECDSA signing and verification?

texts:
I'm a complete newbie to ECC. but I was trying to get my feet wet with
(what I thought would be) a TRIVIAL/EXTREMELY SIMPLE example of ECDSA
signing and verification (that I could check by hand).

I'd appreciate any advice as to what I'm missing. Or have done wrong.

And if this is NOT an appropriate venue for this kind of question, I
apologize, and would welcome any advice as to what group/forum would be
a better choice.

E := y^2 = x^3 + 2 x + 2 mod 17

(this elliptic curve has 18 points, and any of the points on the curve
can be the generator (G).. so I chose G = (5,1))

I chose an "ephemeral" key

k = 3

then

k G
= 3 (5,1)
= (10,6)

I chose

dA = 5

then

QA = dA G
= 5 (5,1)
= (9,16)

so A's private/public keys are

dA (= 5) and QA (= (9,16))

And finally, I chose an value for "e" (the hash of the message) of 8.

e = 8

SIGNING:

R = (rX,rY) = k G
= (10,6)

(r =) rx = 10

s = (e + dA r) k^-1 mon n
= (8 + 5 10) 3^15 mod 17
= (8 + 5 10) 6 mod 17
= 8

so the "signature" (for any message that hashes to e = 8) is

(r,s) = (10,8)

VERIFICATION:

w = s^-1 mod n
= 8^15 mod 17
= 15

u1 = e w mod n
= 8 15 mod 17
= 1

u2 = r w mod n
= 10 15 mod 17
= 14

P = (pX,pY) = u1 G + u2 QA
= 1 (5,1) + 14 (9,16)
= (5,1) + (16,4)
= (9,1)

And pX (9) SHOULD be equal to r (10). But, clearly, it's NOT.

What am I missing or doing wrong?


texts: Is ElGamal encryption still secure if the randomness is known to be even?

texts: In ElGamal encryption $(g^r, g^mg^{kr})$, if the randomness $r$ is always chosen from even numbers, and the attacker knows about this, is it still provable secure?


texts: MIT says: mathematical theory behind encryption is wrong. What are the consequences?

texts:
A friend shared with me the following link: Encryption is less secure than we thought

I'm not a security expert and could understand great part the article, except the section about noise, but what I haven't figured out is the impact of that research in real life.

What does it mean for mortals, in practice?


texts: The meaning of formal and semi-formal in cryptography

texts: The question is about "formal" analysis, proofs, etc... What is a correct definition of a formal proof, or a formal analysis? Is there a good way and a bad way to formally prove something. What is the meaning of a a "semi-formal" proof, "semi-formal" argument.


texts: There is Alice and there is Bob. But what is the name of the malicious user?

texts:
I know it is a kinda funny and maybe even naive question but its still security related, so I decided to ask.
Bob and Alice are widely used names indicating the two end-users/parties for web protocols. But in security there is also a third entity, the malicious user. I read a blog post naming that entity "Maria". I giggled and wondered:
Is "Maria" actually a well-established name for the malicious user, in the security industry?


texts: Checking both Quadratic residuosity and Jacobi symbol simultaneously and efficiently

texts:
I have to randomly generate a number $u$ such that $u \in J(N)-Q(N)$

where $J(N)$ denotes the set of elements less than $N$, whose Jacobi symbol value is equal to 1; and $Q(N)$ denotes the set of quadratic residues in $J(N)$ .

What is the best time-efficient way to generate it ?

I am thinking to generate like this:

1) Select an  positive integer $x$such that $(x+1)^2 \le {N}$.

2) Select any integer $y$ between $x^2 $ and $(x+1)^2 $ then check for $\big{(}\frac{y}{N}\big{)}=1$ and continue until we get .

The above method is not correct and counter example is provided in comments below .

Is it good and correct one ?


texts: Are 80-bit keys considered secure as of late-2017?

texts: I've seen a lot of ciphers with variants that use 80-bit keys, like Grain, Trivium, KLEIN, KATAN & KTANTAN, Piccolo, PRESENT, RC4, Skipjack, and TWINE. Some of these designs are younger than six years old, making me wonder if an 80-bit key size is "secure", be it against brute force attacks or as a buffer in the case of weaknesses in a cipher's design. Is 80-bit security not enough anymore? Is it only on the edge of being insecure? If it is on the edge, by what time will 80-bit keys be obsolete?


texts: Which symmetric algorithm should I use for storing files in untrusted servers?

texts:
I have gigabites of files, which I have to backup. I have some servers for storing this files. But these servers are untrusted. So I need to encrypt files, then backup files. When my PC  breaks down, I will dowload files from unstrucsted servers and restore them.

So, basically, I think about AES-256. Is it OK for me, or there is more suitable symmetric algorithms?


texts: one-way deterministic hash for low entropy input?

texts:
My problem is the following:
we have a low entropy data called ID. (personal id number of 10 decimal digits plus a sum, and it contains a date)
We want to create a data (H) which is the same for the same id, but id can neither be computed nor brute-forced by trying all combinations.
It should be proven that even we are not able to reconstruct ID from H using neither computation nor brute force

My solution: use
k:= an RSA1024 key residing in a slow hardware token, unextractable
the reason is to improve entropy

H:=SHA512SUM(RSA(k,SHA512SUM(ID)))
We limit third parties to 1 operation per minute.

Please comment on whether this solution is sound enough, or are there better solution for the problem.
What measures can we use to express the soundness of the solution?


texts: I studied some papers related to NTRU. All these papers describe NTRU as a lattice based cryptosystem but I could not find any paper which illustrates NTRU algorithm from lattice point of view. It would be of great help if anyone describes NTRU algorithm using lattices and how the algorithm is based on Shortest Vector Problem(SVP).


texts: Does there exist trapdoor permutation from lattices?

texts: It seems that the lattice functions are either surjective (SIS) or injective (LWE), due to the error that is basically intended to destroy the structure and provide security. I was wondering whether there exist bijective functions for lattice, more precisely trapdoor permutations? Is there any work that has studied this?


texts: Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

texts:
Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 CKM_SHA256_RSA_PKCS using a reasonably long (i.e. 2048 bit) key?

For reference, CKM_SHA256_RSA_PKCS is described as follows:

  The PKCS #1 v1.5 RSA signature with SHA-256 mechanism, denoted CKM_SHA256_RSA_PKCS, performs single- and multiple-part digital signatures and verification operations without message recovery.  The operations performed are as described initially in PKCS #1 v1.5 with the object identifier sha256WithRSAEncryption, and as in the scheme RSASSA-PKCS1-v1_5 in the current version of PKCS #1, where the underlying hash function is SHA-256.


texts: Why does FIPS 186-4 require specific sizes for keys?

texts:
In FIPS 186-4, page 32, about FFC crypto it is required that the length of $p$ will be exactly 1024 bit and the length of $q$ will be exactly 160 bit. Why is the requirement not stated in terms of lower bounds?

For instance, any $p$ with length greater than 1024 bit would be good, and any $q$ with length greater than 160 bit would be good. For instance, if $q$ is 170 bit, would that harm security?


texts: Does a cipher exist with the following properties?

texts:
The key can unlock the ciphertext in polytime (measured in length of key + cipher).
a. Given the key + ciphertext as input, if you cannot unlock it in some fixed number of steps (relative to input size (key + cipher)) you reject.

b. No one can break your cipher in under this ^ number of steps without a valid key (not the average case--worse case)
The length of the ciphertext is no more than polynomially longer than the key.


texts: Extracting randomness from highly-biased RNG

texts:
I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source.

Will it be helpful to XOR 350 bits with jump 128 bits, e.g. $n_0\oplus n_{128}\oplus\dots\oplus n_{128*350}$ or maybe some more times?

EDIT:
The source is SRAM so the bits are fairly independent.
Distribution of min-entropy is on the histogram. The first bar is like 500 bits, but the others are much lower so I cut the first one.


texts: What is the significance of $\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$ in Asmuth–Bloom threshold SSS?

texts:
In this paper by Asmuth–Bloom on threshold SSS, the algorithm is as follows:

Shares Distribution

To distribute $n$ shares of a secret $K$ among the set of participants
$P = \{ p_i : 1 ≤ i ≤ n\}$, the dealer D does the following:

A set of integers $\{ p, m_1 < m_2 < · · · < m_n \}$, where $0 ≤ K < p$, is chosen subject to the following conditions:

$\gcd(m_i , m_j)=1$ where for $i\neq j$

$\gcd(p , m_i)=1$ ,for all $i$,

$\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$
Let $M =\prod \limits_{i=1}^{t}m_i$.
The dealer computes $y = K+ap$, where $a$ is a positive integer generated randomly subject to the condition that $0 ≤ y < M$
The share of the $i^{th}$ participant,$1 ≤ i ≤ n$, is $y_i = y~ mod ~m_i$

Secret  Construction

Assume $C$ is a coalition of $t$ participants to construct the secret.
Let $M_C =\prod \limits_{i=1}^{C}m_i$

Given the system $y \equiv y_ i \mod m_ i$  for $i \in C$, solve $y$ in $GF(M_C  )$ uniquely using the CRT.
Compute the secret as $K = y \mod p$

According to the CRT, $y$ can be determined uniquely in $GF(M_ C)$. Since $y \lt M \leq M_C$, the solution is also unique in $GF(M)$.

Could you please explain significance of
$\prod \limits_{i=1}^{t}m_i > p \prod \limits_{i=1}^{t-1}m_{n-i+1}$ in Asmuth–Bloom threshold SSS?


texts: Does Benford's law hold against encrypted data?

texts: If I can assume that the output of a block cipher like AES is a PRandom distribution, can I assume that Benford's law will hold if I partition that output into integer data?


texts:
What types of algorithms that are capable of signing a message are out there that run on a physical level, e.g. lacking the infrastructure of a standard PC, no memory, processor or motherboard in the traditional sense?

I'm curious whether there are some strong really low level implementations (if these statements don't contradict each other)


texts: Is it possible to combine true streaming with AEAD?

texts: It seems there is a difference between "streaming" in cryptographic sense (as in CTR) and "streaming" in general programming sense (as in "accept a file larger than RAM from socket and save it on disk"). It shows when people try to apply AEAD (or in general authenticated encryption) schemes to something like Java's InputStreamReader (e.g. authentication is broken or not enforced enough). To do streaming in a latter sense it would be very useful to have AEAD scheme that provides "intermediate" authentication, that is, for block of encrypted message it should be known if it's genuine up to the point. Granted, later we can discover that there were some meddling and revert all the work already done (or just skip affected part), but it would be simpler compared to what is, in a sense, two-stage scheme (receive an entire message and only then verify it). Is there such schemes out there? Am I missing something that makes the proposed arrangement terribly insecure?


texts: Purpose of hashing last block in Merkle-Damgård?

texts: Is hashing the last block in the Merkle-Damgård necessary in preventing collisions? i.e.  What if I just outputted $z_B || L$, where $z_i$ is the hash of the last block of the message, L is the length of the message and B is the number of blocks, instead of $H(z_B || L)$?


texts: When attacking keyed algorithms, how is it known when the output is correct?

texts:
I've been reading a little bit about cryptanalysis, and I'm wondering how attacking algorithms that work on keys is performed.
It's obvious how algorithms like MD5 are attacked, in pseudocode:
hashed = 'blablabla'
while guess != hashed:
    guess = md5(inc(guess))
print('{hashed} is {guess}')

But I can't see how you'd perform a similar attack on, for example, XTEA. To attack it through the deciphering process you'd have nothing to compare the guess to, and to attack it through the enciphering process you'd have to guess if  encipher(key, data) == enciphered_data, i.e. guess both the content of the data and the key, which seems like it would take an incomputable amount of time, especially if data is, say, a 64-bit block.
Is brute-forcing such a large space truly the only option?


texts: Scrypt as a KDF with one-time high-entropy input

texts:
I'm looking at using Scrypt as a KDF. Assume the following:

the input will always be high-entropy random bytes generated by a CSPRNG
the length of the input can vary from between 8 to 32 bytes
the input-bytes are never re-used for generating another key
the salt is also generated by a CSPRNG
dklen (aka, output key length) can var from 64 bits to 1024 bits, depending on the algorithm for which the key is being used)
the cpu/memory/parallelization difficulty factors are user-defined, obviously with higher values resulting in higher security, but more processing time.  These factors are set at the client's discretion
all key-expansion happens client-side
please don't be concerned with the practicalities of implementing such a system, it's beyond the scope of this question

Assuming that brute-force attacking a KDF is faster than brute-forcing the key itself, I understand that more KDF processing-time equates to more protection from such attacks.  However, I've seen recommendations such as HKDF and KBKDF (discussed here), however I'm hesitant to use one of these protocols for various reasons (they're less-widely used/recognized, there isn't a lot of source code around for them, etc).  Would Scrypt be a good fit for this scenario?  Does it have any weak points, in which other protocols would be stronger?


texts: In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?

texts:
In the 1978 RSA paper, it is recommended, among other things, to choose primes $p$ such that $(p-1)$ has a large prime factor $u$. This was motivated by Pollard's p-1 algorithm. Further, the authors state:

  Additional security is provided by ensuring that $(u−1)$ also has a large prime factor.

What was the motivation for that?


texts:
My software uses a TRNG (entropy source) which is part of an MCU.

A check of random numbers generated by my software, carried out by a testing authority revealed a problem, which I have to examine now:

They ran my random numbers against NIST Test suite:
https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-22r1a.pdf

The Non-overlapping Template Matching Test failed.

It is looking for the number of occurrences of given bit sequences in a random string and compares those numbers with the expectation values. The test statistics $\chi^2$ is a measure, how well the observed number matches with the expected number of occurrences.

A big number of N*M bits is divided into N blocks of each M bits.
The pattern has length m.

The mean value of hits is

$\mu = \frac{M-m+1}{2^m}$

The variance

$\sigma^2 = M (\frac{1}{2^m} - \frac{2 m - 1}{2^{2m}})$

The test statistic is

$\chi^2 (obs) = \sum_{i=1}^{N} \frac{(W_i-\mu)^2}{\sigma^2}$

with i iterating over all N blocks and $W_i$ denoting the number of matches in block i.

The p-value is

$p = 1-\Gamma_{inc}(\frac{N}{2}, \frac{\chi^2 (obs)}{2})$
where $\Gamma_{inc}$ is the incomplete gamma function.

If the computed P-value is < 0.01, then conclude that the sequence is non-random.

I implemented this test on my own and got with a test run of 80,000 random bytes:

N=8, M=80000

A good pattern would be:

expected occurrences of 1110000 in random binary of length 80000:624
W[0]:657
W[1]:633
W[2]:620
W[3]:608
W[4]:659
W[5]:610
W[6]:607
W[7]:628
OK: P=0.697173010616

Most patterns are good, but some are very bad, like:

expected occurrences of 1110110 in random binary of length 80000:624
W[0]:554
W[1]:618
W[2]:715
W[3]:648
W[4]:602
W[5]:619
W[6]:683
W[7]:611
*****NOT OK: P=0.000101720454752

or

expected occurrences of 11000100 in random binary of length 80000:312
W[0]:310
W[1]:352
W[2]:297
W[3]:325
W[4]:332
W[5]:376
W[6]:327
W[7]:318
*****NOT OK: P=0.00404698900088

Now the question:

As I interpret the P value, it is the probability for getting the observed test statistics given the sequence is random. So P=0.000101720454752 would be extremely unlikely, so the test fails.

Most interestingly, when I increase the block size by a factor of 10 (800,000 random bytes)

N=8, M=800000

I get only good results on all patterns.

What does it really mean now? Are my random numbers really "bad" or is that a statistical effect which "must" happen from time to time? Anyway the test fails...

And why is it OK for the ten-fold data-set?

I would appreciate any comments.
Thanks.


texts: Generating secure short activation code for offline applications

texts:
My application is as follows

User has a hardware system (with an unique ID) that does not have
connectivity but has a keypad for input.
To make the hardware operational, the user has to go to central authority and get a code (7-8 digits) in exchange for money
The user enters this code through the keypad and the system is operational for a certain period of time after which the user has to repeat the process.

Requirements

The code has to be short and numeric (7-8 digits)
The code should work for a specific hardware only (unique to each user)
To keep things simple at the beginning, we can assume that every code generated will run the hardware for the same amount of time (as opposed to codes which give the time for which the hardware should run)
Availability of standard libraries to implement this.

Here's what I've done so far

I thought of using the ISO 7064 Mod 97,10 formula to generate codes (in the central authority) and the use the same formula on the hardware to see if it is valid. Based on this post. However, this means the same code is not unique to a hardware system. This is just an error detection algorithm.
I can generate the code using the above formula and use RSA with digital certificate. However, the output will be too long correct? Besides, this means that the central authority has to have access to public keys of all hardware systems.


texts: How to design a practical and secure MAC scheme?

texts:
I am sorry, but I need to introduce some concepts which are not directly related to cryptography to make myself clear, I hope I won't stun you with this ... (I'd rather explain  it here than redirect the reader to an even more stunning external link ;) )

UBI Properties

I am working on Flash memory devices. These devices are divided into blocks of a quite significant size (from a few kilobytes to a few megabytes). The blocks, called eraseblocks, have a major property : they wear out. Once data has been written to a specific location within an eraseblock, the whole block must be erased to overwrite this data.
This erasure operation can only be performed a finite number of times before the block becomes worn and unusable (this number varies between 103 and 105 on nowadays chips).

Multiple solutions handle this problem, by reserving some space at the beginning of each block to manage them. UBI (Unsorted Block Images) is one them and is the one I am currently using. UBI writes two header fields at the beginning of each block which contain some information about it and extra things that it needs to manage the blocks. Among these things, a few are worth to mention :

A 32-bit long logical eraseblock number
A 32-bit long volume ID
A 64-bit long sequence number

UBI can divide the Flash memory in partition-like entities called volumes. Each volume has an ID (volume ID) and a size expressed in eraseblocks. The blocks of a volume are numbered from 0 to this size limit (this is the logical eraseblock number). UBI makes a difference between a logical block (LEB) and a physical block (PEB). The former is a block of a volume and the latter is the physical block on the memory device itself on which is written the logical one. For instance, the block numbered 0 of the volume numbered 0, i.e. LEB(0,0), can be stored in any PEB at a given time, say PEB(10). UBI moves these logical blocks to various physical ones for an efficient wear-out management. Since some bad things can happen, any time UBI has to map a specific LEB to a PEB (by writing the block headers in the targeted PEB) it updates a global sequence number which is integrated in one of the headers.

Encryption concerns

I want to perform on-the-fly encryption when reading or writing to the memory. I already have the pure encryption pattern. It involves AES-128 encryption on a UBI volume basis.

Now, I want to combine it with a MAC scheme in order to authenticate that the data on the flash was not forged. The thing is : how can I cook up a reliable scheme for this purpose ?

Here are my thoughts on this subject : using HMAC-SHA1 (eventually truncated for memory space constraints), I can produce a tag that authenticates a given PEB(p) < - > LEB(v, l) mapping, using the encryption key K for the volume v. The tag should be produced in this way

  HMAC-SHA1(v | l | sqnum | p, K)

This pattern has some advantages :

It is easy to compute to perform checking operations
It prevents a malevolent user to corrupt the volume with any other method than the two following : erasing the physical block p or overwrite the physical block p (which involves erasure of the block), which can only be performed up to 105 times.

I came up with this design because I find it practical for the uses of UBI I am making, but I have no idea of the security flaws it might introduce or solve in the whole thing.

Actually, I have a few questions. First, is my design safe ?
And in any case, what would you suggest ?
I am aware that last one is quite an open question, but I think there might be existing patterns that could be customized to fit my use case.


texts: CryptoJS.AES result always has same first few bytes?

texts:
When using this very minimal CryptoJS AES example:

(Live demo here: http://jsfiddle.net/RwnYL/)

Note that the Key, IV and Salt are always different. But the output (here displayed as Base64) always starts with the same 10 characters. I'm probably missing something, but why is this?


texts: How to prove that the given encryption scheme have ciphertext indistinguishability for all PPT adversaries?

texts: I am not sure how to prove that the given two scheme is perfectly indistinguishable for all PPT adversaries!


texts: MAC forgery using the DES's Complementary Property

texts:
I've started reading on MACs and working on a problem where given a MAC construction as $H_0=IV$ and for every $i>0$ $H_i=H_{i−1} \oplus E_{M[i]}(H_{i−1})$ and the tag is $(IV,E_{k_1}(H_ℓ))$, I would like to show for a DES as a cipher this construction does not give message integrity.
The way I'm thinking of approaching this is, I can start by using the complementary property of DES cipher, to show that for message $M_1$ given that $H_1=H_{0} \oplus E_{M[1]}(H_{0})$ is equal $-H_1$ for message $-M_1$ (complement of message $M_1$). Hence, under the chosen message attack with given construction, I can perform existential forgery. Based on my reading and the details defined in Coursera I think I almost got the concept but not sure if I'm on right track?


texts: Should I use SHA256 or Blake2 to checksum and sign scrypt headers?

texts:
I use scrypt as a key derivation function (not to store passwords). To pass around the detached key header I use the standard encoding as implemented in Colin Percival's scrypt implementation (scryptenc.c#L224).

The original scrypt key header encoding

binary encodes an algorithm identifier ("scrypt\0"), logN, r, p and salt into a 48 bytes header
checksums these bytes using SHA-256 and appends the first 16 bytes of the checksum to the header
signs the concatenated work factors and checksum using HMAC SHA-256, appending the signature to the header

The resulting 96 bytes form the key header.

My requirements

I rarely need to derive keys, probably a dozen times per day.
Keys are derived from human-generated passwords
My application runs on both 32-bit systems (e.g. smartphones) and 64-bit desktops.
My project is in Go which supports both SHA-256 and Blake2
the Go implementations of Blake2s and Blake2b don't provide 128bit checksums

Would it make any difference for me to use Blake2 for checksums and signing instead of SHA-256? Is there any difference in security?

If I use Blake2-256, would I cut off 16 bytes for the checksum (this seems to be not recommended), use 32 bytes or just keep it as is using SHA-256?

Thanks!


texts: Where can I find test vectors for the PRESENT cipher with a 128-bit key?

texts: Where can I find the test vectors for the PRESENT block cipher with a 128-bit key?


texts: A bit-sliced implementation (or the algebraic normal form) of the two FIDES S-Boxes

texts: I want to see a bit-sliced implementation of 5-bit and 6-bit S-Boxes of FIDES or, at least, a representation of these two functions in algebraic normal form. Where can I find it?


texts: Does hashing a compromised rng and a secure rng give cryptographically secure random output?

texts:
If I have a compromised random source and a cryptographically secure one, is hashing them together makes a cryptographically secure random output?

Example:

The compromised random output: ABC

The cryptographically secure random output: DEF

Hashing them together:

printf 'ABCDEF' | sha512sum
569350085b223ba854dfc5d607643ceb85e4607e46e5a9ad3696f898e29d8a3fe22610956167cefb7e2ba769e740f94b31e4e3c52195ba65e64ba40d82343591

Is this hash a cryptographically secure random output?

If I am not clear enough, please ask and I will update the question.


texts: How to prove identity in this peculiar case

texts: Lets say Alice wrote a book under the name Alyssa. The only other person who has read the book is Bob. Bob then publishes the same book but under the name Bobby. Is there a way for Alice to prove that the book was originally published under the name Alyssa?


texts: Can one extract a private key from a series of carefully constructed signed messages?

texts:
In a situation in which A handles a message P for B to sign using ECDSA, and that event repeats itself many times, is there a way A can discover B's private key?
A can carefully choose what will be P every time, and be confident that B is always the same person using the same key to sign.
Does it change anything if P is always a string of 32 bytes that B won't hash before signing, he will just sign directly -- as it would do with a message he had hashed himself.


texts: Why don't we use Blowfish if it hasn't been cracked?

texts:
Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but why? AES has many vulnerabilities, such as padding oracle attacks and power-consumption analysis, but Blowfish doesn't have any well-known issues. And Blowfish can take a key up to 448 bits, which is larger than AES's 256 bits. Is there something I am not understanding? It's been under public scrutiny for the longest with the least issues.
Perhaps it is because of Blowfish's small block size?
Context: Is it safe to use Blowfish to encrypt strings of less than 30 characters?


texts: Is there a name for strong human-computable encryption schemes? Are there definitions for "human-computable"?

texts:
Background:
There is some interest in encryption schemes meant for humans to perform without computational aid. (Relevant questions here, here, and here.) People often cite the VIC pen-and-paper cipher, the Schneier Solitaire cipher, or more recently the LC4 cipher. These would be useful in the context of, say, two people using communication devices where one or both may be monitored.
I've seen these referred to as pen-and-paper ciphers, human-computable ciphers, and as low-tech ciphers. They've also been compared to historical ciphers.
Question:
I could not find any lit-reviews for these schemes. Generally, I'm wondering if this is a field, and how much it has been explored. More specifically, is there a name for this class of modern, strong, human-computable encryption schemes? Have there been any attempts at defining, describing or measuring what makes a cipher "human computable"?


texts: Effect of $L_n[1/4,c]$ integer factorization on RSA-2048

texts:
Using the L-notation, integer factorization of an integer $n$ has the best known complexity of $L_n[1/3,c]$ using general number field sieve. Would discovery of an algorithm with complexity $L_n[1/4,c]$ be of any consequential significance to security of RSA-2048? If my computation is correct, for $c \approx 2$, it shows the complexity is reduced from $10^{36}$ to $10^{23}$, which seems doable with today's hardware. But I'm not confident in my computation or my assumptions about the capabilities of today's hardware.

Edit: here are my computations and assumptions: $\log(2^{2048})\approx1420$. $L_n[1/3,2]\approx \exp [2 (1420)^{1/3} (\log 1420)^{^{1 - 1/3}}]\approx 10^{36}$. $L_n[1/4,2]\approx \exp [2 (1420)^{1/4} (\log 1420)^{^{1 - 1/4}}]\approx 10^{23}$. Assuming $10^9$ possibilities can be tested every second and there are $10^6$ such processing units, it takes 3 years to crack RSA-2048: $10^{23} / (10^{9}\cdot60\cdot60\cdot24\cdot365)\approx 3 \times 10^6$.


texts: If I want Integrity and Authentication AND Non-Repudiation, can the Digital Signature be based on the MAC?

texts:
Let's say I'm making a digital signature like this:

hash = hash(message)
digital signature = encrypt_with_private_key(hash)

where the private key is Alice's private key from a secure public-key cryptosystem.

And I'm making a MAC like this:

MAC = hash(message + some_secret_key)

And I then send both of these to my friend, encrypted using AES or some other cipher.

I feel I'm just creating work for him.

Could I simplify things like this?

MAC = hash(message + some_secret_key)
digital signature = encrypt_with_private_key(MAC)

Please tell me the pros and cons of this.


texts:
I have come across many paper that applies Patarin’s H-Coefficient Technique in various cryptographic securities (KPA, CPA, CCA,...).

I am asking kindly if someone could explain it simple with example so i can absorb the method to apply it for different cryptographic primitives.


texts: Encryption design for user data with service access

texts:
I'm looking to provide users with a way to give a service sensitive information, which the service can freely use up until the user decides otherwise. I want to encrypt the data at rest (and of course, in transit).

My thoughts right now run along like so... when the user signs up for the service, they provide their public key. The service generates a public/private pair for this user's account, too, and combines the user's public key with the new service-user public key to encrypt the data. I'm not sure what encryption scheme or tooling would be appropriate here, because I want to meet the goal that the service can now decrypt the data without the user's private key (so only using the service's own private key(s) and maybe the user's public key if it's still necessary).

The other half of the puzzle for me is that if there is a way for the user to stop access, I'm not aware of it. If the user regenerates their keys, that doesn't change how the data is already encrypted. Maybe that part just comes down to trusting the service will delete or re-encrypt when the user notifies of a new public key?


texts: Difference between when select x from $\mathbb{Z}_{p-1}$ and $\mathbb{Z}_p$ in discrete logarithm Problem?

texts:
Reading "Security Arguments for Digital Signatures and Blind Signatures" paper, I confused by some questions.

Q1. when it refers to "El Gamal signature scheme",

The key generation algorithm: it chooses a random large prime $p$, of length $n$ polynomial in $k$, and a generator $g$ of $(\mathbb{Z}/p\mathbb{Z})^*$, both public. Then, for a random
secret key $x \in \mathbb{Z}/(p − 1)\mathbb{Z}$, it computes the public key $y = gx \mod p$

why $x$ select from group $\mathbb{Z}_{p-1}$,but not $\mathbb{Z}_p$? what is the difference?


texts: Why is hybrid encryption more effective than other encryption scheme?

texts:
Currently I am learning about Hybrid Encryption but I was not able to find any good study material.

Below is my understanding:

One of the reason why we use Hybrid Encryption because public-key cryptosystems often rely on complicated mathematical computations and are thus generally much more inefficient than comparable symmetric-key cryptosystems. A hybrid cryptosystem is one which combines the convenience of a public-key cryptosystem with the efficiency of a symmetric-key cryptosystem.

Steps of Hybrid Encryption:

  To encrypt a message addressed to Alice in a hybrid cryptosystem, Bob
  does the following:

Obtains Alice's public key.
Generates a fresh symmetric key for the data encapsulation scheme.
Encrypts the message under the data encapsulation scheme, using the symmetric key just generated.
Encrypt the symmetric key under the key encapsulation scheme, using Alice's public key.
Send both of these encryptions to Alice.

  To decrypt this hybrid ciphertext, Alice does the following:

uses her private key to decrypt the symmetric key contained in the key encapsulation segment.
uses this symmetric key to decrypt the message contained in the data encapsulation segment.

I am pretty much understood how Hybrid Encryption works but I don't see how this is better than Public Key Cryptography.

Question :- Why is Hybrid Encryption superior?

It is doing an extra work for generating a symmetric key by using Alice's public key. This will also involve complex mathematical computation.
Along with sending data here it also needs to key along.
Alice also needs to first decrypt the symmetric key and then decrypt the message. It almost seems like a double work.

I found some answers here but still it seems incomplete link1 and link2


texts: Fastest multiplication algorithm for efficient exponentiation in C++?

texts: First I apologize if this question is better tailored for SO, but since I'm using the method for crypto stuff, I thought I'd ask anybody that might know here. Karatsuba algorithm does a pretty good job, but maybe there is something that works better.


texts: Is McEliece secure with non-binary Goppa codes?

texts:
A binary Goppa code with codewords of length $n$ bits that can fix $t$ errors with a polynomial over $GF(2^m)$ can encode $k = n - mt$ bits long data.
That is one needs to add $mt$ check bits to fix $t$ bits.
This means at most 1/m-th of the codeword can be filled with errors.
On the other hand if you work in a field of $GF(p)$ where $p$ is some prime, to fix $t$ wrong symbols you need to add only $2t$ more symbols (as the polynomial for the generic case needs to have twice degree). So $k = n - 2t$. And in the most extreme case half of the codeword can be error.
If I understood correctly "information set decoding" relies on finding a $k$ symbol long subset of the the transmitted data that doesn't contain errors. So this means it's an advantage to be able to introduce more errors in the message. And it seems the general Goppa codes are better at doing that.
Is there any particular reason we use binary Goppa codes instead of general Goppa codes? Does binary codes defend better from other kinds of attacks?
EDIT: I'm also interested in the case where the code's polynomial is over $GF(2^m)$, but the codeword's elements are not over $GF(2)$ but also over $GF(2^m)$. It's tempting to use a field like $GF(2^{16})$ so the matrix and polynomial elements are represented by "short words" and the transition to bits part is are omitted so we can do all the stuff within a single field, the generator matrix's elements are also short words. And the input is also processed as 2 byte batches: easier and faster vectorized implementation is possible.
EDIT2:
In information set decoding we are looking for a subset in the ciphertext that are not in error. In an $[n, k, t]$ code. We can pick k elements ${n \choose k}$ way and the number of possible correct guesses is ${n-t \choose k}$. So the chance of stumbling upon an error free sequence is ${n-t \choose k}/{n \choose k}$.
Now let's use a generic Goppa code over $GF(1021)$. Let $n = 725$, $t = 145$ and $k = 725 - 2*145 = 435$
So calculate ${725-145 \choose 435}/{725 \choose 435} \approx 6.953 \cdot 10^{-71}$. Which is about $2^{-233}$. So 233 bits of security.
Elements in $GF(1021)$ can be represented in 10 bits giving us a key size of 3153750 bits or about 400kB.
With binary Goppa-codes more check symbols needed. Consider code over the extension field $GF(2^{13})$ with parameters $n = 5600$, $t = 172$, so $k = 3364$
${5600-172 \choose 3364}/{5600 \choose 3364} \approx 4.373 \cdot 10^{-71}$.
For similar security levels. But the matrix is now larger than 2 MB.
Hence my question.


texts: How to calculate the order of the subgroup?

texts:
Given a curve with points over GF(p), a subgroup of prime order q and a co-factor h.

How do I calculate the size of q which is also the modulus?

I was thinking q = p/h


texts: what are DP and DQ in Encryption by RSA in c#

texts:
I want to know about these tags in RSA Encryption by private Key. when I use this code:

using (var provider = new RSACryptoServiceProvider(keySize))
    {
        publicKey = provider.ToXmlString(false);
        privateKey = provider.ToXmlString(true);
    }

It create this xml:

<RSAKeyValue>
   <Modulus>…</Modulus>
   <Exponent>…</Exponent>
   <P>…</P>
   <Q>…</Q>
   <DP>…</DP>
   <DQ>…</DQ>
   <InverseQ>…</InverseQ>
   <D>…</D>
</RSAKeyValue>

I know that $p$ and $q$ are the primes number, but I dont know what are DP and DQ and why we need to InversQ and else...

is anyone explain these items for encryption?


texts: Fully homomorphic encryption with polynomials

texts:
I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea.

Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{Enc}(m)$ be a polynomial $P(x)=a_{p-2}x^{p-2}+\ldots+a_1x+a_0$ with random $a_{p-2},\ldots,a_1$ and $a_0$ such that $P(x_0)=m$; $\mathrm{Dec}(P):=P(x_0)$ (everything is modulo $p$). This construction gives FHE because $(P_1P_2)(x_0)=P_1(x_0)P_2(x_0) \bmod(x^{p-1}-1)$ and $(P_1+P_2)(x_0)=P_1(x_0)+P_2(x_0).$

Is this idea reasonable or I missed some pitfalls?


texts: Are there any disadvantages of using libsodiums helpers for en-/decoding/comparision instead of the native ones?

texts:
Libsodium has some helpers, which allow hexdecimal decoding, encoding and also constant-time string comparison.
So if you use the php binding libsodium-php you obviously also have the native php implementation of bin2hex and hex2bin. The libsodium replacements were introduced because the native implementations are not timing-resistent. So for sensitive data this should be used.

But if you have a library/project where you use libsodium anyway are there any disadvantages of using libsodiums functions even in places where this would not be necessary?
I mean one advantage clearly would that you can prevent to forget to use these timing-save implementations in cases where it is important if you just use it everywhere.


texts:
I am trying to factor few integers that are each between 115 and 135 digits long. I was wondering if anyone knew of any efficient methods or any programs that I could use to find the two primes $p$ and $q$ for $n=pq$.

I was thinking of using quadratic sieve but I don't know if there is any other way. Plus I don't know how I would write the algorithm on any program. Any input is much appreciated.


texts: What are some major applications of Identity based signatures (IBS) in real life?

texts:
I read about Identity Based Signatures this week. I was thinking about its application in major fields like IoT etc. Are there any such applications?
For example: Multi-signature have application in cryptowallets. I am trying to see are there any major application of IBS like this.
Thanks.


texts:
Have tried to create simplest example. A,B,C,D are 32-bit unsigned, as is k[4]. P is an expansion type p-box of 256 "random" 32-bit values. Assume key-whitening and multiple rounds/keys

#define b0(u) ((u)&0xff)
#define b1(u) (((u)>>8)&0xff)
#define b2(u) (((u)>>16)&0xff)
#define b3(u) (((u)>>24))

// rounds...
A += P[b0(D)^b1(D)^b2(D)^b3(D)] ^k[0];
B += P[b0(A)^b1(A)^b2(A)^b3(A)] ^k[1];
C += P[b0(B)^b1(B)^b2(B)^b3(B)] ^k[2];
D += P[b0(C)^b1(C)^b2(C)^b3(C)] ^k[3];
k+=4
// end rounds

Also, is there a term for this specific method? (besides just "weak")


texts: How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?

texts:
I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement process take pace in Virgil E3Kit SDK. The workflow they describe in SDK document is:

If A want to send messages with end-to-end encryption protection to B, so the steps are:

A generate her key pairs (one Public Key is published on Virgil Card Services and
one Private Key is saved securely on her own device).
B generate his key pairs.
A looks up for B's Public Key on Virgil Card Services and
uses B's Public Key to encrypt the messageA-B.
When B is received the messageA-B, he use A's Public Key to verify the messageA-B's
integrity and he uses his Private Key saved on his device to decrypt the messageA-B.

In the document page, Virgil shows algorithms that are used in Virgil E3Kit, in which:

They uses PRNG for key generation
They uses KDF2 for key derivation
They uses X25519 or ECDH for key exchange

I think both X25519 and ECDH need a new random shared secret for each secure communication session. How does Virgil E3Kit do that while both parties of communication just only need to generate their key pairs when they first register account, then they can start using end to end encryption with these key pairs forever? Virgil E3Kit uses asymmetric key exchange with X25519 or ECDH, but after that they use symmetric encryption with AES GCM to encrypt messages in endpoints.

So my questions are:

How can Virgil E3Kit SDK use symmetric key for symmetric encryption in endpoints, while they use asymmetric key exchange? And could you please illustrate and explain for me about this process?
And, what role PRNG, KDF2 (key derivation function) and X25519 or Ed25519 (Elliptic Curves) play in this key agreement process?


texts:
I want to calculate the S-box for AES. But I have a problem with the multiplicative inverse step. For example, the inverse of 95 is 8A.

I don't know how to get this result. How is the multiplicative inverse computed?


texts: Purpose of leading zero in PKCS1-v1_5 padding

texts:
According to this document the padded message has the following structure:

$EM  \;= \; 0x00 \; || \; 0x02 \; || \; PS \; || \; 0x00 \; || \; M$

What is the purpose of this null byte at the beginning of the message?

After OS2IP decoding (also described in the document) to convert the message to a "bignum" I would expect this byte to be discarded, since a most significant byte of zero does not change the value of the number.

Also, when decoding the message, the standard document expects this zero byte to be present in the ouput too. Why should a bignum routine preserve a zero leading digit?

Instructions for decoding the message are given in the document and quoted below.

  If the first octet of EM does not have hexadecimal value 0x00, if the
  second octet of EM does not have hexadecimal value 0x02, if there is
  no octet with hexadecimal value 0x00 to separate PS from M, or if the
  length of PS is less than 8 octets, output "decryption error" and
  stop.


texts: converting to rank one constraint system

texts:
I was reading Vitalik Buterin's post on ZK-snarks and I need some clarification
on some points . since there aren't that many posts and articles regarding the subject , I had no choice other than turning to stackexchange .
here is the post :
https://medium.com/@VitalikButerin/quadratic-arithmetic-programs-from-zero-to-hero-f6d558cea649

first I need to know what does he mean by saying " There is a standard way of converting a logic gate into a (a, b, c) triple depending on what the operation is " ?   is he pointing to a specific topic in math ? why triple ? googled R1CS . not that many results came up.

secondly , why use the variable "one" . why assign the variables in a particluar order which is : "one" "x" "out" ... etc .  why 3 vectors ? and HOW does that exactly work ? ESPECIALLY assigning the variables at the 3rd gate is a bit not clear .

I know these are too many questions and even though I really appreciate any help that I can get , yet I don't expect you to answer every single question.however , if you could point me to the topics,keywords,etc... which describe the methods used therein ,perhaps I could work my way to the end of this article .
i wish someone would have wrote a complementary post on this article instead
of repeating the sudoku example over and over again . all you can find is either
really heavy math papers or waldo analogy . nothing in between .

p.s : i have read posts on zcash blog. still not clear on R1CS and QAP . and scientific papers are too math heavy ...!
thanks in advance


texts: Secure implementation of public key cryptography

texts:
Reading online I've found out that for example the RSA implementation that you usually find on textook is not secure.
Where I can find some secure implementation of algorithm such as RSA, ECDH, ECDSA?

(written in C or C++ or python)


texts: Is it sufficient to seed a pseudo-random number generator (PRNG) with two different values to be able to claim that we now have two independent PRNGs? Or is it that we have to use two functionally different generators for that?


texts: Why DDH is easy if a pairing function exists?

texts:
When I look at some demos which demonstrate that DDH is easy if a pairing function $e$ exists, I usually see if $e(g,g^c)=e(g^a,g^b)$. Then we can know that $g^c=g^{ab}$, but why is this so? How do we remove the $e$? Let's imagine this is a symmetric-key cypher problem and $e:G_1 \times G_1 \rightarrow G_2$.

For example: here.


texts: Why does l'Ecuyer reject p-values close to 1?

texts:
When applying several tests to a given generator, p-values smaller
than 0.01 or larger than 0.99 are often obtained by chance even if the
RNG behaves correctly with respect to these tests (such values should
normally appear approximately 2% of the time). In this case,
suspicious values would not reappear systematically (unless we are
extremely unlucky).
(Source,
page 6.)

Here's result where the test MaxOft AD produces a p-value close to 1 and so the RNG fails that test.
========= Summary results of SmallCrush =========
[...]
The following tests gave p-values outside [0.001, 0.9990]:
[...]
Test p-value
----------------------------------------------
[...]
6 MaxOft AD 1 - 3.6e-06
[...]
----------------------------------------------
All other tests were passed
[...]

NIST SP 800-22 calls such values "perfect randomness" (page 1-4, that is, PDF-page 16).

If a P-value for a test is determined to be equal to 1, then the
sequence appears to have perfect randomness. A P-value of zero
indicates that the sequence appears to be completely non-random.

So, what's wrong with a p-value close to 1?


texts: Prove that secure authenticated encryption system composed with itself is secure

texts:
Suppose $(E,D)$ provides authenticated encryption with key space $K$. Define $(E',D')$ with key space $K^2$ as follows:
$$
E'((k_1,k_2),m) = E(k_2,E(k_1,m)) \\
D'((k_1,k_2),c) = \begin{cases}
D(k_1,E(k_2,c)): & D(k_2,c) \ne \bot \\
\bot & \text{otherwise}
\end{cases}
$$
How to construct a ciphertext integrity attacker on $(E,D)$ given one on $(E',D')$?
I get stuck at matching the keys. I know the attacker on $(E',D')$ can give me a ciphertext which decrypts successfully. However, under what key? In the definition of ciphertext integrity the key is chosen at random by the challenger before the attacker submits its allowed queries. Now I'm supposed to construct an attacker on $(E,D)$ which has a non-negligible advantage against the challenger which starts its algorithm by choosing a random key from $K$. I suppose there's some nuance in the definitions that eludes me, allowing to somehow relate this key to the key from $K^2$ for $(E',D')$.


texts: Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?

texts:
BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such signatures in a smart contract, using the new precompiled contracts for pairing operations (pairing equality, scalar multiplication, and point addition) released with Byzantium.

Verification of a BGLS signature of $n$ signers is done through checking equality $$e(g_1, σ) == \prod_i^n e(v_i, h_i)$$
where:

$e : G_1 \times G_2 \rightarrow G_T$ is a bilinear pairing/mapping
$g_1$ is a generator of $\mathbb{G}_1$
$\sigma$ is the aggregate signature
$v_i$ is the public key of signer $i$
$h_i$ is the hash of the signed message of signer $i$

Question:
Does anyone know whether we can formulate the equality above in terms of only three operations: point additions, scalar multiplications, and equality checks?

Thoughts:
What I was thinking is that we could rewrite the equality as $$e(g_1, σ) ==  e(\prod_i^n v_i, \prod_i^n h_i)$$
but I have not been able to prove whether that is correct.

Background:

Point additions, scalar multiplications, and equality checks are currently the only operations supported in Ethereum.
I asked a similar, but more Solidity-specific, question on the
Ethereum StackExchange.
Another user posted a question on verifying BLS signatures (which is essentially a BGLS signature for one signer). My question can be seen as a follow-up on that.


texts: Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

texts:
Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme:

generate random seed z using n - 1 bits - where n is the size of the modulus N
interpret the seed z as unsigned number and encrypt using the public key e: w = RSA(e, z)
derive a session key and IV using s = KDF(z, "skey") and iv = KDF(z, "iv")
encrypt the plaintext message m' using (c, t) = AEAD(s, iv, ad, m), where t is the authentication tag and ad is (additional) authenticated data
output w | c | t

Would it be advantageous to include the value of w - the encrypted key seed - in the authenticated data ad?


texts: Is it possible keep the "one wayness property" of certain one way function in Merkle-Damgård construction? I'm asking this question because according to Collision-Resistant hashing: Towards making UOWHFs practical the target collision resistant property fail in Merkle-Damgård construction.


texts: Common pitfalls of session key activation?

texts:
Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly including key confirmation. Now they want to use the new $K'$s for the first time and on all subsequent messages.

TLS has specific activation steps involving the messages ChangeCipherSpec and Finished. But in the context of a bandwidth-limited network, such a talkative protocol may not be desirable.

Should I be aware of other protocols that have well-discussed activation routines?
Are there common pitfalls to think of when activating newly established symmetric session keys?

Intuitively I would use something like:
$I$ sends the activation message to $R$ protected by the old keys.
Alternative 1: $R$ replies ok using the new keys. Subsequent messages use the new keys.
Alternative 2: $R$ replies error using the old keys. Subsequent messages use the old keys.

Or more formally:
$n$ - identifier of the previous key establishment process implying an identifier for the new keys $K'$
$H(K, M)$ - HMAC of message $M$ using key $K$

$I \rightarrow R: (I, R, n, Activate)_{K_{enc}}, H(K_{auth}, I||R||n||Activate)$
$R \rightarrow I: (R, I, n, ActivateOk)_{K'_{enc}}, H(K'_{auth}, R||I||n||ActivateOk)$
or
$R \rightarrow I: (R, I, n, ActivateFail)_{K_{enc}}, H(K_{auth}, R||I||n||ActivateFail)$


texts:
I'm confused about whether the following hash function is collision resistant.
$x \sqsubseteq y $ denotes that x is equal to y or x precedes y.

$ H:\{0, 1\}^* \rightarrow \{0, 1\}^n$

If $x \sqsubseteq y $ then $h(x) \sqsubseteq h(y) $

Does this mean H is collision resistant?


texts:
We have a transmission system such that a message $m\in[0,1]$ is converted to $N$ symbols $S=[s_1,s_2...s_N]$ and $s_i\in[1,2,3,4]$. The obfuscation of the symbols is as follows:

A key $K1$ seeded to random number generator such that the output of RNG $G=[g_1,g_2,...,g_N]$.
The encrypted symbol $X=[x_1,x_2...x_N]$ and $x_i=(s_i+g_i) \, \mathrm{mod} \, 4, i\in{1,2,...,N}$

How to show the cryptanalysis in terms of the CPA or KPA attacks?
And when second key $K2$ is used to induce a symbol noise $E=[e_1,e_2..,e_N]$ to further increase the complexity of the cipher detection at the attacker as follows:

the final encrypted plaintext $C=[c_1,c_2...,c_N]$ such that $c_i=x_i+e_i$ where $0<e_i\leq 1$ knowing that the receiver's detector first round the symbol value to nearest integer.

In this case, are there improvements to reduce the probability of the CPA\KPA attacks?


texts: Is exponentiation of a fixed generator modulo a prime collision-resistant?

texts: Let $p$ be a prime number, and $g$ a generator of $\mathbb Z/p\mathbb Z$. For a message $m$, define the hash function $$h(m) = g^m \pmod p.$$  Is $h$ collision-resistant?


texts: Shamir Secret Sharing Scheme - some doubts not answered earlier

texts:
my first question on here.

I've gone through some examples of Shamirs Secret Sharing Scheme, but I have 2 rather  pressing doubts -

i. Why do we choose the co-efficients of the polynomial from the set {1,..., p-1}?

ii. Why should we have p (the choice of prime) > n (total number of parties involved in the secret sharing scheme). I am able to reason why p > k but not the above!

Thanks very much in advance.


texts: Lightweight Asymmetric encryption algorithm

texts:
I'm an embedded systems researcher, and new in the crypto field. Actually, I need to know if there are any lightweight asymmetric encryption algorithm especially considering the time needed for key generation.

I found that NTRU is considered one of the most lightweight asymmetric crypto systems, is this correct?


texts: What's the meaning of "Ops" in this ABE schemes performance form?

texts:
I am a Ph.D. student focusing on Attribute-Based Encryption, and now I'm reading the paper "Outsourcing the Decryption of ABE Ciphertexts", seen in Figure 1 below. It gives a summary of an ABE scheme performance, but I don't understand the meaning of "Ops."  I marked it in the figure below in yellow color.

What's the meaning of "Full Decrypt Ops" and "Out Dec Ops"？ Does it stand for decryption time?

Below is the link to the paper, maybe someone has read it.

http://static.usenix.org/events/sec11/tech/full_papers/Green.pdf


texts: Is there a way to project one elliptic-curve element to a subgroup with certain size?

texts:
For discrete logarithm we can pick a random number $n$ and project it to a subgroup. E.g. given a prime $p$ with
$p-1 = 2\cdot a \cdot b +1$
we can compute
$n^{((p-1)/a)} \equiv n_a \mod p$
after this $n_a$ is an element of a subgroup with size $a$
$(n_a)^a \equiv 1 \mod p$

Is there a way to do something like this for elliptic curves?

Target use case scenario:
1.)random number $r$ is picked
2.)element of elliptic curve $e$ out of $r$ with some function gets computed: $e_r=f(r)$
3.)element which lies in subgroup with size $k$ gets computed: -> $e_{r,k}$  (how?)
4.)repeat 1.-3. for another random number $r$ --> $e'_{r',k}$
target result: A possible attacker who has access to source code and runtime variables should not know how to compute $e'_{r',k}$ out of $e_{r,k}$ with given EC generator $g$.

The subgroup with size $k$ likely (if exists) also has a generator $g_k$. There should be some way to produce $e'_{r',k}$ out of $e_{r,k}$, e.g. with $e'_{r',k} = e_{r,k} \odot g_k^i$. In case multiple subgroups with size $k$ exist which have disjoint elements this only need to be true for elements in same group. The amount of disjoint groups should not be larger than a low number (<1000).

In case that is possible whould it have a significant impact at security?


texts: What's the industry standard for verifying phone number ownership?

texts:
What's the industry standard for generating single-use SMS codes verifying phone number ownership?

I'm currently evaluating two main alternatives, both based on sending a verification code to that phone number via SMS. How would one properly generate such code?

Obtain an OS-generated random GUID and somehow shorten it to a human-friendly code, e.g. 6-digit number.
Use a incremented, stored sequence and obfuscate it deterministically into a human-friendly code.

With option 1 my main concern is how to shorten a GUID to something human-friendly while still preserving good entropy.

Option 2 allows uniqueness if the maximum sequence value is significantly larger than the expected code count, but it's fully deterministic and that could allow attacks based on the knowledge of several subsequent codes.

The SMS code is only used to verify phone number ownership. It's not a 2-factor authentication scheme and it's hardly authentication at all, since anyone with a working phone number is authorized to access the service behind it. The only reason for it is to prevent people from putting numbers they don't own and potentially have our service spam unrelated, unaware people with text messages.

UPDATE

The original question did not reflect the actual problem, which is verifying that an anonymously supplied phone number in fact belongs to the actual supplier.

Thanks for all the replies, I believe getting a few bytes from CSPRNG mod 10^n is the appropriate method.


texts: ASCII characters in an image steganography

texts:
Given an image size of 300 by 400, what is the maximum number of ASCII characters (7 bits) that can be embedded using the LSB steganography?

I would assume that every pixel can perform an LSB so would that mean 300x400 bits change? I should then divide this by 7?

I'm confused about how this works. Could you elaborate?


texts:
I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC.

Is reusing the same key several times dangerous in AES-CBC mode? Does the use of a random IV preclude all possible attacks in such cases?


texts:
I am supposed to implement ECC over binary field (in C++) for equations of the type - $y^2 + xy = x^3 + ax + b$, as my project. I wish to include the following features :

The user will enter a prime number $m$, which will serve as the order of the binary field as $2^m$.
For the given $m$, the irreducible polynomial will be generated.

  Q1. AFAIK, there is no method to efficiently find a random irreducible
  polynomial. The only way is to pick a random polynomial and check
  whether it is irreducible or not. (The polynomial can be no more than
  pentanomial, and trinomial in some cases) Am I thinking the right
  way?

The coefficients $a$  and $b$ will be generated.

  Q2. Can I use random number generator (with appropriate constraints)
  to generate $a$ and $b$ instead of producing it from a Seed $S$ ? Also, I have seen both Seed $S$ and the parameter $b$ being mentioned. What is the purpose to write both the things when $S$ is sufficient to generate $b$ ?

Various points that lie on the curve will be listed.

  Q3. To generate all the points, put $x=0, 1, 2 ...m-1$ and solve for
  $y$ for equations of the type : $y^2 + ky = l$. How to find the square
  root in such a scenario? Is there any better way to generate all the
  points?

Schoof's algorithm and the likes will be demonstrated to count all the points lying on the elliptic curve. (Though all the points have already been generated, but presenting an algorithm will be an added advantage)
A suitable base point $P$ will be chosen such that it has reasonably low cofactor.

  Q4. To find such a point, the order of each and every point should be
  found out. The only way that I can think of is : Pick a point $Q$.
  Find $2Q, 3Q$ until the points start repeating. Hence, one gets the
  order. Do so for all the points while maintaining the maximum order. Is there any better way to achieve
  it?

Finally an El-Gamal and/or Diffie Hellman analogous of ECC over binary field will be presented.

I would like to get clarification on above questions based on the mentioned scenarios. As of now, I don't have sufficient knowledge of ECC so it is pretty much possible that I have asked some nonsensical questions and I am really very sorry for it. Please feel free to share your ideas on these/any other features so as to make the project more worthy.


texts:
Are there cryptographic scheme where encryption is sequential and take a long time (in a way that it can be quantified) while instead decryption with a secret key takes very short time?

Some sort of reverse time-lock encryption where it takes a long time to decrypt rather than encrypt?

(Either with symmetric or asymmetric)


texts: Can you help me to finding some papers that shows AES is secure against known-plaintext attack?


texts:
Shor's algorithm shows how a quantum computer (with sufficiently many qubits) can solve the factorization problem efficiently. Also the discrete logarithm problem can be solved efficiently with such a quantum computer.
Both boil down into finding the period of a certain function.
Can quantum computer find the period of any given function efficiently? Are there any requirements towards the function?
Closely related, the discussed post-quantum schemes (e.g. the ones submitted to NIST) do not provide a function whose period could be exploited to break the scheme?


texts: How to generate the exact AES key in both client and server side?

texts:
I am using AES to create a secure tunnel for transmission of data.
As the symmetric key encryption will require the same key to encrypt and decrypt, so we need to generate the exact same key for the decrypt process. Is there any possible way for me to generate the exact same key for both side?


texts: Proving that RSA encryption function with non-square free modulus is not a permutation

texts:
Here is a backgroung for the question on hand. While studying RSA I came up to the question about what happens if $p$ and $q$ involved in modulus computation are not actually primes? There is already a related topic on this (Why does RSA need p and q to be prime numbers?). While most of the answers boil down to efficency and security considerations, there is a single answer which states that RSA encryption function with modulus consisting of prime powers loses it's bijection properties, i.e, it is not a permutation any more. However this behaviour is shown only on example with no proof.
Given that, I've started to search a proof of RSA permutation property, and I found such a proof here. But again, it states that the proof works only if $p \ne q$, while it is not actually clear why it is not for $p = q$.
Then I have started to digging it up by myself. Actually, it seems pretty clear for $p = q$ case if $p$ is prime. Then for $N = p^2$, we got a set of plaintexts $\{m_i\}$ such that $0 \leq m_i < N$ and $m_i \equiv 0\pmod{p}$, and having the exponent $e > 2$ we also got $m_i^e \equiv 0\pmod{p^2}$.
But I'm not sure how to generalize cases for $N = p^s, s > 2$; $N=p^sq, s > 1$; $N=p^sq^r, s > 2, r > 2$. Let's take a second case for example. Let $N=5^23= 75$, then $\phi(N) = (5^2 - 5)(3 - 1) = 40$, and $e=3$ is acceptable exponent. Next if I compute all $c_i=m_i^3\pmod{75}$ for all $0 < m_i < 75$, I see that there are 3 sets of discinct $m_i$ values that give the same $c_i$ after encryption:

$c_i = 0, m_i=\{0, 15, 30, 45, 60\}$
$c_i = 50, m_i=\{5, 20, 35, 50, 65\}$
$c_i = 25, m_i=\{10, 25, 40, 55, 70\}$

Thinking of this $c_i$ values I found the following pattern $5^3 \equiv 50\pmod{75}$, $5^32\equiv 25\pmod{75}$, $5^33 \equiv 0\pmod{75}$, $5^34 \equiv 50\pmod{75}$ and so on. Given that it's clear that:

for $m_i = 5(3k_j + 0)\pmod{75}, k_j \geq 0$ we got $c_i = 0$
for $m_i = 5(3k_j + 1)\pmod{75}, k_j \geq 0$ we got $c_i = 50$
for $m_i = 5(3k_j + 2)\pmod{75}, k_j \geq 0$ we got $c_i = 25$

And that's where I stuck. I have tried to explore the examples for $N = p^s$ and $N=p^sq^r$ and have found similar patterns like shown above. But I still need some clues in order to generalize this behaviour and prove that RSA encryption with non-square free modulus is not a permutation. I believe that there should be some simple concept I missing, but since I'm not much into Number Theory, I need community help.
Just for clarification. I'm completely OK with efficency and security considerations of $p$ and $q$ being two discinct prime. The only thing I'm worrying about is RSA encryption function bijection property (or it's absense, which is the case).
Thanks in advance.
UPD
@poncho gave a clear explanation on existence of multiple preimages for $c = 0$. But it also be great to generalize existence of other ciphertexts that can have multiple preimages.


texts: Proof that this is not a secure pseudorandom function?

texts:
$p$ is a large prime number. Consider the following function $F:\mathbb Z^*_p \times \mathbb D\rightarrow\mathbb Z^*_p$ where $\mathbb D=2,....,p-1$.
$F_k(x)=x^k \bmod p$
Proof that it's not a secure pseudorandom function.

What I‘ve tried:
I give a value to $x_1$ and obtain $y_1$, then I set  $x_2 =y_1+p$. At the end $y_1$ is equal to $y_2$. Could this be right or is it  totally wrong?


texts: What is Rolling Code in cryptographic terms?

texts:
My first contact with cryptography was programming Rolling Code keychains. Since then I've been reading about this topic. But is hard to me understand the various types, uses, concerns of cryptography world.
Is Rolling Code a type of Authenticated Message? Or is it a Cryptographic method of dispersion? Is it Block or Stream cipher cryptography?

Edit: This Application Note explains how implement a Rolling Code controller. http://www.atmel.com/Images/Atmel-2600-AVR411-Secure-Rolling-Code-Algorithm-for-Wireless-Link_Application-Note.pdf


texts: Sending TLS messages with out encryption using openssl code

texts:
Is it possible to send messages over TLS with out encryption?

If so which cipher suite is needed for this?


texts: Why isn't Rabin-Williams cryptosystem widely used?

texts:
I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein).

Now some already have noticed that he has an opinion towards cryptographic questions.

In his 2008 paper ("RSA signatures and Rabin–Williams signatures:
the state of the art" by Bernstein) on state-of-the-art signature schemes he documents the "evolution" of RSA and I get the impression he's advertising the usage of the rabin-williams (RW) cryptosystem with the optimizations mentioned in the paper.

Now (finally) my question:
As Rabin-Williams seems to have so many advantages over RSA (smaller keys, smaller signatures, faster verification, ...) why isn't it in widespread use and everyone still uses "old" RSA?

This seems a bit odd as the latest optimizations are dated as of 2003 (!) which is ten years ago and I think there's also the proof that square-root is equally hard as factoring and I think RW even reduces to FACTORING.


texts: A strange phenomenon of the composition of permutations of order 2

texts:
Suppose that $f,g,h:X\rightarrow X$ are permutations such that $f^{2}=g^{2}=\textrm{Id}_{X}$ (i.e. $f,g$ have order 2). Let
$F=f\circ g$. Let $D_{f,g}$ be the distribution that takes the value $n$ where $n$ is the least positive integer such that $F^{n}(x_{0})=x_{0}$ for randomly chosen $x_{0}$.

So if $f,g$ are chosen at random, then the expected value $E(D_{f,g})$ has order around $|X|$ with high probability. However, in my experience, if $f,g$ are not chosen randomly and they have some sort of relation to each other, then $E(D_{f,g})$ often falls very close to either $\sqrt{|X|},2\sqrt{|X|},4\sqrt{|X|},\frac{4}{3}\sqrt{|X|}$. Furthermore, if $f_{1},g_{1},f_{2},g_{2}$ are all closely related in some mysterious way, then
$$\frac{E(D_{f_{1},g_{1}})}{E(D_{f_{2},g_{2}})}$$ is typically very close to $1$.

For example, suppose that $X=\{0,1\}^{n}\times\{0,1\}^{n}$ and $R,S:\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ are randomly selected functions. Let $f(x,y)=(x,y\oplus R(x)),g(x,y)=(x\oplus S(y),y)$. Then $f,g$ are permutations of order 2 which are related and where $E(D_{f,g})$ is typically around $2^{n}$ (The phenomenon holds even when the relation between $f$ and $g$ is more complicated. It is hard to tell when the phenomenon will hold though).

What is the mathematical explanation for this phenomenon?
Is there any way to predict $E(D_{f,g})$ when $f,g$ have a simple description and are easy to compute?
I am wondering if this phenomenon could cause an insecurity in a symmetric cryptosystem that is constructed from permutations of order two. For example, suppose that $f,g$ are closely related permutations of order two, and suppose $h$ is another permutation of order 2. Let $\ell_{0}=f\circ g$ and $\ell_{1}=f\circ g\circ h$. Suppose that for an expanded key $a_{0}\dots a_{n-1}$, the block encryption function is $$E_{a_{0}\dots a_{n-1}}=\ell_{a_{n-1}}\circ...\circ \ell_{a_{0}}.$$
Then could there be any cryptographic weakness from the block encryption function $E$? In particular, could there be any security weakness that arises from a cryptographic hash function that arises from the Matyas–Meyer–Oseas construction from the encryption function $E$? Should I be suspicious of a possible weakness of cryptosystems of this form?


texts: Proof of Disclosure? Is there such a thing?

texts:
Let's say I have a document. I want to give you a copy, and then I want to prove that I gave you a copy. Ie, I want some kind of digitally signed receipt from you. If you're dishonest, you may receive the document and then refuse to give me a receipt. I would like some sort of cryptographic protocol that provides some sort of "simultaneous swap" - I give you a document, you give me the receipt. Does anything like this exist?

PS. I'm happy to do the research myself, but I have no idea what terms to google for. "Proof of disclosure" definitely isn't the right search term.


texts:
Is there any theoretically safe notion of white-box?

I have been reading about white-box [1, 2, 3] recently. It seems white-box deals with code obfuscation and its not known whether a perfect white-box exists.
I am curios about theoretical notion behind this. For a stream cipher, the theoretical notion is PRF. For block cipher it is PRP. For a hash function, it is one-way function. Is there anything comparable for white-box?
I am looking for something which is not necessarily practical, but we can actually show this achieves perfect white-box, like a really scrambled code or something.
UPDATE. I vaguely remember reading something on the line of

White-box would be possible if a super-huge memory exists. The memory could be loaded as a look-up table with the plaintexts as the look-up-keys and the ciphertexts the look-up-values. Since the encryption-key is not involved in the look-up table (it has been used previously to create the look-up table), it cannot be recovered but encryption would be still possible.

But I could not retrieve the source. Does anybody know anything about it?


texts: Elliptic curve scalar point multiplication

texts:
I need to compute ecc multiplication with this values : $ P=(1,3)\space ; \space k=2 \space ; \space a=24 \space ; \space b= 13 \space ;\space p=29 $ which means $y^{2}=x^{3}+24x+13 \space$. as far as I know in such situation one should compute values using this formula :

$
\lambda= \frac{3x^{2}+a}{2y}
$

$
x_r=\lambda^2 - 2x
$

$
y_r=\lambda(x-x_r) - y
$

when I calculate equation I end up $R=(18.25 , 6.375)$ where true answer of this shoud be $R=(11,10)$ (this site proves it : http://www.christelbach.com/eccalculator.aspx). please help me to find my calculation mistake.

  note : just if you are interested I'm using this matlab code :

   temp=(3*(x1^2)+a)/(2*y1);
   x3=mod(temp^2-x1-x2,n);
   y3=mod((x1-x3)*temp-y1,n);


texts: Can Pseudorandom values be used as secure keys?

texts:
I want to derive $n$ keys from a master key.

I pick a master key $mk$ and use pseudo-random function (PRF) to generate $n$ pseudo-random values, $v_i=PRF(mk,i)$ where $1\leq i \leq n$.
Next, I use key derivation function to generate $n$ keys: $k_i=KDF(v_i)$, where $1\leq i \leq n$. Note that key derivation must be deterministic.

Question 1: Is above scheme a secure way of generating $n$ keys?

Question 2: Can we consider values $v_i$ as secure cryptographic keys?


texts: How a sender will ensure that the public key used for encryption is the key of intended reciver?

texts: Say Alice is the sender and Bob is the receiver. Alice has the public key of Bob and wants to send some data to Bob. How Alice will ensure that the public key she is having is really belongs to Bob?


texts:
It seems like that the construction of the LWE problem: $As + e = b$ resembles how neural nets work: $Ax + b = y$.
In LWE, we are given the problem instance $A$, and the product with errors $b$ and are challenged to produce the secret vector $s$. Is it similar to the problem in ML where we are given the coefficient matrix $A$ and the expected label $y$, can we produce a valid sample $x$?
Also, I'm wondering whether techniques we use in ML such as backpropagation can be applied to LWE as well?


texts: Using a RSA signature to confirm the sender of a physical letter?

texts:
(1) Alice wants to send Bob a physical letter.
(2) Alice also wants Bob to be confident that she sent the letter and not an imposter.
(3) Alice is confident that a potential imposter will not be able to intercept any letter she sends.
(4) Alice has previously in-person provided Bob a RSA Public key.
Can Alice use a RSA Signature to confirm she sent the letter?
What is the best approach Alice can take, that makes such verification as easy as possible for Bob?


texts:
so I have to find all generators for modulo p. And I thought: isn't there are rule for it? As far as I remember, every number from {1,...,p-1} is a generator because p is a prime. Is that true? Or am I mistaken? What is the rule called?

Or how else do you find generator elements quickly? Do you really have to take each and every element and modulo it with p and figuring out if it returns all numbers n for 0 > n < p-1?


texts:
Let $c_1$ and $c_2$ two encryptions of $m_1$ and $m_2$ using the Paillier Cryptosystem.

$c_1= E(m_1,r_1) = g^{m_1} r_1^n \bmod n^2$ and $c_2= E(m_2,r_2) = g^{m_2} r_2^n \bmod n^2$

Paillier homomorphic encryption enables us to combine two messages such as

$D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$

Given two random numbers in $\mathbb{Z}_n^*$, namely, $k_1$and $k_2$, we compute $k_3$ such that : $k_1$ + $k_2$ + $k_3$ = 0 mod ${\lambda}$

If we encrypt $m_1$ and $m_2$ to $c_1^{'}$ and $c_2^{'}$ as follow:

$c_1^{'}= E(m_1,r_1) = g^{m_1} g^{k_1} r_1^n \bmod n^2$ and $c_2^{'}= E(m_2,r_2) = g^{m_2} g^{k_2} r_2^n \bmod n^2$

Can we retrieve $m_1+m_2$ from  $D\left(c_1^{'} \cdot c_2^{'} \cdot g^{k_3} \mod n^2\right)$ ?


texts: Which of these ECC libraries is more secure, fast and commonly used?

texts:
I have a python project and for this project, I need to use Weierstrass-based ECDSA. On the web, I've found two libraries;

Library 1 is called fastecdsa:
Library 2 is called ECPy:

I couldn't see any security analysis and performance metrics for those libraries.

Is there any security and performance analysis of these libraries?
Is there a better alternative for those libraries?