texts: Is this Diffie-Hellman key exchange variant vulnerable to man-in-the-middle attacks?

texts:
As we all know, the Diffie-Hellman key exchange protocol without authentication is vulnerable to a man-in-the-middle attack. And if we use STS(Station-to-Station protocol) instead, it would be secure.

My question is:
Suppose we use a variant of Diffie-Hellman key exchange protocol with signatures like this:

Alice $\rightarrow$ Bob : $Bx = g^{Ax} ,S_a(Bx)$
Alice $\leftarrow$  Bob : $By = g^{Ay} ,S_b(By)$

Then they have a shared key $g^{(Ax\ \times\ Ay)}$.

It's like STS but not the same.

So is it secure against man-in-the-middle attack?
Suppose Eve is an active man-in-the-middle, will Eve be able to decrypt Alice's or Bob's message later on? (Suppose Alice and Bob won't send Ax,Ay in this channel)


texts: Why not just generate random strings for one-time password (OTP)?

texts:
http://en.wikipedia.org/wiki/One-time_password#How_OTPs_are_generated_and_distributed

Why have so many methods to generate OTPs, why not just use just random strings?


texts:
I read this in a description of Linear Shift Feedback Registers

Note that the allzero state must be excluded. If an LFSR assumes this state, it will get “stuck” in it, i.e., it will never be able to leave it again".

I can understand why an all zero state means that if the LFSR comes to an all zero state, it gets stuck in the state. However, how does one prevent it from getting to an all zero state? Can an LFSR never get into an all zero state unless it's initialized to an all-zero state? If it cannot, is there any proof for this?


texts:
Is there any possible way to filter a key space in a crypto-system to get a set of keys that decrypts out a valid text (text that is in same language or readable)?

I tried a random approach and got certain set of keys but its not that appreciative to actually required text size

code

from Crypto.Cipher import ARC4
import base64, string, time, random
key = ''.join(random.choice(string.ascii_letters + string.digits ) for i in       range(8))
obj1 = ARC4.new(key)
obj2 = ARC4.new(key)
text = 'abcdefgh'
cipher_text = base64.b64encode(obj1.encrypt(text))

decoded_text= obj2.decrypt(base64.b64decode(cipher_text))

Dict={}
count=0
valid = set(string.ascii_letters + string.digits )
def test(s):
    return set(s).issubset(valid)

print; print 'plain text: ', text
print; print 'Actual key: ', key
print; print 'Cipher text: ', cipher_text

timeout=time.time()+60
while time.time()< timeout:
   count+=1
   key = ''.join(random.choice(string.ascii_letters + string.digits ) for i in range(8))
   obj2 = ARC4.new(key)
   decoded= obj2.decrypt(base64.b64decode(cipher_text))
   if test(decoded):
       Dict.update({'key: '+key : 'Valid Decrypted Text: '+decoded})
import pprint
print; print 'Analysis: '
pprint.pprint(Dict)
print;print 'Number of valid Decrypted Text: ', len(Dict)
print;print 'Total number of decryption performed: ', count

Output:

plain text:  abcdefgh

Actual key:  go6oMkCG

Cipher text:  JB1a3osG+es=

Analysis:
{'key: 0UUvjzLw': 'Valid Decrypted Text: mzptBVo4',

 'key: 2beOXKN1': 'Valid Decrypted Text: Yhz3jIL8',

 'key: 3Eq7MKwu': 'Valid Decrypted Text: GA9BTdzy',

 'key: 3jUQPXs8': 'Valid Decrypted Text: 3gCa3KBG',

.

.

Number of valid Decrypted Text:  36

Total number of decryption performed:  2275140

Is there any better to sort out such keys. Such keys may be valuable to strengthen cryptography by introducing confusion


texts:
I'm newbie in the word of TLS, and need some verification about my picture.
I can use TLS with 3 or 2 participants:

3 participants: Client, server, CA (certification authority). The CA is where the server's certificate is signed in, or created by a CA comp. The browser trusts in it automatically, because they have some contract with each other. So the browser starts a https connetion to the server. It asks for the certificate. The server sends it, with the public key. The browser checks, if this certificate is signed in any trusted CA? If yes: Check if the certificate is related to the server, and domain? If yes: Then the certificate is valid >> server is the "person" who I wanted to "talk", so it is OK.

2 participants: Only client and server, where the client needs to trust the server's certificate.

Case 1: Here the client needs to add the server's certificate to the browser manually to allow the connection
Case 2: Or needs to confirm the certificate througth the browser. This case is the self-signed PKI. Here you can not be sure, who the server is. You can communicate by an encrypted channel, since you use the async encoding, but you can not be sure who you communicate with.

Am I right?


texts:
I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions.

  At the beginning I want to remind the definicion of CBC-MAC.

  Let $F$ be a pseudo-random function. We define the CBC-MAC as $(Gen,Mac,Vrfy)$ as follows:

  (a) $Gen$ on input $1^n$ outputs a key $(k_1,k_2) \in \lbrace 0,1 \rbrace^n \times \lbrace 0,1 \rbrace^n$ selected uniformly at random.

  (b) $Mac$ on input a key $(k_1,k_2) \in \lbrace 0,1 \rbrace^n \times \lbrace 0,1 \rbrace^n$ and message $m \in \lbrace 0,1 \rbrace^*$ does the following.

  It first unambiguously pads the message $m$ to $m^{pad}=m|1|0^l$, where $l \in \lbrace 0,\ldots,n-1 \rbrace$ and $||m^{pad}|| \equiv 0 \mod n$.
  Then it splits $m^{pad}$ into $r$ blocks of $n$-bit: $m^{pad}=m_1^{pad}|m_2^{pad}|\ldots|m_r^{pad}$.
  Let $t_0=0^n$. For $i=1,\ldots,r$, it computes $t_i=F_{k_1} \left( t_{i-1} \oplus m_i^{pad} \right)$.
  Mac outputs $F_{k_2}(t_r)$.

  (c) $Vrfy$ on input key $k_1,k_2 \in \lbrace 0,1 \rbrace^n$, a message $m \in \lbrace 0,1 \rbrace^*$ and tag $t \in \lbrace 0,1 \rbrace^n$ outputs $1$ if $Mac_{k_1,k_2}(m)=t$ and $0$ otherwise.

Now I have some exam from previous year, and I don't know at all how to prove this facts (and, it should be done in rigorous way).

  Consider the modification CBC-MAC' of the CBC-MAC where the algorithm $Mac'_{k_1,k_2}(m)$

  selects $t_0$ uniformly at random,
  computes $t_1, \ldots, t_r$ as in CBC-MAC,
  and outputs $\left( t_0,F_{k_2}(t_r) \right)$.

  The verification algorithm given tag $(t_0,s)$ performs the same computation as $Mac'_{k_1,k_2}(m)$ using the given value $t_0$ and outputs $1$ if $s=F_{k_2}(t_r)$ and $0$ otherwise.

  1) Prove that CBC-MAC' is not strongly existentially unforgeable under an adaptive chosen-message attack (definition is below this exercise).

  Consider the simplification CBC-MAC'' of the CBC-MAC where the algorithm $Mac''_{k_1,k_2}(m)$ outputs $t_r$ instead of $F_{k_2}(t_r)$.

  2) Prove that CBC-MAC'' is not strongly existentially unforgeable under an adaptive chosen-message attack.

  3) Is there a condition on the message space of CBC-MAC'' such that your proof does not hold? Explain your answer.

Reminder:

  An efficient MAC is strongly existentially unforgeable under an adaptive chosen-message attack if for all PPT adversaries $\mathcal{A}$ it holds that $Pr[MACforge_{\mathcal{A}}(n)=1]$ is negligible function, where $MACforge_{\mathcal{A}}(n)$ denotes the outcome of the following experiment:

  (a) A key $k \leftarrow Gen(1^n) \in \lbrace 0,1 \rbrace^n$ is generated.

  (b) The adversary $\mathcal{A}$ is given oracle access to $Mac_k(\cdot)$ and outputs a pair $(m,t)$. Formally: $(m,t) \leftarrow \mathcal{A}^{Mac_k(\cdot)}(1^n)$. Let $Q$ denote the set of query/response-pairs $(m',t')$ for all the queries $m'$ asked by $\mathcal{A}$ during its execution.

  (c) The output of the experiment is $1$ if and only if $(m,t) \not\in Q$ and $Vrfy_k(m,t)=1$.

If you could help me with the rigorous proof, I'd be really grateful for your time.

Thanks, Ben.


texts: Public key crypto without modular arithmetic?

texts:
This comment from Reddit math, in response to a statement about how people can communicate secrets to each other with a third party listening, has a very small, simple example of public key cryptography:

Take your message, treat it as a number and multiply it by a bunch of primes.
Send it to me. I will then multiply by a bunch of primes too.
I send it back to you. You then divide by all of your primes.
Send it back to me. I divide by all of my primes and get the original message.

This comment has 5700+ upvotes by Reddit math, but it strikes me as unusual because there's no modular arithmetic used, only primes.
Does this example actually work, if sufficiently large primes are used?


texts: Brute force attack on RSA - success criteria?

texts:
In a hypothetical discussion we ended up with a concrete question I'd like to find the answer to:

If you try to brute force an RSA encryption, but the original vale which was encrypted was just random binary data, can you ever be sure you found the correct key? In other words: What are the success criteria for RSA brute forcing?

Do "you" say "This is neither a text encoding I know nor a file format I recognize, so this isn't the correct key" and try the next? Or can you tell by metadata or something that you've found the correct key? Or is it safe to say that completely random data encrypted with RSA is unbreakable by brute force?


texts: In one-time pads we always say do not use same key twice to encrypt ASCII messages, but if we use a random key to XOR a random binary message and then reusing the same key for XORing new random messages will compromise our key ? Or is attacking reused keys for random messages infeasible?


texts: How many bits of entropy can I expect from /dev/urandom in iOS?

texts:
Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and "interrupt timing once the device has booted" as seeds. Calls to the iOS API SecRandomCopyBytes will retrieve random bytes from /dev/random by default. Apple's random(4) man page seems to suggest that their /dev/random is non-blocking, but that it somehow does not need to block in order to ensure fresh entropic bytes:

  /dev/urandom is a compatibility nod to Linux. On Linux, /dev/urandom
  will produce lower quality output if the entropy pool drains, while
  /dev/random will prefer to block and wait for additional entropy to be
  collected.  With Yarrow, this choice and distinction is not necessary,
  and the two devices behave identically. You may use either.

NIST's DRBG validation list indicates that Apple is using AES-128 in counter mode as a pseudo-random function for CTR_DRBG.

So, how many bits of entropy can we expect out of SecRandomCopyBytes? If I query it for 256 bits of entropy, will I instead get 128 bits of reasonably entropic data, potentially followed by another 128 bits of less entropy data due to the lack of blocking in iOS's /dev/random?


texts: Authenticating a message with HMAC vs AES-CBC

texts:
Given some string s I want to sign, are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?

s + HMAC(s, secret_key)
AES_CBC(s + string_of_zeroes, secret_key)

And validation:

recalculate HMAC of first part of message and compare it to second one
decrypt message and verify that it ends with string_of_zeroes

If that is true, string_of_zeroes of what length should be taken to make them equivalent?


texts:
I recently noticed that OpenDKIM on my mail server is objecting to DKIM signatures from a client, saying their key is insecure. It may be that that's due to lack of secure DNS (confirmation anyone?) but I also noticed that the signing algorithm is shown as a=rsa-sha1, and with the move to “Deprecate SHA-1” in other contexts, I'm wondering: how urgent this is for DKIM?

It is now feasible to brute-force SHA-1 hashes. Am I correct in thinking that this would need to be done for each message an attacker wished to forge the signature for, without being able to re-use that work for the next message?


texts:
So my understanding of TLS is that it uses asymmetric cryptography such as DH to perform a key exchange, once this has occurred it then used an symmetric algorithm for the data exchange. (Obviously I am missing a lot of detail here and it may be slightly inaccurate but I think thats generally the high level idea?)
My question is once the key exchanged has taken place what symmetric algo is used? AES? Or is it implementation specific? Or developers preference???


texts:
In Dan Boneh's crypto book, there is a section describing the "Rewinding Lemma", however I cannot find it explained in other sources on the internet.

How does this differ from the forking lemma?


texts:
Does module-LWE remains hard for an even modulus $q$, or a power of two?
This is true for Ring-LWE (pseudorandomness) and Module-LWR (SABER).
I can't find any reference to it!


texts: Attack against modular inversion operation using side-channels?

texts:
I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, etc.).
All information I found related to side-channels in modular arithmetic applies to modular exponentiation.
The algorithm used for inversion is the standard Extended Euclidean algorithm.
The attacker may be able to measure, for example, computing time. He does not have access to the output, nor to the modulus. He knows only the value that will be inverted.
Update: found a relevant reference


texts:
Lets assume we have a group $G$ with unknown order.
And we have a pair $(A_1,K_1), (A_2,K_2)$ in which all $A_1,K_1,A_2,K_2$ are group elements.
The claim is $A_1= K_1 ^ x$ and $A_2 = K_2 ^ x$. or informally we want to show they both have the same exponent. ($x$ is prime)

We do not want to share both $K_1,K_2$. We want to share a single element as a proof for this fact. It is ok if someone can extract $K_1,K_2$ from the single element provided.

Is there any protocol for this?


texts: Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

texts:
This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges.  The purpose would be for a man-in-the-middle attack where both of the unsuspecting target users check to make sure they're using the same session key.

The way I am thinking it would work is that Eve establishes a normal DH key exchange with Alice.  She then does a key exchange with Bob where she uses specially-crafted responses to end up with the same session key she generated with Alice.

Is it possible, and how would this work in practice?  I'm guessing it would either be impossible or extremely time-consuming with large primes, etc., but that's just a quick assessment.  Thanks!


texts: Is AES-256 a post-quantum secure cipher or not?

texts:
We know Grover's algorithm speedup brute-force attacks two times faster in block ciphers (e.g brute-forcing 128-bit keys take $2^{64}$ operations, not $2^{128}$).
That explains why we are using 256-bit keys to encrypt top secrets. But latest practical attack on AES shows brute-forcing AES-256 take $2^{100}$ operations.
Does this attack work with Grover's search to make AES cipher quantum unresistant?


texts: Elliptic Curve Encryption Ciphertext Size

texts: I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)


texts: Inconsistency Between NIST SP800-108 and KBKDFVS

texts:
I am attempting to implement a Key Based Key Derivation Function (KBKDF) in Counter Mode as part of a larger project. To test my implementation, I was directed towards the Verification System for this function (KBKDFVS) by this helpful question & answer.
I intended to generate tests for my code based on the full vector list downloadable here, but before that I decided to grab one sample vector as a simple hand-written test, and that's when I encountered some confusing discrepancies between the KDF as defined in SP800-108, and the algorithm as referred to in the KBKDFVS.
Firstly, the KBKDFVS (and the test vectors) indicate that multiple counter locations (before, middle, after) should be supported:

3.e Order of the fixed input data: Does the IUT support the counter coming
before, in the middle, and/or after the fixed input data?

However, the original document makes no allowance for variable location of the counter in the input string, it is explicitly at the beginning of the bitstring:

K(i) := PRF (KI, [i]2 || Label || 0x00 || Context || [L]2)

This bitstring definition for each iteration of the PRF highlights another issue with the test vectors, which can be seen in this example:
[CTRLOCATION=BEFORE_FIXED]
[RLEN=16_BITS]

COUNT=0
L = 128
KI = 26ef897e4b617b597f766ec8d8ccf44c543e790a7d218f029dcb4a3695ae2caccce9d3e935f6741581f2f53e49cd46f8
FixedInputDataByteLen = 60
FixedInputData = bc2c728f9dc6db426dd4e85fdb493826a31fec0607644209f9bf2264b6401b5db3004c1a76aa08d93f08d3d9e2ba434b682e480004fb0d9271a8e8cd
    Binary rep of i = 0001
    instring = 0001bc2c728f9dc6db426dd4e85fdb493826a31fec0607644209f9bf2264b6401b5db3004c1a76aa08d93f08d3d9e2ba434b682e480004fb0d9271a8e8cd
KO = a43d31f07f0ee484455ae11805803f60

The "instring", the value which is input to the PRF in addition to the key, is simply the concatenation of the counter (i) and the fixed input data (Label || 0x00 || Context). The binary representation of L is simply not present.
With L in the input string my implementation's KO does not match the output of the vector, but if I modify my implementation to omit L from the input string, my KO matches that of the input vector, so I do not believe the authors simply omitted this step from the vector data while still including it in the output.
My actual question:
Is anybody able to explain this inconsistency to me? Why do the test vectors seem to disagree with the specification of the algorithm? And if it is simply an error or outdated data, is there a better way to verify my implementation?
Handy Links:
SP800-108 itself
SP800-108 KBKDFVS


texts:
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads to problems, when then IV is too short.
For example, in AES-GCM, the variable part of the IV is only 64 bits. If for each message we choose the IV randomly, we will start getting collisions after a $2^{32}$ messages; which is very insecure depending on the protocol.

Now a hacky way to roll our own crypto would be the following:
AES-GCM with extended-IV
First of all, we will stop using the normal IV part of the AES-GCM construction. Instead, for each message, we will mangle the key like this:
$$
K' = \text{KDF}(K || \text{nonce})
$$
where $K$ is the original key, $K'$ is the new key, and $\text{nonce}$ is a nonce that is long (say 256 bits) and randomly generated for each encryption; $\text{KDF}$ is assumed to be a properly domain-separated PRF that returns a new 256-bit value.
Now we encrypt our message using AES256-GCM with the new key. As mentioned, we set the IV to some kind of constant value. We transmit $\text{nonce}$ along with the ciphertext.

I would expect that, because collisions are possible in $K'$, this construction has only $\text{len}(K') = 128$ bits of security. However, I find it hard to reason about its security. The main question:
Could this scheme be used as an alternative for AES128-GCM, but with randomized nonces (similar to XSalsa20Poly1305)?

I mean hypothetically! I would not actually such a construction like that. I don't think that would make any sense.

Edit: As Poncho shows, this scheme is obviously not nonce-misuse resistant. I badly worded the question. I updated it.


texts: Entropy of system data - use all and hash, or trim least significant bits?

texts:
I'm working on a background entropy collector for key generation that monitors hardware and produces an entropy pool.

Here's my list of sources:

Mouse position
Keyboard timings (i.e. time between keystrokes)
Network

Bytes sent
Bytes received
Datagrams sent
Datagrams received

Processor (per CPU)

Interrupts/sec
Queued DPCs/sec
C3 Transitions/sec

Memory

Page Faults/sec
Transition Faults/sec

Disk

Write bytes/sec
Read bytes/sec

Process (total)

IO Read Bytes/sec
IO Write Bytes/sec
IO Other Bytes/sec
Page Faults/sec

USB

Interrupt Bytes/sec
Controller PCI Interrupts/sec

Time taken to fetch all of the above data (measured using QueryPerformanceCounter)

These stats are collected once every 330ms. At the moment, I'm just globbing all the data into an array of around 100 bytes. I then hash the array using SHA512, to add a total of 64 bytes to the entropy pool, giving me roughly 200 bytes per second.

The pool is initially populated by the hash of a single timestamp value indicating the system boot time. When the pool reaches 64KB, I xor with the oldest 64-byte block. This is somewhat warned against in another question, but I don't foresee a problem because the pool is very large and the reasoning for removing old data is size. Keys are generated by computing a cryptographic hash of the entire entropy pool.

This seems reasonable, but I wonder whether SHA512 is overkill. Would I be better off extracting the least significant bits of each statistic into a bitstream? If so, how many? Are there any other issues with my approach?


texts: Is tagging the hash of a password along with ciphertext secure?

texts:
Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any encryption key "works". If you use the wrong password to decrypt, you won't get an empty output or error like AES, but instead, you just get corrupted/useless data. I want to be able to validate the password so that I know whether it is correct before decrypting. If I take the SHA3_512 of the Argon2ID-ed password and include it with the ciphertext, is the ciphertext now vulnerable to attacks? I'm using a CSPRNG to generate Argon2ID's salt and ChaCha's nonce, which would put off rainbow tables. Is this scheme secure? Here's a visual example:
plaintext = "sfsdfasdfadfasdfasdfasdfadf"
password = "some_very_strong_password_blah"
salt = csprng(16)
nonce = csprng(24)
key = argon2id(password,salt,t=32,m=1GB,p=4)
ciphertext = XChaCha20.encrypt(plaintext,password,nonce=nonce)
check = sha3_512(key)
ciphertext += check
// Done. To check the password,
// I would derive the key using Argon2ID
// again and compare it with 'check'

Would this be secure? I know about this question, but that scenario is without a KDF and doesn't include any entropy. Thanks.
Update: AES does not give an empty output if the wrong key is used. The crypto library I use does.


texts: Homomorphic set hash with membership proof

texts:
I'm trying to solve a problem that goes as follow. There is a set of item and that set is very large. Several actors needs to exchange information about this set, such as adding and removing element from the set and querying if an element is in the set. These actors do not trust each others so they need solid proof. Because the set is very large, actors need to be able to operate with partial knowledge of the set.

So I've been able to find scheme that solve some of the constraints, but not all of them. Here are the direction I explored:

ECMH: https://arxiv.org/pdf/1601.06502.pdf

This allows to commit to a set of items and recompute the commitment easily when items are added/removed, even when the content of the set is unknown.

Sorted Merkle tree: This satisfy the ability to prove membership, however, adding and removing elements from the set require knowledge of the whole set.


texts: Using the OTP and RSA compared to only using the OTP itself

texts:
To use the OTP with RSA, I implemented the one-time pad first for only one time, and then I used the RSA algorithm to encrypt the message.
For the RSA algorithm, I pick $p$ = 2143 and $q$ = 3257, values which do not share any common factors and generate a random value between 1 and $(p-1)(q-1)$. Then generate a public key and private key for RSA encryption and decryption.
My question is: Is it more secure than only using the one-time pad to encrypt the message?


texts: Does blinding protect again fault injection attack against RSA with CRT

texts:
I know that blinding can be used as a countermeasure against side-channel timing attacks on RSA-CRT:
RSA Timing Attack and Prevention through blinding
My question is: can blinding also be used as a countermeasure against differential fault injection attacks on RSA with CRT as described by BellCoRe (see: https://hal.archives-ouvertes.fr/hal-00939473/document and here: https://www.limited-entropy.com/crypto-series-dfa/)


texts: Why can we always assume that $Gen$ algorithm choose key uniformly?

texts:
Disclaimer: This is exercise 2.1 in Katz-Lindell book.

Given a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ takes the security parameter $1^n$ as input and generates a key $k$ of length $n$.

Usually we simply assume that $Gen$ chooses key uniformly from $\{0,1\}^n$ but this is not always the case.

Given $Gen$, how would you construct a new generation algorithm $Gen'$ that indeed outputs $k$ uniformly at random?


texts: Probability that n is prime such that n fails the Miller-Rabin test N times

texts:
I'm working through An Introduction to Mathematical Cryptography and one of the exercises asks

  Suppose that we run the Miller–Rabin test N times on the integer n and that it fails to prove that n is composite. Show that the probability that n is prime satisfies (approximately)

  Pr($n$ is prime $\mid$ the Miller–Rabin test fails $N$ times) $\geq 1 − \frac{ln(n)}{4^N}$.

This is assuming that the Miller-Rabin test is 75% accurate and that the probability $n$ is prime is $\frac{1}{ln(n)}$. I think by "failing on a number", they mean they identify the number as prime. (Fail to identify it as composite.)

Based on the assumptions, I find the following:

Let $n$ be "$n$ is prime" and $N$ be "The Miller-Rabin test fails $N$ times". Because the test always fails on a prime, $P(N \mid n)=1$. $P(n)=\frac{1}{ln(n)}$ as above, and $P(N \mid n^c)=(\frac{1}{4})^N$ because the test identifies a composite as prime $\frac{1}{4}$ of the time.

From this, I can use the fact that $P(n \mid N)=\frac{P(N \mid n)P(n)}{P(N \mid n)P(n) + P(N \mid n^c)P(n^c)}$ to find

$$
P(n \mid N)=\frac{\frac{1}{ln(n)}}{\frac{1}{ln(n)} + (\frac{1}{4^N})(1-\frac{1}{ln(n)})}\\
=\frac{\frac{1}{ln(n)}}{\frac{1}{ln(n)} + \frac{1}{4^N}-\frac{1}{4^Nln(n)}}\\
=\frac{\frac{4^N}{ln(n)}}{\frac{4^N}{ln(n)} + 1-\frac{1}{ln(n)}}\\
=\frac{4^N}{4^N + ln(n)-1}\\
$$

But that doesn't seem to get me anywhere. What am I missing here?


texts: Memory-expensive hash from an array of hashes?

texts:
Why can't people make a hash function that requires dozens of mega bytes of memory instead of cpu to avoid all the cracking and hacking?
What I have in mind myself is this:

We have an input $X$, we choose hash function SHA2-256,  make a multi-megabyte array.
Hash $X$ and put it in the beginning of the array.
Hash the previous hash and put it next to it.
$(hash(x), hash(hash(x)))$
Step 3 until the array is full
Reverse the array
Hash the array in N passes, In each pass reading 1 byte and skipping $N-1$

I'm planning to use this for authentication, I'm not sure if it's a good idea or not, just need to know if it stop the damn GPUs from cracking my passwords.

EDIT:

This is why people shouldn't make their own encryption – see the comment by John Meacham proving this algorithm insecure. An easy fix IMO is to require the algorithm to go multiple passes over the reversed array. Like: get the first byte, skip 15 bytes, get another byte and so on… and when we reach end of the array, start from beginning, only this time we get the second byte, skip 15 bytes and so on… and we do this 16 times until we have read every byte in the array. Of course number $16$ is probably not a good number but still I think the whole idea is good.


texts: About the Algebraic Normal Form (ANF) of S-Box in DES

texts:
I've thought up a way to represent the transformation of S-Box in DES by ANF. Let
$x_i\;(1\le i\le 6)$ be the input of an S-Box,
$y_i\;(1\le i\le 4)$ be the output, for example, then
$$y_1= 1\oplus x_1\oplus\dots\oplus x_1x_5\oplus\dots\oplus x_3x_4x_5x_6\oplus\cdots$$
Here the "$\oplus$" is "xor" operation and the operation between two continuous inputs is "and". I've omitted many terms because it's too long.

(This paragraph is in the old version)I think this is a very basic problem so it must be researched by so many people. But I can't find related papers. Can someone explain the ANF researches on S-Box of DES or provide some resources for me? Thanks a lot.

This is an explict expression because the left side is a single output and the right side is a polynomial of inputs with degree at most 6.

In algebraic cryptanalysis, reaserchers always represent the relations between inputs and outputs in an implicit way, like
$$f(x_1,x_2,x_3,x_4,x_5,x_6,y_1,y_2,y_3,y_4)=0$$
What I want to know is that are there any advantages or applications of explicit form compared with the implict form?


texts: Knowing N and a relationship between the 2 prime numbers(p and q) find p and q generated with RSA


texts: Can anyone explain most popular RSA attacks like I'm 5?

texts: Suppose I implement RSA myself in C and I use just the formulas from number theory. What attacks would my implementation be vulnerable to? Can anyone explain this to me like I'm 5?


texts: Interesting malleability property of Goldwasser-Micali PKC

texts:
GM is a cryptosystem with a modulus $N = pq$ ($p$, $q$ prime) and quadratic nonresidue $r \in (\Bbb Z / N\Bbb Z)^*$ as the public key. You can see the details on Wikipedia.

Anyway, let's say that $N < 2^{1024}$. Then the ciphertext can be represented as a $1024$-bit string regardless of $N$. In which case, you can take a ciphertext $c$ (which is the encryption of a single bit), and then multiply $c$ by a random $z^2 \pmod{2^{1024}}$, and get an equivalent ciphertext. An adversary should, as far as I can tell, be unable to decide whether this decrypts to the same plainbit as $c$. And you don't need to know the public key $(N,r)$ to do this operation.

Is there any literature on this property?


texts:
I can't find the exact type and settings for the BLS12-381 curve.

Is this type-3 in Symmetric XDH settings ?


texts: In W-OTS, could you XOR all public keys?

texts: Since the signatures all generate the public keys, those can be derived from sig and proven by pre-commited XOR of every pub key compared with XOR of every signature end hash.


texts: How can I accomplish Key Derivation in JavaScript?

texts:
I need to take a potentially weak user password and derive a strong key for AES encryption in JavaScript. How can I do this?

I expect the hardest problem is generating a good random salt - perhaps an SSL request could be used to ask a server to provide half of the salt. This would work but I'd rather keep it simple if possible.

Should I use bcrypt? Perhaps with however many iterations are necessary to hit about 1 second on slow hardware (current model smartphones).

I only need to support modern browsers, my userbase is small and everyone is a geek.
The derived key will be used to encrypt plaintext passwords with AES, similar to how LastPass works.


texts:
Suppose there is a cryptographic hash function $H : \{0,1\}^* \to \mathbb G$. Now, we want to define a hash function $H' : \{0,1\}^* \to \mathbb G \times \mathbb G $.

My first idea is to define $H'$ in the following way:

$H'(x) = (H(x||'0'), H(x||'1'))$

Is $H'$ cryptographically secure? If not, can you propose a secure construction that uses $H$?

The motivation behind this question is that some crypto libraries (e.g., Charm) provide functions for hashing to groups (e.g., $H$), but in some cases you need custom hash functions (e.g., $H'$)


texts: Are there any cryptographic algorithms, which lets the user apply some modifications on the encoded data, without decoding it?

texts:
I would like to encode some data with a key, and send it to a third party. They don't know the key to decode it, but I would like to make it possible for them to apply some modifications on it. Then they send i back, I can get decode it, and get the result.
For example let the encoded data is the integer 5. I encode it with a key k and it becomes xxxxxx.
The user can apply operations to xxxxxx without knowing k, like +5 and *2. After those operaions, the encoded value becomes yyyyyy.
If I decode the value with the key k, it should be 20, as if I applied +5 and *2 on the original data 5.
Are there any cryptographic algorithms like that?


texts:
I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF.

I've already check this site and Google, and I think I'm in the right path, but probably I am missing something.

I have access to messages and the ECDSA signature that they generate. The format is always the same:

Example of a message:

{"session_id": "6621a96c7db568374f2885d6d135f395010e75a94ec2233a433ff8e2", "user": peter}

And the signature have always the same first half.

znnlVaDhCokfqzU5figrY2cZ1nk87rH/

Example of two signatures:

znnlVaDhCokfqzU5figrY2cZ1nk87rH/+Zc/DvAEIyjZ4pv8SVmCsWLtq+yJrtFJ
znnlVaDhCokfqzU5figrY2cZ1nk87rH/zcCHDV2rLJ6nhdjE9vzblfpkzrhqzVjY

This looks like signatures generated with NIST192p curve (because of the size) ?

There are similar CTF that used the same thing as this one, and a solution like this one: http://ropnroll.co.uk/2017/05/breaking-ecdsa/

But the new generated signature doesn't start with the same part as the above ones.

They seem to be based on this one, https://antonio-bc.blogspot.com/ (you can look for ECDSA).

Here is again another CTF with a similar issue, but with a different curve. http://itemize.no/2016/08/26/IceCTF-contract-task/

Also I've checked the video from LiveOverflow that tackle the same issue, https://www.youtube.com/watch?v=-UcCMjQab4w

Since these are solutions for previous CTF, I'm thinking the the way I'm creating the messages isn't the same as the server.

This ECDSA implementation should be vulnerable, right ?
This is the modified code that I have right now.


texts:
Consider the following fixed length MAC for messages of length $\ell(n)=2n-2$ using a pseudorandom function $F$:

On input of a mesage $m_0||m_1$ ($|m_0| = |m_1| = n-1$) and a key $k \in \{0,1\}^n$, algorithm Mac outputs $t=F_k(0||m_0)||F_k(1,m_1)$. Algorithm Vrfy is defined in the natural way.

Is (Gen, Mac, Vrfy) existentially unforgeable under a chosen message attack? Why?


texts: SpongeWrap without padding and frame bit

texts:
Assuming all inputs are same length as rate except last can be shorter. Is it necessary to pad every input (not just last) to sponge for authenticated encryption to be secure?

Is this just, because it is wrapped around Absorb and Squeeze?

What is purpose of frame bit in SpongeWrap?


texts: Statistical saturation attack on block ciphers

texts:
I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is this

What I really need is basic explanation of the attack itself with a small example if possible such as any basic block cipher that you could come up with, with 3-4 rounds. This is for my personal understanding so any input is more than welcome


texts: Why does SSH authentication protocol send a challenge message instead of using digital signature to verify client

texts:
Why does SSH authentication protocol choose to have the server with the public key send a challenge message encrypted with this public key of the client instead of having the client send a message signed with it's private key along with client ID and have the server verify the signature?

Wouldn't verifying the signature be enough proof that the client really does possess the private key and hence is authenticated?


texts: Rabin-Williams, blinding and size of Integer r?

texts:
I was reading the paper Breaking the Rabin-Williams digital signature
system implementation in the Crypto++ library. The library uses blinding, but it was not enough to stop key recovery.

But my question is about the Integer r used for blinding. Crypto++ uses a random integer in the range [1, n-1]. Then, the operation proceeds by calculating m * r (mod N); (m * r)d (mod N); and finally (m * r)
d * r-d (mod N) = md (mod N). If n is 3072 bits, then r is effectively 3072 bits.

Since r needs to provide a mask at an equivalent security level of 128-bits, wouldn't a 256-bit integer suffice to mask the operation? In this case, its 128-bits times 2 because there's a 50/50 chance of selecting a 0 or 1. So someone trying to build a system of equations to deduce bits in the private key would need a table at least 2128 in size.

Is there criteria in selecting the size of the blinding integer r for Rabin-Williams? Or is it convention (or required) to always use the size of the modulus?


texts: Add a pepper to a hash: as a string or a buffer, and should I calculate a hash of a peppered plain text?

texts:
I'm using a bcryptjs to generate a computationally slow hash function for storing passwords:

BCRYPT.hash(plainTextPassword, HASH_ROUNDS_NUM);

Now I want to add a pepper before a hash is calculated:

BCRYPT.hash(pepperedPassword, HASH_ROUNDS_NUM);

where pepperedPassword = plainTextPassword + PEPPER;

Questions:

Should I represent a PEPPER as a string or as a buffer?
To calculate a pepperedPassword I can either just concatenate two values:

pepperedPassword = concate(plainTextPassword, PEPPER);

or concatenate them and then calculate a fast hash of it (in addition to  bcrypt):

const concatPassPepp = concate(plainTextPassword, PEPPER);

const hashedConcatPassPepp  = crypto.createHash("SHA3-512").update(concatPassPepp, "utf8").digest("base64");

Is it a useful idea to calculate a fast hash of password-pepper concatenation before sending it to bcrypt? Which scenario should I prefer?

Both questions are asked from security and performance point of view.


texts:
I'm trying to understand how Chia proof of space work, reading docs at https://github.com/Chia-Network/chiapos/tree/main/documents
According to this doc, I need to calculate f(x1) = f2(x1, x2) but with the requirement f1(x1) == f1(x2) + 1.
The problem is, f1 is not a permutation. How do I handle the x1's for which there is no such x2? It seems f(x1) is not defined for about 2/3 of the domain.


texts: Can two elliptic curve point multiplications have a same resulted point?

texts: Is it possible for $aG \equiv bG$, with $a, b$ are scalars and $G$ is a point on the curve?


texts: AES process candidates implementations and usages

texts: There were fifteen candidates in the AES selection and I suppose that Rijndael wasn't the single good algorithm. I know that Camellia is an evolution of E2 candidate and can be used as symetric cryptographic routines in TLS. Which others ex-candidates have today a "serious" implementation and a real usage ?


texts: Making attacks on password hashes less economical

texts:
Perhaps an abstract question on complexity given the trade offs between memory vs runtime, I was wondering if it's possible to constrain only either extremes approaches to be optimally efficient, thus making attacks on hashes less economical.

Background

I attended a seminar on recent publication, Scrypt is Maximally Memory-Hard 1, where the authors focus on scrypt, a simple candidate Memory-hard function (MHF) designed by Percival, and described in RFC 7914.

From the abstract:

  We prove that scrypt is optimally memory hard, i.e., its cumulative memory complexity (cmc) in the parallel random oracle model is $\Omega(n^2 \cdot w)$, where $w$ and $n$ are the output length and number of invocations of the underlying hash function, respectively.

Additionally in the introduction:

  In this work, in Section 5, we also prove an optimal $\Omega(n^2 \cdot w)$ lower bound on the parallel cumulative pebbling complexity for a game which abstracts the evaluation of scrypt: we consider a path of length $n$, and an adversary must pebble $n$ randomly chosen nodes on this graph, where the ith challenge node is only revealed once the node of challenge $i − 1$ is pebbled. This already gives an optimal $\Omega(n^2 \cdot w)$ lower bound on $cc_{mem}$ for scrypt for adversaries who are only allowed to store entire labels, but not any functions thereof.

From my understanding, it would be possible for an adversary to formulate a strategy that is a suitable compromise between memory and runtime complexity, e.g. where pebbles for $X_0, X_1, \dots , X_{n−1}$ are stored for only the even $i$, thus halving the worst case memory usage, while also having the worst case runtime, but yet leaving the total memory·time cost the same as before.

Question

For a single system, I'd say hardware cost is nonlinear with respect to CPU performance or size of onboard memory, i.e components representing the extreme of either spectrum may be exponentially more expensive. Thus to lessen the rate of return or increase the necessary capital investment an attacker would expect, we might like to mitigate the usability of midrange hardware that would otherwise be the most economical to use.

To visualize my rudimentary thoughts, I've included a crude graph below, where x and y axis are memory and time usage. The volume of the orange rectangle intersecting the purple line at the green point represents the total memory·time cost for any configuration, e.g. if you had sufficient memory one could compute the hash in $\frac{1}{2}$ time units. I was wondering if a problem could be formulated such make the memory·time cost follow the red curve instead, thus pushing an adversary further towards hardware extremes to achieve optimal memory·time costs while to the detriment of hardware cost.

  https://www.desmos.com/calculator/rpjseuy0sj

Perhaps there are studies some of you may know that touch on optimal efficient outcomes from an economic standpoint, i.e. considering hardware investment, operational costs, expected return per solution. I guess this sounds like a miners optimization problem when working with crypto currencies that require proof of work, but I'm slightly more interested in the economics the motivate attackers or scammers.

@misc{cryptoeprint:2016:989,
author = {Jo\"el Alwen and Binyi Chen and Krzysztof Pietrzak and Leonid Reyzin and Stefano Tessaro},
title = {Scrypt is Maximally Memory-Hard},
howpublished = {Cryptology ePrint Archive, Report 2016/989},
year = {2016},
note = {\url{https://eprint.iacr.org/2016/989}},
}

Basically

Are there any functions that render a linear combination of memory or runtime approaches less efficient than committing solely to either a memory or compute speed optimizations, thus always making midrange hardware unsuitable for profitable attacks?


texts: FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

texts:
I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you look, both values of $\sigma$ are made by different values. I can't understand how it's possible that $\sigma_b = \sigma_a$.
I need to understand which combination of $d$, $e$, and ephemeral keys are necessary to allow the node to reach the same $\sigma$ value in order to gain the same shared secret key.


texts:
In this Paper, Shamir secret sharing scheme  there is one dealer and n players. The dealer gives a share of the secret to the players, but only when specific conditions are fulfilled will the players be able to reconstruct the secret from their shares. The dealer accomplishes this by giving each player a share in such a way that any group of t (for threshold) or more players can together reconstruct the secret but no group of fewer than t players can. Such a system is called a (t, n)-threshold scheme (sometimes it is written as an (n, t)-threshold scheme).
I found that everyone who is participating in the secret sharing scheme has some benefit. For suppose, participants can able to get shares and reconstruct the secret, which they didn't know in prior. But, for a dealer, I feel that there is no benefit or purpose for itself to participate in the whole system since the dealer knows all the things in prior and is just doing its role to make the scheme work.
Is it true? Is the dealer a volunteer in Shamir secret sharing scheme?
If no then what is the purpose for him to involve in the scheme?


texts: What does universal look like? What is the complexity(size/depth) of universal circuit

texts: I was reading a paper about attribute based encryption. The authors showed that ciphertext-policy ABE can be constructed from key-policy ABE using universal circuit. But the universal circuit should be in the circuit space supported by CP-ABE. So what is the complexity of universal circuits?


texts: Diffie-Hellman should size of group be a prime?

texts:
I have found some contradicting answers regarding finding a safe prime.

  When p is a "safe prime", this means that $(p−1)/2$ is also prime. We then define $q=(p−1)2$. In that situation, the order of any non-zero $g\mod p$ (except 1 and p−1) is either $q$ or $2q$

If it can produce a group of size $2q$ then the groups length is by definition not a prime.

Okay, so following this theory, 83 should be regarded as a safe prime.

$(83-1)/2=41$ and $41$ is a prime.

The length of the subgroup produced by $2 \mod 83$ is $82$. (can you phrase it like that? Even though it refers to a set/group of congruences by $2^{1..p-1} \mod p$?

I can prove it with a little program

const groupSize = (p, g) => {
    const group = new Set()
    for(let i = BigInt(0); i < p-BigInt(1); i++){
        group.add((g**i)%p)
    }
    console.log(group.size)
}
groupSize(BigInt(83), BigInt(2))

output: 82

This contradicts an answer to one of my previous questions regarding choosing a safe prime.

  If h is a factor of the size of the group generated by g, then given $g^x\mod p$, we can compute $h\mod n$ in $O(\sqrt h)$ time. If g generates the entire group, well, its size will be $p−1$, which always has a factor of 2 (assuming $p>2$), and so we'd be giving away $x\mod 2$ for free.

Diffie-Hellman what is the subgroup

This makes me believe that the group cannot be an even number, since it is then a factor of 2?


texts: Understanding Genkin-Pipman-Tromer's ground potential, side channel attack on RSA

texts:
I'm pretty sure that by now folks might have come across this research from Genkin-Pipman-Tromer (GPT) on extracting the RSA key used by GnuPG (GPG) just by measuring the ground potential. I'm going to call it the GPT attack on GPG for short. I have done work on extracting informational content of a processor core by studying it's high frequency current draw at power supply source but this is cool because it's a low frequency analysis (i.e. easier to perform).

Their work is at http://www.tau.ac.il/~tromer/handsoff/ and I got lost at Q13, where they point to the frequency components as an indicator of when the exponentiation with the secret primes p and q happen. The spectrograph is sideways (time is vertical and frequency is horizontal) and the 12 yellow arrows show 12 RSA decryption captures where the algorithm switches from the exponentiation of p to the exponentiation of q. I get that.

But then the question (Q14) they immediately have a lovely analog wave showing the final private key bytes (basically p and q)! Here it is:

I recall that a 0 bit in the base to be exponentiated, simplifies the modular exponentiation but that still doesn't explain the jump to the final image showing the secret bits in all their glory.

Question: How did they jump from the spectrogram showing the RSA exponentiation timings straight to the secret bits? I expect that jump is highly dependent on GnuPG's RSA implementation. If you can supplement with the math (informal math ok), bonus points!

PS: Yes, I know they did similar low frequency analysis with the spectrum of acoustic signals emanating from the decrypting chassis. I also suspect this might be due to RSA being partially homomorphic ...


texts: Why is the Lovász condition used in the LLL algorithm?

texts:
The LLL algorithm is used to approximate the Shortest Vector Problem, i.e., it outputs a reduced basis. Such a basis will satisfy two conditions:
  $$ \forall i \gt j. \quad \lvert\mu_{ij}\rvert \le \frac{1}{2} \qquad\text{[size-reduced]} $$
  $$ \forall i.\quad \lVert b_i^*\rVert^2 \le \lVert b_{i+1}^*\rVert^2 + \mu_{i+1,i}^2\lVert b_i^*\rVert^2 \qquad\text{[Lovász condition]}$$

It seems the first condition assures the resulting basis is nearly orthogonal.
But what does the Lovász condition mean and why is it used?


texts:
I have found many sources against cascading encryption, however I am having trouble finding arguments FOR using cascading.

AES-256 + BlowFish + RC5 etc... each with a different key.

This is for university, so preferably need sources I can reference (so no blog posts unless they are from reputable people).

I also do not need to worry about other weaknesses like dumping RAM, short passwords etc...

Thanks!


texts: AES-GCM encryption and decryption doubts

texts:
I'm using AES-GCM mode in my project and I have some doubts.

public String encrypt(String plainText, String authenticationTag) throws GeneralSecurityException, IOException {
        Cipher cipher = Cipher.getInstance(ALGORITHM_MODE_PADDING);
        final int blockSize = cipher.getBlockSize();
        SecretKey secretKey = readKeyFile(...);
        byte[] plainTextByte = plainText.trim().getBytes(Charset.forName("UTF-8"));
        byte[] ivBytes = generateIV();
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, new GCMParameterSpec(GCM_TAG_LENGTH, ivBytes));
        cipher.updateAAD(authenticationTag.getBytes(Charset.forName("UTF-8")));
        byte[] encryptedMessage = cipher.doFinal(plainTextByte);
        byte iv_and_encryptedMessage[] = concatIvAndCipher(ivBytes, encryptedMessage, blockSize);
        Base64.Encoder encoder = Base64.getEncoder().withoutPadding();
        String iv_and_encryptedText = encoder.encodeToString(iv_and_encryptedMessage);
        return iv_and_encryptedText;
    }

    public String decrypt(String iv_and_encryptedTextBase64, String authenticationTag)
            throws GeneralSecurityException, IOException {
        Cipher cipher = Cipher.getInstance(ALGORITHM_MODE_PADDING);
        final int blockSize = cipher.getBlockSize();
        Base64.Decoder decoder = Base64.getDecoder();
        byte[] iv_and_encryptedMessage = decoder.decode(iv_and_encryptedTextBase64.trim());
        byte[] ivBytes = extractIvFrom(iv_and_encryptedMessage, blockSize);
        byte[] encryptedTextBytes = extractEncryptedMessageFrom(iv_and_encryptedMessage, blockSize);
        SecretKey secretKey = readKeyFile(...);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, new GCMParameterSpec(GCM_TAG_LENGTH, ivBytes));
        cipher.updateAAD(authenticationTag.getBytes(Charset.forName("UTF-8")));
        byte[] decryptedByte = cipher.doFinal(encryptedTextBytes);
        String decryptedMessage = new String(decryptedByte, Charset.forName("UTF-8"));
        return decryptedMessage;
    }

Questions:

I'm using a GUID as authentication tag which is binding to a user to whom the sensitive information belongs. The encrypted text and tag is stored in separate databases at separate locations. Is this OK?
From what I've read AES-GCM takes in (plain text, IV, key, associated data) and outputs (cipher text, authentication tag). Are associated data and authentication tag the same thing, because my implementation of encrypt and decrypt work when I pass same value in cipher.updateAAD(...)? How to obtain the authentication tag after encrypting?
Should I use Bouncy Castle instead of using default Java implementation?
If the data to encrypt is 16 bytes, when should I generate a new DEK for enc/dec?
One master KEK for all DEK's? For encrypting DEK's should I use same AES implementation? If not, then what to use?


texts:
I have a device, HASP, which has functionality to encrypt 8 byte data using 3DES in ECB mode, with three different keys, I am interested how secure is this?
I know it might not be most secure, but how much? Attacker may query HASP to encrypt something, and try to bruteforce keys from this?

Idea is I thought if I need CBC in my application, I will query the HASP as many times as needed and perform chaining of blocks on PC side.

Or is it better to tell HASP producers to implement encryption of single block however in CBC mode?


texts: Hide secrets in an article composed with Machine Learning?

texts:
Say that Alice wants to communicate with Bob, but she does not want any direct contact with him. Instead, Alice will put the secret in public, such as a discussion board, and Bob will come there to get the info.

Assume that the secret is "attack", Alice can come up with the sentence "Apple is the best to eat, and it can really keeps you healthy." Assume Bob knows the magic key 2, he can retrieve the secret.

My question is, how possible it is to generate an article (that makes sense) out of a longer secret, such as a sentence? Is AI good enough to do it?

Of course, the shorter the word-span, the harder it is to compose a suitable article. But if I require a relevant word appears at the location 1, 51, 101, 151, ..., I think it is not too hard.

Update: thank you all for your reply. As you see, the example I gave is rather simple. I can easily improve the "magic number", instead of using 2 or 50 or 100, I can generate a series of random number from the same seed, owned by Alice and Bob.


texts:
I read the $K$-Friedman test to determine the period of a Vigenère ciphertext, and I understand something like this:

$K$-Friedman test tries to find out what period of the cipher by calculating some values of $K(C,C^n)n$, where $C^n$ is the ciphertext with $n$ shifts to the left, thereby determining the most likely value of the cipher.

But deep down, what the Friedman Test does? Overlaps two texts and see coincident indexes? Can anybody explain this method better?


texts: LUKS: decrypting with master-key rather than with passphrase

texts:
It's my understanding that LUKS encrypts data by using a randomly-generated master-key, which is then itself stored encrypted by my passphrase. When I want to access the data, I use my passphrase to decrypt the master-key, which is then used to decrypt the data.

Question:
Is it possible to have LUKS just encrypt the data by using the randomly-generated master-key (can I specify the size?), but then instead of encrypting this with my passphrase and storing it, just tell me the master-key (which I will memorize or write on a piece of paper). When I'll want to access the data, I will use the masterkey to decrypt it.

As a side note, let me explain why I think that this would be more secure than the usual procedure: when cryptographically sanitizing a USB or non self-encrypting SSD drive (or changing the LUKS password), it's my understanding that the master-key encrypted by the old password will always be physically present on the drive, because digital sanitization is hard to achieve for USB and SSD. The randomly-generated master-key would then be recoverable by either guessing the old password, or by brute-forcing it.


texts:
According to the original paper of Bernstein, there is no key validation needed when using Curve25519 for Diffie-Hellman Key Exchange. However, where does this property come from?
Is there any proof or argumentation available in order to understand this really practical property of Curve25519?
Does this mean that each $x$ coordinate could belong to a point $P=(x,y)$ from Curve25519? Is that even possible?


texts:
I'm trying to figure out whether the following is impossible or merely improbable:

Does there exist an input, I and its hashed value, H, such that:

hash(I) --> H and hash(H) --> I

If not, what prevents it?


texts: Authenticated encryption mode for stream cipher?

texts:
Block ciphers have modes like GCM or OCB that combine primitives to provide both authentication and encryption.

Are there similar constructs for stream ciphers, which provide both authentication and encryption using only one cryptographic primitive - actual stream cipher (or keystream)?


texts: Why algorithmic symmetry is important in hardware implementation?

texts: In AES, the encryption and decryption functions ordered in a symmetric way, I mean the same order of functions are used inside the round structure of both encryption and decryption (subbytes, shiftrows, mixcolumn, addroundkey) (see The Design of Rijndael List 3.8 page 49) but how does it actually make the algorithm better in hardware implementation?


texts: Can I say "I have encrypted something" if I hash something?

texts:
As I understand it, a hashing algorithm is some kind of encryption, just a specific kind of it. So is it wrong to say "I encrypted this value." if I "only" hash it?

I understand that it gives the wrong impression, but I think it is not absolutely wrong, or is it?


texts:
I have a scheme and I don't know that this scheme is semantic security or not.

Secret keys $\{s_1,s_2, x_1,x_2\}$ and public parameter $p$ (large prime number).
Encryption E(m): $C_1 = s_1m + x_1k \bmod p$ and $C_2 = s_2m + x_2k \bmod p$ where $k$ is pseudo-random number.


texts: Building content-defined chunking with adversarial data preserving guarantees on splitting probability and global stability

texts:
I'm using the Prolly tree data structure. This structure operates on serialized data which it chunks at the byte level into pieces. To build trees recursively, the list of chunk hashes is itself serialized and chunked until an un-chunked root node is created.
I am building a distributed application that must construct these trees on potentially adversarial data. The normal chunking algorithm can be manipulated to produce badly performing chunks that are oversize or undersized. I need a chunking algorithm that can guarantee good chunking properties while being publicly known to the attacker.
This algorithm must be globally stable to preserve the efficiency of the data structure since local modifications should not require recalculation of chunking outside some local region. This ensures modifications have consistent log(n) tree size dependent time complexity.
I'm interested in a secure solution to this problem, even if not very efficiently computable.

What I think may be doable is some standard rolling hash function applied over a one-way hashing of the original content to determine the splitting points, but I've not been able to write a non-fundamentally-flawed algorithm.


texts: For discrete elliptic curves, can you find G, if you are given b and B?

texts:
I know you cannot find $b$ if you are given $B$ and $G$, where $B = [b]G$,

but can you find $G$ given $b$ and $B$?


texts:
Alice is color blind.  She never knows if her gloves are matched.  Her
  brother Bob always   teases her saying her gloves are mismatched and
  she should go change them.  Alice wants to  know if Bob is telling the
  truth about her gloves.

  Assuming Alice only has 2 colors of gloves, how can she design a
  protocol that she can use  with her brother to determine if Bob is
  being truthful or just teasing her?

I would assume that Bob decides at the beginning whether to tease or be honest. If teasing, he chooses his response at random.

My intuition tells me this problem is similar to the coin toss over the phone problem... but I can't seem to create a scheme where Alice would know if he was telling the truth is she has no way of verifying?  Any help would be appreciated as I'm studying for finals!


texts: Solving the discrete logarithm problem for a weak group

texts:
I was reading an answer about an attack on a weak group for the discrete logarithm problem and wanted to formalize and verify that the attack was correct. That is, that it was guaranteed to always find $x$ (and quickly) given $g$, $h$, and $p$ for $h \equiv g^x \pmod p$. Please read the answer here. In the process I think I found a mistake on the author's part, but figured out how to quickly solve the problem anyway. A number of other questions came up in the process that I'll ask below.

I'll start by proving the first assumption of the attack. How do we know $\forall i: \exists x_i: g^{x_i} \equiv h \pmod {a_i}$?

We know $a_i | p$. Let $b_i = p / a_i$. We also know $g^{x} = py + h$ for some $y \in \mathbb N$. This implies $g^{x} = a_i \cdot b_i \cdot y + h$, so $g^x \equiv a_i \cdot b_i \cdot y + h\equiv h \pmod {a_i}$. Thus, $x$ satisfies $x_i$ in the equation above, so $\forall i$ there is at least one solution and $x \equiv x_i \pmod {a_i}$.

How do we most efficiently compute the $x_i$?

It seems like according to these records listed on Wikipedia that a number field sieve algorithm will be the fastest since these are fields of form $(\mathbb Z / p \mathbb Z)^\times$, $p$ prime, and that's what the records are for. On the other hand, it must be faster, even for the best implementation of this algorithm to simply do trial multiplication until $p$ is at least so large.

How do we know that $\exists x': \forall i: x' \equiv x_i \pmod {\phi(a_i)}$?

Now, the author suggests using the Chinese Remainder Theorem (CRT), but because the $\phi(a_i)$ are not pairwise coprime (in particular, $2$ is a divisor for each $\phi(a_i)$), this doesn't follow. This really threw me off because for a while I was trying to prove that such an $x'$ existed, and was trying to understand how the group order of each cyclic subgroup was relevant to finding $x$.

If you think can explain where the author may have been going, please let me know.

What we're actually looking for is a $x'$ such that $x' \equiv x_i \pmod {a_i}$ holds $\forall i$. By the CRT we know that such a $x'$ exists, and is unique (up its residue modulo $p$). Thus we know $x' \equiv x \pmod p$.

Now we just need to efficiently compute $x'$.

How do we efficiently compute $x$ that satisfies the $x \equiv x_i \pmod {a_i}$ equivalences?

Again, reading from Wikipedia it lists solving the equivalences for the first two moduli using the extended Euclidean algorithm and Bézout's identity, followed by extending the solution to all equations as the fastest way to solve this. Will any optimized algorithm, in general or in particular, such as a number field sieve or the Pollard rho method work faster than the two steps listed above? That is when the group is "weak" (or when it is "weak" in this particular way being a composite of many small primes) is there such an algorithm that will always work faster and implicitly take advantages of the weaknesses?

Am I missing any important ideas? Is there a more illuminating way to explain anything I did above?


texts: Why does RSA OAEP add this many zero bytes?

texts:
The choice of $n_\text{Len}–K_\text{Len}–2\,H_\text{Len}–2$ zero bytes seems arbitrary to me and I can't see any reasoning for why it was chosen and it doesn't look like the zero bytes being replaced at any point either? Why was this specific formula used? From section 7.2.2.3 of Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography:

  b. Construct a byte string $PS$ consisting of $n_\text{Len}–K_\text{Len}–2\,H_\text{Len}–2$ zero bytes. The length of $PS$ may be zero.

  c.   Concatenate $HA$, $PS$, a single byte with a hexadecimal value of
  01, and the keying material $K$ to form data $DB$ of $n_\text{Len}–K_\text{Len}-1$
  bytes as follows:

  $$ DB = HA \mathbin\| \text{PS} \mathbin\| 00000001 \mathbin\| K,$$
  where $00000001$ is a string of eight bits.


texts: Key management protocol for end-to-end security on Advanced Metering Infrastructure

texts:
I am currently working on a research on end-to-end security implementation for Advanced Metering Infrastructure (AMI). Pardon me if I a bit off topic or not asking the right question as I am relatively new in the cryptography field and hope to get more information.

So basically I am to research on implementing security for smart grid system ensuring data integrity, authenticity as well as confidentiality for AMI when message is passed from the smart meters, to a concentrator where it computes and aggregate data received and finally sent to the utility end. One important consideration is that smart meters have limited processing power. As such, the cryptography algorithm should not have a large processing overhead in this case.

So right now I have this in mind after some research and reading relevant literature:

A shared master key across all the devices.
Smart meters authenticate themselves using this master key together with their unique ID.
After which this master key will be used to generate a session key for secure transmission.
Using HMAC and related algorithm to sign data and transmit to concentrator. Concentrator perform checking base on the HMAC received. If integrity is verified, it is then send to the utility.

The usage of a symmetric key (master key) is to ensure that there will be lesser computation as compared to any asymmetric design.


texts: Sigma protocol ZK-proof of a pair of pedersen commitments

texts:
Let's say you are using a $\Sigma$ protocol ZK proof to prove knowledge of $x_1, x_2$ so that $Y = g_1^{x_1}g_2^{x_2}$. Of course $g_1$, $g_2$ are generators within cyclic group G of prime order q, with q of sufficient size.

My question is, if $z = dlog_{g_1}g_2$ is known to the prover, how would that affect the soundness of the proof? If the value of z is known to the verifier, how would that affect honest-verifier z-k property?

Intuitively it seems like knowing z would break things, but I don't see how.


texts: Lattice Crypto worst case to average case

texts:
I am currently reading the ETSI white paper Quantum Safe Cryptography and Security

On page 24 one finds the following statement:

  Lattice problems also benefit from something called worst-case to average-case reduction, which means that all keys are as hard to break in the easiest case as in the worst case when setting up any of the parameters of a lattice based cryptosystem. In a crypto system like RSA, generating keys involves picking two very large random numbers, that should be prime and should yield a hard instance of the factorization problem, but there is a certain degree of probability of choosing wrong and resulting in a weak security level. In lattice-based cryptography, all possible key selections are strong and hard to solve.

This puzzled me, because I had a different understanding of worst-case to average case reduction in lattices.
According to my understanding it means the following:

  A lattice cryptosystem on the average (i.e. with randomly chosen keys) is as hard as the hardest problem of the underlying lattice problem. This does not imply that all possible key selections are strong and hard to solve.

Now, who is wrong? Me or ETSI ?


texts: Simple example to describe Bilinear mapping

texts:
Notation : $\mathbb{G}$ is an additive group and $\mathbb{G}_T$ is multiplicative group of prime order $q$.

Bilinear mapping $e: \mathbb{G} \times \mathbb{G}  \rightarrow \mathbb{G}_T$ has to satisfy two properties.

1) $e(aP,bQ) = e(P,Q)^{ab}$        for all $P,Q \in \mathbb{G} , a,b \in \mathbb{Z}_q$

2) $e(P,P) \ne 1_{\mathbb{G}_T}$ for all $P \in G$

In addition to the above two, it has to be computable.

Is there any simple example for such bilinear pairing?

I searched over internet as I can but I didn't find.

I want example like this $e(x,y) = xy \mod n$ (It's not a valid example).

Note: The sets under consideration $\mathbb{G},\mathbb{G}_T$ must have at least four elements.

Duplicate question for https://math.stackexchange.com/questions/1380004/simple-example-for-bilinear-mapping


texts: Can prepending "junk" be equivalent to an IV when encrypting using CBC?

texts:
We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption.  We are considering two approaches to make this secure; use an initial vector (which we then need to store as well), or just prepend some junk to the integer before encryption (possibly 6 characters, this is the plaintext we might encrypt to store 123: "fI8cW3123").

The second approach seems better to us, (we only store a single value, and "discover" the IV while decrypting), but we aren't cryptography experts.  Is this dangerous or less secure?


texts: Why does OpenSSL append extra bytes when encrypting with aes-128-ecb?

texts:
Plaintext:

Attack at dawn!!

Hex:

41747461636b206174206461776e2121

Key:

abcdefghijklmnop

Hex:

6162636465666768696a6b6c6d6e6f70)

Through calculations done both by hand and with various sites online, the result should be:

379693884e25f00f6e8aaa43df4db541

The result is the same length as the input, byte-for-byte.

I tried to recreate this result using OpenSSL with the following:

echo 'Attack at dawn!!' | openssl enc -aes-128-ecb -K 6162636465666768696a6b6c6d6e6f70 -nosalt -out out.bin

The output is:

379693884e25f00f6e8aaa43df4db541
8e64ce873f174dbb2423fcd814580e15

The fact that the first 16 bytes of the OpenSSL result is the same the by-hand calculations shows me that I'm on the right track.

My question is: What are the remaining "extra" 16 bytes for?


texts:
Daniel Roesler's personal page has a live examples table for WebCrypto support.
https://diafygi.github.io/webcrypto-examples/

Without explination he marks several as "Discouraged! Only use for backwards compatibility!". Two of them i am using in my application are RSA-OAEP for encryption, RSASSA-PKCS1-v1_5 for signing. As far as I know they are not broken.

On the other hand ECDSA and HMAC are recommended by him for signing.

Why is no RSA method recommended for encrypting?

So can someone please help me understand the reasoning for marking these methods the way they are?

Is it just that, for example, elliptic curves produce smaller key sizes for the same level of security?

or about potential for missus, or browser implementation?


texts: How can I prove "single-use authorization" from multiple parties without revealing identity?

texts:
I've been trying to create a distributed authorization protocol where identities are not revealed. Let me explain with an example.
Let's assume we have 4 actors, Alice, Bob, Charlie, and Dan. Alice is authenticating at Bob and Charlie's server and getting authorization from them. This authorization is valid for one-time use only. After that, Alice will send a request to Bob, Charlie, and Dan where she'll have to prove that she has the authorization without revealing her identity to them. And after 1 request, this authorization cannot be used again.
My Progress so far: I've been doing some research on Zero-Knowledge Proofs of Identity. The latest topic I've been reading up on is anonymous credentials. Using Anonymous credentials we can solve almost all the issues, but there is just one problem. So far as I know, after authenticating using anonymous credentials, you can use its proof as many times as you want. This completely takes away the on-time usage aspect of the authorization.
Can someone help me achieve the desired properties in my system?


texts: Verion of crypto_box() which doesn't allow the sender to decrypt previously sent messages

texts:
Libsodium's crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the receiver to verify the identity of the sender knowing its public key.

However, since those functions work by calculating a shared symmetric key, the compromise of the sender's private key would allow the attacker to decrypt all messages previously sent using the same combination of sender's private key and receiver's public key.

There's another function, crypto_box_seal(), which does not have this weakness, since it uses an ephemeral keypair, but it doesn't allow verifying the identity of the sender.

Is there a function which allows both things - verify the identity of the sender and make sure previously sent messages can't be recovered without knowing the private key of the receiver?

I was thinking of doing what crypto_box_seal() does, but instead of using Poly1305 as an authentication tag, use the output of crypto_sign_detached() on the hash of the rest of the output (i.e. on ephemeral public key and ciphertext). That is, for each message, we generate an ephemeral keypair, encrypt plaintext using it, then sign the whole thing using our long-term private key and use that as an authentication tag. Would that make sense? Is there perhaps a better way?


texts:
OK, so we've had questions about hashes build from stream ciphers (not a good idea) and about stream ciphers made out of hashes (yes, of course, use counter mode). What I want to ask is related but doesn't seem to have been asked before.

Is it possible to make a streaming hash? With a "streaming hash" I mean a hash function whose state is updated for each separate byte, instead of the byte itself having to be cached until a full message block is known.

Or, to turn the question around, is it required to always split the message into blocks instead of processing bytes? Or is this just an artifact of the functions used internally by the hash?


texts: Zero knowledge proof of equality of discrete log and hash preimage

texts:
So my question is as follows: We know that we can prove in zero-knowledge equality of discrete logs, for example to prove equality of committed values we can prove in ZK for $g^xh^y$ and $g^{x'}h^{y'}$ that $x = x'$ using a Sigma protocol.

Is there a way to prove equality when one committed value is the output of a hash function? This means prove in ZK for $g^xh^y$ and $H(x')$ that $x = x'$. (the tricky part here is that the Hash function doesn't necessarily have homomorphic properties as the commitment does)


texts: Dangers of using CTR mode for encryption

texts:
I know that it is never suggested to use the same key or key/IV pair twice for a stream cipher or for a block cipher operating in CTR mode. Filesystem-level encryption reuses the same key for a file when it is edited.

Would it be an okay idea or a bad idea to use CTR mode for such encryption? Would it require changing the IV upon each edit and re-encrypting to make sure it is secure?


texts: How is an epsilon of 1/1000 non-negligible?

texts:
Lately I've been studying cryptography and in the current course I'm taking we're reviewing statistical tests and how they can be used to determine if a pseudo-random generator is secure or not.

Essentially, one of the requirements for a Pseudo-random generator to be secure is that the probability of guessing the next bit in the string is less than 1/2 + a non-negligible epsilon (epsilon being any statistical advantage the computer has of guessing the next bit of the string due to insecurity in the PRG).

In an example the professor uses, he states that the probability of guessing the next bit of output from the PRG is 1/2 + 1/1000 (the non negligible epsilon).

How is 1/1000 non-negligible? I understand we're using computers with thousands of times faster processing power than a normal human brain, but that still means that a computer only has a 50.1% chance of guessing the correct bit. How can a computer leverage that tiny extra probability to crack a secret key?


texts: Does secp256k1 have any known weaknesses?

texts:
I am wondering whether there are any properties of the curve which would technically make it easier to attack than any other curves of 256 bits in size.

I have heard that being a Koblitz curve, it has a few bits weaker security than some other curves of the same size - I was wondering if anybody has a source for a proof (or sketch proof) of this fact if it is true, and for any other properties that may make the secp256k1 considered weaker.

EDIT: I have found this website http://safecurves.cr.yp.to/index.html which states that the curve does NOT satisfy all of the safety requirements for that website - however I am unable to understand the parameters under which it is considered not safe, and explanation on this would be nice too thanks :)


texts: I'm looking for a service that can verify an identity by enter a code or key. For example, I want to be able to send a doc to a anonymous person with a specify code or crypto and that person copy that code into an app or similar service to verify that code match with my ID. The goal is to avoid usurpation of ID. Thanks for the help.


texts: Does this implementation of a function operate in constant time?

texts:
Suppose we have a function that takes $n$ parameters, each being one bit in size, and returns a single bit. Internally, this function has a bit string $N \in \{0, 1\}^{2^n}$ and it operates by using the $n$ inputs to form a pointer to bit $i$ in $N$, where $i$ is equal to the input bits being concatenated and treated as an integer.

As an example, imagine we have $F(a, b, c)$ and $N = 01110001_{2}$. If we have $F(1, 0, 1)$, then the output will be found by retrieving bit $101_{2} = 5$, which would be $1$ (or $0$ if you want the left-most bit to be bit $0$).

Would implementing a function this way run in constant time? If it's implemented in hardware? If it's implemented in software?

Update: I thought it was obvious, but selecting the bits from $N$ would be implemented using a bitwise shift followed by a bitwise AND (with the value $1$).


texts: Connections between Instance Hiding and Fully Homomorphic Encryption

texts:
Another approach taken by researchers for carrying out computations over encrypted data is Instance Hiding.

In brief, If a user wants to outsource the computation of a function for a particular input x (instance). She transforms the input x to an encrypted input y (thus hides it) in such a way that the server cannot infer x from y and sends to the server. The server computes the function on y and returns the result. (References below).

This is also called Encrypting Problem Instances. The functions that allow such transformations are called encryptable functions. These techniques argue that encryptabality is property of a function and not all functions can be encryptable.

If this is the case, it may contradict some results of Fully Homomorphic Encryption.
FHE tries to evaluate functions on encrypted inputs much generically.

Edit : in FHE, We transform the inputs (encrypt) them to cipher text which is then fed to say a function "add" carried out by server. Here add is generic function, does this mean add is encryptable function ?

I guess the catch is making assumptions on transformations

What is the catch here ? anybody ?

Refer :Abadi, Martin, Joan Feigenbaum, and Joe Kilian. "On hiding information from an oracle." Proceedings of the nineteenth annual ACM symposium on Theory of computing. ACM, 1987.


texts: DSS security in comparison to ECDSA or RSA

texts:
OpenVPN allows the users to choose the TLS cipher suite, depending on the deployed SSL/TLS library. With OpenSSL 1.0.2g and OpenVPN 2.3.11 this is a rather long list (Full list).

Amongst the many options there are TLS cipher suites like the following available:

DH-DSS-AES256-GCM-SHA384

Which breaks down to:

Key Exchange: DH
Signature: DSS
Cipher: AES256
Mode: GCM
Digest/Used for PRN: SHA384

I'm trying to validate the security of the deployed cipher suites, but I can't find details of the DSS signature method.

Is there another name, I may identify DSS as, or is it just very uncommon?

How does DSS perform, only considering the security?


texts: How to compute a discrete logarithm modulo a power of 2?

texts:
This question is related to this one. Specifically, assume that we have $p$ = 2048, $m$ = 13 and $c$ = 357.

In this case, $c\ =m^e\ \bmod \ p$.

I know that many algorithms rely on the difficulty of computing the discrete logarithm. I have read however that discrete log across powers of 2 is weak. Could someone explain to me why and how you would compute it in my example?


texts: Certificate public key keyexchange, Which key exchange is used in browsers?

texts: I have a question regarding the keyexchange happening in web browsers. If you check the certificate here on crypto.stackexchange you can go under details and see that the public key is type RSA (2048 Bits). Does this mean that StackExchange is generating a private key via RSA between them and me to encrypt my messages?


texts: Is it safe to send IV in plain text for every request?

texts:
Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles data but does not send anything back.

The plaintext data part of the QR code needs to be encrypted and should not be changed, nor intercepted, so I made the following protocol:

The IoT device generates a new EC keypair at every boot;
The server has a permanent EC keypair. The server public key is stored in the firmware of the IoT device;
When creating a QR-code, the IoT device calculates a DH agreement with the server's public key and the private key of the IoT device;
The IoT device creates an IV from an incremented nonce (8 bytes array);
The data gets encrypted using chacha20 with the calculated agreement;

The QR code is then generated using the following format: (IoT public key) + (iv) + (ciphertext).

The server is then able to decrypt the ciphertext by using the IoT public key, which can be used for calculating the agreement and the IV for decrypting the ciphertext.

Now I have several concerns since I am new to crypto and I am almost sure that my protocol is not safe enough.

Is it safe to embed and send the IV in plain text in every QR-code?
When using the same nonce, decryption will still work, what is the purpose or misuse of the nonce here?
Should I use chacha20 at all? Or is there a much better encryption/decryption method to use here?
I need to keep my server's public key secret and only in the firmware of the IoT device, to prevent 'fake devices' generating valid but fake QR codes, which sounds bad.


texts: Can frequency attack be successful on Vigenère cipher?

texts:
Here is my question when learning Vigenère cipher, can we perform frequency analysis attack toward this cipher?

My first impression is no, because each column of its matrix has exactly 26 English letters. But I also know that this cipher is not secure. So, my question is, whether and how we can perform frequency attack towards this cipher?


texts: how hashing algorithm is shared in public key

texts:
I am reading about public key working at following linkenter link description here

Here picture is provided

My question is how hashing algorithm is shared between sender and receiver?


texts: What kind of approach can I use to reverse the following encryption scheme?

texts:
I'm trying to reverse an encryption scheme without success. I have several pairs of ciphertext + plaintext and found the encryption method to be something like this:
K = secret key, eg. [a,b,c,d]
P = key provided with the ciphertext, eg. [1,2,3,4]

Q = provided key bits shuffled around using each entry as an index into the secret key

N = Q concatenated with one more byte resulting from state of the previous step (so it also depends on the secret key)

O = Has the same elements as the key provided, and each element is made by bitwise OR in this fashion: ( N[i] | N[i+1] )

Then O is xored with the ciphertext to get the plaintext.

I have no experience with cryptography, and as a programmer, my first approach was to reverse the procedure and try to find the key using my ciphertext-plaintext pairs.
Obviously, the first hurdle I encountered is that I can't reverse the OR combination.
I tried looking for information and learn what kind of approach I could try to solve this problem (And even how solvable it is), but I don't even know the terminology I could use to find it.
Any hint or help about how to tackle this, what to look for or where to learn more, would be greatly appreciated.


texts: 2DES Meet in the middle attack complexity

texts: In the meet-in-the-middle attack, if we built the tables first and then looked for matches, we would have another high complexity problem. For each of the table 1 entries, compare with all the table 2 entries; this algorithm has complexity of O(2^2k). How the matching could be done while building the tables, resulting in the total complexity remaining at O(2k+1)?


texts:
Let's consider hashing of odd 256-bit number $L$ with 256-bit odd key $K$:
$z = (2^{256}-L) \cdot K \bmod 2^{256}$
$z$ is the hashed number.

If $K$ is selected randomly is it secure to hashing numbers this way? It is as far as I know just linear congruential generator, they are not secure. But this is slightly different (we have exponentiation in modulus and we are not using it to generate some sequence of numbers, we have no seed, just numbers to hash). Why exactly it can't be secure?

Is it secure if $L$ and $K$ are selected randomly, to hash $L$ this way?


texts: Secure CCA Encryption under Partial Key Exposure

texts:
I'm currently learning about chosen ciphertext attack and stumbled across a problem on CCA security. If I have an encryption scheme $(Gen,Enc,Dec)$, which is CCA-secure with $Enc:\{0,1\}^n\times \{0,1\}^∗\to \{0,1\}^∗$
How can I build a new cipher out of $(Enc,Dec)$ with the keys $(k_1,k_2)$ which would be CCA-secure under partial key exposure i.e. the adversary knows only one of the key?
I was thinking of implementing a cipher $(Enc', Dec')$ such that $Enc'(P) = Enc_{k_2}(Dec_{k_1}(Enc_{k_2}(M)))$ and $Dec'(C) = Dec_{k_2}(Enc_{k_1}(Dec_{k_2}(M)))$ but then realized this scheme isn't secure CCA secure if the key k2 is known. I also read the paper On the Security of Multiple Encryption or
CCA-security+CCA-security=CCA-security? but wasn't too successful in understanding all the concepts listed in the paper. Any hints or idea on this will be extremely helpful. Thanks!


texts: Is there a proof-of-work scheme vulnerable to length extension attack?

texts: I wonder is there an example of proof of work scheme that uses a hash function and requires the hash function to be immune to length extension attack? I mean the scheme, that becomes easy to solve if we use vulnerable hash function, but has strong security properties as soon as the underlying hash function resists length extension.


texts: Finding an elliptic curve of specific order

texts:
I wish to use elliptic curves for cryptographic operations like commitments etc. I see that most standard elliptic curves like $\operatorname{secp256k1, sect571r1}$ have a certain specific and fixed order of the corresponding bit-length.
However, I require groups of non-standard order like say $q = (2^k)n +1$ for a certain $k,n$ for $k =128, 300$ etc.
Is there a way I can generate/form an elliptic curve group of any given order? Of course, I require solving discrete-log to be hard in the group.


texts: How should the length field be handled in a cipher?

texts:
Suppose that I have a chunked stream. Each chunk is to be encrypted separately. The structure is basically this:

([LEN][DATA])[MAC]([LEN][DATA])[MAC]([LEN][DATA])[MAC]...

How should one handle the LEN field? If I encrypt the whole thing in a (), this encrypts the LEN field as well. So at decrypt, LEN field must be first decrypted, to find out, where the MAC is. Which is considered a bad thing (as I found at several places that the recommendation is: "one should verify MAC before decryption").

The other solution, to pass LEN in cleartext, maybe not a good idea either, as I'd like to encrypt everything.

What's the correct solution for this problem?


texts: Which algorithm can be performed by humans?

texts:
Suppose I want my grandmother to perform encryption without any help from a computer, and she must encrypt the word 'HELLO' for me.

I could ask her to instead of typing the real keys, that she always hits the key thats on the right side of the real key. So that instead that she types HELLO, she types JR;;P. On my side I just look what JR;;P means, and I can decrypt that she said HELLO.

I am sure that she can do this. Is there an improvement possible to the scheme I just proposed, or is this the best the average human can do?


texts: Deriving AES key and HMAC key from shorter master key

texts:
I am working in .NET and as far as I can tell the only choice for key derivation is PBKDF2-HMAC-SHA1.  SHA1's output size is only 160 bits.  But I am implementing authenticated encryption and thus need 512 bits of key material (a 256-bit AES key and a 256-bit HMAC key).  My original idea was to input the password, salt, and a high numberOfIterations into PBKDF2 to derive both the AES key and the HMAC key.

Several people pointed out that I was making an attacker's job easier.  Getting 512 bits of key material from PBKDF2-HMAC-SHA1 would require ceil(512/160) = 4 calls * numberOfIterations.  However, an attacker would only need the AES key to decrypt the message, so he/she would only need to perform ceil(256/160) = 2 calls * numberOfIterations.

I've read two suggestions on how to fix this:

Use PBKDF2-HMAC-SHA512. It would provide enough output for both keys.  Unfortunatley, .NET doesn't seem to support this.
Use PBKDF2-HMAC-SHA1 with the password, salt, and a high numberOfIterations to output a 160-bit master key.  Then use HKDF-Expand to expand the master key into two 256-bit keys.  Unfortunately .NET doesn't provide HKDF-Expand as far as I can tell.

I have read in other stack exchange posts such as this post and this post that one could derive two keys from a master key (MK) by doing the following:

Create 160-bit MK through PBKDF2-HMAC-SHA1 using a user-supplied password, a 160-bit salt, and a high numberOfIterations.
Calculate HMAC-SHA256(MK,"e") -> aesKey
Calculate HMAC-SHA256(MK,"a") -> hmacKey

Would these steps result in a suitable pair of keys for AES-encrypt-then-HMAC-authenticate?

Note 1: I realize that the 256-bit aesKey and 256-bit hmacKey would each only have 160 bits of entropy, but that doesn't seem concerning, as the likely attack path would be on the password, not the keys.
Note 2: Even though .NET does offer HMAC-SHA256, HMAC-SHA512, etc., it does not offer a choice for PBKDF2-HMAC other than PBKDF2-HMAC-SHA1.


texts: How long should a HMAC cryptographic key be?

texts:
In the top answer to this question the answerer says 'with a sufficently long key'.

I am using a SHA1-HMAC (may switch to SHA256-HMAC) algorithm to verify cookies sent to clients as authentication tokens haven't been tampered with. The cryptographic keys are rotated with a new one being generated every 24 hours. Keys are valid for 3 days (i.e. there are 3 keys used to sign cookies active at any one time) meaning if a user doesn't login for 3 days then there authentication token is invalidated.

I am using 32 character long random alphanumeric strings as the cryptographic keys, would this be considered 'sufficiently long enough'?


texts: Does anyone know an easily creatable asymmetric cryptosystem for usage in VDF?

texts:
I've read multiple papers about VDFs (1, 2, etc.).
I look for a lighter alternative to El-Gamal regarding cryptosystem creation.
It can be anything exotic too, but it would be nice to have at least some security.

(Let's assume I know what I'm doing; This is my small research)

I would like to know if anyone knows a cryptosystem that could fulfill these criteria:

Creation of public key with 100% guarantee that private key will exist (Or open key validation would work) (I want to pick a valid public key and compute private key by brute force later)
Light creation of cryptosystem. There shouldn't be a need to factor large integers or derive difficult parameters. It could have a small amount of calculations, but I want to avoid brute-force.

ElGamal has some good parts, but won't work for my case:

El-Gamal allows creation of public keys without private ones. So if the generator operates on the whole cyclical group then we can have shorter keys too.
Integer factorization is one of the ways to create an efficient generator. I want to avoid factorization.

ECC is even harder to set up:

To derive a new ECC cryptosystem I have to choose several parameters and a big prime number. I want to create cryptosystems on the fly so it's not very convenient. Let's say it may be solvable somehow (for the sake of this example) -- prebuilt cryptosystems.
Public key generation, though, won't work for 100%. As elliptic curve public key points can't be validated such as ElGamal's because we never operate in the whole group.
Also this means that order of the base point has to be brute-force-adjusted to have the maximum number of points in a group. Because elliptic curve (under a field) contains point count related to it's base point. So this creates a brute-force need when creating a cryptosystem. I would like to avoid it.

RSA

Won't work because there is no way to validate the public key.

NTRUencrypt

Private key has to be of a certain form so that polynomial multiplication would work during decryption (wiki). I would like to know if it's possible to use it as the basis for this kind of VDF.

I would like to get any guidance or even samples of cryptosystems that would work under such scenario.

Thanks.


texts: Alter signature post signing without the private key

texts:
There a plethora of signature scheme's but I am wondering if there are scheme's with the following properties:
Given that you know the message, alter the signature with the public key in such a way that a new signature is created (a different hash) but is still valid for the given data.
The reason I am looking for this is that I want a server to sign some random data, but I want to change the signature so the server cannot create a lookup table of the signed values.


texts: Can Bob prove that Alice have a key which encrypts C into A?

texts:
Alice has a ciphertext $A$, its AES key $B$, and decrypted plaintext of $A$, let's call it $C$.
Alice sends $A$ and $C$ to Bob.
Bob wants to prove $C$ is just decrypted $A$, and has not been tampered with.

Can Bob achieve this without knowing the key $B$?


texts: What is a discrete logarithmic assumption? How does it set up trustless proofs?

texts:
A pending proposal of bulletproofs as a ZK proof for confidential transactions relies on Fiat-Shamir heuristic to be non-interactive by creating a digital signature on interactive proof of knowledge. As described in  "Bulletproofs: Short Proofs for Confidential Transactions and More" [Bootle, Wuille, Maxwell et al] it also relies on discrete logarithmic assumption to be a trustless proof (unlike SNARKs).

This led to my question above, what is a discrete logarithmic assumption and how does it set up trustless proofs? I'm not well-versed on this topic and would like to learn more about this, more specifically in its relation to setting up bulletproofs.


texts:
I know that $XOR$ is equivalent to modular addition in the field $\mathbb{F}_2 = \{0,1\}$ (is it right?), and thus should satisfy the following property of a bilinear form:

$$\oplus(u+v,w) = \oplus(u,w) + \oplus(v,w)$$

My doubt is: how has the $+$ in the previous formula to be interpreted? Because if I interprete it like the same $XOR$ (even if looking at the formula it seems not to make much sense), applying the property I think I would have:

$$(u\oplus v) \oplus w = (u \oplus w) \oplus (v \oplus w) = u \oplus v   $$

Even though I was expecting a result like:

$$ u \oplus v \oplus w$$

If the interpretation of the $+$ like the $\oplus$ is not the right interpretation, how has it to be interpreted, even considering that the normal $+$ and the $\oplus$ coincide in $\mathbb{F}_2 = \{0,1\}$?

At the end, what's the meaning of that property?


texts:
I am generating RSA Public and Private keys with node.js instead of reading them from pem/crt files as I can hide them inside a private object using this module https://www.npmjs.org/package/private

this node.js module https://www.npmjs.org/package/keypair puts text in front and at the end of each public and private (-----BEGIN RSA PUBLIC KEY-----)

Edit: forget this question (thanks D.W.) Is this they way they should look or can I remove the text?

var keypair = require('keypair');

var pair = keypair();
console.log(pair);

outputs

{ public: '-----BEGIN RSA PUBLIC KEY-----\r\nMIGJAoGBAM3CosR73CBNcJsLv5E90NsFt6qN1uziQ484gbOoule8leXHFbyIzPQRozgEpSpi\r\nwhr6d2/c0CfZHEJ3m5tV0klxfjfM7oqjRMURnH/rmBjcETQ7qzIISZQ/iptJ3p7Gi78X5ZMh\r\nLNtDkUFU9WaGdiEb+SnC39wjErmJSfmGb7i1AgMBAAE=\r\n-----END RSA PUBLIC KEY-----\n',
  private: '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4\r\nBKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/\r\nF+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4j\r\nJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0T\r\ncseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJP\r\nLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN\r\n+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9a\r\nNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinr\r\nutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8W\r\noaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7Ia\r\nPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7Jxj\r\nTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----\n' }

Public key is real short!

I found this code

function bitSize(n){return n.toString(2).length;}

If i give the pub key padding like

1001 0011

or some other random repetition of the same byte until the public key is the same length as the private key. Will that be acceptable padding? I would have to protect my prime numbers with this kind of padding, true?

If I did add padding how would the private key have any relation to the padded public (Could it still decrypt?)


texts: What is a preimage and how do you find a preimage of a hash?


texts: Differences between using HMAC-SHA1 vs HMAC-SHA256 for data storage?

texts:
Reading the question “HMAC-SHA1 vs HMAC-SHA256”, I figured out that the known attacks on SHA1 don't apply to its HMAC version. So, HMAC-SHA1 is quite strong right now.

In a protocol like SSL, if it gets broken tomorrow, we can “simply” turn off all the cipher-suites that use HMAC-SHA1. But what if it is used as MAC protection for encrypted data storage? Let's say that I decide to use HMAC-SHA1 instead of HMAC-SHA256 and the former gets broken. It would be a problem because the old stored data will continue to have a broken MAC protection.

Would using HMAC-SHA256 help in that case?

To be more precise: Is HMAC-SHA256 likely to be much more difficult to break compared to HMAC-SHA1 and are both HMAC-SHA1 and HMAC-SHA256 likely to be broken in the near future?