texts: Generating and distributing a secret without trusting the source

texts:
I have multiple entities (servers) that all share a private secret already.
Those servers need a rotating secret (TTL a few hours). All servers must have the same set of secrets at all times.
I have another server (command & control) with a communication channel to all my clients.
I want the command & control to handle the generating and rotating of the temporary secrets.
I also don't want the command & control to ever know the temporary secret.
So basically:

command & control generates a random blob
command & control distributes the blob to clients
clients use their shared secret to reduce the blob into a common secret (using I presume a pseudo-random cryptographic function)
the final secret needs to be ~80 bytes

What would be the best practices to do this?


texts: Randomly initialised global counter used to encrypt the kth message with $\operatorname{IV} = \operatorname{IV} + k \hspace{5mm} mod \hspace{5mm} 2^n$

texts: The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then $\operatorname{IV} + 1$ for the second , $\operatorname{IV}+ 2$ for the 3rd etc. How can I construct an attack to show that this mode is not secure?


texts: Set membership check between untrusted parties

texts:
There are two parties who don't trust each other mutually, say A and B. A has a large set of strings. B has a string and needs to check if this is contained in A's set or not. B does not want to reveal the string to A and neither does A want to reveal all the strings in the set to B. But still, B should know the answer to her membership question from A.

Is there any existing encryption scheme that helps me do this. Please direct me in the right direction.


texts: Why can't hashes be reversed with toffoli gates?

texts:
This is a follow up question to this question: Crack cryptographic hash functions using Toffoli gates?.

Suppose there is a hash function $$H(x)=y,$$ where $x$ is the input of the function and $y$ is the hash of $x$. Now, suppose we have made an emulating software that emulates $H(x)$ using Toffoli gates. This new function can be denoted by $$T(x)=(y,z),$$ where $z$ is the garbage. Now toffoli gates are reversible, so we can make a function $$T^{-1}(y,z)=x.$$ Now the problem is that we do not know $z$, because it was lost during the calculation of $H(x)$.

Now we can choose any random (but valid) garbage $z'$ and calculate $$T^{-1}(y,z')=x'.$$ Now by definition of $T^{-1}$, we have $T(x')=(y,z')$; and so $$H(x')=y.$$ So we have found a collision (if not the original value).

I know very less about cryptography, and I know something must be wrong in the above but I cannot find out what is wrong. So, please tell me what is wrong. I do not have the neccesary information and software to test this procedure.

Example

This is a very simple example. More complicated examples can be difficult to calculate by hand.

Suppose $x\in(0,1)$ and $H(x)=x\land1$. Now we will try to reverse the output $H(x)=0$. Now let's denote the toffoli gate by $G(x,y,z)$. The function $H(x)=x\land 1$ can be converted into $$T(x)=(y,z) \rightarrow G(x,1,0)=(y,z_1,z_2).$$ Reverse of this is $$T^{-1}(y,z)=(x) \rightarrow G^{-1}(y,z_1,z_2)=(x,1,0).$$ We have $y=1$. Let's choose $z'=(1,0)$. Now calculate $$T^{-1}(1,(1,0))=1 \Leftarrow G^{-1}(1,1,0) = (1,1,1).$$ So, we have $H(1)=1$. This is the answer! (Because $1\land1=1$)


texts: Consequence of $p\bmod e=2$ in RSA prime generation

texts:
When generating a prime $p$ for use in an RSA modulus with public exponent $e$, it is necessary that $\gcd(p-1,e)=1$. When $e=3$, and since $p$ is a large prime, that implies $p\bmod e=2$.
Assume an RSA key generation procedure for 1024-bit primes used for a 2048-bit modulus is written to always generate primes with $p\bmod e=2$, for both factors, including for large $e$ supplied as a parameter at key generation.
For what values of $e$ does this have any dire consequence?
Note: I know no circumstance making this assumption hold, not even a CTF.  And that would not be a subtle way to rig the key generator, since that's externally detectable from the public key because $N\bmod e=4$ always holds.


texts:
I have read this article and I do somehow "understand" that the reduction of entropy makes it easier to guess.

But how exactly can the security be reduced by that? Can you give a concrete scenario, where a poor (P)RNG leads to security issues?


texts: Why is it inadvisable to increase the number of rounds or using a larger block size to a published(standardized) block cipher such as AES?

texts: I wanted to know how does the increase the block size or rounds in AES is not a good idea


texts: I was using a SOCKS5 proxy today (tunneled through SSH) and I began to wonder what the effect of encrypting twice (TLS over encrypted SOCKS5 in this case) would have on the security of the transmitted data. The proxy was using 256-bit AES in CTR mode, while the page I was viewing was using 128-bit AES in GCM mode. While I am not worried that this will be harmful at all, I am curious as to how much more difficult a scenario like this would make it for an attacker to break the encryption (assuming they could somehow bruteforce 128/256-bit keys).


texts: Increasing rounds in DES, increases or decreases the security?

texts:
I was wondering whether in DES,
if we used more than 16 rounds, the security of the message was increased or actually decreased?
(disregarding the decreased speed of execution / computation.)
Thanks in advance!


texts: If I use for example AES-256 (GCM), and my message is bigger than 256 bit (broken into smaller 256 bit blocks for encryption), should the IV change for every 256 bits of the message?


texts: Why doesn't GMAC/GCM encrypt its authentication tag?

texts:
As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with AES(j) where j is the GCM counter. If a nonce is duplicate you get identical AES(j) which lets you XOR and get the raw GHASH and then attack the GCM polynomial.

Why doesn't GCM encrypt its final authentication tag using AES in ECB mode (one ECB block)? If performance is a concern and you want to avoid doing two  AES encryptions why not do AES(GHASH(m) ^ j) or similar? GHASH(m) XOR AES(j) seems like it's begging for sudden death on nonce reuse. Why do that?

It seems like this simple design change would have made GCM/GMAC more resistant to nonce repetition. You'd still be able to XOR ciphertexts just like you can with any stream cipher when a nonce is repeated but you wouldn't be able to compromise the authentication key, right?


texts: What is the direct connection between LWE and GapSVP?

texts:
Learning with Errors Problem (LWE): Given a polynomial number of random noisy linear equations $b_i$ in the form of pairs

$$
 (a_i, \quad b_i = \langle s, a_i \rangle + e_i)
$$
where $a_i \in \mathbb{Z}^n_q$ are uniformly random, $e_i$ is sampled from some noise distribution such that $e_i \ll q$, and  $\langle s, a_i \rangle$ denotes the inner product of $s$ and $a_i$, find the secret vector $s \in \mathbb{Z}^n_q$.

This problem is supposed to rely on the hardness of GapSVP. In Regev's paper, he showed a complicated reduction from GapSVP. Is there a way to see the immediate connection between the two problems? What are $a_i$, $b_i$ and $\langle s, a_i \rangle$ with regards to a lattice?

Thanks!


texts: Is there a secret sharing scheme which allows sharing of a secret (one-out-of-n)

texts: Is there a secret sharing scheme where the knowledge of just one share is sufficient to find the secret, in other words a (one-out-of-n) sharing scheme ? Plz I need to know if it is possible to make such operation with secter sharing


texts: Need help solving a puzzle (from a layperson)

texts:
As the title says, I'm a layperson when it comes to cryptography, so my question may not make absolute sense. Apologies in advance if this is vague.

Here is the puzzle I'm presented with:

  You were smart to look here.

  Can you take on the next step?

  ecdsa-sha2-nistp256

  AAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOKGEKYjpEGmRrtoGdf79CJljyk1y/GbMFCXt9AoKnk5Lw9r5Snv63xYZ5WLBNkozVe4sNLXIaUGti/pMOy4akk=

From this point, three "hints" were provided:

1) Run the ecdsa public key trough a base64 decoder.

When running the public key through various online base64 decoders, the result has been varied on each site. I get everything from Korean characters to random box characters. So I'm somewhat stuck at hint 1.

2) Open the base64 decoded value in hex editor.

3) Public key should be a 65-byte array, starting from byte with value 4, next 32 bytes would be x value, and the next 32 the y value.

A final clue is this: "First have the name of the digital signature algorithm, then the name of the curve, and then the public component of the key. Got it?"

Can anyone here make sense of all of this? Thanks in advance for any help. I'm happy to answer any questions that could help you in solving this.


texts: PQC schemes & theory on academic courses

texts:
This question doesn't cover any technical aspects of PQC but I would want to know if undergraduate computer scientists study at a good level any of the available PQC schemes in literature during their stance at university in whatever country you know.
Don't get my wrong, in the country where I live there is no PhD on Cryptography perse. There are masters on Cybersecurity that cover the basics of Information Theory combined with classic Cryptography but these are not deep enough to grasp the technical math behind these fields.
In my case, I'm a self-taught individual and asking questions related to PQC or non-classicak crypto on the institution where I used to attend never had an answer. With time, effort and patience I was able to learn part of the math behind.
I'd like to read your experiences through academic education and how did you discover and start researching on PQC. It'd be great if you can specify the country where this happened.
Questions:
Was it once after the master or PhD ended?
Should PQC be taught to normal students when dealing with Cryptography for the sake of the future?
Would you change the way Cryptography is taught to students to include new topics that will be mainstream in few decades?
P.D : Feel free to vote to close if this post doesn't fit the site's rules. I found the education and theory tag to fulfill the requirements, but maybe do not.


texts: Getting the encryption/has algorithm used for modem configuration file

texts:
Hello guys I have backed up my modem configuration file and found the username and password is in clear text; the files shows the username and the password is :

password=_DEV_4FC6EA6A****************************

how do I get which encryption or hash algorithm is used to generate the given string and how strong it is?


texts:
I am designing a protocol where a user A sends a time-locked deposit to user that if the user B within time t provide a proof that he exists in a location x (this may be obtained by third party like Google), user B can get the deposit of A. Otherwise, A can get his money back.

Any help of how to do that using cryptography or two-way secure computations?


texts: Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?

texts:
I understand that NaCl's crypto_stream and crypto_stream_xor don't do any authentication like crypto_secretbox does. Does using them allow listeners to forge crypto_secretbox messages for any key you use them with?
I'm worried about a known plaintext attack. If I use crypto_stream_xor to encrypt a bunch of zeroes, the listener now has the full keystream for whatever nonce I just used. I think they can use the first 32 bytes of that as a crypto_onetimeauth key to forge valid authenticators for crypto_secretbox messages, with whatever plaintext they want (up to the length of the zeroes I encrypted, minus 32).
If that's right, then using crypto_stream_xor seems to break authenticity just as badly as nonce reuse does. The NaCl/libsodium documentation is pretty clear about saying "never reuse a nonce with the same key", but there's nothing in there about "never use crypto_stream_xor with a key that you also use for crypto_secretbox."


texts: Why is a hash function required for building Public Key Encryption from a Trap Door Function

texts:
This is from Dan Boneh's Coursera Lectures - Week 6 - Constructions.
https://www.coursera.org/learn/crypto/lecture/nTRhL/constructions
Here he picks a random x from X. And then Hashes X to get the session key k from K
k = H(x).
Why not just pick a random k from K instead of first picking x from X & then hashing it to get k? What is the necessity of the Hashing function here?


texts: Term for the ratio of ciphertext to plaintext size?

texts: Is there a term that determines the ratio of size of ciphertext $|c|$ and plaintext $|n|$? I vaguely recollect reading it as scale out factor. Is there a better term? Or a popular term for this?


texts: Proof that Niederreiter Cryptosystem is correct

texts: I read about Niederreiter Cryptosystem. I understood the Key Generator, encryption and decryption of the cryptosystem, but if I want to prove that is a correct cryptosystem, what should I do?


texts: Does anyone know where I might be able to find test vectors for the PRF function in TLS? (either 1.0 or newer). I'm trying to implement a client and I am getting the BAD Record MAC return after sending my encrypted client finished message. I'm pretty sure everything seems to be working so I'm kinda scratching my head wondering what I'm doing wrong.


texts: Forgive me if this seems like a trivial question. I've read that AES is a SP network. However, when reading about P-boxes in SPNs they say that they simply shuffle bits around. In AES the ShiftRows step is definitely shuffling bits around, but MixColumns step is not a bit permutation. Does this make AES something more than a SP network, or can the definition of a P-box simply be stretched a bit?


texts: Exploitability of AES in CBC Mode For Recovery of Plain Text

texts:
I'm aware of existing literature that shows in a comprehensive manner just how simple it is to tweak the ciphertext of AES-CBC such that the decrypted message ends up being entirely different than what it was originally (due to the lack of a MAC to provide AEAD).
Can This Be Used to Compromise Encrypted Keys?
Specifically, I came across documentation for a popular piece of software that countless individuals around the world use. This software package generates a private/public key pair for the end user (secp256k1) and encrypts the private key with AES-256-CBC.
Wondering if CBC Mode Poses Any Issue Here
To be clear, by 'issue', I'm referring to the outright recovery of the private key that was encrypted.
If the secret key is damaged / altered in this scenario, that's of no concern (for the question). Not sure if it makes a difference to add in that the key will be decrypted and re-encrypted as it is used (not sure if there is any leakage of the private key data that occurs during this time).


texts: Is it more secure to upload only part of a cryptographic quantity or rewrite it from scratch?

texts:
I'm implementing a key revocation scheme in C. Information of such a scheme is not important for the goal of my question. Know that every party maintain in its storage a key. These keys are serialized C structure and, when needed, the are loaded in main memory, used, and the the memory they have been requiring is freed. Now, when a revocation occurs, two field of the structure must be updated according to a certain protocol. My question is: is it more secure (i) to unserialize the whole structure and load in main memory, update the offending fields (from C), re-serialize the entire and free the occupated memory or (ii) to read and unserialize only the offending fields and update just them (still freeing the occupated memory at then end)?
I omitted the details of the scheme under analysis as I deemed them useless in this scope, but if needed ask me in the comment


texts: Why are side channel attacks such as SPA/DPA/ CPA based on the AES SubBytes routine?

texts:
I have three questions about AES related to side channel attacks:

Why are side channel attacks  such as CPA  related to the non-linearity of the SubBytes routine within AES?
What is the difference between using the substitution BOX (SBOX) in a non-linear way and the combinational SBOX proposed in articles such as "Design of AES S-box using combinational logic optimization"?
Does the use of a combinational SBOX avoid side channel attacks?


texts: How do these figures represent a boolean function?

texts:
In the Wikipedia article "Bent functions",
there are some figures representing those Bent functions:

How do these figures represent a boolean function ?


texts: General idea for storing public/private keys?

texts:
What are the general ideas for storing keys in order to make sure no one else has access to it?

It's not a good approach to hash the keys, since you are going to need them later.


texts: Is client certificate mandatory for two-way TLS?

texts:
In One-way Transport Layer Security (TLS), client who initiates the connection verifies the identity of the server or entity it is connecting to, but server not necessarily validates client identity.
In Two-way TLS connections, both client and server validates each other's certificate (public key) to achieve mutual authentication. The question here is, does the client necessarily send its certificate? What if the client sends a credentials (E.g token/API key) that the server knows and validates to verify the identity, is this not a mutual authentication and two-way TLS?  I do understand certificates are a better way of proving identity than token/secret.


texts: Elliptic Curve Cryptography - When to use p and when to use n

texts:
Im currently playing around with ECC, in particular the ECDSA scheme on a brainpool P256R1 curve. While implementing the signature verification function, I've stumbled upon a few problems.

So far I've understood that there's a prime $p$ and the order of the elliptic curve $n$ (such that $n * G = \mathcal{O}$).

For the modular arithmetic functions inside my ECDSA verification function we have to use the group order $n$. But for our elliptic curve functions such as point addition and point doubling we need to use $p$. I was wondering why its the order for curve operations and the prime for the other in order to make the system work.


texts: How to efficiently find Schnorr groups that have a generator $g=2$?

texts:
A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$.
As far as I know, the normal way to find a Schnorr group is to:

determine $q$ as a random prime in the desired range of the group size (e. g. $2^{255} \le q < 2^{256}$), which ultimately also determines the signature size of Schnorr signatures;
pick a random number $r$ that brings $p$ into the desired $b$-bit range such that $\lfloor log_2r \rfloor=b-\lfloor log_2q\rfloor$ (e. g. $2^{1792} \le r < 2^{1793}$ for bit size $b=2048$ of $p$, with the value of $q$ being in the range of the example noted above), where $p$ should be fairly large to resist attacks, namely it should be at least a 2048-bit number;
compute $p=qr+1$ and check whether the resulting $p$ is prime;
for $g=h^r\pmod{p}$, check whether $g \equiv 1\pmod{p}$ and return to step 2 if so, else $g$ is the generator of the group.

However, for efficiency reasons, I'm interested in groups with the generator $g=2$ because exponentiation of $2$ is a trivial bit shift. When generating groups with the method outlined above, there is an approximate chance of $\frac{\lfloor\log_2{q}\rfloor}{\lfloor\log_2{p}\rfloor}$ that $2$ is a member of the group – and all members of the group are generators of the group because $q$ is prime. However, that is still an effectively impossible chance.
Is there a way to generate a Schnorr group with $g=2$ that doesn't rely on random chance and is reasonably efficient to compute (possible to do within at most weeks on commodity hardware)?


texts: How can Shor's Algorithm be applied to ECC?

texts:
I have not found a specific answer to this question on here.

Shor's algorithm can be used to factorize a large (semi)prime $N$ by reducing the task to period-finding of a function $f(x)=x^a$ mod $N$.

This is done by creating an equal superposition over all pairs of $a_i$ and $f(x)=x^{a_i}$ for a random $x$, then measuring $f(x)$ causing the superposition to collapse into all $a_i$ for which $f(x)$ is our measures value. Using "Fourier sampling" (I have not fully understood this part) we can then obtain the period of  $\ f$ and with .5 probability this yields a non-trivial square root of $N$ which leads to a prime factor.

(Plase correct me if my understanding of the above is flawed)

Now how can this algorithm be applied to Elliptic Curve schemes like ECDSA? I struggle to find an explanation for how the discrete log problem for groups over elliptic curves could be solved using Shor's.

EDIT: I would just as well appreciate a reference to other papers except Shor's, that explain the case of Shor's algorithm on DLPs.


texts: Generating passwords from a master password using rules

texts:
I realize it's generally considered bad idea to use the same password everywhere.

I can use icloud / lastpass to generate my passwords for me, but that leaves me clueless when I don't have access to these services, or attacks to those services.

Does it make sense to use 1 "master password", but modified for each website / service with set of rules?

For example, let's make my master password foobarone and name of the service is "facebook". My rule is to shift 1st letter X. Where X is number of first letter in service name (facebook, first letter is f, f = 6). Therefore, I am shifting 1st letter by 6, so my final password for facebook is loobarone. In reality, these rules would be more complicated.

Does this provide me layer of security, or is my thinking out of line and the only solution is to have random password for every service?


texts:
I was wondering about the difference between these two terms...
What is the difference between a digest and a hash function?


texts: How to get an optimal strategy in computing isogenies for SIDH/SIKE

texts:
How to get a strategy $(s_1,...,s_{t-1})$ as mentioned in section 1.3.7 of SIKE spec?

If possible, can anyone give me an example?

And why do we need to compute all leaf point? I though we just need the right most leaf point to get an isogeny of smooth degree ${l_A}^{e_A}$


texts: Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext

texts:
I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are my chances of recovering the crypto key using brute force methods or using brute-force + some crypto analysis?

Is there any good guidance to pull off padding oracle?


texts:
I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV?

I have multiple devices with poor entropy sharing the same key and I want to ensure the IV is unique. I am using AES-128 CBC.

Can I use some bits of the IV as the ID of the device? For example can I set the first 32 bits of IV to the IP address of the device and the remaining 96 bits to a random value? Is this still considered 'unpredictable'?


texts: Is this RSA signing and verification process secure?

texts:
I need to verify that messages in a communications program are from valid senders. Below is a highlevel outline of how I think the process would work. The connections themselves are done over TLS. The process here is just using RSA signing/verification on top of that. The data itself is actually not that important so the extra AES encryption is somewhat redundant. Can someone confirm whether this is the general approach or set me straight if not?

Sending host

plaintext = "Hello World!"

#SIGN
digest = SHA256(plaintext)
sig = rsa_encrypt(sender_priv_key,digest)

#ENCRYPT DATA
iv = generate iv
key = generate random key
ciphertext = aes_encrypt(iv,key,plaintext)

#ENCRYPT KEY
encryptedKey = rsa_encrypt(recipient_pub_key,key)

#SEND
send(sig+iv+encryptedKey+ciphertext)

Receiving host

#RECEIVE
sig+iv+encryptedKey+ciphertext = recv()

#DECRYPT KEY
key = rsa_decrypt(recipient_priv_key,encryptedKey)

#DECRYPT DATA
plaintext = aes_decrypt(iv,key,ciphertext)

#VERIFY
sigDigest = rsa_decrypt(sender_pub_key,sig)
msgDigest = SHA256(plaintext)

if sigDigest == msgDigest
    #valid sender so long as we can trust where we got the public key
    #data integrity is good


texts: Tactics available to help prove security of a new system?

texts:
I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new system can be accepted as secure until proven otherwise. Please correct me if I'm wrong.

That aside, are there any set of requirements a developer can proactively test their cipher system against before a public release?

I'm working on a large key (4096 bit), symmetric encryption system and I'm doing my best to be weary of the "anybody can make an encryption that they themselves cannot break" trick of believing that my cipher is unbreakable.

What kind of tests can I run on the process or the output? Are there good ways to measure entropy? What statistics should I expect after encrypting a section of data? I know there won't be some magic function that proves I'm secure, but I certainly don't want a public release followed immediately by being broken by a simple problem that some data analysis would have found.


texts: I would like to know the step by step method to construct the SAC dependence matrix for AES S-Box. Can someone help me?


texts: Challenge / Response to Prevent Replay Attack - Using nonce as challenge

texts:
I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other.

My plan is to implement a challenge response system to authenticate both ends of the communication. Instead of separately generating a unique value for the challenge, my intention is to use the nonce as the challenge and then encrypt the nonce using ChaCha20 and the pre-shared key for the challenge response.

Is it safe to encrypt the previous nonce? This will not be a random unpredictable value, but it will be unique and it wont be the same nonce that is used to encrypt the current packet. The attacker will know both the plain text and the encrypted form (is they know the protocol), but this only helps for a brute force attack, I believe?

The packets are authenticated with poly1305 using the same key.


texts:
Hello all, I'm new to crypto,  I'm not sure if my thought process is correct ? any assistance will be helpful.

How useful is the partial info that A gets from (a), (b), and (c) ; in (c) A can determine Fn. How useful is this partial info in distinguishing F from a Rand Func

I understand that the advantage is the P ( Real) - P ( Rand). and in the first instance where the key is 000, each query that A makes returns the same output as the input. So the adversary will guess that they are in the real world since input and output matches

So does that mean the advantage is: 1 - (2^-3) ??


texts: Ed25519 PKCS8 private key example from IETF draft seems malformed

texts:
Malformed PKCS8 Key

Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following:

An example of the same Ed25519 private key encoded with an attribute
and the public key:

-----BEGIN PRIVATE KEY-----
MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
Z9w7lshQhqowtrbLDFw4rXAxZuE=
-----END PRIVATE KEY-----

The same item dumped as ASN.1 yields:

  0 114: SEQUENCE {
  2   1:   INTEGER 1
  5   5:   SEQUENCE {
  7   3:     OBJECT IDENTIFIER '1 3 101 112'
       :     }
 12  34:   OCTET STRING, encapsulates {
 14  32:     OCTET STRING D4 EE 72 DB F9 13 58 4A D5 B6 D8 F1 F7
                 69 F8 AD 3A FE 7C 28 CB F1 D4 FB E0 97 A8 8F 44
                 75 58 42
       :     }
 48  31:   [0] {
 50  29:     SEQUENCE {
 52  10:       OBJECT IDENTIFIER '1 2 840 113549 1 9 9 20'
 64  15:       SET {
 66  13:         UTF8String 'Curdle Chairs'
       :         }
       :       }
       :     }
81  33:   [1] 00 19 BF 44 09 69 84 CD FE 85 41 BA C1 67 DC 3B
              96 C8 50 86 AA 30 B6 B6 CB 0C 5C 38 AD 70 31 66
              E1
       :   }

The last bit doesn't seem to be valid be a valid PKCS8 private key. Here's the ASN.1 definition for private keys from PKCS8:

PrivateKeyInfo ::= SEQUENCE {
  version                   Version,
  privateKeyAlgorithm       PrivateKeyAlgorithmIdentifier,
  privateKey                PrivateKey,
  attributes           [0]  IMPLICIT Attributes OPTIONAL }

The ASN.1 definition has one context-specific tag with a tag number of 0 whereas the private key my first snippet has has two context-specific tags - one with a tag number of 0 and one with a tag number of 1.

Do the ASN.1 standards permit the appending of arbitrary strings to an ASN.1 encoded object? Because it seems that that's what the "private key encoded with an attribute and the public key" is doing...

Alternate Approaches

It seems to me that if the authors wanted to make the private key include the public key they could add the public key live in the PrivateKeyAlgorithmIdentifier. Quoting the definition for that:

PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier

AlgorithmIdentifier  ::=  SEQUENCE  {
     algorithm               OBJECT IDENTIFIER,
     parameters              ANY DEFINED BY algorithm OPTIONAL  }

(AlgorithmIdentifier is defined in RFC5280)

DSA private keys do this. The DSA Parameters $p$, $q$ and $g$ are defined in the parameters field of the AlgorithmIdentifier. So it's not like use of that field isn't without precedent (see RFC5912, for example).

Another possibility: just hijack ECPrivateKey. Just make it so Ed25519 can only be utilized with a NamedCurve and parse publicKey and privateKey differently (as specified in RFC8032) when Ed25519 is being used...


texts: TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

texts:
I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message" computes an asymmetric digital signature based on the certificate's signature algorithm, over the whole handshake. The finished message on the other hand employs a symmetric HMAC using the exchanged symmetric ephemeral keys to also compute a MAC over the whole handshake.
RFC 8446 phrases this as:

CertificateVerify:  A signature over the entire handshake using the
private key corresponding to the public key in the Certificate
message.  This message is omitted if the endpoint is not
authenticating via a certificate.  [Section 4.4.3]

Finished:  A MAC (Message Authentication Code) over the entire
handshake.  This message provides key confirmation, binds the
endpoint's identity to the exchanged keys, and in PSK mode also
authenticates the handshake.  [Section 4.4.4]

In my understanding, the authentication code is calculated over the message to avoid man-in-the-middle attacks. However, I do not understand why the complete handshake is authenticated twice with two different messages ( using two different algorithms and two different keys)?
Wouldn't it be sufficient to solely use the asymmetric signature from the certificate over the complete handshake to authenticate the handshake and bind the symmetric keys to the identity?
Also, I think that if somebody would have tampered with the DH-Key exchange earlier, even the CertificateVerify message would not decrypt correctly, as the whole handshake is different. This would also mean that the symmetric key is bound to entity already with the CertificateVerify Message, and the Finished message is obsolete.
However, the designers of TLS 1.3 presumably have a much stronger cryptographic background than I do, so I was wondering where I was missing a security need for the finished message?
Thank you in advance.


texts: Complex Numbers on Elliptic Curves & Usage in Tate Pairing

texts:
I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve $E: y^2 = x^3 + 3x$ over $\mathbb{F_{11}}$. The author is showing the computation of $e(P,Q)$, where $P=(1,9)$ and $Q = \phi (P) = (10,9i)$ using Miller's Algorithm. Through this algorithm, the author chose a point $Q' = (6,6)$ and then computes $S = Q + Q' = (8+7i, 10+6i)$. This is where I'm having an issue, I can't seem to determine how the complex addition of points occurs in elliptic curves, and I'm looking for an explanation in the usage for the Tate pairing.

Paper being referenced : http://www.win.tue.nl/~bdeweger/downloads/MT%20Martijn%20Maas.pdf , Section 4.3.1


texts: Is AES-256 weaker than 192 and 128 bit versions?

texts:
From a paper via Schneier on Security's Another AES Attack (emphasis mine):

In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2176 and 2119 time, respectively. While these complexities are much faster than exhaustive search, they are completely non-practical, and do not seem to pose any real threat to the security of AES-based systems.
In this paper we describe several attacks which can break with practical complexity variants of AES-256 whose number of rounds are comparable to that of AES-128.

Is the implication here that AES-192 is stronger than AES-256? If so, in simple terms, how is that possible?

The attack exploits the fact that the key schedule for 256-bit version is pretty lousy -- something we pointed out in our 2000 paper -- but doesn't extend to AES with a 128-bit key.

Again, in simple terms, what does that mean?
In practice, does this mean I should drop AES-256 in favor of its 128-bit counterpart, like Schneier recommends in the comments?

That being said, the key schedule for AES-256 is very poor. I would recommend that people use AES-128 and not AES-256.


texts: Where x509 signature validation is concerned, what does the error "x509 certificate chain incomplete of leaf TP not found" mean?

texts:
I'm validating the x509 signature of an XML document and I encounter the following error: "x509 certificate chain incomplete of leaf TP not found"

Any thoughts on what the impact is for a TLS connection?


texts: What is the appropriate choice of hash family to make XOR homomorphism unlikely?

texts:
Let's say $N \subseteq [n]$ is not empty. Is there a type of hash family $H = \{h : [n] \rightarrow \{0 , 1\}^k\}$, where $k = \theta(\log(n))$, to ensure that the following holds when $|N| > 1$?
$$\underset{h \in H}{\Pr}(h (\underset{t \in N}{\oplus}t) = \underset{t \in N}{\oplus}h(t)) \leq \frac{1}{2^k}$$


texts: Convert plain text as numbers to encrypt using RSA

texts:
All mathematical description of encryption functions assume, despite the use of the word plaintext, that the message to be encrypted is a sequence of numbers. For example RSA with $n=pq$ assumes that one wants to encrypt a number $x$ less than $n$  than a message consisting alphabets. It says encrypted form of $x$ is $x^e\pmod m$. Is there any (open) standard for converting text to numbers before encrypting?

As ASCII values go only up to 256. Does one take plain text, say 10 characters at a time, and read it as a 10-digit number in base 256? This is my own guess. I would actually want to know the exact standard followed in the industry.


texts:
Recently, I've been researching and implementing a bit of post-quantum cryptography, and I came across two RLWE-KEX algorithm for key exchange.

The first one, which I implement in my software, is the one by V.Singh http://eprint.iacr.org/2015/138 which provides 2 practical parameter sets. I find this one simple and easy to implement.

However, this paper seems to get little attention and few citation compared to NEWHOPE http://eprint.iacr.org/2015/1092 by L.Dacus et al. It provides only 1 set of practical parameters, but seems to get more attention. I remember seeing another stackexchanger recommending it to a fellow, and there are several proposals for improvements out there (although I feel these improvements also apply to the VS scheme back there).

So, should I switch? I do remember NIST saying they don't expect to "pick a winner", so I guess I could stick to my choice. Or is there an inherent advantage within NEWHOPE over the VS scheme?


texts: Distributed generation of random integers with prescribed sum

texts:
While reading this document I came across the following problem. Assume you have $n$ clients. The clients need to generate random integers in $\mathbb{Z}_p$, say $T_i$ for $i \in \{1, \ldots, n\}$, such that $\sum_{i=1}^n T_i = 0$ in $\mathbb{Z}_p$. This integers are then used as secret keys, so if $n-2$ clients cooperate, they still should not be able to obtain the secret key of the other two.

This is a bit modified version of the problem appearing in this document (page 15) in SetUp procedure. There it is not explained how to do it.

The closest answer to this question I found is in this document (section 6.1), but is not exactly what I am searching for. Is there a known solution I am missing?


texts: Does the generator (base point) is preshared between the sender and receiver in elliptic curve cryptography?

texts: Or the elliptic curve and the generator point are known to everyone?


texts: How to build disk encryption system using forward permutations like Gimli?

texts:
First of all, this is purely a thought experiment. The width of Gimli isn't even a power of two (384 bits), and secondary storage bus speeds aren't even worth using a high performance permutation like Gimli. So from a practical perspective, this is totally pointless.

But it's nonetheless an interesting one. And from it, I have three concrete questions that can be considered:

Can we build a tweakable bijective keyed permutation from just a pseudo-random forward permutation?
Is there a practical disk encryption system using only forward permutation?
How do we interpret the "new conventional wisdom" that "a permutation
is a better unified primitive than a block cipher"?

Gimli paper can be here.


texts: If PRESENT had different permutations s would that protect it against Statistical Saturation Attack?

texts:
The block cipher PRESENT is vulnerable to the Statistical Saturation Attack for up to 15 rounds (PDF) and a simple example is here.

So my questions are, if some (or all) of the permutations were changed:

would this protect it against the Statistical Saturation Attack?
if so, can we then use fewer than 31 rounds without causing a weakness against "other" attacks?


texts: Vigenère, auto-correlation vs Kasiski examination

texts:
What are the differences between 'Kasiski examination' and 'auto-correlation' ?

In Cryptool site, they state that autocorrelation analysis is more efficient and clearer than the Friedman or Kasiski test. But, they fail to mention how they achieve this or how they differ from Kasiski.


texts: How would you decrypt an affine cipher with only the ciphertext?

texts:
If I have only the ciphertext but the alphabet and the value of a and b are all unknown ... how would I go about this? I understand decryption with the key and alphabet, that is fairly easy but if we don't have even one of them what would be my first step?

also, my goal is to have the computer return the plaintext and the alphabet &key. Without me choosing what looks like english or not.


texts: Could someone please elaborate on how $(c^d \bmod n) \bmod p = c^d \bmod p$, given that $n = pq$, where $p$ and $q$ are prime numbers?

texts:
I'm following this (Chinese Remainder Theorem and RSA) post, but I don't understand how
$(c^d \bmod n) \bmod p = c^d \bmod p$.
Being told that it's because $n=pq$ is not enough for me to understand.
Could someone please elaborate on that to help me fully understand what's going on here?
Any input would be GREATLY appreciated!


texts: Is this a reasonable design for encrypting records in a key/value database?

texts:
A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking would be infeasible for, say, 30 years. I was happy with the pattern I developed, but I'm no expert, so thought at least an informal review here might help me avoid dumb mistakes.
Here's the pattern, in brief:

Use SHA-256 with a salt to hash lookup keys. One salt applies to all lookup keys for consistency of lookup, and is deployed with the application, never the database

Use XChaCha20-Poly1305 (or, previously, GCM) to encrypt values, using a cryptographic random function to generate the nonce for each value, and store the result in the database as a single payload, formatted as $id$nonce$tag$ciphertext. It inputs a hash of the lookup key as additional data in order to prevent swapping values between lookup keys. The $id identities the key configuration used to encrypt the value, so that keys can be rotated (and algorithms changed). As with the lookup key salt, the encryption key is deployed in the application configuration, not the database itself.

The same encryption algorithm also encrypts the lookup key, using the same encryption key (but a newly-generated random nonce, always), so that when rotating keys, the lookup key can be hashed with a new salt. The resulting table configuration using a RDMBS back end is three columns: Hashed Lookup key, encrypted lookup key, and encrypted value.

Rotation can be performed by deploying a new key config with a new ID to the service. The config has a new lookup key salt, lookup key encryption key, and value encryption key, and may adopt different hashing and/or encryption algorithms. New records are encrypted with the new keys, but old records can still be decrypted with the old keys. A background process gradually decrypts old records with the old keys and re-encrypts them with the new keys, replacing the old records. Once all records have been re-encrypted, the old key config can be removed from the service.

One signifiant question: does it make sense to store the nonce along with the ciphertext? I've seen that pattern with older block ciphers and IVs, but have found less information about this pattern for a streaming cipher like GCM or XChaCha20, where there is more of an expectation of a shared counter when exchanging messages. That pattern makes a lot of sense for, say, a messaging platform, but less feasible for an encrypted database.
But other than that, how flawed is this design? Are there any obvious ways in which it could improved? Or is it fairly sensible?
PS: Holy cow is the term “key” overloaded!


texts: Using AES-CTR to generate AES subkeys from a master key and nonce

texts:
Suppose I would like to encrypt some data using AES-GCM because it has hardware support on my processor and it is secure.

Unfortunately, I don't like the 96-bit nonce size, because I want to randomly generate the nonce each time (to avoid having to keep state).

So instead of it, I use my 256-bit master key to encrypt 32 null bytes with AES in CTR mode with a 127-bit nonce, and use the resulting keystream as the AES-GCM key.

I have now a $96 + 127 = 223$ bit nonce, which is plenty long enough to generate afresh each time.

I presume that this is secure since a block cipher in CTR mode can be used as a CSPRNG (as here).

Am I correct?


texts:
When we consider the security of a cryptographic hash function with $n$ bit output we simply say that it must have at least $\mathcal{O}(2^{n/2})$-time security against the (generic) collision attack due to the birthday attack / paradox.
When we talk about the attacks from an educative perspective one needs to demonstrate good examples of the usage of the collision attack.
One attack example from Wikipedia based on the hash-and-sign paradigm

The usual attack scenario goes like this:

Mallory creates two different documents A and B that have an identical hash value, i.e., a collision. Mallory seeks to deceive Bob into accepting document B, ostensibly from Alice.
Mallory sends document A to Alice, who agrees to what the document says, signs its hash, and sends the signature to Mallory.
Mallory attaches the signature from document A to document B.
Mallory then sends the signature and document B to Bob, claiming that Alice signed B. Because the digital signature matches document B's hash, Bob's software is unable to detect the substitution.

Another one From Our site: Squeamish Ossifrage answer

I make three versions of a software package:

the good one does what it is advertised to do which is something useful
the bad one does something harmful noisily, like uploading credit card data to a bad place
the sneaky one does something harmful quietly, like slowly making your screen look blurrier and blurrier over the course of a month, or silently disabling disk encryption

There's a sneaky catch: the good one and the sneaky one collide under MD5, but the bad one does not.

and, in short, goes like this the bad one detected due to an incorrect hash but the sneaky one survives since it has a hash collision with the good one.
What are other good attack examples that use the hash collision?


texts: Constructing private matrix for Algebraic Eraser

texts:
Having look into Algebraic Eraser key exchange (AEDH) seems the private key matrix may not be random to prevent weak-key results from the key exchange.

From the documentation and articles available it is not really clear for me how to construct the private key matrix. This session paper states:

$M_A = \sum_{i=0}^{N-1} \alpha_i . M_i^0$

however I am unable to find what is meant by $\alpha_i$ and $M_i^0$

For my spare-time projects maybe I will be ok with a random private key matrix $M_A$, but when I'm learning something, lets do it properly.

Thank you in advance.


texts:
DES has a 64-bit key size, but only 56 of those are used during encryption. The other 8 are "parity bits".

What was the intended purpose of the party bits, and why are they no longer used in modern ciphers?


texts:
Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac based authentication only service via using only Gmac instead of complete Gcm.

So I wondered if GMAC could or not be proposed as a serious / valid standalone Mac mode of operation when compared to well-known  Hmac or Cmac.

I fear the answer is NO for at least the two following reasons but as not being a crypto expert I would be interested to get more pertinent advices:

first GMAC requires use of an iv which is not the case for other Mac modes; this induces additional overhead on the messages to carry associated iv (subset)
then GMAC is known to fail (ghash key disclosure) if iv uniqueness constraint is not strictly respected.Hmac or Cmac do not know that kind of risk as not using any iv

Is it correct or am I too much pessimistic about GMAC in regard with robustness & performances of Hmac or Cmac widely recognised modes ?
.


texts: What about using Shamir's secret share over the real numbers leaks information? I know there is a problem with random number generation, and someone suggested it leaks the parity of the polynomial, but I can't see very many other problems.


texts: Is this API for ECDSA signature verification consistent with NIST test vectors?

texts:
I'm trying to use code from "Easy ECC" package (a github project), for ECDSA-verifying a signature.
The problem I'm facing is that the API assumes a public key length of N+1, which is different than NIST test vectors, where the public key is composed of 2 components (Qx, Qy) which are N bytes each.
(N is the number of bytes for the chosen derivative. For example, for P-256, N is 32).

To be specific, here is the API (ECC_BYTES is 32):

int ecdsa_verify(const uint8_t p_publicKey[ECC_BYTES+1],
    const uint8_t p_hash[ECC_BYTES],
    const uint8_t p_signature[ECC_BYTES*2]);

and the corresponding NIST "verify" test vectors are:

P-256,SHA-256
Msg = (omitted)
Qx = e424dc61d4bb3cb7ef4344a7f8957a0c5134e16f7a67c074f82e6e12f49abf3c (32 bytes)
Qy = 970eed7aa2bc48651545949de1dddaf0127e5965ac85d1243d6f60e7dfaee927 (32 bytes)
R = bf96b99aa49c705c910be33142017c642ff540c76349b9dab72f981fd9347f4f (32 bytes)
S = 17c55095819089c2e03b9cd415abdf12444e323075d98f31920b9e0f57ec871c (32 bytes)
Result = P (0 )

R and S are 32 bytes each and this is consistent with the API signature length of 2*N = 64 bytes.
Qx and Qy are also 32 bytes each and this is not consistent with the API's public key length of N+1 (33 bytes)

My question is: Does this API conform to ECDSA standard ? Eventually, I will have to test it with test vectors like the NIST one above.


texts:
I'm taking my first cryptography course and having trouble deciphering some Vigenere encrypted text.

I was able to crack the first one:

I'm having difficulty with the other two. I think the solution to #2 and #3 lies in the wording of the question. It says that the "message format" is the same as the first one, but what does that actually mean? Are the numbers arranged in the same way (i.e. first number is 3 chars long, second is four chars, third is four chars, etc)? I've been trying out a bunch of approaches but i'm not getting anywhere. Please help!


texts: Algorithm for anonymous but associated communications from a set of verified communicants?

texts:
Let's say that I'm selling a product, and I want to get authentic feedback from my customers. However, I have the following two constraints:

My customers must be able to give [at least some of] their feedback anonymously (and, due to practical constraints and legal reasons, it is impossible for I and many customers to agree on any auditor or provide any reasonable assurance that I "simply don't know", say, which "return envelope" I include into each box; otherwise, I'd simply pack each device with a smartcard and a video of my initializing such without observing it before sealing it in tamper-evident packaging.)

I must be able to associate multiple feedback entries from the same customer with each other; i.e. a customer must not be able to trick me into thinking that multiple customers share their required use-case. However, I want to be able to receive e.g. follow-ups or corrections, clarifications, etc. on feedback items with assurance that the original communicant is the one making the correction. (I additionally want to be able to track, say, particularly needy—or insightful—customers across multiple pieces of feedback.)

(It goes without saying that I must also have assurance that each piece of feedback is coming from a customer, not least of the reasons behind which is: this not being the case would break (2) indirectly by enabling customers to launch sybil attacks.)
Additionally, it can be assumed that customers will generally either know each other, or know of each other and be able to get into contact with one another; a solution may assume that every customer is able to get in contact with at least a few other customers (to verify that they have the same public key on file for me, etc.)
Is this a solved cryptographic problem?

If so: what is the solution; or what algorithm, system, or class of algorithms or systems allows this?
If not: what is the state of the art / discussion on it; or what terminology do cryptographers refer to this class of problems by?


texts: Efficient Incremental Updates to Large Merkle Tree

texts:
I have a data set with 300 Million entries and every 5 minutes 4000 random entries in this table change.  I need to calculate the merkle root on this data set to validate integrity multiple times every 5 minutes.

Assuming sha224 hashes this would be 8 GB for just the leaf nodes and almost 16 GB of data would have to be processed via sha224 to calculate the root and would take over 5 minutes to calculate.  To accelerate the calculation I must cache the tree and make incremental updates.

Is there a any known approach to accelerate incremental updates without requiring 16 GB memory mapped merkle tree?


texts: SSL-like protocol with public-key hard-coded in the client

texts:
Imagine a SSL-like protocol that instead of using certificates signed by a trusted CA, has the server's public key hard-coded in the client.
My question is: what happens if the server's private key is compromised?
Without certificates, the system doesn't have a CRL (Certificate Revocation List) and until the users update the client, the attacker can impersonate the server. How can one build a system that makes public-key revocation possible while having the public-key hard coded in the client?


texts:
I want to use Salsa 20 in Java, so I downloaded Bouncy Castle, and... it makes no sense to me. I've got it working, but most of my choices were essentially random. But I can't see there anything leading me to the right path. The interface CipherParameters accepts nearly any nonsense and a key size of 257 bits works perfectly.

private static StreamCipher newCipher(byte[] password, byte[] salt) {
    int iterations = 50000; // really?
    PBEParametersGenerator generator =
        new PKCS5S2ParametersGenerator(); // really this one?
    generator.init(password, salt, iterations);
    Arrays.fill(password, (byte) 0);
    final CipherParameters cipherParameters =
        generator.generateDerivedParameters(256, 64); // would 257 be better? :D
    final StreamCipher result = new Salsa20Engine();
    result.init(true, cipherParameters);
}

As I wrote, it works, but is this the right way? Especially,

Is PKCS5S2 with 50000 iterations a good choice?
The password gets stored nowhere, so I'm assuming, the only thread would be an attacker having access to both the plaintext and the ciphertext, xoring them together, and using it for verification of their password guesses. Am I right?
Concerning the practical POV, is there a way how to verify I did nothing seriously wrong (like switching password and salt or using a inappropriate method)?


texts: Generally accepted algorithm for two-pass, misuse-resistant AEAD that is efficient in software

texts: I would like to know what the standard is for two-pass, nonce-misuse-resistant AEAD that is efficient in software.  Thus, AES-SIV is excluded; modes based on a stream cipher like ChaCha20 are preferred.


texts: Efficient polynomial ring multiplication with coefficients in GF(2^s)

texts: Is there something similar (or an other efficient approach) to the NTT for the multiplication of polynomials in polynomial rings modulo $X^{2^n} + 1$ with coefficients in $\operatorname{GF}(p)$ with $p \equiv 1 \pmod{2^{n+1}}$, but instead for polynomial rings with coefficients in $\operatorname{GF}(2^s)$?


texts: Security of a 3-party key exchange protocol

texts:
I am trying to find attacks on a theoretical protocol or prove its security. An initiator wants to establish a shared key with a responder with help of a trusted server.

We have the following roles: $I$: Initiator, $R$: Responder, $S$: Server.

There are long-term symmetric keys between all pairs of involved entities denoted by $k(X,Y)$.

The protocol involves some nonces:

$\mathrm{sid}$ and $n_I$ are generated by $I$.
$n_R$ is generated by $R$.
A session key $\mathrm{sesskey}$ is generated by $S$ at every execution.

The message $m$ encrypted with the key $k(X,Y)$ is written as $\{m\}_{k(X,Y)}$.

Goal: The key $\mathrm{sesskey}$ should be secretly shared between $I$ and $R$. $S$ is trusted, and is also allowed to know $\mathrm{sesskey}$.

Adversary model: Dolev-Yao. The adversary knows all entity names at beginning.

Protocol:
$$
\begin{array}{rcl}
 1. & I \to S : & \mathrm{sid}, \: I, \: \{n_I, \mathrm{sid}, I, R, S\}_{k(I,S)} \\
 2. & I \to R : & \mathrm{sid}, \: I \vphantom{\{\}_{k()}} \\
 3. & R \to S : & \mathrm{sid}, \: R, \: \{n_R, \mathrm{sid}, S, I, R\}_{k(I,R)} \\
 4. & S \to R : & \mathrm{sid}, \: \{n_R, \mathrm{sesskey}\}_{k(R,S)} \\
 5. & S \to I : & \mathrm{sid}, \: \{n_I, \mathrm{sesskey}\}_{k(I,S)} \\
\end{array}
$$

Now what I have found so far is that if we assume $\mathrm{len}(\mathrm{sid},I,R,S) = \mathrm{len}(\mathrm{sesskey})$ then we can easily break the protocol with a type-flaw attack as follows. Impersonate $S$ and send $\mathrm{sid}, \{n_R, \mathrm{sid}, S, I, R\}_{k(I,R)}$ to $R$ in step 4, and $\mathrm{sid}, \{n_I, \mathrm{sid}, I, R, S\}_{k(I,S)}$ to $I$ in step 5.
 We thereby construct two session keys $(\mathrm{sid}, S, I, R)$ and $(\mathrm{sid}, I, R, S)$ for $R$ and $I$. We can thereafter intercept and forward (encrypting with one and decrypting with the other key) all communication between $I$ and $R$.

However, I find this unsatisfactory because we impose assumptions on the length of $\mathrm{sid}$, the names and the session key. It is not leaving my mind, but I cannot find any other attack. Can you prove the security of this protocol or do you see a different possible attack?


texts: How to compute the decompositions used in fast FHE bootstrapping?

texts:
Leo Ducas and Daniele Micciancio's recent paper "FHE Bootstrapping in less than a second" gave an exciting result that one can compute the `atom operation' of Fully Homomorphic Encryption (i.e. NAND-and-Recrypt) within 1 second without loss of security. I am trying to figure out how their scheme works.

However the key technique of their bootstrapping scheme, 'Homomorphic Accumulator', uses some decomposition algorithms that may be common and trivial in the area of mathematics but I have no idea about them.

Concretely, on page 10, the Algorithm 1 states:

  (For each $i$) compute the base-$B_r$ representation of $-a_i = \sum_j B_r^j \cdot a_{i,j}$ ($\mod q$)

where $j$, $B_r$ are small integers and each $a_i$ is a component of vector $\boldsymbol{a}$.

Similarly, on the next page,

  On input the current accumulator content $ACC \in R^{2d_g \times 2}$... first computes the base-$B_g$ decomposition of $u^{-1}ACC = \sum_{i=1}^{d_g} B_g^{i-1} \boldsymbol{D}_i$ (where each $\boldsymbol{D}_i \in R^{2d_g \times 2} $ has entries with coefficients in $\{ \frac{1-B_g}{2}, \dots, \frac{B_g-1}{2} \}$...

My question is, how to perform these decompositions?


texts:
So I went through my /etc/shadow file in Linux and discovered that my passwords were stored in SHA-512-based crypt ('sha512crypt') mode, so SHA-512. But why? I mean SHA-512 is not even a secure password hashing function. Why not bcrypt or Argon2 or scrypt ....
And how much iteration does this hash even have?

PS: Does $2$ "Blowfish" mean bcrypt ? And if yes, then why do they use the name of the block cipher?


texts: Three-party protocol for multiplication with output privacy

texts:
Suppose this simple protocol with three parties: $X$ (with secret input $x$), $Y$ (with secret input $y$), and $Z$ (no input). Suppose that we are operating with elements from a finite field.

The goal is that after the execution of the protocol, $Z$ knows $x\cdot y$ but not $x$ nor $y$, and $X$ and $Y$ does not learn anything. This can be considered similar to output privacy in secure multiparty computation. It is clear why we need output privacy: if $X$ learns $x\cdot y$, he can compute $y$ (and viceversa).

An initial approach could be based in using blinding factors. $X$ gives $b\cdot x$ to $Y$ and $b$ to $Z$, for a randomly sampled $b$; next, $Y$ gives $(b\cdot x)\cdot y$ to $Z$; and finally, $Z$ removes $b$ to obtain $x\cdot y$. This solution assumes that all parties are honest.

Any other ideas or references on how to come up with better solutions? I'm sure that similar problems should have been already tackled by the SMC community.


texts: Attack a RSA padding scheme that appends zeros


texts: Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

texts:
I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the IV.

This seems to be secure:

The IV will only be reused if there is an HMAC collision or if the
plaintext and key are the same.  The former would imply that the HMAC is
broken and the latter is harmless, since it is just producing the output
twice.
The HMAC is verified after decryption, but before padding is checked, so
padding-oracle attacks should not be an issue.

In particular, if the HMAC and the block cipher use different keys, there
seems to be a very simple proof of security, assuming that either (1) the HMAC cannot be distinguished from a random function or (2) the block cipher is secure against maliciously-chosen (but unique) IVs:

The attacker cannot forge the HMAC, since this would require knowledge of
the signing key.
Since the signing and encryption keys are different in this case, and the
HMAC is assumed random, malicious IVs cannot be triggered by an attacker.

Alternatively, if the cipher is secure against malicious (but unique) IVs, then the security of the cipher+security of the HMAC seem to prove the security of the system.

This (obviously) provides no protection against replay attacks, but that
requires state anyway.

However, I am not a cryptographer so I do not trust my conclusions on this
matter.  If this technique is secure, it would appear to be quite useful in
practice, as it is simple and provides both encryption and authentication.


texts: Determining message given cipher-text and public key

texts:
Consider the following scenario:

  Suppose A and B have set up their RSA public keys, namely $(e_a, n)$
  and $(e_b, n)$, where the n-value is the same. Also, it happens that
  the $\gcd (e_a, e_b) = 1$. Suppose C wants to send both A and B a
  message $M$ that is coprime with $n$. Thus, C encrypts $M$ using A and
  B's public keys, producing the cipher text, $C_a$ and $C_b$.

I was told by my instructor, that suppose if there is someone who obtains the values of both $C_a$ and $C_b$, that particular person can determine the message $M$ using the public keys of $A$ and $B$, without knowing their private keys. Why is it necessarily true? Any help would be highly appreciated!


texts: What is the intuition of attacks on ring lwe?

texts:
I know that there are several attacks on ring lwe. But I am not sure why they work.
Does anyone have intuition of such attacks?

What is the common idea used?
Reducing the Search space (modulus space)?

I want to know them.


texts: Security relevance of random factor in Paillier

texts:
In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$.

The additive-homomorphic property of the system shows that
$g^{m_1} r_1^n \cdot g^{m_2} r_2^n = g^{m_1+m_2} (r_1r_2)^n = g^{m_1+m_2} r'^n\mod n^2  = m_1 + m_2 \mod n$

so the resulting $r'$, that would be needed to encrypt $m_1 + m_2$ to the identical result of the homomorphic addition, would be: $r_1 \cdot r_2 \mod n^2$

Supposed now one were to homomorphically sum up the encryptions of a couple of messages from a limited publicly known set of plaintexts $S=\{0, 1\}$. If one then were to proof the correct encryption of the sum by disclosing the encrypted sum, the plaintext sum and the resulting random factor $r'$ for the encrypted sum - would this provide any useful information about which summand encrypts which plaintext message?

Assuming "revealing r" would provide any information about the summands of a homomorphically added sum. Would it help to use primes as random factors for the encryption of the summands? I mean an attacker then would have to find an efficient way to factorize the resulting $r'$.

Is there a way to turn "revealing r" into an interactive version involving a challenge? Would this solve the problem that by passing on $r'$ the proof becomes transferable which may be an undesired property?

[1]
Pascal Paillier -
Public-Key Cryptosystems Based on Composite Degree Residuosity Classes
Link


texts: What is the restriction on $k$, for the $k$th composite residuosity problem to be hard?

texts:
The paper “Residuosity Problem and Its Applications to Cryptography” considers the exponent to be an odd integer.

When $k = 2$, it is called the quadratic residuosity problem (mod $n$, where $n$ is composite) which is hard and can be solved if the factorization of n is known.

What happens to the $k$th residuosity problem if $k$ is an even integer $> 2$?


texts: Is this block encryption scheme using PCBC for RSA secure?

texts:
I stumbled over this post, containing code to encrypt larger messages with RSA by splitting them into blocks using PCBC mode
I will copy the relevant part here, but for details see the original posting or this archived copy.

# As indicated in Prologue, this is an implementation of an idea of the present
# author to closely combine asymmetric and symmetric encryptions, which
# presumably is novel.
#
# Encryption will be done with receiver's public key on blocks chained in a way
# analogous to the chaining in common symmetric block encryption processing. The
# chaining value is initialized by a pseudo-random iv. A plaintext block (as a
# big integer resulting from character to integer transformation) is xor-ed with
# the chaining value before being encrypted. The chaining value is then updated
# by xor-ing it with the current plaintext block and the ciphertext block. (In
# distinction to the well-known CBC chaining, we empoly thus PCBC chaining. Note
# that the variable chaining sums up via xoring the values of pp and cc of all
# preceding blocks such that it has a in this context very desirable high error
# propagation property. The iv and the last chaining value obtained are then
# encrypted and appended to ct, the list of the ciphertext blocks, for purposes
# of authentication (integrity check). It is to be particularly remarked that we
# have, as described, integrated certain well-known techniqes commonly employed
# in symmetric block encryption into asymmetric encryption. A normal message is
# processed in this example. In its place there could of course be anything else
# instead, e.g. a secret key for use in a symmetric block cipher (which is how
# RSA is commonly used in other software).
#
# Users employ for encryption and decryption the functions
# rsaencryptplaintexttoct() and rsadecryptcttoplaintext() respectively in case
# the given secret material is in form of a text string, and the functions
# rsaencryptbytearraytoct() and rsadecryptcttobytearray() respectively in case
# the given secret material is in form of a byte sequence.

# Encrypt pt, a list of integers of mb bits (integers in [0, 2**mb-1]) to ct,
# another list of integers, with the public key of the receiver. Note that ct
# returned is a list of integers which may be larger than mb bits, i.e. up to
# receivern-1.
#
# mb: See comments of rsakeygeneration().
#
# (receivere, receivern): The public key of the receiver.

def encrypttoct(pt,mb,receivere,receivern):
assert mb%8 ==0 and mb >= 2048 and 2**mb < receivern
tpmb=2**mb
tpmbn1=tpmb-1
RANDOM=random.SystemRandom()
# A pseudo-random iv is generated to be the initial chaining value.
iv=RANDOM.randint(1,tpmb-1)
chaining=iv
ct=[]
# Each pp is a block of plaintext.
for pp in pt:
    assert pp < tpmb
    u=chaining^pp
# Encrypt with receiver's public key to obtain the ciphertext block.
    cc=pow(u,receivere,receivern)
    ct.append(cc)
# Update the chaining value by xor-ing it with the plaintext block and the
# ciphertext block (limited to mb bits).
    chaining^=pp^(cc&tpmbn1)
# Here at the end of the loop the chaining has its last value.
# Encrypt iv and the last chaining value and put them into ct.
g=pow(iv,receivere,receivern)
h=pow(chaining,receivere,receivern)
ct+=[g,h]
return(ct)

(all rights to this code belong to the original author Mok-Kong Shen

It strangely looks like this is somehow the PCBC mode decryption as described in Wikipedia used for encryption.

Is there any issue resulting from using that with RSA instead of a symmetric cipher?

Assuming that RSA is as secure as BlockCipher XYZ, will this give the same security as PCBC used with XYZ?


texts: Why can't different messages result in the same ciphertext when encrypted with RSA?

texts:
In the encryption step of the RSA encryption to get the cypher text $C$

$C \equiv M^e \pmod n$

I am struggling to understand how we know that there only exists one $M$ that maps to a certain $C$?

Does there not exist an $M$ and an $N$ such that $M^e \equiv N^e \pmod n$? How do we know this?


texts: eXtended Merkle Signature Scheme (XMSS) vs Leighton-Micali Signature (LMS)

texts:
Very briefly, how does eXtended Merkle Signature Scheme (XMSS) stack up against Leighton-Micali Signature (LMS)?

I'm asking this in the context of my article here.


texts: Understanding the signature and hashing algorithms in TLS connection debug output

texts:
I have an application using TLSv1.2 for communication. I use the option -Djavax.net.debug=all

Cipher Suites: [TLS_DHE_DSS_WITH_AES_128_CBC_SHA]
Compression Methods:  { 0 }
Extension signature_algorithms, signature_algorithms: SHA512withECDSA,SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA, MD5withRSA
Extension renegotiation_info, renegotiated_connection: <empty>
***
[read] MD5 and SHA1 hashes:  len = 74

I do not quite understand this output.

The client sends the cipher suites it wants to use, and the signature algorithms extensions correspond to that cipher suite?
I also do not understand the [read] MD5 and SHA1 hashes:  len = 74 why is the length of the message equal to 74 ?


texts:
Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states:

  In the case of CTR, we are merely XORing the output of the cipher
  against the plaintext. This means there is no inherit reason why the
  plaintext has to be a multiple of the cipher block size. CTR mode is
  just as good for one-bit messages as it is terabit messages.

I dont understand the author's statement. In my implementation im planning on having a 16 byte IV/counter, with 12 bytes being the random IV, and 4 bytes for the counter. In pseudocode, something like this:

byte [] CTR_encrypt(byte [] key, byte [] plainText){
    byte [16] IVAndCounter;
    nPlainTextBytes = plainText.getLength();
    int blockCount = ceiling(nPlainTextBytes / 16)
    for(int i = 0 ; i < blockCount ; i++){
        byte [???] cipheredIVAndCounter = AES(key, IVAndCounter);
        IVAndCounter++;
        byte [???] cipherText = cipheredIVAndCounter XOR plainText;
        byte [???] cipherTextComplete = cipherTextComplete + cipherText;
     }
     return cipherTextComplete;
}

I understand why why you wouldn't have to pad say the last block of plaintext, that might not be 128 bits long, but you still have to divide the plaintext into 128 bit blocks in order to XOR it with the 128 bit ciphered IV/counter don't you? You cant just XOR the 128 bit ciphered IV/counter with the whole plaintext, as that would leave much data unencrypted? That is, the plaintext, must be 128 bits or less for CTR mode?

Maybe im missing something. I looked at this question: Why doesn't CTR mode require blocking? , but still dont get it, and feel if anything more confused after reading it.


texts: Output of a Linear Shift Register given Plaintext and intial state

texts:
Given an initial state $S_0 = (0101)$ and plaintext $P = 1010101011$ I need to find the ciphertext.

The method to solve this was not taught in my coursework, and the information I have found online does not seem to apply to this.

Can anyone explain the steps needed to solve this?


texts: What is the definition of Feistel Cipher?

texts:
I know how Feistel Network works, but I want to know the exact definition of "Feistel Cipher" to solve several questions below:

  question 1: Is it correct to say DES (Data Encryption Standard) is Feistel Cipher?

Opinion: I think the statement "DES uses Feistel Network" is correct. Also, since the encryption and decryption process is same, except key scheduling,
somebody can say that DES is Feistel Cipher. But I think somebody else can say that DES is not a Feistel Cipher since DES has initial and final permutations.

  question 2: Does "DES_Encrypt'(M,K1,K2) =  DES_Encrypt(M,K1) xor K2" is also Feistel Cipher?

Opinion: I think the statement "The above modified DES uses Feistel structure" is correct. But, since the above modified scheme's encryption and decryption structure are not same, somebody can say that the above modified scheme is not Feistel Cipher.

There can be several options to solve this definitional problem:

We call an encryption scheme a Feistel Cipher, if it uses Feistel Network;
We call an encryption scheme a Feistel Cipher, if it only use Feistel Network;
We call an encryption scheme a Feistel Cipher, if it uses Feistel Network and the encryption and decryption procedure is same, except the key scheduling process.

Which one is correct? Or, are there any other opinions?

I know that this problem is not that important, but I want to make it clear.


texts: Rules Governing Duplicate, Repeated Characters While Encrypting Plaintext to Ciphertext

texts:
What is the general rule if there is one that allows the encryption of a plaintext message to ciphertext message to be able to mask duplicate or repeated letters in the plaintext.
This is an arbitrary example
plaintext: mississippi
to
ciphertext: xkvsdoputyp
Additionally, for the example above can you give a detailed explanation and example of cipher that does this.
In the above example, I also included a non-consecutive, repeated character in the ciphertext to also ask the question what rule governs the mapping of a non-consecutive, repeated single character in the ciphertext to two distinct characters from the plaintext.
I would appreciate it if any of these two questions could be answered. I want to get a better understanding of principles governing the possibilities of a specific cipher algorithm.


texts: Can we prove $(a,b,c,d)$ is of form $(g,g^x,g^y,g^{xy})$ without knowing $\phi (N)$?

texts:
assume $N=pq$ where $p$ and $q$ are two large prime numbers and all computations are modulo $N$.

given $\phi(N)$, one can prove that the tuple $(a,b,c,d)$ is of the form $(g, g^x,g^y, g^{xy})$, i.e. it is a Diffe-Helman tuple.

Question: Can we prove that the $(a,b,c,d)$ is a Diffe-Helman tuple without knowing $\phi(N)$?

Edit- Application:

Assume someone is given $(g,g^{2^3},g^{2^5}) \bmod N$. He wants to compute $g^{2^{8}}$ and prove that he has done the job correctly, but he does not know $\phi(N)$.


texts: RC4, finding key if we know plain text and ciphertext

texts: Having plain text A , and  cipher text B. Can we somehow retrieve key , when we want to decrypt text C which was also crypted with the same key?


texts: How do we find the subkey out of a differential cryptanalysis?

texts:
I understand the differential cryptanalysis up to the "finding the last subkey" part. If XORing with the key doesn't change the differentials, how can testing different key affect the equations we found?

EDIT: I think I kinda get the answer now. Although I'd like a confirmation:

After getting all those probabilities on the differentials at different stage in the cipher. You test these probabilities with real pairs of messages and ciphertexts and you see if for an hypothetical key the probabilities you found hold. If they don't it's probably because you had a bad key, if they do then you probably have a good key.

EDIT2: Mmm, actually no I still don't understand. Even with a bad key, probabilities we found still should apply...


texts: Why aren't 4096-bit RSA PGP key blocks $\lceil\frac{4096}{6}\rceil=683$ base64 characters long?

texts: If a 4096-bit RSA PGP key is considered sufficiently long for most purposes, why are so many key blocks around 3000 base64 characters in length? Why aren't $\lceil\frac{4096}{6}\rceil=683$  base64 characters enough?


texts: How to hide bit frequency of the inter-packet delays covert channel?

texts:
I encode a hidden message as different delays between packets of another data stream.

My implementation now is that for each bit,

if the bit is 0, a inter-packet delay between min and middle is generated and
if the bit is 1, a inter-packet delay between middle and max is generated.

Here's my code in Python:

binary_string = ''
m_time = 0.5
min_time = 0.2
max_time = 0.9
csv_array = []
package_stream_array = []
last_timecode = 0
for c in secret:
    binary_string += bin(ord(c))[2:].rjust(7,'0')
for key, digi in enumerate(binary_string):
    if digi == '0':
        last_timecode += uniform(min_time, m_time)
        csv_array.append(last_timecode)
        package_stream_array.append("p({0:d},{1:.2f})".format(key+1, last_timecode ))
    elif digi == '1':
        last_timecode += uniform(m_time,max_time)
        package_stream_array.append("p({0:d},{1:.2f})".format(key+1, last_timecode))
        csv_array.append(last_timecode)
for memeber in package_stream_array:
    print memeber

After I plot a chart, I found the 0,1-frequency still can be observed.

Is there a better way to improve this?


texts:
There are many limits on key size. As far as I know 56 bit in USA  and 40 bits in India without license. On the other hand much higher 128 bit or 1024 or 4096 bit for banking and other purposes. So what will one do (I am not starting any banking business or something, just asking in case a man wants to make a secure app must he take license?) Without license one cannot comply with both.
Secondly I am new to TLS and cryptography in general. In case of https connection who decides the encryption strength the server or client. How can I force a less than 32-bit encryption on server and clientside. If the data is read then it's not a problem but want to prevent man in the middle attacks.


texts: Is there a way to provide proof of batch RSA security?

texts:
Suppose we have two encrypted messages with two different public key issued from the one server. There is a client who wants to send these to messages to the server.

In the middle there is an adversary, who eavesdrops all the communications, so he already got the two encryption keys and the two encrypted messages.

According to batch RSA, the adversary can recover the encrypted messages without the need to use the private key to decrypt the messages. Can anyone explain how can we prove that batch RSA is secure in such a scenario?


texts: how does BearSSL's GCM modular reduction work?

texts:
BearSSL (in src/hash/ghash_ctmul.c) seems to be doing a modular reduction that I don't completely understand. Here's the code:

/*
 * GHASH specification has the bits "reversed" (most
 * significant is in fact least significant), which does
 * not matter for a carryless multiplication, except that
 * the 255-bit result must be shifted by 1 bit.
 */
zw[0] = c0 << 1;
zw[1] = (c1 << 1) | (c0 >> 31);
zw[2] = (c2 << 1) | (c1 >> 31);
zw[3] = (c3 << 1) | (c2 >> 31);
zw[4] = (d0 << 1) | (c3 >> 31);
zw[5] = (d1 << 1) | (d0 >> 31);
zw[6] = (d2 << 1) | (d1 >> 31);
zw[7] = (d3 << 1) | (d2 >> 31);

/*
 * We now do the reduction modulo the field polynomial
 * to get back to 128 bits.
 */
for (i = 0; i < 4; i ++) {
    uint32_t lw;

    lw = zw[i];
    zw[i + 4] ^= lw ^ (lw >> 1) ^ (lw >> 2) ^ (lw >> 7);
    zw[i + 3] ^= (lw << 31) ^ (lw << 30) ^ (lw << 25);
}

How does this reduction work?


texts: How much time would it take to crack time mnemonic phrases in these scenarios?

texts:
How long time would it realistically take to crack each of following scenarios and how many combinations does each scenario consist of?

Mnemonic Phrase, it is not known if we are looking for a pass-phrase of 12, 13, 24 or 25 words

Scenario 1: There are total 90 words shown on a single sheet of paper.

Scenario 2: There are total 180 words shown on two sheets of paper (90 each). It is not known how many words (of pass-phrase) are on each sheet of paper (meaning one sheet could have 0 and the other all)


texts: What rule(s) for a good S-box is this one violating and how does it relate to non-linearity etc.?

texts:
I generated this single-cycle substitution box and I want to post it as an example for understanding what a good S-box would be like. I get the feeling that this particular one is weak. Here it is (upper four bits of input are matched with the row and the lower four bits are match with the column:

AC 17 FB CB 60 93 35 50 F7 83 DF B3 8B 66 25 05
9B 16 0E 96 04 2A 95 62 FD 43 BE 37 4D 38 D9 07
E7 9C 80 3F D2 8E BA 1E 2F 36 F4 2E 2B AF A8 5A
9E 4C C0 19 82 3B 30 E9 4E DE 01 C8 15 8D 20 0B
39 CA E6 D0 F6 E3 57 D6 A3 1B 03 69 81 CE 22 AD
31 5E 57 34 70 A8 68 09 F2 B9 EA 6A 02 3E 21 78
C6 86 2C 85 6F D3 5C 2D 24 FF 92 D4 CF 18 4F B7
C5 12 FE 51 B1 B4 1C A1 97 40 C4 2F 47 F1 0A DA
F3 A2 8A 29 EE 10 32 F0 3D 48 D7 E8 6D A4 26 DC
B8 FC 91 DB A7 49 0C 5B 9F 13 F8 76 6C 11 73 58
B0 67 CD 88 44 27 75 D5 FA 8C 58 AE 14 7F 0F BB
B5 B6 46 E2 89 A6 63 08 E1 5F 1F 9D F9 98 64 79
4B 1A 42 AC D1 59 61 41 87 EB 77 A0 C2 DD CC 74
45 7D B2 8F C1 E5 99 C7 7E 3A 7B E4 F9 6E A5 7A
1D 53 56 ED 0D EC C9 71 C3 65 AB 06 EF 3C A7 5D
E0 7C 90 9A D8 06 23 A9 54 33 4A BF BD 72 84 6B

I'm noticing several things:

There are a few places where the upper four bits of the output match the upper four bits of the byte right above or below it in the table. There are also ones where it is the lower four bits that match.
There are a few places where the output's lower four bits match the lower four bits of the output to the left or right of it in the table. Same goes for the upper four bits.

I'm not well-versed in the art of S-box construction, but I'm getting the feeling that this one is a poor one.

What I'd like to know is: what rule for a good S-box is this one violating here and how it relates to non-linearity and all that?

Update #1

Richie Frame has pointed out that the S-box above is not bijective. Here is the correct one:

AC 17 FB CB 60 93 35 50 F7 83 DF B3 8B 66 25 05
9B 16 0E 96 04 2A 95 62 FD 43 BE 37 4D 38 D9 07
E7 9C 80 3F D2 8E BA 1E 2F 36 F4 2E 2B AF 55 5A
9E 4C C0 19 82 3B 30 E9 4E DE 01 C8 15 8D 20 0B
39 CA E6 D0 F6 E3 52 D6 A3 1B 03 69 81 CE 22 AD
31 5E 57 34 70 A8 68 09 F2 B9 EA 6A 02 3E 21 78
C6 86 2C 85 6F D3 5C 2D 24 FF 92 D4 CF 18 4F B7
C5 12 FE 51 B1 B4 1C A1 97 40 C4 28 47 F1 0A DA
F3 A2 8A 29 EE 10 32 F0 3D 48 D7 E8 6D A4 26 DC
B8 FC 91 DB A7 49 0C 5B 9F 13 F8 76 6C 11 73 AA
B0 67 CD 88 44 27 75 D5 FA 8C 58 AE 14 7F 0F BB
B5 B6 46 E2 89 A6 63 08 E1 5F 1F 9D F9 98 64 79
4B 1A 42 00 D1 59 61 41 87 EB 77 A0 C2 DD CC 74
45 7D B2 8F C1 E5 99 C7 7E 3A 7B E4 BC 6E A5 7A
1D 53 56 ED 0D EC C9 71 C3 65 AB F5 EF 3C 94 5D
E0 7C 90 9A D8 06 23 A9 54 33 4A BF BD 72 84 6B

It still has the same problems I noted before.


texts: Is it safe to encrypt a part of the message with RSA and the rest with AES?

texts:
The structure can be the following:

A signature (on the sha-256 of everything else).
RSA-encrypted random AES key (or none) and as much data as it fits into an RSA block.
AES-encrypted blocks with the rest of the data (or none at all).

The point is that an RSA block can hold a lot. Seems like a waste of space.

Is it worse than this?:

A signature (on the sha-256 of everything else)
RSA-encrypted random AES key
AES-encrypted blocks with the data


texts: Are keys generated by the user or block cipher algorithms themselves?

texts:
We know block cipher algorithms. In the block cipher algorithms, Key Scheduling is the one crucial part. I see that in some simulation programs of the AES,DES,TripleDES encryption algorithms. In those, some programs are asking for the key dynamically or statically.
Now this time, I need to know clearly how to generate the key in symmetric key encryption.
I mean "is key given by user? or is key ready by default in encryption?"


texts: What is the minimum message length to obtain the full potential of a hash?

texts:
Suppose I want to commit to a uniformly picked nonce of fixed length $n$ bits without revealing the nonce, so I use a secure hash function $H$ mapping messages to digests of length $d$ bits. Suppose $H$ promises a complexity of $\sim 2^d$ for a preimage attack, and $\sim 2^{d/2}$ for a collision attack. Suppose $n$ is publicly known.

Clearly, at least for the preimage attack, the above promise cannot gain you a complexity of more than $2^n$ for $n<d$, because then you can just try out all $2^n$ messages.

My question is: is it considered safe for practical purposes (say, for $H$ from the SHA-2 or SHA-3 family) to use $n=d$ for obtaining the full or almost full complexity of $H$, or should $n$ be even greater?


texts: Is it theoretically possible to create an unbreakable cipher?

texts:
I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and hash algorithms that are unbreakable (like when people said that we'd never run into an MD5 collision in the lifetime of the universe), but get broken in a couple of decades time (MD5 collision can be created on a modern PC in minutes). Others (including me) think that it's impossible. I believe that it is near impossible to create an unbreakable cipher, but I don't quite understand why.
Sure, computing power increases, and transistors double in count every year, but is a cipher really just a bodyguard that has a limited lifespan and dies when computing power increases? With quantum computing (I'll refer to it as QC) rapidly growing, many algorithms such as RSA and AES are becoming vulnerable.
I know, AES256 is safe against QC for now, but in the long run, it'll only get weaker and weaker until it is broken. But why (don't consider bruteforce because hashes take care of that)?
The logic behind cryptography is math, and math is getting more complex (Calculus, modern math, etc). When DES was created, there was no Shor's algorithm or Grover's. As time went on, math advanced, as did technology, and thus Shor's and Grover's algorithms are created. These discoveries weaken ciphers like AES by not a lot, but when they pile up as time goes on, it greatly weakens them.
Is it just impossible to create a cryptographically secure cipher that is strongly rooted in math and designed so that no advance in QC/math will weaken it? If we gathered the world's best cryptographers, gave them telepath (just for example), and gave them 1 billion dollars to create a cipher, would it always be able to be cracked?
I read this SE question and quickly came to the conclusion that it's a scam and just for views, but I'm sure many people believe it. I would like to know if ciphers can be unbreakable and if they can't be unbreakable, why they can't.


texts: where are ssh.com's crypticore and seed defined?

texts:
ssh.com's Tectia offers a few algorithms seemingly unique to itself. Chief among them: crypticore128@ssh.com, crypticore-mac@ssh.com and seed-cbc@ssh.com

Are these algorithms publicly defined anywhere or are the proprietary algorithms?


texts:
How can I understand the term RSA key normalization? What exactly is done in the process??
Please explain.


texts: Two party protocol using only hash function

texts:
I have been told by my professor to compare two passwords as we do it in Yao's two-party protocol but without using any crypto functions. We are only allowed to use a hash function. The passwords are taken from the dictionary so we can't even send the hash of that word as we can't risk a dictionary attack.
I am thinking of changing the alphabets to ASCII code and then pass it down the garbled circuit using Yao's protocol but don't know whether it will work.
Any suggestions? Thanks


texts: The existence of partial homomorphic additive encryption with bit-wise XOR operation

texts:
According to  Protocol A that was presented in Section 3.1  paper entitled "Some Efficient Solutions to Yao’s Millionaire Problem" (2013). [1]

In that protocol they used an assumption that there is an encryption function that has the homomorphism property with respect to both additions (over some finite field) and bitwise XOR operations.

Can someone please send a reference to scheme that uphold the requirements?

My current candidate is to combine the answer in [2] and micali-goldwaser encryption [3].

But I don't know how (and if it possible) the scheme could work  and overcome:
(1) $N$ in GM  cannot be a $Z_{2^q}$ as it's a multiplication of two primes.
and
(2) Is it possible to work with 2-complement binary representation ( To perform the subtraction operation).

[1]- https://arxiv.org/pdf/1310.8063v1.pdf

[2]- Homomorphic encryption based on XOR

[3]- https://en.wikipedia.org/wiki/Goldwasser%E2%80%93Micali_cryptosystem


texts:
I am working in .NET and their PBKDF2 only uses SHA-1.  I am using it to, given a user-supplied password and random salt, generate a 256-bit AES key.  The plaintext is encrypted with the AES key and the ciphertext and salt are then stored.  SHA-1 has a 160 bit output size.  So if I specify 100000 iterations to PBKDF2 it will actually run 200000 iterations.  Let's say an attacker did a dictionary attack on the password (running each password and the known salt through the key derivation and trying to decrypt the data with the derived key). Would he also need to run 200000 iterations, or is there a shortcut he could use that would only require 100000 iterations?

The OWASP states:

  Using PBKDF2 for password storage, one should never output more bits than the base hash function's size. With PBKDF2-SHA1 this is 160 bits or 20 bytes. Output more bits doesn't make the hash more secure, but it costs the defender a lot more time while not costing the attacker. An attacker will just compare the first hash function sized output saving them the time to generate the reset of the PBKDF2 output.

But since I am not storing passwords, is the above not concern for me?

Of course it would be nice if .NET supported PBKDF2-SHA-512, but as far as I know that is not yet the case.

Note: If I understand correctly, my 256-bit AES key only offers 160 bits of security (due to 160-bit output length of SHA-1), but that seems not too problematic considering a dictionary attack on the password would likely be much more appealing to attackers than a brute force attack on the key.


texts: I was reading research Paper. In which writer talks about universal circuit. I want to know how is universal circuit $U_{e}$ different from simple circuit. What properties they have. Is they hide structure of simple circuit


texts: Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?

texts:
Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs.
Will I get 512 bits of encryption strength?


texts:
I read the summary of deniable encryption on wikipedia:
https://en.wikipedia.org/wiki/Deniable_encryption

Then I read a question, by doom123 on security.SE:
https://security.stackexchange.com/questions/34684/truly-deniable-encryption

But I had a subtly different problem which can be stated as follows:

Alice wants to send Bob the book "Mocking Jay" which is banned in Bob's country.
Alice encrypts "Mocking Jay" to data MJ with the password P1.
Using another book of similar size (or by trimming a larger book), say the "The Hobbit", she processes the data MJ and computes password P2.

The solution to this problem will allow Bob to claim that he maintains a copy of "The Hobbit" (assuming that "The Hobbit" is not banned of course), while being able to read  "Mocking Jay". The solution, in theory, should also allow Bob to plausibly deny that there's any other copy hidden in the data "MJ" other than "The Hobbit"; or like the aforementioned security.SE question, should allow "MJ" to hold any number of copies (and thus any number of passwords), providing Bob the excuse of acknowledging only one copy that he has the knowledge of.

The answer provided by the user lynks to the question posed by doom123 solves the problem for storing data on a hard-disk. Is there a general solution to this problem?

UPDATE 1
With regards to the answer provided by fgrieu I am slightly modifying the question. Is it possible to add a third layer (and an arbitrary number of further layers) of such encryption? What I mean is, with Mocking Jay, The Hobbit, and Silmarillion (assuming that the books are roughly the same in size) as inputs, is it possible to create an encrypted output say MJTHSI? I am alright with the passwords being the output as well. Decrypting with password P1 will reveal Mocking Jay. If rubber-hose is used password P2 can also be given up revealing The Hobbit (with the intention of ultimately protecting Silmarillion which can be revealed using P3).


texts: Is it possible to split a large AES encrypted string and decrypt the parts one by one?

texts:
Due to some platform restrictions our decryption algorithm can only handle up to 1 million bytes. The string we receive is larger, having been generated by AES in cipher block chaining (CBC) mode, with PKCS5 padding.

Is it possible to somehow split the encrypted data and decrypt the parts?


texts: How to learn the first bit of m in padded RSA

texts:
Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing the ciphertext $c = (m′)^e$ (mod $N$). For concreteness, further assume that $N$ is a 1024-bit RSA modulus, and that the scheme only handles 512-bit messages.
For the rest of the problem, assume you are given some ciphertext $c$ that is the encryption of some 512-bit message.
Suppose you learn that $(2^e)c$ (mod $N$) is a valid ciphertext. What does this tell you about the first bit of $m$?


texts: secret sharing with 3 parties under constraint

texts:
Suppose we have $3$ parties Alice, Bob and Charlie such that Alice can't talk with Bob.

Suppose that Alice has some string $x\in\{0,1\}^n$ and Bob has a string $y\in\{0,1\}^n$.

Suppose that Alice and Bob have access to a shared random string $r$ and a shared secret $s$.

Suppose that Charlie knows both $x$ and $y$ and he doesn't have access to $r$.

  Describe a protocol in which Alice sends one message to Charlie (it may depend on $x,r,s$) and simultaneously Bob sends one message to Charlie (it may depend on $y,r,s$). Afterwards, if $x=y$ Charlie will know $s$ and if $x\neq y$ Charlie will not be able to know $s$.

The general context of this problem is secret sharing, e.g. Shamir's secret sharing and so on.

I have a proposition for solution to the inverse version of this question, i.e. if $x\neq y$ Charlie will know $s$ and if $x=y$ Charlie will not be able to know $s$:

My proposition is to think of $x,y,r$ as members of the field $\mathbb{Z}_{2^n}$.

Alice computes $s+rx$ and sends it to Charlie.

Bob computes $s+ry$ and sends it to Charlie.

If $x\neq y$ Charlie can interpolate to get $s$, otherwise $x=y$ and Charlie only saw some random element of $\mathbb{Z}_{2^n}$: $s+rx=s+ry$, so he can not recover $s$.

But this is not the original question and I don't know what to do with the original.

Can we generalize it to some boolean function $f:\{0,1\}^n\times\{0,1\}^n\to\{0,1\}$, i.e. only if $f(x,y)=1$ Charlie will be able to recover $s$?


texts: Is SHA-256 secure as a CTR block cipher?

texts:
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.

We represent numbers in simple binary instead of a counting function. 0 in dec = [256 zeros] in binary, 1 = [255 zeros]1, 23092348 = [241 zeros]1011000000101110001111100, etc.

For each nth block needed for the length of the plaintext, XOR x with n and hash it with SHA-256 to form b[n].

Let p[n] be the nth 256-bit block in the plaintext and c[n] be the nth block in the ciphertext. Then c[n] := b[n] XOR p[n].

Send the unencrypted nonce along with the ciphertext.

To decrypt c[n], XOR it with b[n] to retrieve p[n].

Is this secure? If so, then why do we need AES-256?

If this is not secure, then is there any mode of operation for which SHA-256 is secure as a block cipher? Specifically, it would need to be used in cipher feedback, output feedback, or any other mode that only uses the cipher in the encryption direction.


texts: For Diffie-Hellman, why is a g value of p−1 not a suitable choice?

texts:
I am currently learning about the Diffie-Hellman key exchange. I understand that for a $g$ of $1$, the resulting key would always end up as $1$ which would obviously not be secure.

I read that the $p\! -\! 1$ value for $g$ is not secure either, but there is no explanation as to why - which is my question. I guess it has to do with $g$ being a divisor of $p\! -\! 1$ but I am not sure.


texts: Is the HMAC construction really neccessary for a fixed length message?

texts:
The HMAC Construction is defined as:

Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) )

This was designed because a simpler construction such as:

Hash(Key || Message)

Is vulnerable to a length extension attack (but not for all hashes, a notable exception is SHA-3).

The questions are, what about cases where the message:

Is of a known, fixed length, and would be rejected if having any other length than the expected one (CBC-MAC, for instance, is secure for a fixed length message, but not for a variable-length one).
Is prepended with fixed-sized length indicator at very the beginning of the message (i.e. the extended message would be Fixed-Sized Length indicator||Message and the hash would be: Hash(Key||Fixed-Sized Length indicator||Message)).
The same scheme as the previous one but where the length indicator is only included within the hash.

(these may be completely different cases so consider them separately).

Note that for (3) an alternative configuration Hash(Fixed-Sized Length indicator||Key||Message) would guarantee that the length indicator is included in the first block of the hash - I mean, even for a huge key that is larger than the hash function block length. The length indicator would probably not need to be any more than 64bits of size (as most [older] hashes are limited to a maximum message size of 2^64 - 1 bits anyway). This makes it very hard to imagine how can it be insecure? But I'm not a cryptographer, I guess.