texts: Is it possible to encrypt the key by sender's private key and again encrypt it with receiver's public key by using RSA algorithm at sender end

texts: Is it possible to encrypt the data by sender's private key and again encrypt it with receiver's public key by using RSA algorithm at sender end.How decryption is done at receiver's end?


texts:
Is this a sensible scheme for 2-way client/server communication? A client connects to a server. The server and client both generate RSA keys, and send over the public ones to each other. If the client wants to send a message, they encrypt it with the server's public key, send it over, and the server decrypts it. Vice versa with server -> client.

Does this make sense? Presumably breaking this is equivalent to breaking RSA, right? Is something like this ever used in practice? If not, what do alternatives do better?


texts:
I have worked on a random number generator that has turned out to give results pretty close to those of Fortuna with a single source.

I was wondering how it affects the performance and claims of Fortuna as a RNG in this special case of using a single source.

How will the recovery rate be affected?

I think a solution which does not compromise with a multi-pool system can be:
Use a single source to distribute secrets to a different pool. (i.e. my events processed though from one observation go to different pools as per the original design of Fortuna.)

This will be slower, but it will still be a good randomness generator without any compromise. Is this true?


texts: What is modulo switching, in a nutshell?

texts: Coupled with the terms bootstrapping and relinearization, the term modulo switching appears a lot in the FHE literature. What is it and how does it relate to the other two?


texts: Fuzzy Extractor: Order of elements in set

texts:
Does order of elements in two sets matters to authenticate using Fuzzy Extractor?

Using extractor as proposed in https://www.cs.bu.edu/~reyzin/fuzzy.html
it seems the set difference is zero for this case:

$w= {1,2,3,4,5,6,7}$ and $w'={7,6,5,4,3,2,1}$ and other permutations where order of members are changed.

This is not favorable for our case because Eavesdropper can leak information even if has dissimilar set. In our protocol Eve has very low correlated data with Alice-Bob but in certain cases chances of getting $w$ at Eve is high since order is not taken care of.

If the result depends on construction, how to we identify responsible properties or formulations?


texts:
I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement.

Why do people avoid blinding in ECC?


texts: Is the first Nonce exchange between Alice and Bob in Needham-Schroder key exchange protocol redundant?

texts:
For the Needham-Schroder protocol, assuming Alice and Bob are both able to guarantee each other's public keys (e.g. through a Certificate authority), the protocol is

1) A sends to B:
$E_{publicB} [N_1 \mathbin\| ID_A]$

2) B sends to A:
$E_{publicA} [N_1 \mathbin\| N_2]$

3) A sends to B:
$E_{publicB} [N_2 \mathbin\| K]$

Is it wrong to say step 1 is redundant because only B has the private keys $E_{privateB}$ anyways? For example, is this protocol any less safe?

1) A sends to B:
$Plaintext: $ "I  give keys pls"

2) B sends to A:
$E_{publicA} [N_2]$

3) A sends to B:
$E_{publicB} [N_2 \mathbin\| K]$

Step 2 is required for B to verify A is who he says he is (because only A can decrypt 2 and reply with the same nonce but A's authentication of B will also be conducted in step 3 because only B will be able to decrypt the message and get the keys.

Am I missing a potential attack here?


texts:
Ok, I have a wordlist of many many links (of the same site with a bit of difference in URL).

I'm certain that the majority of then will return the same result, a error page. But one will return the "correct" page.
The point is:
Is there a automatic way to test all of those links searching for the different one?


texts:
Amy and Betty have a shared key $k$, and the protocol below is to provide a mutual authentication for both Betty and Amy.

A sends B : $n_a$
B sends A : $n_b \;\|\; E(k, n_a)$
A sends B : $E(k, n_b)$

Where

$n_a$ is a nonce from Amy
$n_b$ is a nonce by Betty

Can spoofing take place here where someone pretends to be Amy even without knowing the shared key?


texts:
I am trying to implement a n-party Diffie Hellman protocol.
In particular I'm implementing Steiners et. al. natural extension "GDH3" (starting on page 34).

The problem is that my python implementation simply does not work. The shared secrets do not match.
The generator and prime are taken from different RFC's and I also tested everything with very small but valid numbers.
Therefore I wanted to know if I have any misunderstanding of the protocol described in the paper.
Since this is a cryptography forum I hesitate to post the python code but if that would help anyone I add it to this question.

Instead of writing down what's already described in the paper I am going to make an example with $n = 4$ participants.
Each participant is denoted by $M_i$ where $i \in [1, n]$
Each secret key is denoted with $SK_{M_i}$ which is a random value $\in [1, p-1]$

Stage 1

$M_1$ generates contrib: $\text{contrib}_{M_1} = g^{SK_{M_1}} \bmod p$

$M_2$ combines contrib: $\text{contrib}_{M_2} = \text{contrib}_{M_1}^{SK_{M_2}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_2}}$ $\bmod$ $p$

$M_3$ combines contrib: $\text{contrib}_{M_3} = \text{contrib}_{M_2}^{SK_{M_3}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_2} \cdot SK_{M_3}}$ $\bmod$ $p$

Stage 2

Every participant receives $\text{contrib}_{M_3}$.

Stage 3

Every participant except the last ($M_i$ where $i \neq n$) removes its own contribution from $\text{contrib}_{M_3}$.
Removing its own exponent (secret key) involves computing the modular inverse of the secret key ($SK_{M_i}^{-1}$).
This is achieved with the extended euclidean algorithm.

$\text{contrib}_{M_3 - M_1} = \text{contrib}_{M_3}^{SK_{M_1}^{-1}}$ $\bmod$ $p$  $\Leftrightarrow g^{SK_{M_2} \cdot SK_{M_3}}$

$\text{contrib}_{M_3 - M_2} = \text{contrib}_{M_3}^{SK_{M_2}^{-1}}$ $\bmod$ $p$  $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_3}}$

$\text{contrib}_{M_3 - M_3} = \text{contrib}_{M_3}^{SK_{M_3}^{-1}}$ $\bmod$ $p$  $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_2}}$

Stage 4

In this stage the last participant ($M_n$) collects all the contributions and raises them to the power of his own secret key and broadcasts them back to every participant.

$\text{contrib}_{M_3 - M_1 + M_4} = \text{contrib}_{M_3 - M_1}^{SK_{M_4}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_2} \cdot SK_{M_3} \cdot SK_{M_4}}$ $\bmod$ $p$

$\text{contrib}_{M_3 - M_2 + M_4} = \text{contrib}_{M_3 - M_2}^{SK_{M_4}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_3} \cdot SK_{M_4}}$ $\bmod$ $p$

$\text{contrib}_{M_3 - M_3 + M_4} = \text{contrib}_{M_3 - M_3}^{SK_{M_4}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_2} \cdot SK_{M_4}}$ $\bmod$ $p$

Finally

Every participant can obtain the shared secret ($SS_{M_i}$) by multiplying its own secret key to the corresponding contribution received from $M_4$.

$SS_{M_1} = \text{contrib}_{M_3 - M_1 + M_4}^{SK_{M_1}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_2} \cdot SK_{M_3} \cdot SK_{M_4}}$ $\bmod$ $p$

$SS_{M_2} = \text{contrib}_{M_3 - M_2 + M_4}^{SK_{M_2}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_2} \cdot SK_{M_3} \cdot SK_{M_4}}$ $\bmod$ $p$

$SS_{M_3} = \text{contrib}_{M_3 - M_3 + M_4}^{SK_{M_3}}$ $\bmod$ $p$ $\Leftrightarrow g^{SK_{M_1} \cdot SK_{M_2} \cdot SK_{M_3} \cdot SK_{M_4}}$ $\bmod$ $p$

$SS_{M_4} = \text{contrib}_{M_3}^{SK_{M_4}}$ $\bmod$ $p$ ($\text{contrib}_{M_3}$ from stage 1)


texts:
I'm looking to implement a performant revocation method for JWTs. I'm reading a paper, in which the following section's second paragraph states:

  If we use the client hashing approach described previously, we have a greater volume of keys to deal with. One possible approach would be to generate the secret using a set synchronized cryptographically secure pseudorandom number generators, creating a kind of rolling code for each group of clients. This would mean that only the key change events have to propagate, not the actual keys themselves, greatly reducing the associated performance cost.

What is a set synchronised cryptographically secure pseudorandom number generator (CSPRNG)?

I know what a CSPRNG is, in that it is a random number generator with an acceptable degree of randomness. But what is the set synchronised part? Does it relate to synchronised sets in Java? What does being set synchronous achieve in this context?


texts: When we apply the differential privacy on medical data to protect the personal data of the patients, how the doctors can access the original data to analyze them and to intervene in real-time. In other words, the added noise to disturb the data, can be eliminated?


texts: i want to know how many RSA 1024 bit long key decryption can a regular pentium4  computer do per second ? how to calculate RSA performance and determine its remaining time ?


texts: How does the Flame malware take advantage of MD5 collision?

texts:
It's said that malware Flame used an MD5 collision to get "a counterfeit copy of the certificate".

We know that MD5 is broken on collision attack, but not broken on pre-image attack, thus the only way to get a fake cert is to generate the fake cert when applying for a legitimate cert.

My questions are :

Isn't it too dangerous for the virus maker to do this? (We can check who applied for the legitimate cert and catch him.)
If he can apply for a legitimate cert, why bother making a couterfeit cert? Why don't use the legitimate cert to sign anything he like?


texts: How to decrypt an RSA ciphertext given an oracle providing the lower 8 bits of decryptions?

texts:
I have access to an oracle that can encrypt and partially decrypt a number with RSA-1024 algorithm.

For encryption:
\begin{equation}
C = M^e\bmod n
\end{equation}
But for decryption, result will be $\bmod256$:
\begin{equation}
\textit{partialM} = (C^d\bmod n)\bmod 256
\end{equation}
Also I know $e=65537$, and $d$ and $n$ will remain unchanged.
I want to know if it's possible for a given $C$ to find $M$.
If yes, how?


texts:
I am reading up on group signatures. With RSA a public key can have more than one private key. For a public exponent $e$, private exponent $d$ and modulus $n$,  there is more than one solution for the equation

$$d \cdot e \equiv 1 \pmod{\lambda(n)}$$

This is possible because of the modulus operation. So, if I want to create a group of keys, I can do so as long as I keep $p$ and $q$ (which are used to compute $n = pq$) secret.

How do I guarantee that two systems/users have not picked the same private key? Would it matter if they did?

Are group signatures possible with DSA or ECDSA? From the key generation steps I see on the wiki it does not look like it's possible. Am I right? I ask this because the parameters ($p$, $q$, $g$) are already public, and the only thing secret is the private key $x$, which was generated first and based on the public key that was generated. So, can I conclude that it is impossible to generate multiple private keys for a given public key?


texts:
Considering that a PKI has already been established, why can't we use RSA to send the One Time Pad instead of using AES?

It makes sense to me since:

A trusts the CA which is providing the identity of B
and vice versa
A obtains the public key of B from the Certificate and uses it to encrypt the pad
B decrypts the message and obtains the pad

Is this possible?


texts: Vigenere ciphers : Need help for math analysis

texts:
I've been learning about Vigenere ciphers and then thought of another method to Encrypt and decrypt that.

This's my method to encrypt :

I have a msg : "messages from father to his son"
I have a key : "home"
And the cipher text : "tsewmkwk fxse krhtjr mv lzl gvv"

I've created the Mathematics algorithm for the encryption, but get stuck for the decription.
This's what I've made fro encryption :

msg : "messages from father to his son"
key : "homemess ages fromfa th ert ohi"

So, I include the msg as part as the encryption method.
And,

my problem is :

How is mathematical/cryptanalysis method for implement this procedure below ?

msg : "tsewmkwk fxse krhtjr mv lzl gvv"
key : "homemess ages fromfa th ert ohi"
to get it back to "messages from father to his son" ?

May be somebody can help me, I'm not clever enough to make an equation.

EDIT :

As I know, the vigenere equation basically like this :

Ci = Ek(Mi) = (Mi + Ki) mod 26

with E is the encryption and K is the key for the Encryption. And you know that the decryption from that encryption is like this :

Mi = Dk(Ci) = (Ci - Ki) mod 26

right ?

Now, I recreate the encryption using this formula :

C_i=E_k (M_i )=(∑_(i=0)^k▒(M_i+K_i ) + ∑_(i=k+1)^m▒〖(M_i+K_i))〗 mod 26

But, that's my problem is you can see my stupidity to create the equation. But I can convert the equation to the programming but not the opposite. I want to make the equation for analysis report. May be this add the unclear problem, and please don't tell me how to encrypt or decrypt that. May be a point to the basic math can enlighten me a little.

Thanks...


texts: Why does a nonce prevent a replay attack?

texts:
I have a question about a cryptographic nonce. I understand the use of a nonce, however there is one particular part that I don't understand. Please consider the picture below.

I don't really understand why a replay attack is impossible, if the nonce is not encrypted. Because, if it isn't encrypted and I (as an attacker) know the nonce, then I can predict the next number (N + 1) and send that to Bob. Obviously I can't generate a MAC by myself (well, I can but Bob won't trust it) - I don't have the corresponding key; but I can send the MAC, who is previously generated by Alice, again with a "new" nonce (N + 1)..?

Could someone explain why this won't work?

Thanks in advance.


texts: Constructing a block-cipher from a hash function

texts: It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible?


texts:
I'm quite new to the topic and read a bit about poodle and padding oracle.

I quite understand the "regular" padding oracle attack, substituting the last byte of block(n-1) to determine the last byte of block(n) - by "myguess" XOR 0x01 for the last byte and so on.

Articles on poodle however state, that the attack is based on placing my target block to replace the padding. As the padding is not checked, the server will accept the message if the last byte of my replacement happens to be the length of the padding, as the server will cut the padding correctly and be able to check the MAC.

Now, as stated here there always is padding, as you could not otherwise know, if the message just happened to fit into blocks.

I understand poodle to work like this:

i forge request with javascript, forcing the victims' browser to copy the encrypted sessioncookie-block as padding
i create at max 256 of these requests, moving my cookie-block further down the line, thus creating longer and longer paddings until the server accepts the request, telling me that the decrypted last byte is the position of the last byte in the forged padding
i "write down" the last byte, drop it and repeat the process with the second to last byte  and so on.

if the last byte of my sessioncookie now happens to be FF, is would need a padding of 255 bytes length, which is multiple blocks of just padding.

Will sslv3.0 implementations just accept that i padded more than is reasonably neccessary?

Or have i misunderstood the concept? I have not found an article really explaining in detail.

I'm glad for links to detailed technical descriptions, videos, most of all for simple corrections in my description of the process if it isn't correct.


texts:
Bitcoin mining relies on generating a smaller hash than the so-called target (a function of the so-called difficultly), thus is vulnerable to a truncated preimage attack (you just need to obtain a certain number of leading zeroes).

I believe this is called a near preimage attack.

What is the current status of attacking truncated second preimages of SHA-256?


texts: Can Hash Functions take fixed-size input?

texts:
I‘ve argued for quite some time with a friend about wether or not this C# method can be qualified as a Hash Function.
public override int GetHashCode() {
    return X.GetHashCode() * 31 + Y.GetHashCode();
}

My argument is that this simply returns a 32-bit integer value, using a fixed input size of 2 variable 32-bit integer values (and one constant 32-bit integer value), while one of the prerequisites for a Hash Function is an arbitrary input size.
Using two 32-bit integer inputs is not arbitrary as far as i can tell.
Unless arbitrary refers to the possibility in general (meaning 2 different functions can have fixed-size input, but the specific sizes aren‘t limited and can be different for each) and not the need for each function to have the ability to accept an arbitrary input size, while returning the output with the same size, no matter the input size.
The values of X.GetHashCode() and Y.GetHashCode() are variable 32-bit integer values and are the result of a Hash Function.
Now, the way i see it, you can just simplify that code to: h(x, y)=x*31+y , where x and y are 32-bit integer values.
Which leaves you with 64-bit fixed input size, so either my simplification is faulted, or it‘s not a Hash Function, correct?
If that simplification is not correct, why not?
And what exactly dis/qualifies this as a Hash Function?
Does the input values being the results of a Hash Function affect the qualification of the code as a Hash Function in any way?
Even if it is guaranteed that the inputs will be the result of a Hash Function, that doesn‘t make this function a Hash Function, does it? (Like how 'f(log2(4), log2(3)) , where f(x, y) = x+y' would not be a logarithmic function just because of the inputs.)
Thank you for your time. Any suggestion is much appreciated.
Also, sorry if some parts are unclear or poorly formatted. I‘m not really versed in this, be it the mathemathical definitions, the language, or stackexchange in general.


texts: dealing with real numbers in Integer Vector Homomorphic Encryption lib

texts:
I am using Integer Vector Homomorphic Encryption for the encryption lib.

I have to multiply a learning rate of 0.01 (i.e. between 0 and 1) by the encrypted data (vector) but it is not integer. I had wanted to multiply by 1/10 instead. Is it possible? because it is know that HE scheme doesn't support division. Is the any way out?


texts:
I am using the RSA crytposytem. I have $p$, $q$ and hence $n$ and $\phi$ however I don't understand how to get $e$ such that $gcd(e,\phi)=1$

Many thanks


texts: Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

texts:
Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been changed by the attacker (in essence converting a malleable cipher into a non-malleable one), why do they still say encrypt then MAC?

Furthermore, doesn't adding the mac-key that is split into pairs like the symmetric cipher authenticate the attacker by proving the rest of the material not subject to attack on the cipher is known (assuming adequate length)?

Of course if we had full asymmetric we'd sign then encrypt but that's not the question being asked.

EDIT: The encryption algorithms I prefer all have the property of not having invalid inputs, in that any ciphertext + any key -> some "plaintext", usually garbage. There cannot exist an attack on the algorithm that would crash the implementation.

EDIT: OK I get the part about HMAC not being hash(a + b) due to most hash functions being unsuitable. I prefer to replace a hash function as unsuitable for any use once it reaches the state of unsuitable for that use but no matter. I don't get the part about why we care if the ciphertext has been altered. The way my stuff is set up it is not faster to MAC before attempting decryption due to rewinding streams.


texts:
I am using the python hmac module to generate an authentication code. Given a key, message, and hash function (I am using md5), the library returns an authentication code as a python bytes object. I am using the first N bytes of the code, i.e. digest[0:N] if digest is the variable storing the code.
How do I unambiguously (i.e. in a library-independent fashion) describe the truncation I am using? Would it be the N most-signficant bytes? Least-significant? If I declare that I am using the HMAC algorithm (RFC 2104) with md5 hash, is it sufficient to say that I take the "first N bytes" of the MAC?


texts:
I want to implement a stream cipher to encrypt very sensitive data in my Python code. I heard about the ChaCha20 algorithm and the
PyCryptodome library
, but how secure is it ?


texts:
I'm studying the BT core spec v5.1 to understand the security features and how everything fits together. I am looking at Secure Connections for now.

In the field "Key generation" it says it uses P-256 ECDH and HMAC-SHA-256 for this. However, when we read a little bit closer about the different functions themselves, it says that it uses AES-CMAC for key generation.

What's going on here?


texts:
I'm trying to better understand the "cost" of randomness usage/generation in practice. I understand that generally, some (small) amount of "true" randomness is generated, and then a CSPRNG is applied to expand this out to a larger amount of pseudo-randomness.

I'm curious as to precisely how these "small" and "large" amounts are related in practice.
If I want $k$ pseudo-random bits, that an adversary can't distinguish from random with less than $2^{\lambda}$ time, how many truly random bits do I need to seed my PRG with?

I understand this may depend on the particular CSPRNG I use. If it does, how does one find out this conversion factor for a particular CSPRNG.


texts: Cryptanalysis Affine Cipher: Brute-Force Search Vs. Meet-in-the-middle

texts:
Affine Cipher:

$Enc(x) = (ax + b) \mod m$

$Dec(x) = a^{-1}(x-b) \mod m$

For a brute-force key search, we need to do $a \cdot b$ encryptions in the worst case.

For a meet-in-the-middle attack, how many encryptions/decryptions do we need to do in the worse case?

Meet-in-the-middle attack definition:  Affine cipher can be broken up into two separate encryptions and decryptions.

$Enc(x) = (ax)\mod m = c_1$

$Enc(c_1) = (c_1 + b) \mod m = c_2$

$Dec(c_2) = (x-b) \mod m = c_1$

$Dec(c_1) = a^{-1}(c_1) \mod m = x$

Now you can start by encryption x over all possible values of $a$ and decrypt $c_2$ over all possible values of $b$ then compare the two tables and find a match over $c_1$

Which now I realize has answered my question that it uses $a + b$ encryptions.

Side question:  How is $a^{-1}$ calculated?  $m - a = a^{-1}$ or maybe $m - a \mod m = a^{-1}$


texts: Breaking RSA using Chinese Remainder Theorem

texts:
When the same message is encrypted for three people who happen to have same public key but different values of n, it is possible to get the value of message by using Chinese Remainder Theorem.

Wherever I have read about this technique, it says that the message value should be smaller than individual values of n. Will someone please elaborate why this restriction? And why does this technique not work if message is greater than any value of n?


texts: Finding Elliptical curve points and encoding text using them

texts:
I recently got into learning Elliptical curve cryptography and are currently building a project in C#.

Everything is working well so far, I can encode and decode points, and thanks to this forum I can do point addition and doubling really fast. Now I want to take the next step and start using really big numbers, so far I've been working off different ECC samples and papers normally using really small primes and numbers for clarity. The end goal is to being able to encrypt and decrypt a text, this will later be used for digital signing of this text. So what I must figure out now is:

What standard curves could I use? I know curves like p192 etc exists, am I allowed to use these?
How can I find valid points to use for messages and generator on these huge curves? So far I've done it using brute force on smaller curves with a small prime. I can't find any using my previous brute force approach since the numbers are too large.
Whats a good way for encoding/decoding text using ECC? Should I simply map each valid character to a point on the curve and perform encryption/decryption once for each character and translate between the character and point using a lookup table?

Thank you!


texts: Does there exist a test vector for the Xoodoo permutation?

texts: What I need is a set of pairs, where the first element of the pair is a 384-bit input (including the sequence of 384 zero bits) and the second element is a corresponding 384-bit output of the Xoodoo permutation. Does such a test vector exist?


texts: Apply HKDF after Diffie-Hellman Key Exchange

texts:
I'm trying to use HKDF after Diffie-Hellman key exchange. However, I got stuck on the HKDF part.
from Crypto.Protocol import HKDF
from Crypto.Hash import SHA512
from Crypto.Random import get_random_bytes

salt = get_random_bytes(16)
key1, key2 = HKDF(master_secret, 32, salt, SHA512, 2)

From my understanding, I only need one key for ChaCha20 or AES-256-GCM. Is it a good idea if I only generate one key by HKDF?
One more thing, how can I generate a good salt for this case?


texts: In the ECIES scheme, the sender generates an ephemeral public key per each message it encrypts. This public key, together with the receiver's private key, is used in order to generate a shared secret that is input to a KDF function that outputs both the encryption symmetric key and the MAC key. However, if instead of the real intended sender, an opponent is impersonating to be the real sender, and sends its own ephemeral public key, the scheme cannot detect it. So how should this used in practice, does the standard supports some sort of digital signature for the public key? If so, this digital signature must be calculated again per each message, as the public key is re-generated each message. So how this is done in practice? And, finally, if digital signature is added anyway, then it can be added for the whole message, thus seemingly saving the MAC calculation step.


texts: Why is RSA encryption key based on modulo $\varphi(n)$ rather than modulo $n$?

texts: While calculating RSA encryption key we take modulo $\varphi(n)$ rather than modulo $n$. I can’t understand why it’s done this way.


texts: Ephemeral Diffie-Hellman generator selection

texts:
I need to generate a EDH group on the fly in one has not been specified in a config file. Diffie-Hellman is kind of expensive in terms of computation, so I'd like to reduce the cost if possible.

Is there any benefit to selecting a generator of 5 versus 3 or 2 in an attempt to keep the costs minimized? Is this a misguided optimization?

Related: are there any libraries that allows you to specify, for example, {2,3,5} are acceptable generators for a group? Or do you normally just specify a subgroup order? (I know OpenSSL has for example, DH_GENERATOR_2, but I'm not aware its a bit mask value).


texts: Is it possible to increase the encryption security of a short key?

texts: If I encrypt a file with a short 4 digit pin is there any way to make it more secure. I've thought about hashing the 4 digit pin and using the result as the encryption key. I think this would work as long as the attacker didn't know that I was using this strategy but if they did they could just try the 10^4 hashing of the possible pins.


texts: How much would it cost in U.S. dollars to brute force a 256 bit key in a year?

texts:
I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this is technically true. However, I think that there is probably a point where it makes sense to say a key is uncrackable (for example, if it would cost 100 times the world GDP to crack it, it is essentially uncrackable without the help of an advanced alien civilization, etc.).

How much would it cost in U.S. dollars to brute force a 256-bit key using a strong algorithm such as AES or Twofish in a year?

I would also be curious to know what it would cost to crack a 128 bit key in a year.

I am asking this mostly out of curiosity. I do not know very much about cryptography, so please feel free to pick the algorithm of your choice if that matters. I am interested in how one would project the cost (assume you have to buy the hardware but you get to choose what hardware you buy).


texts: 80-bit vs 128-bit security in today's world

texts:
In today's world of applications, I see a lot of the time a 256-bit encryption key is used, but what about an 80 or 128? What makes 256 the one to use. Is a 80 or 128 easily decrypted?
Are comp ciphers better than others with the encryption of these keys?


texts: Is this problem based on discrete polynomials modulo $(x^3-1)$ strong?

texts:
We start working with the Ring $R=\left(\mathbb{Z}/p\mathbb{Z}\right)\left[x\right]/\left(x^{3}-1\right)$,
$p$ prime, i.e. degree two polynomials with coefficients modulo $p$
modulo $x^{3}-1$. As $x^{3}-1=\left(x-1\right)\left(x^{2}+x+1\right)$,
we choose a subset of $R$, $S\subset R$, and a public value, $z\in\mathbb{Z}/p\mathbb{Z},\ z\neq0$,
$P\in S,\ P\equiv-z\left(mod\ x-1\right)$.

We can define the transpose operation of elements of $S$ as swaping
the $x$ coefficient with the $x^{2}$one of the corresponding polynomial,
so $\left(ax^{2}+bx+c\right)^{T}=bx^{2}+ax+c$.

Now, we define a function $f:S\times S\mapsto S$, as $f\left(A,B\right)=\left(xA^{T}+z\right)\left(xB^{T}+z\right)-zx$.
It's null element is $-zx$ and $f$ is a closed map of $S$, so $A,B\in S,\ f\left(A,B\right)\in S$.

Next, we define a series as follows:

$A,B\in S,\ s_{0}=A,\ s_{1}=B,\ s_{n}=f\left(s_{n-2},s_{n-1}\right)$

And for a given element of the series,$s_{n}$, a value $r_{n}=f\left(s_{n},A\right)$

The question is

Taking into account that the function $f$ is not
associative, how difficult is, knowing $B$ and $r_{n}$, recover the
value of a secret $A$. As an example of sizes let's say $n=256,\ p\sim2^{128}$.

This problem can lead to a cryptosystem described in this two documents:

https://drive.google.com/open?id=1OGnFfooWASVCD1Iw_hVwvHYgqMGGE5nH

https://drive.google.com/open?id=1OeKh_ZJF-i7_KzWFRv8jodk3YkXe2qyv


texts: How does OpenSSL know if a decryption failed?

texts:
I have a file full of garbage, random data, and I encrypt it with AES256:

openssl -in myfile -out encfile -aes256 -pass pass:abc123

If I try to decrypt it with the wrong password, it says:

bad decrypt
140546891773584:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:516:

But, if I try to decrypt it with the correct password, it doesn't return any errors, meaning it was successful.

How does it know that it was successful?


texts: Is EncFS good for online storage services?

texts:
Conclusion from an EncFS audit:

  EncFS is probably safe as long as the adversary only gets one copy
  of   the ciphertext and nothing more. EncFS is not safe if the
  adversary   has the opportunity to see two or more snapshots of the
  ciphertext at   different times.

I don't quite understand this sentence: "to see two or more snapshots of the ciphertext at different times". Given a scenario, e.g. my Dropbox was hacked, and the hacker has access to my EncFS encrypted texts, and probably the history of it as well. Is that what was mentioned as "two or more snapshots" and "different times"?


texts: Why work in a subgroup QR(n) of an RSA group $Z^*_n$?

texts: I sometimes read in papers that a (sub-)group generator $g$ is taken from $\mathrm{QR}(n)$ instead of $\mathbb{Z}^*_n$, where $n = p \cdot q$ and $p$ and $q$ are prime. Is there a reason for this? What properties does $\mathrm{QR}(n)$ have? Is it an especially big subgroup?


texts: RSA vulnerability when e is particularily large?


texts: Alter plaintext through IV in block cipher AES in CBC mode

texts:
IV: 69bb375aa919c72aa561dd7b7ffacf66

Ciphertext: "c28ea025d10186510855d083747d6435c808d9857075abd9bfc54b094e60eaf3"

Plaintext: "SEND ENCRYPTED DATA"

I want to be able to change the resulting Plaintext to "SEND THE DATA", which if I understand correctly would involve altering the IV in this case.

I have read about the bit flipping and how this attack works, I am just having troubles implemeting it in this scenario, please help.

below the encryption (at the server side- we were given the code), includes the padding used,   def encrypt(plaintext):
            log.info("[%d] encrypt data command invoked" % (client_id))
            iv = Random.new().read(AES.block_size)

        # add padding
        if (len(plaintext) % 16 != 0):
            plaintext += b"_" * (16 - len(plaintext) % 16)

        cipher = AES.new(shared_key, AES.MODE_CBC, iv)
        ciphertext = cipher.encrypt(plaintext)

        return hexlify(iv) + b"," + hexlify(ciphertext) + b"\n"

   def no_tranform(plaintext):
        log.info("[%d] send data command invoked" % (client_id))
        return hexlify(plaintext) + b"\n"

    commands = {"SEND ENCRYPTED DATA": encrypt,
                "SEND THE DATA": no_tranform}

 Also you can see that the only allowed commands are "SEND ENCRYPTED DATA" and "SEND THE DATA" and I would like the latter.


texts: Re-encrypting a message and proving that the message has not changed

texts:
Is there a method that allows for re-encryption of a message in a way that allows observers who only have access to the two cipher texts to prove that the plain text message is the same in each?

More specifically: if I have a message $m$, and I encrypt it with an asymmetric key scheme $E_1: c_1 = E_1(m)$ and then re-encrypt it with a new key pair $E_2: c_2 = E_2(m),$

is there a way for an observer (possibly using a ZKP or homomorphic encryption) who only has access to $c_1, c_2$ and the public keys of $E_1$ and $E_2$ to prove that $m$ is the same plain text used to generate $C_1$ and $C_2$?


texts: Symmetric Encryption, meet in the middle attack, effective key length

texts:
What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)?
.
Say the encryption scheme has |key space K| = |plaintext space M| = |ciphertext space C| , all keys are 64 bit length, and $k1,k2,k3,k4,k5$ are all different (no key reuse like in some DES key options).
$c = E_{k5}(E_{k4}(E_{k3}(E_{k2}(E_{k1}(m))))$
You know that double encryption would not result in $|K|^2$ possibilities, but in fact due to the mitm attack the possibilities the attacker is forced to iterate over is only around ~2*K. You also know that triple encryption is much better, as it forces the attacker to have to iterate a total of ~$|K|^2$ even with the mitm tactic. What is the effective key length then when using double encryption, triple encryption, and x5 encryption respectively when using the above scheme?


texts: Why would we want parallelizable authentication?

texts:
I believe that parallelizable authentication schemes are superior from an aesthetic perspective and because most non-recursive calculations (e.g., CTR, ECB, PMAC, etc.) are better than recursive ones (e.g., CBC, OFB, CFB, CBC-MAC, etc.).

Most of the CAESAR candidates, i.e. GCM, OCB mode, PMAC, XOR-MACs, and protected counter sum provide parallelizable authentication while HMAC is not parallelizable.

One paper out there says that many schemes used by the CAESAR candidates, GCM, and XOR-MACs can be trivially broken by an incredibly unrealistic quantum attack (it turns the complexity from $O(2^{n})$ to $O(n)$ but requires a quantum entangled state that can only be generated with the key). Additionally, with or without quantum computers, many of these parallelizable authentication schemes only provide security up the birthday bound.  This makes it seem like a lot of the known parallelizable modes of authentication are not as strong as an HMAC construction.

Am I mistaken? Is there anything about most particular parallelizable methods that have drawbacks/weaknesses relative to HMACs? If so, what are they? And why do we seek parallelizable methods if that is the case?


texts: Is there any place where I can find test vectors for point addition and doubling of ECC?

texts:
I want to extensively test my implementation of point addition and doubling. I have only one test vector with me. I need more values to test.

In the web, I could find test vectors only for key pair generation and  signature verification. So if anybody can refer me a link containing test vectors, it will be of great help!

Thankyou.


texts:
I need to implement AES_GMAC encryption and decryption in c/c++ programming language.

For the implementation, I have referred following document:
http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf

But It seems that it contains esoteric information specific for people with cryptographic background. I am belonging to a non-cryptographic group.

Can anyone help with the pseudocode for the implementation purpose ?


texts: Why TLS uses in-band handshake signalling

texts:
TLS uses handshake protocol to compute session keys to be used later to protect bulk of application data transfer. The handshake protocol and application protocol uses same transport layer port.

IPSec uses IKE for a key agreement between two endpoints. Here the key agreement protocol uses a separate UDP based transport channel. The data from applications is not sent through this UDP port.

In a way, IPSec uses out-of-band handshake whereas TLS uses in-band handshake.

Why TLS designers chose to use same transport layer port for both handshake and application protocol? What would be the implications if a TLS like security protocol is designed to run handshake and application protocols to run on different transport layer ports?


texts:
I don't get the modulo 10001 operation in MixColumns so much.

If I have to take the byte computations mod 100011011 anyway what leads me to a result of 4 byte length, why do I need the mod 10001 operation? Where is my mistake in thinking?

Can you maybe give me an example where I'ld need it?


texts:
I'm doing an online free course about cryptography and there's a very confusing question:

Can anyone explain the answer please?

Question for hashing algorithms:
Select one or more than one.

a. It is impossible to break its resistance to collision and preimage
b. It is more difficult to break its resistance to collision than to the preimage
c. It's just as easy to break your resistance to collision than to preimage
d. It is easier to break its resistance to collision than to preimage


texts:
In digital signature  The encrypted message is signed by the sender private key and verify using sender public key. The encrypted message is encrypted with another public private key pair which the receiver will have a way to compute those out

Instead of ds, cant the sender just encrypt that encrypted message with his own public key using symmetry key encryption? Wouldnt that be sufficient to prove that the message is indeed from the sender?

Any thoughts on this? Or ds is required


texts:
I have an application where I need to store small to moderate amounts of data in a symmetrically encrypted form. For various reasons, CMS with an AuthEnvelopedData seems to tick all the requirements.
For example, password recipient info (PWRI) neatly binds up the KDF and the (encrypted) content encryption key.
Another of those requirements was to be able to move the code to using newer crypto solutions without needing to redesign the data and storage structure.
I'd like to use NaCl (libsodium, actually) for implementation, which would prefer Argon2id for KDF and AEADChaCha20Poly1305 for encryption, but whilst the encryption algorithm has an ASN.1 AlgorithmId, Argon2id is nowhere to be seen. PBKDF2 is there, but I've only been able to find a Draft proposing an Algorithm id for scrypt (in the context of the implementation, scrypt would be acceptable as KDF).
Here's the rub, though - the RFCs describing CMS are all fairly old (3370, 5083, 5652, 7468, 8103), and the ASN.1 has not been much updated with more recent algorithms. Is AuthEnvelopedData at a dead end? What is there that's standards based that can be used to replace it?


texts: Leftover hash lemma-like without lossy functions

texts:
In short:

  Are lossy function the only way to prove security using leftover hash lemma for computationally secure protocols?

Longer:

I recently discovered/understood the leftover hash lemma, that basically states that even if you have only partial knowledge about a binary string $s$ (the entropy still needs to be big enough), then you have no information about the xor (it also applies to other functions but xor is enough for me) of a random subset of this string.

However, it appears that this lemma is expressed in the unconditional/information theoretic setting, and most of the times in real applications we are interested in the computational setting. As far as I understand, people use lossy functions to go from computational setting to unconditional setting, and then they use leftover hash lemma. But you want to make sure that no adversary can distinguish whether you are using lossy functions or injective functions.

The problem is that in my case I need to send one bit of information to the adversary, and I have no argument to say why this bit could not leak whether we sampled a lossy function or an injective function... (I just know that this bit does not reveal too much about $s$ and that's why I wanted to use leftover hash lemma). Are lossy function the only way to prove security using leftover hash lemma for computationally secure protocols? Or is there any other lemma/method that I could apply when aborting could leak some partial information ?

-- EDIT --

To give more details, say I have a cryptographic function $f$ that encrypts a $t$ bits message, and let's define $y = f(x_1,\dots,x_t)$ a given encryption. Given $y$, I can show that no polynomially bounded adversary can obtain any information about $X = x_1, \dots, x_t$, so intuitively the (computational) "entropy" of X is $t$ (of course an unbounded adversary could obtain it, but in exponential time). Now, I send this $y$ to an adversary, and he can send me a message (that I interpret like a question), and I will answer to this message with a single bit $a$, and I abort if $a \neq 1$. I can easily show that no polynomially bounded adversary can guess with good probability the exact value of $x_1,\dots,x_t$ when the protocol does not abort (i.e. $a = 1$, I also assume that the probability to continue without abort is non negligible), so the advantage he can get from this bit is not huge. So intuitively, the entropy of $X|a=1$ is still of the order of $t$, but I don't know which part of $X$ has been leaked. So I really would like to be able to apply the leftover hash lemma to extract one bit of information from this string $X | a=1$...

BUT the leftover hash lemma does not apply here, because the entropy I'm using from the very beginning is not a real entropy, but more a "computational" equivalent. Indeed, if I know $y=f(X)$, the entropy of $X$ is 0 as $f$ is injective: an adversary could just try all possible values until he finds the good $X$. As far as I understand LHL, people solve this problem by in the proof by using another kind of function that are lossy, i.e. non injective, in order to be back to a real entropy (given $y$, I have lot's of possible preimages, so I cannot get $X$), and they say that an adversary cannot distinguish between the real usefull injective function and the lossy one. But here I can't do that as the bit $a$ could leak some information about whether I'm using a lossy function or an injective function... Any idea if I have another way to prove security here, as the result seems super natural? (I also need a quantum-resistant proof to simplify things)

Thanks!


texts: What happens at this part in the key schedule of a Speck...?

texts:
I am trying to figure out the process behind the Speck block cipher.
I understand how XOR works (Exclusive-or) when you take 2 strings of bits and you want to XOR them together.

However, in the key schedule of the cipher, there is a point where XOR takes place but I don t understand what is being XORed.

Link: https://en.wikipedia.org/wiki/Speck_(cipher)#/media/File:Speck_block_cipher_0_indexing.svg

For example, in the key schedule in the link, the result of the binary addition is being XOR d with 0?

Can someone explain what this means?
Thanks.


texts: Efficient Aggregate Signatures With Same Key

texts:
Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs to Bob, who knows Alice's public key.

Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. ($\mathcal M, s')$, that validates with Alice's public key?

If I understand it correctly, this is achievable using BLS signatures, but I was wondering if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.

Thanks in advance.


texts: How is the precomputed table for 25519 Elliptic curve generated?

texts:
I am wondering how the precomputed table for scalar multiplication for elliptic curve (in my case 25519) is generated/precomputed?

I am talking about this
[https://github.com/WhisperSystems/libsignal-protocol-javascript/blob/master/native/ed25519/base.h

The piece of code which uses this header file is:

/* base[i][j] = (j+1)*256^i*B */
/*static const ge_precomp base[32][8] = {
#include "base.h"
} ;*/

ge_precomp is defined as

ge_precomp (Duif): (y+x,y-x,2dxy)

Is there a paper or a piece of code where I can see how this table is generated? I am not trying to learn more about elliptic curves, I simply want to precompute this myself because of the specifics of my project.

I guess I would have to add point B to itself for (j+1)*256^i mod p times for each i and j.
Is there a less compute intensive way to do this on an e.g. Raspberry Pi?

Thanks in advance!


texts: What does it mean that a semi-honest adversary can look at the internal state of a controlled party?

texts:
I have a doubt regarding the definition of (static) semi-honest adversaries. In this tutorial I read:

  Such an adversary controls one of the parties (statically, and so at the onset
  of the computation) and follows the protocol specification exactly. However, it may try to learn
  more information than allowed by looking at the transcript of messages that it received and its
  internal state.

Does it means that, for example, in the case of a commitment scheme a semi-honest adversary, who controls the party supposed to commit a value, knows the committed value (since it is part of her or his internal state)? However, since the adversary is semi-honest, she or he cannot take advantage of this information to deviate from the protocol in a profitable way.


texts: Why is there no "ephemeral non-DH EC" key exchange in TLS?

texts:
In RSA key exchange, the client picks a premaster secret and encrypts it with the RSA public key in the server certificate, and sends it to the server. This offers no forward secrecy.

In ECDHE key exchange, the client and server both generate ephemeral EC key pairs, and use DH key exchange to negotiate the premaster secret. The server public ephemeral public key is signed using the server authentication certificate. This gives forward secrecy.

In the latter, two ephemeral key pairs have to be generated, by the server and the client. How about the following mix of both key exchange methods that does not need the client to generate an EC key pair:

Server generates ephemeral EC key pair, signs the public key using the server authentication certificate.
Server sends the ephemeral EC key pair public key to the client.
Client picks a premaster secret, encrypts it using the server ephemeral EC public key and sends it back.

What are the inevitable downsides that make ECDHE superior? I don't see a glaring security hole. Maybe difficulties to use an EC keypair for encryption?


texts: Are there attacks against broken RSA signature pad checking with $e = 65537$?

texts:
Let's say that an RSA implementation of PKCS #1 signatures fails to validate that the 00 01 FF FF FF ... FF 00 portion of the decrypted signature is exactly as long as needed to fill up the signature block entirely when appended with the hash identifier and hash.  This means that the padding could be shortened to some minimum length.  The latter part of the block may then vary arbitrarily and the broken validator would accept it.

For the case of $e = 3$, the Bleichenbacher attack would work: you could calculate $\left\lceil{\sqrt[3]m}\right\rceil$ of a signature block $m$ with the padding and hash in the upper part and zeros below.  Since greater than $\frac23$ of the decrypted block is unchecked, the random data in the low part from using an inexact cube root doesn't break the signature as far as the broken validator is concerned.

Does such an attack exist for $e > \log_2n$, such as the common $e = 65537$?

I believe that an attack exists in this scenario if you have access to a signer for other signatures, but what about the case when you don't?


texts: Tweakable encryption algorithms vs Key wrapping

texts:
I have read many articles about Key wrapping and tweakable cipher modes.
However, I don't understand the main difference between them?
What you recommend for Key storage and Key Archive.


texts: Discrete logarithm with 2 solutions? A clarification request

texts:
I need some clarification on the discrete logarithm problem...
When a friend and I were solving for the discrete logarithm problem of 9 = 2 ^ x mod 11, we got two different answers. My initial answer was 6 for x.
But his answer was 12 for x. So we decided to cross check our answers and indeed we were very correct.
So what does this mean? Does it mean that there can be more than one answer for a single discrete logarithm problem?
And does this also relate to the circumstance in a real discrete logarithm problem?


texts: How to encrypt a 192 bit plaintext using AES-192?

texts: Can we use AES-192 bit algorithm for 192 bit plaintext? If yes, what are the changes we have to do?


texts: What is the actual result of a Logjam's DH attack?

texts: Does a Logjam attack calculate a group of probable Diffie-Hellman private keys for a user and then try them one at a time to see if it can decrypt the message - or does it directly calculate the one specific instance of a user's private key?


texts: How would Keccak attain a 512-bit security level?

texts:
I am well aware that the general consensus is that a hashing algorithm with a security of 512 bits is unnecessary, but I'm just curious about how that would be implemented for Keccak despite that.

According to SHA-3 block sizes / bitrate calculation?, the bitrate of the algorithm would be calculated by 1600 - 2c = r. However, with C being 1024, one would get a negative value, which I assume would mean the algorithm will not work for that capacity.

Am I wrong in my assumption? Are there any workarounds that would allow for a capacity this high?

Again, this is just a theoretical question to sate my curiosity. I am well aware that such a level of security is considered unnecessary.


texts: NIST random test suite choosing bitstream length and count

texts:
I am trying to use the statistical test suite software from NIST SP800-2.
First it asks for bitstream length.
Usage: ./assess <stream length>
   <stream length> is the length of the individual bit stream(s) to be processed

After file is given to program, it asks for;
How many bitstreams?

How can I determine that values? Let's say I have 1000000 32-bit ASCII sequence of 0s and 1s in a file like;
01111111000111000110010001111010
.
.
.
00110100001001100010111100000011

Which values will be appropriate for this?


texts:
I'm currently reading up on the components of PGP and I am wondering what exactly the PRNG is used for. PGP uses ANSI X9.17 and entropy from a users keystrokes to generate a temporary key.

So, is this temporary key used for the public key encryption? Is it one of the keys in the key pairs? And how does PGP actually generate it's key pairs?


texts: Is it OK to encode data using key equal to data

texts:
For some project, I need to store some short string in encrypted form. It would be ideal for the current purposes to encrypt it using itself.

# This would be the usual way:
result = AES_ENCRYPT(string, key)

# but I would like to do it this way:
result = AES_ENCRYPT(string, string)

The same string itself would be used as the key!

The 'string' is always some short text, like 20 characters of letters and numbers. This solution seems better to me than using any hash function, since hash could lead to collisions - different strings could potentially produce the same result, which is low probability, I know, but still not zero so I want to avoid that.

My question is, is my approach safe? Encoding the data using the data itself, does it lead to any security issue? Would it mean that it could be easier to decrypt the result, if the 'attacker' knows the fact it is produced by encrypting my way? Thank you.


texts: How can XTS be used to detect the presence of TrueCrypt hidden volumes?

texts:
According to a thread on the VeraCrypt discussion forum, and a single-post followup, it is possible to detect the presence of a hidden volume in certain conditions due to a flaw in the cryptography or the way it is used, rather than a flaw in the software implementation. The fix was to use random data rather than zeros for the plaintext of the hidden volume header. When a hidden volume is in use, the area where the header for the hidden volume is populated and encrypted. When there is no hidden volume, it is initialized with zeros and encrypted. All encryption uses XTS mode. A post in that thread explains my concern:

  I'm somewhat worried about the possibility to distinguish encrypted data from uniformly distributed random data in general, because this could possibly hint some issue with the ciphers or their usage. If even a rather short block of encrypted zeros can be distinguished from random data, what about larger chunks of plaintext which show distinctive patterns (e.g. a 1 GB file of zeros), or plaintext chosen by or known to the attacker? Could they possibly also be detected in the ciphertext?

  I think it could be at least worth investigating why a block of XTS encrypted zeros could be distinguished from an XTS encrypted header, or random data.

And another post with speculation on an issue with XTS:

  My personal opinion is that the presence of 255 consecutive blocks of zeros encrypted by XTS next to a single block different from zero is the key point behind this issue, and that this enables somehow to have a statistical distinguisher for this special case.

I cannot imagine how the design of XTS could lead to that behavior.

Typically, disclosures done in this manner tend to be disclosures of software vulnerabilities which can be found without a large amount of skill. A fundamental flaw in XTS would require far more expertise and would be the sort of thing reported in a groundbreaking research paper, not in an email thread to the author of a single encryption product which uses XTS.

Obviously, the issue isn't a distinguishability attack against the cipher itself, but with how XTS is being used. I do not know enough about XTS to tell what the issue is, but the reported problem seems to violate XTS' cryptographic guarantees. My questions:

How could the presence of 255 consecutive zero blocks and a single non-zero block encrypted with XTS be distinguished, without the key, from the presence of any other 256 arbitrary blocks?
Is this a known issue? At the time of the last post on that thread, no more information about the attack was revealed, and the thread died in 2016 with little extra coverage.
Could this be a hoax or otherwise entirely false? It would seem that XTS, while not extremely simple, is simple enough that the described attack could be trivially independently discovered.
Could the issue be completely unrelated to XTS, for example caused by an implementation issue? This seems unlikely as dm-crypt, which uses proper XTS, works with TrueCrypt.

This issue, if true, seems very severe. I'd love to hear from some actual cryptographers.


texts: TLS Handshake : Server authentication or only Server ‘s Certificate authentication?

texts:
I have some difficulty understanding the way in which the Server is really authenticated by Client in TLS handshake (in case of using RSA key exchange).

When Client receives Server ‘s Certificate and verifies it with using CA root public key, I fully understand that at this time, Client can consider that such received Certificate is valid and authentic if verification is ok

But if Server’s certificate is checked sucessfully by Client, how is it possible to consider that Server has been authenticated by Client, while at this time none message signed with Server’s private key has been sent to the Client and verified by it ? Can’t intruder possess and send real Server's certificate to the Client ?

Note : I agree that if Server is not the real one and so doesn't possess real Server private key, it will not be able to decrypt the pre-master key sent by Client, but this appears as indirect / implicit authentication, rather than explicit authentication

More generally (outside case of TLS), is it correct to talk about « Authentication by Certificate » (assuming based on Certificate verification via CA root public key)  instead of  authentication via digital signature ?


texts: Single Party Encryption, Multi Party Decryption

texts:
I am looking for an adequate protocol for public key decryption, which would allow $n$ parties to jointly decrypt a cipher text. The usage scenario for such a protocol would be a mixnet that wouldn't require the sender to know all mixes in advance. The requirements are:

There is a single externally known long term public key $Y$. Each decryptor $D_i$ has a long term private key $x_i$ and the decryptors do not reveal their respective private keys to each other.
When decrypting a cipher text, it is done in sequence by the decryptors. Let the incoming cipher text be $c = c_0$. $D_i$ decrypts $c_{i-1}$ to $c_i$ and forwards it to the next decryptor.
The order in which the decryptors decrypt the cipher text must be arbitrary, i.e. the encryptor does not have to know in which order the cipher text will be decrypted by the decryptors, or even how the private key is split up between the decryptors.
The pair $(c_{i-1},c_i)$ must be indistinguishable from $(c_{i-1},u)$ for everyone except $D_i$, where $u$ is selected uniformly at random (from the set of intermediate cipher texts).

First question: I am correct that the above requirements might be met using the following protocol based on ElGamal:

Let each $Y_i = g^{x_i} \pmod p$ be known by all decryptors and let $Y = \Pi_{i=1}^nY_i \pmod p$
Let $m$ be the plain text and $c = (Y_0,r_0,e_0) = (Y,g^k \pmod p,Y^kPad(m) \pmod p)$, where $k$ is selected uniformly at random by the encryptor.
$Y_i = Y_{i-1}g^{-x_i} \pmod p$
$r_i = r_{i-1}g^{k_i} \pmod p$, where $k_i$ is selected uniformly at random
$e_i = e_{i-1}r_{i-1}^{-x_i}Y_i^{k_i} \pmod p$
If $Y_i = 1$ then $m = Unpad(e_i)$ else $c_i = (Y_i,r_i,e_i)$.

Note: This is a fragile scheme in many ways, but in particular because it might allow the first and last decryptor to collude. If $D_1$ multiply $e_1$ by a small integer, most $Unpad$ functions (such as PKCS#1 v1.5 and PKCS#1 v2.1) will fail, unless $D_n$ first divides $e_n$ by the same small integer. If this small integer is an identifier for the sender of the message, the scheme is broken.

Second question: Does there exist any similar protocol e.g. based on secret sharing that still meets all of the above requirements, but in addition:

Allows $t \lt n$ of the $n$ decryptors to decrypt the cipher text?
Allows the decryption to be performed in any order not necessarily agreed upon in advance, but still in a finite number of steps bounded by $poly(n)$?
Features robustness, i.e. if a small numbers of decryptors (less than $n-t$) are compromised and participate in the decryption, $t$ remaining decryptors will still be able to eventually decrypt the message?


texts: Are there example certificates available for test purposes?

texts:
Are there example certificates (PEM format) for testing available somewhere ?
For test purposes I would need a certificate signed with SHAS256/ECDSA P-256, together with a complete chain to test verification.


texts: Cryptography Engineering - Design Principles and Practical Applications - Chapter 9 Generating Randomness - Section 9.4 The Generator

texts:
I'm currently reading "Cryptography Engineering - Design Principles and Practical Applications" written by "Niels Ferguson, Bruce Schneier, Tadayoshi Kohno" published by Wiley in 2010.
In "Chapter 9 Generating Randomness", "Section 9.4 The Generator", there are two paragraphs (see screenshot below) which I do not quite understand.

In particular, how does the author comes with the probability of $2^{-97}$, the number of requests as $2^{97}$, and the total workload for the attacker as $2^{113}$ steps?

This continues from the above question. How does the author mean there are $2^{113}$ steps on both the attacker's machine and the machine that is being attacked?
Any kind folks who can help to explain this clearly greatly appreciated!
Thanks in advance!


texts: Security of Lindner-Peikert parameters for lwe

texts: From Regev's paper in 2005, we know that for applying worst-case to average-case reduction to an lwe cryptosystem, one should use error distributions with standard deviation $s$ bigger than $2\sqrt{n}$. Why this condition is not regarded by Lindner & Peikert parameters (e.g. n=128 & s=6.77)?


texts: Verifying DER encoded DSA/ECDSA signature with extra content?

texts:
Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are "some valid DER encoded ASN.1" || "some extra bytes" – is the correct behavior to error out, or would it be more correct to proceed to attempt to verify just the DER encoded portion of the input (since it's self-delimiting)?

Specifically, I would like to know if there are any implications in relation to cryptographic security.


texts: How many bits of symmetric security does RSA-3072 actually provide?

texts: I know that the sizes are standardized to $1024$, $2048$ etc. but they actually provide different security than $128$, $256$... for example $\texttt{RSA-}2048$ is actually $112$ bits of security and $128$ bits would be $2304$, so how many bits of security is $\texttt{RSA-}3072$ actually providing?


texts: Now that quantum computers have been out for a while, has RSA been cracked?

texts:
D-wave systems has released a commercially viable quantum computer. This means in theory, that all asymmetric encryption algorithms — such as RSA — are now useless due to the speed at which quantum computers can factor.

Has RSA been cracked yet? If not, why hasn't it?

The reason for our company's concern is an upcoming product that relies heavily on cryptography, and a significantly large number of hackers may attempt to break it. If the code was found to be insecure, it would be a huge problem for our company, our users, and anyone on the Internet if RSA was found to be insecure.

Update: article on D-Wave recent announcement here


texts: How can I construct a proof that the decryption of a certain encrypted file matches a hash?

texts:
Let's say Alice has file $F$ and she generates key $K$. She widely publishes the $hash(F)$ for identification. She wants to sell the file to Bob. She encrypts the file with $K$ and sends both $E_f = E(F, K)$ and $hash(K)$ to Bob. However, Bob wants to verify that this encrypted file really is the one he has asked to buy.

How can Bob verify that $hash(Dec(E_f, K)) = hash(f)$ knowing only $hash(K)$ and $E_f$? He shouldn't be able to decrypt the file, but should be able to prove that the encrypted file Alice sent, when decrypted, matches the hash, $hash(f)$.

It seems like I might need to use some sort of ZK-proof, but that may not work because the proof would be prohibitively large.

This question may be similar to: Proof that a hash matches an encrypted file, however, knowing only the hash of the key seems to present a different problem.

This could also be looked at as a Proof-of-Knowledge of a key $K$ such that $hash(K)$ matches the one Alice revealed to Bob and $Dec(E_f, K) = hash(f)$.


texts: How to calculate Modulo using a standard calculator for a one time pad encryption


texts: Order of letters on 3-rd rotor: Enigma III

texts:
In the photo you can see the three Enigma's rotors.

On the 1-st rotor (marked with number 50 on the photo) letters put on clockwise.
On the 2-nd rotor letters put on counterclockwise.

Question. What is an order rule on the 3-rd rotor?

Edit. After the Maarten Bodewes comment, I have tried
Number mod 1 and Number mod 2:

Edit2. On the second side of the 1-st rotor (marked with number 51 on the photo) letters put on clockwise.


texts: Security (CPA?,CCA?) in Authenticated identity-based encryption

texts:
When I read authenticated identity-based encryption by Ben Lynn, encryption works to send data from user A to user B where:

$$a=e(d_{A},B)$$
$$s=H_{3}(Msg,K)$$
$$C=<s,\gamma \oplus H_{2}(a,s),H_{4(\gamma)}(Msg)>$$

Revealing [$H_{2}(a,s)$] can break the security if the correct ($a$) value is known by attacker.

The scheme may be CPA-secure if the private key extraction query restricts for sender's identity. However, if decryption oracle exists, will it be CCA-secure?

Attacker will modify the ciphertext as follows:

$$C^{*}=<s,\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s),H_{4(\gamma)}(Msg)>$$

where $t$ will be any pairing operation and submits $(C^{*},IDB)$ to decryption oracle. I think the oracle will return $\gamma \oplus H_{2}(t,s)$. Thus, attacker can easily reveal $\gamma$ by XORing with $ H_{2}(t,s)$.

Could you tell me if it is CCA-secure?

What is a suitable assumption for the problem of finding $e(d_{A},ID_{B})$ value knowing $ID_{A}$ and $ID_{B}$? Is it a bilinear Diffie-Hellman problem?


texts: Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption?

texts:
Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption ?

I know that the one-time-pad doesn't have perfect secrecy and doesn't provide unconditional security provided the same key is used for more than one encryption.

Is this general for all encryption schemes, that unconditional security is unachieveable given that a key is used repeatedly ?


texts: With RSA or ECC, if I encrypt my private key with my public key, is there a way to recover my private key?

texts: Is there an algorithmic, mathematical, technical or implementation "hack" to recover the private key or is it definitively encrypted without any particular mathematical property, like any message M?


texts: Why doesn't appending a message to a key instead of vice versa defeat length extension attack?

texts: It's well established that H(K||M) is vulnerable to length extension attacks for SHA-2 and other hashing algorithms, and instead an HMAC construction should be used. However - why can't H(M||K) be used instead? Will this also be vulnerable to length extension attack in the same way?


texts: In regard to using RSA-OAEP-256 in JWE to also authenticate token issuer

texts:
I'm not an expert on cryptography, so, the understanding below might not be entirely correct.
From what I understand, in the context of JWE, the RSA-OAEP-256 key algorithm is meant to provide payload integrity and confidentiality. If the authenticity is also a goal (i.e. to know that the token is created by a trusted party), it's better to use a symmetric key algorithm (e.g. A256GCMKW) instead, or use an embedded JWT with JWS inside a JWE.
And the reason that RSA-OAEP-256 doesn't provide authenticity is that it's an asymmetric key algorithm, where the public key used for encryption is meant to be known to everyone. Therefore, anyone with the public key is able to create a token.
My question is, if the public key is only held by the trusted party, will it be fine to use RSA-OAEP-256 to authenticate the token issuer? (Q1)
The question I guess becomes whether it's considered feasible to deduce the public key using CCA and CPA attacks in the context of RSA-OAEP-256 in JWE.
If it's not considered feasible, is it still preferred to use a symmetric key algorithm e.g. A256GCMKW over using RSA-OAEP-256 in this way (keeping the public key as a secret), given that the goal is to achieve integrity, confidentiality and authenticity? (Q2)
Thanks.


texts: Why is it good to split a CTR-mode counter into nonce and counter?

texts:
When discussing the CTR mode of block ciphers, Wikipedia says the following:

  Simply adding or XORing the nonce and counter into a single value
  would completely break the security under a chosen-plaintext attack.

I don't understand the difference between the split nonce/counter design and simply using a random value and incrementing.  Why is using nonce +/⊕ counter insecure whereas nonce || counter is secure?

I don't see the difference between a split nonce/counter and nonce +/⊕ counter.  At first glance, isn't split nonce/counter mode the same as concatenating a bunch of 0 bits to the nonce and using nonce +/⊕ counter mode?

(By "+/⊕", I mean either addition or XOR, since it doesn't seem to matter which is used for this purpose.)


texts: Finding discrete logarithm with baby-step-giant-step algorithm

texts:
I am trying to use the Baby Step Giant Step algorithm to find discrete logarithm in:
$$a^x= B  \pmod p$$
with using BSGS:
$$x = im+j$$
$$a^j = B a^{-im}$$ where
$m = \sqrt{p}$

Wikipedia says:

  A cyclic group of order $p$, having a generator $\alpha$ and an element $B$.

But $p$ is a 158 bit number. Hence $m$ is too large and I know that $j$ is not a very big number,  $j < k$, where $k \ll n$.
I try to limit test values for $j$ and $i$ by defining $n$ as the next prime of $k$, but in this case I have this problem:

$$x = im+j \pmod {\operatorname{nextPrime}(k)}$$

$$a^x = B\pmod p$$
and when I try $B a^{-im}$ it does not give me $a^j$  because $B$ is actually $a^x \pmod p$ and I cannot find it in the lookup table I have created using values of $a^j$.

How can I solve this?


texts: How does $g$ being a generator imply Diffie-Hellman's correctness?

texts:
In the Diffie-Hellman protocol for key exchange over an unsecured channel, we choose $p$ and $g$, where $g$ is a generator of $\mathbf{Z}_p^*$. However I want to know why this assumption makes the equation below true, assuming Alice and Bob choose $a$ and $b$ as secret keys:

$$(g^b)^a \equiv (g^a)^b \pmod p.$$

In other words, how does the assumption that $g$ is generator of $\mathbf{Z}_p^*$ make the above equation true?


texts: What is the best way to share a shared secret key over HTTPS to be used for HMAC authentication?

texts:
I am writing an application in Java that will be using SHA-1 HMAC message authentication.  From what I understand, a connection over HTTPS is considered secure enough to share a secret key in plain text, and there is little added benefit to hashing the key before sending it from the client to the server.

So, my implementation would have to share a secret key when the first connection is made.  After that, the client would send an API key along with the message that would identify the client and allow the server to look up the correct secret key.

For more information on the approach that I want to use, I am following this guide (Gary Rowe's Multibit Merchant).

The goal is to authenticate the client on subsequent connections.

Is my assumption correct that I can safely send the secret key over HTTPS on the initial connection?


texts: On the privacy of perfect hash functions

texts:
I'm digging into the several algorithms for building (Minimal) Perfect Hash Functions. It seems that the recent works provide quite a few very efficient algorithms.

However, I'm wondering how a (M)PHF behaves in case of unsuccessful searches and what level of privacy can guarantee:

What happens if a user computes the hash function over a key which wasn't in the key set used for the creation of the hash function? What result will be returned?
The user wants to run a membership test of $x$ over a set $S$ in a privacy-preserving way. He computes the hash of $x$: $H(x) = i$, and then asks the server to return the key in position $i$. Let's suppose $x$ is not in the key set, did the user leak anything about $x$? What information could the server obtain knowing that the user asked for a key in position $i$?

EDIT:

Is there any perfect hash function which allows membership tests? Given the phf $H$, a user $U$ would like to test whether $x$ is in the key set.


texts: What use is the signature without the message under RSA?

texts:
Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid signature, given knowledge of the original public key?

First, let me describe how I understand signing/verification with RSA:

You start with a keypair with modulous $N$ that is the product of two large primes, along with integers $e$ and $d$ such that $e d ≡ 1 \pmod {\varphi(N)}$, where $\varphi$ is the Euler phi-function. The signer's public key consists of $N$ and $e$, and the signer's secret key contains $d$.

To sign something, the signer computes $\sigma ≡ m^d \pmod {N}$. To verify, the receiver checks that $\sigma^e ≡ m \pmod N$.

( http://en.wikipedia.org/wiki/Digital_signature#How_they_work )

What are the risks to making $\sigma$ public, if $m$ is kept secret, along with the signers private key, $d$?

The public key, $N$ and $e$, is public, as is $\sigma$, the signature.

$\sigma^e$ is easily calculatable, which gets us $m \pmod N$, but not $m$ itself.

Given $m \pmod N$ but an unknown $m$, what can we do with it?

Can a second signer, with public key $N^{\prime}$ and $e^{\prime}$, and private key $d^{\prime}$ be used to generate $\sigma^{\prime} = m^{d^{\prime}} \pmod {N^{\prime}}$?

How resistant to brute forcing is that? How about if some sort of verification oracle is available?

Since $m \pmod N$ is lossy, without $m$ (or more likely $\text{pad}(\text{hash}(m))$ in practice), is anything about $m$ recoverable?

Is there another system for signing whose signatures are of less use without the message?


texts: Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?

texts:
Assumptions:

Alice and Bob use (cryptographically secure, hardware-rng generated) 4096 bit keys.
Each message is encrypted using a new key; meaning: once a key is used, it's destroyed.
Alice and Bob only need to encrypt/decrypt messages up to a length of 256 bytes.
To keep it simple, key-exchange is not part of the picture and can be assumed 100% secure.

Since the 4096 bit keys practically represent 512 bytes, the key obviously holds enough random material so that it "could" be considered suitable for One-Time-Pad use (like in classical OTP cipher examples).

Looking at the above assumptions, would the use of a simple OTP-XOR cipher indeed be secure enough from a cryptographic point of view, or is it more advisable to use another crypto-algorithm (for example a block-cipher) for some specific reason? And if, why would it be more advisable to use another cipher?


texts: Can the key-generation algorithm always be uniform?

texts:
Assume that the encryption uses $n$-bit keys to encrypt $l(n)$-length messages.

If a symmetric key encryption scheme is defined as $\Pi_{1} = ( \mathrm{Enc}, \mathrm{Dec} )$, then for every $x_{0}, x_{1} \in \{0,1\}^{l(n)}$,
$$ \left\vert \Pr\left[ A (\mathrm{Enc}_{U_{n}}(x_{0})) = 1\right] - \Pr\left[ A (\mathrm{Enc}_{U_{n}}(x_{1})) = 1\right] \right\vert < \varepsilon(n) $$
if it is computational secure.

And if a symmetric key encryption scheme is defined as $\Pi_{2} = ( \mathrm{Gen}, \mathrm{Enc}, \mathrm{Dec} )$, then for every $x_{0}, x_{1} \in \{0,1\}^{l(n)}$,
$$ \left\vert \Pr\left[\mathrm{Gen}(1^{n})=k; A (\mathrm{Enc}_{k}(x_{0})) = 1\right] - \Pr\left[\mathrm{Gen}(1^{n})=k; A (\mathrm{Enc}_{k}(x_{1})) = 1\right] \right\vert < \varepsilon(n) $$
if it is computational secure.

The definition of security is different because the definition of the encryption  is different.
Generally, we do not require that the distribution of $\mathrm{Gen}$ must be uniform.
But it seems that the uniform distribution is always the best.
So, if $\Pi_{2}$ is a computational secure scheme, I want to know whether there exists a PPT algorithm $\mathrm{Gen}'$ which is uniform such that
$$ \left\vert \Pr\left[\mathrm{Gen}'(1^{n})=k; A (\mathrm{Enc}_{k}(x_{0})) = 1\right] - \Pr\left[\mathrm{Gen}'(1^{n})=k; A (\mathrm{Enc}_{k}(x_{1})) = 1\right] \right\vert < \varepsilon(n) $$


texts:
I would like to know how to find multiplicative inverses in $\mathrm{GF}(2^8)$. I know how to multiply two elements of $\mathrm{GF}(2^8)$ (for example, I know that 0x1b*0xaa equals 0x8c).

I follow this explanation, but I still don't understand the process. More specifically: How exactly (step-by-step) are logarithm and antilogarithm tables for AES' finite field formed?


texts: What kind of adversary is a compromised party?

texts:
Imagine multiple parties executing a secure multiparty computation protocol to evaluate a function securely. Let Alice be one of the parties who is intended to get all the partial results and combine these partial results into complete result at the end of the protocol.

In practice , if Alice's machine is compromised and the attacker is impersonating Alice and he has the complete results at the end of the protocol, what kind of adversary would he be in theory ?

Attacker is  not passive adversary, he is not eaves dropping all the parties.

Is attacker an active adversary ( or byzantine adversary ) ?  I believe active adversaries corrupt the parties to execute arbitrary/malicious code etc. But here attacker is not corrupting the parties to do some computation of his choice rather he compromised the party that is intended to get the results .

Is attacker an non-adaptive adversary ? attacker infact control only one party but he has complete results .


texts: How to best obtain bit sequences from throwing normal dice?

texts: Throwing normal dice, one can get sequences of digits in [0,5]. In practice, which is the best procedure to transform such sequences into a desired number of bit sequences?


texts: Transposition cypher that uses Vigenere table

texts:
I have difficulty understanding the difference between two cyphers that both use Vigenere table and transposition, here is examples of both:
The key for the system is the key pair $k_1, k_2$, where $k_1 - $ slogan (witch contains no same letters) and $k_2 \in Z_m $. Then transposition rule can be defined as:
$$\phi(k_1) = \left(\begin{matrix} 0 & 1 &2&3&...& m-1 \\ s &l & o &g &... & z_{m-1} \end{matrix}\right)$$
where $z_i \in Z_m$ differ from slogan and usually ordered alphabetically.
Latin square substitution is defined by $T^{i} \circ \phi(k_1), \ i = 1,2, ..., m-1$.
Example: slogan is given as: B,D,A, alphabet used to cypher is A,B,C,D,E,F. Then the Viginere table for all possible $i = k_2$ is:
$$\left(\begin{matrix}\ i & A &B&C&D&E&F \\ 0 & B&D&A&C&E&F \\ 1&C&E&B&D&F&A \\ 2&D&F&C&E&A&B \\ 3& E&A&D&F&B&C\\4&F&B&E&A&C&D\\5&A&C&F&B&D&E\end{matrix}\right)$$
But in case the key is given as a bijection: X: $\left(\begin{matrix}A&B&C&D \\ C&A&D&B\end{matrix}\right)$ The composition of Viginere table nd the X would be:
$$\left(\begin{matrix}i &A&B&C&D \\ 0 &C&A&D&B  \\ 1 & A &D&B&C \\ 2 &D&B&C&A \\ 3 & B&C&A&D\end{matrix}\right)$$
In the first example, The order of the alphabet is defined in first row: A,B,C,D,E,F. But in the second example the alphabet is first shifted to become C A D B. I don't understand the difference between these two methods as they seem identical only with the difference that the first ones key has this slogan. Can someone explain?


texts: Why does using a prime-order subgroup in DLP improve security?

texts:
Let's consider a discrete logarithm

  $\beta \equiv \alpha ^{x} \bmod \,\, p$

We can solve it using Pohlig-Hellman algorithm. And, if $p-1 = tq$ where $q$ is a large prime factor, we can avoid any leakages by choosing $\beta=a^{t}$.

This is what my professor said at lesson, however i don't succeed in understanding why it avoids any leakages. Can you explain to me why ? Also with calculations if it's possible


texts:
S-boxes with non-linearity greater than 112 are considered prone to side channel attacks.
If a non-linear S- box with non- linearity greater than 112 (excluding bent functions with non-linearity of 120) is implemented through lookup tables, then the amount of power consumption should be similar to 112 S-box. In other words, side channel attacks shouldn't be able to distinguish between the two S-boxes. The question is, if an S-box with non-linearity greater than 112, implemented through look ups is safe or not?


texts: Can ECB mode really leak some characters?

texts:
In an Ars Technica article about Adobe's use of 3DES in ECB mode, there's a paragraph

  The passwords, according to password expert Steve "Sc00bz" Thomas, are encrypted in a mode known as ECB. That was a poor choice on
      the part of Adobe engineers, because ECB often leaks information about the passwords, such as their last few characters and some of
      their lengths. In certain cases, for example, passwords that end in e will generate an encrypted string that ends in
      n2auThm2+Q==; those that are nine or 17 characters long will sometimes end in mfZq5OGbb5.

Is it really the case?


texts:
It is known that a Feistel Network containing 3 rounds is relatively secure against Chosen Plaintext attacks. Now as a game I was given the task to find a possible attack against a Feistel Network with 3 rounds, but the first encryption with a key has no effect. (So the input in the second function is just $L \oplus R$). It should be possible to find out, with significant probability and only to Chosen Plaintexts, if the network produces the results of the chosen inputs or just a random sequence. I just can't wrap my head around it, can anyone help me there?

Thank you in advance!


texts: What does the "Type 1 query" model on Miles, Sahai, and Zhandry's paper?

texts:
On the paper Annihilation Attacks for Multilinear Maps: Cryptanalysis of Indistinguishability Obfuscation over GGH13, authors present, in section 2, an abstract model to analyze security of $i\mathcal{O}$ and current multilinear maps candidates.

In this model, there are two queries that an attacker may do, but I'm now interested on the first one: the Type 1 query, which works as follows:

The attacker has a polynomial $p_k = p_k^{(0)}(\{X_j\}, \{Z_i\}) + gp_k^{(1)}(\{X_j\}, \{Z_i\}) + g^2p_k^{(2)}(\{X_j\}, \{Z_i\}) + ...$ on variables $X_j$, $Z_i$, and $g$, and it may submit this polynomial to the challenger. Then, the challenger answers in the following way:

  If $p_k$ is identically 0, then the adversary receives $\perp$ in return. If $p_k^{(0)}$ is not identically 0, then the adversary receive  $\perp$ in return. If $p_k$ is not 0 but $p_k^{(0)}$ is identically 0, then the adversary receives a handle to a new variable $W_k$, which is set to be $p_k / g = p_k^{(1)}(\{X_j\}, \{Z_i\}) + gp_k^{(2)}(\{X_j\}, \{Z_i\}) + ...$.

So, this is my doubt... At first glance, it seemed to me that this query was trying to model the fact that the attacker can multiply the zero-testing parameter $p_{zt} := [hz^kg^{-1}]_q$ by the high-level encoding $u$ it has (as if he/she would test $u$ encodes a zero) but without ending the test to get a bit (encodes or not a zero), taking, instead, another ring element.

In this case, the polynomial $p_k$ would model a level-$k$ encoding. Thus, the two cases where the symbol $\perp$ is returned make sense, but the third case is weird, because I don't see how the returned expression $p_k / g$ may be obtained from $p_{zt}$. It seems that the value $hz^k$ is missing, I mean, I was expecting that

$$p_k \cdot p_{zt} = hz^k p_k / g = hz^k p_k^{(1)}(\{X_j\}, \{Z_i\}) + hz^kgp_k^{(2)}(\{X_j\}, \{Z_i\}) + ...$$

would be returned instead.

Then, am I right about supposing that this query really models the ability of performing a product by the public parameter $p_{zt}$?

If so, how could the value $ p_k / g $ be returned?


texts: How to implement oblivious transfer where probability of the receiver getting secret is exactly 1 out of 4?

texts: As we know that oblivious transfer is done with probability of 1 out of 2. But how to implement it with probability of 1 out of 3 or 1 out of 4??


texts: Why isn't the alternating step generator used more often?

texts:
According to the Wikipedia entry for the Alternating Step pseudorandom number generator, there is no public cryptanalysis for this device since it was invented back in 1987 by C.G. Gunther. I have several questions about this:

If it hasn't been cracked since 1987, why is it not considered to be a candidate for a "one way function" like the RSA crypto system, the discrete logarithm system, etc.?
If it is unbreakable, why isn't everybody using it?
Why doesn't Mr. Gunther have a U.S. patent for such a great invention?


texts: Do I need to know the "mode of operation" to decrypt a message encrypted with a block cipher?

texts:
If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My understanding is that this is indeed the case.

If so, how is the mode of operation transmitted along with the encrypted file?


texts: Maximum allowable correlation for a random sequence to be useful?

texts:
This question is inspired by a RNG question and some of the comments in the one of the answers.  I have been designing random number generators in hardware recently and my results are significantly better than what I get from /dev/random and /dev/urandom.  I took a sample of 10000 results from /dev/random and /dev/urandom and the results are as follows:

I ran this a few dozen times and the results are about the same with /dev/random being better than /dev/urandom, but that's not the crux of my curiosity.

Mathematically, of course, we want a completely decorrelated sequence of numbers for a random set. My question is if there is a maximum value for correlation in a set of random numbers that is acceptable?  From the hardware standpoint, I can save a lot of power if I have slightly less random numbers and this is a very appealing idea for me.  I don't know if it matters, but I use my random number generator for a ECC engine.

Update
It seems that my /dev/random and /dev/urandom differences were outputs from the same device, but just with less entropy. My working theory is that the second read from the device has less entropy, but more than the OS minimum requirement. However, my question on the maximum correlation is still how much is the maximum acceptable correlation in a series of "random" numbers.


texts:
The text below has been taken from the below paper Groth-Sahai Paper. The relevant part is highlighted in red.

What does this group-dependent language mean in this context? From the definition of a language we know that it means a set of strings. In this case, what are all the strings forming the language?


texts: What happens when domain parameter $q$ in DSA is not prime number

texts:
Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters.

How exactly can an attacker take advantage of this situation?


texts: I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of these cases are obtained. However, at current state I find it quite complicated. Can you recommend any good lecture materials or maybe survey articles that would help to get into this topic?


texts: What will be appropriate AES padding characters?

texts:
I am completely noob in terms of cryptography and security.
So I decided AES Cipher for encrypting my data.

I pad my input data String with blank white spaces to fit it in multiples of my cipher blocksize.
So "Hello world" becomes "Helo world                   "

But is it the right way ?
Can some body crack my key, by sending empty Strings ?


texts: Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?

texts:
By my math, if you are inputting all possible 17 byte values, and the output is 16 bytes long, then there must always be 256 possible inputs that will result in each output hashsum. However, looking at some rainbow tables, it seems that either this isn't the case, or (more likely) the rainbow tables were incomplete. But, some of the other research I've done says that the smallest known MD5 collision happens well beyond 17 bytes in length.

How can this be possible?


texts: Known plaintext, unknown 128 bit block cipher

texts:
I have an encrypted configuration file from an embedded device which I'm trying to decrypt. The file seems to be encrypted in 128bit blocks, as changing a single option causes a 16 byte block to change (all bytes change). The file appears to be encrypted in ECB mode, as blocks of all-zeroes are always encoded the same way.

Is there any way of determining the cipher used, and what are the chances of a known plaintext attack?


texts:
Suppose I have a file server running ZFS with file deduplication enabled, and I have two users that are sharing files: Alice and Carol. If Alice uploads huge_file.tgz to her www/ directory, and Carol uploads the same huge_file.tgz to her www/ directory, then they are only stored on disk once, and both files are available to the world.

Now, instead of Alice and Carol wanting to share huge_file.tgz with everybody, Alice only wants to share it with Bob, and Carol only wants to share with Dan, and we want this sharing to be enforced with public keys, and we want the sharing to work with ZFS's deduplication. We obviously want to abandon Semantic Security here, since the same plaintext must encrypt to the same cyphertext.

Given that, does the following make sense: both Alice and Carol encrypt huge_file.tgz using a symmetric algorithm with deterministic nonce (all null, perhaps?) and a key derived from the file's contents (a sha hash?).  They will both then generate the same ciphertext, and then Alice can encrypt the (deterministic) symmetric encryption key to Bob's public key, and Carol can encrypt the key to Dan's public key. So, Alice's www/ directory will hold huge_file.tgz.encrypted as well as encrypted_key_for_bob.bin, while Carol's www/ directory will hold huge_file.tgz.encrypted as well as encrypted_key_for_dan.bin . Now, we have the bulk of the data being deduplicated, and a tiny file specific to each recipient, which is only readable by that recipient.

Is this method at all sane? Aside from abandoning semantic security (basically a prereq here), the only weakness that I (somebody with basically no crypto knowledge) can see is that using a straightforward sha for the key is dangerous because that's information that a user could reasonably publicly leak; doing something like using the MD5 of the SHA doesn't increase the "strength" of the system at all, but it does decrease the likelihood that the symmetric "secret" would be innocently leaked.

Even better than poking holes in what I've written here, could somebody point me to a legitimate, publicly reviewed, public key cryptosystem that allows deduplication? I'd love to simply use something that an expert has created, if such a thing exists.


texts: Hashing/encrypting an integer to produce an unique integer in the same range

texts:
I'm looking for a function or set of functions that can produce a pseudo-random permutation on an input set of arbitrary size.
Given a set of $M$ values in range $0..M-1$, where $M$ is positive integer,
I need a function $I' = F(K,M,I)$, where $I$ is a value in range $0..M-1$, $K$ a key (to be determined) and $I'$ a value in range $0..M-1$.
For each value $I$, there must be only one $I'$ value, and for each $I'$ value, only one $I$ value.
Having the reverse function $I = F'(K,M,I')$ is not strictly needed, but it seems implied by requirement.
So this looks like an encryption function.
If $M$ was $2^{128}$ or $2^{256}$, I could use a block cipher.
If $M$ was a multiple of $256$, I could use a stream cipher (byte oriented).
But $M$ could be any value, without any special properties: it's not required to be odd, even, prime, power of two,...
I'm not aware of such encryption or hash function.
Could you help me to formalize what I need and give me some hints to find an encryption/hash scheme that suits my needs?
I seem to have found what I was looking for: Format Preserving Encryption (FPE), but I need some help to sort this out.
EDIT: In order to be strong, I think it's important the function should not be self-inverse, e.g., given $I' = F(K,M,I)$, $F(K,M,I')$ should not return $I$.


texts: Unknown bit in the output of encryption of data using SIMECK32 cipher?

texts:
How is the unknown bits (annotated by red arrow in figure below) come in the OUTPUT after round 1 and round 2 ?

Following is the pictorial representation of SIMECK round function operation.

Ref: Research Paper (figure 3)


texts: Non Repudiation - Message Authentications methods

texts:
According to a definition given by my professor:

  Message authentication methods verify that the message is from the
  right sender, however they don't guarantee non-repudiation.

To me this sounds like a contradiction, what does "right sender" mean?


texts: Smart Card - Entropy during on-board public key generation

texts: I know that some (advanced) smart cards or tokens allow generating key pair directly on the device, but I wonder how the card can gather entropy during the process. Any idea ?


texts: Where can I find a sample of data with a known entropy to see how well NIST SP 800-90B does on it?

texts:
I'd like a sample of true random data from a source that has a known entropy.  It's not easy to even produce true random data in sufficient quantity --- much less know the entropy of the source.  For instance, my only chance at grabbing true random data is waiting for /dev/random.
I'm spinning my hard drive and using the system as hard as I can to feed the kernel with enough entropy.    Meanwhile I'm collecting data up to 1,000,000 so as to satisfy NIST SP 800-90B because I'd like to estimate the entropy of /dev/random using the state of the art in entropy estimation.  (I'm aware of various problems with NIST SP 800-90B, but I have not found anything better out there that has been received the due scrutiny from the scientific community.)
How am I spinning my system?
$ while true; do sudo find /; done

How am I collecting the data?
$ cat /dev/random >> random.bit

Why am I not collecting it quickly from /dev/urandom?  Because that does not make sense.  I'd like to estimate the entropy.  I won't get more entropy from using a PRNG to process true random data.  As far as I can tell, using a PRNG might just make it harder for the estimators.  (Any thoughts on that?)
Do you know of any sample of random data out there that has a respectful entropy estimation that I can use to see how well NIST SP 800-90B does on it?  Is there any work done that states the entropy of Linux's /dev/random?


texts:
Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely unsubstantiated claim that it is inherently weaker. But on the other hand GPG says that DSA is well-regarded.

My understanding is both the prime factorization problem and the discreet logarithm problems must hold for RSA to hold but only the discreet logarithm problem must hold for DSA to hold.


texts:
What are the currently recommended modes of encryption for large disks? Basic requirements would seem to be that you can update an encrypted sector independently of others, which rules out most standard modes of operation except CTR. For example are there any problems with taking the counter to be the current block number + some initial offset that could be stored for example on the first block.

What security models are usually considered for disk encryption? Is IND-CPA-security (as offered by CTR) enough?