texts: How to use AES-CBC to password-encrypt a small block of stored data

texts:
I have a small block of data (16 bytes) that I am required to encrypt,
store (in an unsecure, visible location).  Later I have to retrieve
and decrypt it.  I must use AES-CBC and a user-entered password.

After decrypting the data, I need to know if the correct password was
used (so I can reject the data if not).

My initial plan:

Encapsulate the 16-byte payload in a plaintext frame something like this:

     Frame:
        8-byte random salt
       16-byte data block
        8-byte checksum of salt+payload

Generate a random 128-bit IV.
Generate a 128 or 256 bit key from the user-entered password.
Encrypt the plaintext frame using IV+key.
Concatenate the IV and ciphertext frame and store them.  [Using 48
bytes of storage.]

Storage size isn't critical: a hundred bytes (or two) is OK, but
thousands is probably too much.

My questions:

Do I really need a random IV if I salt the data?  Prepending
128-bits of random salt to the data is the same as using a 128-bit
random IV, right?
What should I use for a PBKDF?  The application is running on a
smallish, slowish embedded system and has rather limited crypto
routines available (aes, arc4, des3, sha1, sha256, md2, md5).  So,
I'll have to roll my own PBKDF.  A PBKDF algorithm that runs in one
second on an attacker's machine will probably take thousands of
seconds on this device -- so let's not get carried away: I need to
do the encryption and decrypting in no more than a second or so.
Most discussions of using a PBKDF emphasize the importance of
including a salt value.  That means I also have to store the PBKDF
salt along with the IV and the ciphertext, right?
I have access to the stored data produced by a previous version of
this product (which I'm told uses AES-CBC to do the same thing),
but I have no access to source code or the people responsible.  The stored
data is exactly 16-bytes long.  AES-CBC always uses 16-byte blocks,
so that must be a single block of ciphertext.  That means

a) They aren't using any salt in the PBKDF algorithm?

b) They must be using an IV produced by the PBKDF (or a constant
    IV)?


texts: How did Kyber's authors compute the error probability $\delta$?

texts:
I'm studying the specification of Kyber that was submitted to NIST PQC Round 3. However, I cannot figure out how they compute the error probability $\delta$ for Kyber 512, 768 and 1024. I have read the Kyber paper (written with respect to round 1), especially its Theorem 1 (correctness theorem). But the paper did not explain how to compute $\delta$; instead, the author just stated that they "provide with [the] software" a Python script to compute it (which was in neither the paper's appendix nor, apparently, the software's Git repo).

$$\begin{array}{c}
\text{Table 1: parameter sets for Kyber} \\ \hline
\begin{array}{l c}
& n & k & q & \eta_1 & \eta_2 & (d_u,d_v) & \delta \\ \hline
\text{Kyber512}  & 256 & 2 & 3329 & 3 & 2 & (10,4)  & 2^{-139} \\
\text{Kyber768}  & 256 & 3 & 3329 & 2 & 2 & (10,4)  & 2^{-164} \\
\text{Kyber1024} & 256 & 4 & 3329 & 2 & 2 & (11,55) & 2^{-174}
\end{array} \\ \hline
\end{array}$$

Can one explain how $\delta$ is computed? How accurate or "tight" are these $\delta$ values, and how would one evaluate their correctness?


texts: How can I encrypt more than 128 bits of data with AES?

texts:
To my understanding a state is a $4 \times 4$ byte array used to store the plaintext. That equates to $128$ bits of data.

To encrypt more than $128$ bits of data do I need to setup multiple of these states in order to encrypt all the data and perform the algorithm on those states? Or is there another method?


texts: Are two outputs of a PRF computationally indistinguishable when using two different keys?

texts:
Assume we have a pseudorandom function $f(\cdot)$ that maps an input to $\mathbb{F}_p$ where $p$ is a large prime number.

Assume $r_1$ and $r_2$ output of the pseudorandom function using two different keys.

Question: Are $r_1$ and $r_2$ computationally indistinguishable?


texts: What is the new attack on SHA-1 "SHAttered" and how does it work?

texts:
There's a new recent Attack on SHA-1 named "SHAttered" by Google and some researchers. I understand that it uses some fancy new techniques, but not the details.

My question is: How?

How does the attack work (on a high level)? How does it compare to previous attacks?

Note: The matter of implications is already handled by this other question, so don't focus on it please.


texts: Complexity of multiplication of two numbers

texts:
If I am multiplying two numbers $m$ and $n$, where $n$ has $k$ digits and $m$ has at most $n/2$ digits, will it be considered polynomial time or exponential time in terms of $k$?
Addition (by proxy of mod): This multiplication's time will be exponential in $k$ (answering the above), yet polynomial in size of $m$. Will it be called an efficient result or not?


texts: Why cant Public Key Encryption be perfectly secure?

texts:
I would be very grateful for any help. I cant figure out why (probabilistic) public key encryption schemes can never provide perfect secrecy? Any Ideas?

Excerpt:
In contrast to the private-key setting, perfectly-secret public-key encryption does not exist. (We stress that this holds regardless of how long the keys are and how short the message is.) In fact, given pk and a ciphertext c computed via c ← Enc_pk(m), it is possible for an unbounded adversary to determine the message m with probability 1.

(See comments for why this is not a duplicate.)


texts: what is the order for the brainpool twisted curves?

texts:
Per What is the difference between regular and "twisted" ECC curves? I guess the brainpool twisted curves and the brainpool regular curves use the same point addition and point doubling algorithms.

Domain-parameters.pdf#page=15 mentions the parameters for the 160-bit regular curve and the 160-bit twisted curve. For the regular curve it has a $p$ parameter and for the twisted curve it has a $Z$ parameter. I assume the $Z$ parameter is the prime number you need to do the modulo of after every operation.

What about the order $q$? Is the order the same for both curves?

If the curves are the same thing then couldn't one just treat them as aliases of one another? Like when you're randomly selecting $k$, between [$1, n-1$] and then multiplying the base point by that then you'd get the same answer no matter which curve you used?


texts: What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What advantage they are talking about?


texts: Proof of probability of weak keys in block cipher

texts:
My textbook has the following theorem:

  Given a block cipher with a key length of K bits and blocksize of n bits as well as t plaintext-ciphertext pairs, the expected number of false keys which encrypt all plaintexts to the corresponding cipher text is $$2^{k - tn}$$

This makes sense if you consider DES gives us roughly $2^{-8}$ for a single plaintext-ciphertext pair as explained here. However the author doesn't give a proof to this theorem, I want to know if it's possible to prove it and how can I prove it? I thought about using induction but I'm having some problems about which assumptions I can make


texts:
I'm a complete cryptography beginner and I'm interested in the cryptography behind Bitcoin, hashing, key cryptography etc.
I suspect that SHA-256 can only take Alpha-Numerics but I was wondering if anybody could confirm this or explain otherwise, I've scrubbed the web for answers but found nothing.


texts: Can we replace the XOR operation in DES with some other operation?

texts: Can we replace the XOR operation in the DES algorithm with some other operation? If so, does it work for both encryption and decryption?


texts:
How much can I shorten a password hash before it begins to impact security?

Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF.  From what I've seen, it's typical to use 256 bits of output, since that matches what comes out of the PRF.

My intuition suggests that there would be no security impact if this output were truncated to 128 bits.  Is this correct?  My reasoning here is that salting prevents multi-target attacks, and that collisions are unimportant in the context of password verification.


texts:
I am very new to cryptography, I apologize if my question is so basic.

I do not understand how a hash can have a fixed length, because you can have infinite inputs to a hash function. With a fixed length you would have limited possibilities of hash outputs. So a hash can have different messages with the exact same output?


texts:
I'm new to asymmetric encryption guys, I read about it thoroughly lately and I don't get one thing.

If, say, I have a message, I sign it by first hashing the message, then encrypting it with my private key. After that I publish message and signature together. Then if anyone wants to check it, they have to decrypt it with my public key and compare the hash.

My question is: how do they know my public key?

If I send it with message - then anyone can forge it by altering the message, replacing the open key and making a new valid signature. Or maybe it can be requested from me? If yes, then what if someone interrupts that request and replace my public key in response with theirs fake one?

One more thing: what if the public key is not available? For example if there is a system were each node can broadcast its public key - what if some of the nodes are offline for weeks - does it mean their signatures can not be verified? Maybe their public keys are saved on some kind of centralized database, where you could request my public key by, say, my email. But this database can be hacked and public key will be replaced by a fake one - and nobody will trust my signatures anymore.

You see, maybe I don't get some particular subtle moment here - an issue of how to trust a genuine public key in any given network system, given that hacker may somehow interrupt any connection and replace messages between nodes (or if it's a centralized DB - public keys may be replaced by hacker).


texts:
I'm learning about OpenSSL and public key infrastructure and am curious about the structure of an RSA key and how it's related to its corresponding public key.

I can generate a private RSA key with the OpenSSL genrsa command:

$ openssl genrsa -aes128 -out fd.key 2048
Generating RSA private key, 2048 bit long modulus
....+++
......................................................................................
+++
e is 65537 (0x10001)
Enter pass phrase for fd.key: ****************
Verifying - Enter pass phrase for fd.key: ****************

I know there are three factors to think about when generating a private key:

Algorithm
Size
Passphrase

In this case, I'm using the RSA algorithm, 2048 bit size, and encrypting the key with AES-128 encryption.

I can view the structure of the RSA key using the rsa command:

$ openssl rsa -text -in fd.key
Enter pass phrase for fd.key: ****************
Private-Key: (2048 bit)
modulus:
    00:b6:ae:03:fa:d5:ec:3d:7b:1e:a5:33:68:44:5f:
    [...]
publicExponent: 65537 (0x10001)
privateExponent:
    1a:12:ee:41:3c:6a:84:14:3b:be:42:bf:57:8f:dc:
    [...]
prime1:
    00:c9:7e:82:e4:74:69:20:ab:80:15:99:7d:5e:49:
    [...]
prime2:
    00:c9:2c:30:95:3e:cc:a4:07:88:33:32:a5:b1:d7:
    [...]
exponent1:
    68:f4:5e:07:d3:df:42:a6:32:84:8d:bb:f0:d6:36:
    [...]
exponent2:
    5e:b8:00:b3:f4:9a:93:cc:bc:13:27:10:9e:f8:7e:
    [...]
coefficient:
    34:28:cf:72:e5:3f:52:b2:dd:44:56:84:ac:19:00:
    [...]
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
[...]
-----END RSA PRIVATE KEY-----

I'm also able to view the public key using the using the rsa command:

$ openssl rsa -in fd.key -pubout
Enter pass phrase for fd.key: ****************
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyOYm8hJCi3vKLaud2YTU
O3glFfQUpJ6d4gXiWp//HkDQIvi2BFmvbUyHMh4XWLwPbmaX2dfJ5Aa8+ZIC9KCY
y96Gmbw+v75RzxHq5iFLnZNFhYM2zkMvUUjJs/UqunOL1OoEiC06hb85SBepKtnE
JUUKo/rtZ2Sj/pHvF0Wqu1hLyR3iOxdJb26+m2IhOy4wB3HI6FBcvrMd4Hmejpup
skIRhTQXkV7XQ79yRCTS3ejiGoVvkPKzWxL+OFWOJTduXAk8McMLEozSGZll8bv7
jJUWLhmegvokKS2eLfA4B16yU59EgNbvuoG5doKUeV0LJ03Iiqv81nFB9SqEG/Xe
VQIDAQAB
-----END PUBLIC KEY-----

From the Hexadecimal wiki page:

  One hexadecimal digit represents a nibble (4 bits), which is half of an octet or byte (8 bits).

Some things I'm curious about:

Which numbers correspond to the 2048bit length? Is it prime, exponent, coefficient...?
How is the public key related to the private key? Is it calculated from the numbers, or is it embedded in the private key?

From reading another answer it sounds like the 2048 length corresponds to the modulus.

However when I calculate the length I get 2056:

$ echo "00:b6:ae:03:fa:d5:ec:3d:7b:1e:a5:33:68:44:5f:d0:6a:0b:b5:87:31:80:a0:50:32:b0:7c:73:4b:f8:a2:03:91:89:c2:11:32:69:2e:13:90:71:f6:a9:48:21:00:c5:ad:1c:93:f0:21:27:ce:ca:15:04:53:30:c6:88:7b:45:c0:f2:01:d5:a7:9e:c1:c5:f2:ae:b0:7f:31:68:b7:3c:c3:62:13:eb:40:25:a9:3f:cd:81:90:9f:a1:3f:02:84:d8:6e:73:d2:5d:53:28:cc:97:35:f6:fa:5c:b7:dc:11:fb:60:08:1b:75:f7:74:dc:24:29:3e:ff:fb:ba:dc:77:2c:48:0d:3b:a1:7b:d9:9a:3d:52:7d:9a:d6:c1:f1:e7:46:df:be:75:b0:d2:0f:d2:1c:7b:25:57:94:33:8f:d5:b3:ee:7f:30:98:a9:06:25:b5:ab:b1:a6:ab:f9:f2:52:b8:e7:8f:87:5f:6d:96:36:67:47:38:4c:ef:29:c7:71:e4:07:7c:13:19:3a:e2:b4:3c:85:18:32:77:a6:98:0e:0d:b4:70:01:75:79:de:e9:83:c5:df:41:2f:69:f6:30:8d:13:29:84:9a:84:3a:c0:6a:4c:0d:bd:cd:9b:1e:93:de:8e:c9:a4:02:b7:0f:a2:96:45:ad:b8:3e:3a:d3:fd:4d" | tr ':' '\n' | wc -l
257

Each line contains 2 hexadecimal digits

257 * 2 = 514

Each digit contains 4 bits

514 * 4 = 2056

Shouldn't it add up to 2048?


texts: Are there any "cumulative signatures" for decentralized networks?

texts:
Lets assume that there is a decentralized network $N$ with participants $A,B,C, D$ and that there was a message $m$ that all of $A,B,C,D$ agreed to. An outsider $X$ wants to know via signatures that $m$ was indeed agreed to by all of $N$.

Is there a way of combining the signatures of $A,B,C,D$ such that $X$ just has to check one signature? So if $m$ arrives at $A$ first, then $B,C, D$ they sign $D(C(B(A(m))))$ which would translate into $N(m)$ which $X$ only had to check once regardless of the order of $A,B,C,D$ in $D(C(B(A(m))))$? Is there any literature on this or does such an algorithm not exist (yet)?


texts: Is it possible to reduce the output of AES after encryption into 64 bit with the possibility of a reversible before decryption Without any error


texts:
I know this happened a long time ago, but I always wanted to ask this to a professional: Why was TrueCrypt Discontinued?

Is it related to this: FBI hackers fail to crack TrueCrypt?

And what is the best option, without backdoors, currently available?


texts: Is it hard to compute $g^{ab}$ when given $(g, g^a, g^b, \frac{a}{b})$?

texts: We know that the CDH problem, computing  $g^{ab}$ from given $(g, g^a, g^b)\in\mathbb Z_p^3$, is hard. Is it still hard with an auxilary information $\frac{a}{b}\bmod q$ (where both $p$ and $q$ are large primes with $q|p-1$, and $g$ is a generator with order $q$) ?


texts: AES Is it safe to expose the plaintext and cyphertext in the same place,

texts:
In a web application, I need to send in a webpage form an id (my plain text) and then retrieve it back when the user submit the form.
But i need the id to be protected, so malicous users can't send an incorrect id to the server.

I was thinking to send the id and the cypher text to the client, and when i retrieve them server side, i decrypt the cypher text, and if the id don't match the decrypted value, i reject the call.
I am using AES with 256bit key.

So the question is : is it safe to do that? is there a better way?
thank you for your help

PS : There is a business need to send the id as plain text (not encrypted) to the client.


texts: Why is it said that if we have a duplicate ciphertext block it can leak our information?

texts:
I have been recently going through a question:
https://security.stackexchange.com/questions/15767/what-do-key-size-and-block-size-mean-in-cryptography and it created in me a series of doubts. Referring to the 2nd answer you may find the information that there is 50 percent chance of repetition of a duplicate block if we receive the square root of total amount of data. If some how a block is repeated how can it be cracked? How does the information gets leaked?


texts: Private Information Retrieval with no server computations

texts:
Is there any way to perform Private Information Retrieval when no computations can be executed on the server-side?

I would like to perform the computations on the client, and without having to download the whole database.


texts: Hash function notations and their corresponding existing cryptographic hash algorithm

texts:
I am implementing Role-based access control by referencing the paper Enforcing Role-Based Access Control for Secure Data Storage in the Cloud. In page 6, they have mentioned to choose hash functions $H_1$ and $H_2$ during the setup
$$ H_1 : \{0, 1\}^∗ → Z^∗_p, H_2 : G_T →Z^∗_p $$
where $G_T$ be a cyclic multiplicative group
Can anyone please explain me the notation of the two hash functions?
Should the two hash functions $H_1$ and $H_2$ be implemented using different cryptographic hash algorithms? Or can I use SHA-256 (for example) to implement both of them? If No, please recommend me cryptographic hash algorithms for them.


texts: Naccache–Stern knapsack cryptosystem: How to calculate $p_i ^{s^{-1}} \mod p$?

texts:
In the algorithm(link), for calculated n and chosen secret key s, we need to calculate $\sqrt[s]{p_{i}} \bmod p $.

As an example in original research paper (link) , For a given $p=9700247$ and $s=5642069$, It is given that $\sqrt[s]{2} \bmod p = 8567078 , \sqrt[s]{3} \bmod p = 5509479$  and so on.

So how to calculate this $\sqrt[s]{p_{i}} \bmod p $.


texts: Using a straight password for encryption and authentication

texts: Assume we have a password like 3buNCh_7kaRmencrEst3. Now suppose we have two parties who know this password. We a have communication scheme that uses the password to establish session key and to authenticate the handshake used to establish the session key. Assume a password-based key derivation function is used to authenticate the challenge-response protocol used to establish the session key and that that same function is used to generate the session key. Is such a scheme secure?


texts: Is there a PRNG algorithm that allows to switch between states directly, not calling next()?

texts:
Basically I need a function with the following interface:

getRandomBytes(uint128 seed, uint64 state, uint16 byteCount)

Consecutive calls with the same seed and state must give the same results.

What algorithm should I look at?


texts: Offline app authentication - embedding hashed password inside an encrypted file

texts:
I am working on an occasionally connected app.  To allow the users to authenticate I created a profile which is encrypted and placed on the users machine.

The first byte of the file contains the IV length followed by the IV and then encrypted using Aes where the key is the users password hashed using SHA256.

Within the contents of the profile is the SHA512 hashed user password which I use to authenticate the user and (I think) acting as a mac.

So, the users enters their password, it is hashed into the Aes Key and used to decrypt the profile.   Then I authenticate the user by hashing the entered password and comparing it to the stored hashed password.

Am  introducing a security problem by embedding the hashed password within the profile file and does this ensure message integrity?


texts: Why isn't this HMAC construction/check secure?

texts:
A MAC is calculated the following way:

mac = sha1(secret || m)[0:8]

[0:8] denotes taking the first 8 characters from the resulting hash.

The length of the secret is unknown. Users (and potential attackers) can check the validity of a particular MAC and message pair online.

if(macInput == sha1(secret || m)[0:8]){
   // ok
}else{
   // access denied
}

Can this be attacked? I heard it can, but I don't see why and how.


texts:
If I want to protect a private RSA key, do I just XOR the password into the key, or do I do something else? Is it secure?

Edit:
I got a good answer from a comment - Hash the password/passphrase with PBKDF and use that as a key for AES to encrypt the RSA private key. Also the passphrase is never stored on the disk. The user is prompted to enter it when starting the programm and it is stored in RAM for a limited amount of time(It will be overwritten later and RAM is cleared anyway on shutdown.)


texts:
I need help of cryptanalyzing a "bad" RC4 implementation to recover an encrypted text of 13742 bytes.

I don't know the key and this implementation does not utilize the drop-n routine.

But, I know the key length (256). Also, I think it is a bad implementation because the KSA is as follows:

def ksa(key) :                                   # RC4_KSA_STANDARD
  S = range(256)[::-1]                           # S = range(256)

  j = 0
  for i in range(256) :
    j = (j + S[i] + key[i]) % 256                # j = (j + S[i] + key[i % len(key)]) % 256
    S[i], S[j] = S[j], S[i]

  return(S)

The initialisation of S is inverted ([::-1])
j is calculated without key[i % len(key)]

My hypothesis: recover the first round with the first 256 bytes of encrypted text (because KSA is maybe more "predictable" without key[i + len(key) % 256]).

My questions are:

Am I on the right track?
Otherwise, is there some better strategy?
What is the calculation to conduct the attack to obtain the plaintext message?

I have a little problem with the mathematical logic in some aspects (is my bad asperger side). If anyone would be kind enough to explain this to me?


texts:
Alice and Bob decide to use the prime $p = 601$ for their affine cipher. The value of $p$ is public knowledge, and Eve intercepts the ciphertexts $c_1 = 324$ and $c_2 = 381$ and also manages to find out that the corresponding plaintexts are $m_1 = 387$ and $m_2 = 491$. Determine the private key and then use it to encrypt the message $m_3 = 173$.

Since the encryption and decryption functions are defined as $$e_k(m)=k_1\cdot m + k_2 (\mod p)$$ and $$d_k(c) = k_1'\cdot (c-k_2) (\mod p), \quad k_1' = \text{inverse of k1 modulo p)}$$
I began by setting up the system
$$387k_1 + k_2 (\mod 601) = 324$$
$$491k_1 + k_2(\mod 601) = 381$$

But I can't figure out how to solve for $(k_1, k_2)$


texts: Some simple questions about tweakable ciphers

texts:
I have read a few papers on tweakable ciphers (didn't understand them well, though) and looked at many of the questions and answers on this exchange: What is a tweakable block cipher, Tweakable Block ciphers, Tweaking Even-Mansour Ciphers [video]. However, there are a few things I'd like cleared up.

Are the tweaks always just a string of bits? And are they usually shorter than the key?
It seems DES-X is a tweakable cipher where the tweaks are the pre- and post-whitening that use secret extra keys. Does this mean some tweaks are necessarily secret? The reason I am asking is that I got the impression from the papers I read that tweaks are always public.
In view of Q2, what other tweakable ciphers (if any) use secret tweaks or ones that may be secret if desired?
If a tweak is secret does this add strength to the cipher as well as variability?
If a tweak is appended to a key, does this mean to the session key or to each subkey? I am a little confused because I thought part of the idea of tweaks is that they are easier to change than producing new keys through a complex key schedule (for instance).
Perhaps this should be a separate question, but: the term permutation seems to mean two different things. 1) a bit-wise (say) permutation, i.e. excluding XORs, S-boxes, etc. and 2) a complete block cipher encryption that produces an apparently random permutation of the input, i.e. typically including XORs and substitutions, etc. In relevance to tweakable ciphers, when I look at some models I see the cipher is denoted by $E_n$ but when I look at models based on the Even-Mansour ciphers I see $P_n$. I assume the $E$ refers to an cipher that may include several operations (perms, s-boxes, etc. as for $DES$, $AES$, etc.) but the $P$ refers only to bit-wise permutations (or perhaps byte-wise). Is this assumption correct?

Much obliged to anyone who can help.


texts: Is AES_CMAC specified to double ciphered zeroes during initialization?

texts:
Reading the SIV RFC https://tools.ietf.org/html/rfc5297#page-9, I found that the S2V function starts by calculating the MAC of a "zero" block, doubles it and then XORs further data to the result.

Now looking at the BouncyCastle implementation, the exact same thing happens during the initialization of AES-CMAC.

How do I have to understand the S2V specification? Do I have to do all the "zero" stuff and doubling and XORing? Or does this already happen inside the AES-CMAC function? Would that mean, that AES-CMAC(key, plaintext) is equivalent to S2V(key, plaintext)?


texts: Proving equivalency of two security definitions of symmetric encryption schemes

texts:
how to prove definition 3.8 and 3.9 are equivalence ?

picture is from book an introduction to modern cryptography (2nd edition) by j. katz and y. lindell pdf

and https://repo.zenk-security.com/Cryptographie%20.%20Algorithmes%20.%20Steganographie/Introduction%20to%20Modern%20Cryptography.pdf is link to first edition which definitions can be find on pages 63 and 64 of book as definition 3.9 and 3.10


texts: Multiple parties must encrypt and get the same result

texts:
Hopefully this question is not too simple - I did some research but with encryption I really don't want to make a mistake.

Our scenario is that multiple groups need to encrypt a number and arrive at the same result.

This is because they want to use credit card numbers to search for documents, but we are only willing to store an encrypted version of the number as a search index.

I believe a one way hashing function of some sort would be best, salted somehow.

Would this be secure, given that:

We are storing a masked version of each number too (roughly half the number is visible, i.e. the non-personal details)
An attacker could have an account and therefore know their own plaintext

AES-256 was discussed as it's fairly standard in the banking industry but I don't know if it's appropriate here - we would be unable to use a random salt or initialisation vector.

It may be better to accept the full number as a search term and encrypt server side, but for various reasons I don't believe this will be possible.

Thanks.


texts: Share secret non-interactively in a verifiable way

texts:
In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received the same secret and if not will ignore the message. The problem is that the other receivers may not be online right now and thus an interactive protocol is not an option. The end goal is that all recipients get the same secret or all recipients ignore the message.

One solution I came up with is that after a recipient decrypted its part and received the secret he encrypts it with the public keys of the other recipients and checks that the cyphertext is the same, but this requires that the encryption scheme is deterministic but I only found probabilistic schemes and explanations why deterministic schemes are bad (but the concerns seem not to be a problem in my case as the plaintext is always a random number).

Is there a ready available deterministic asymmetric encryption scheme?
In other parts of the system, I use ECDSA so if I could reuse these keys it would be optimal but adding another scheme would be possible as well.
I'm not a cryptography expert and unless there is no other way I would like to avoid changing an existing scheme to make it deterministic.

Another option I found was using zero-knowledge proofs like SNARK, STARK or Bulletproofs but this seems like overkill and extremely complicated to pull off.

Are their other options I missed?


texts: MAC tag size in AES CCM, when using CTR + CBC-MAC (not CBC MAC only)

texts:
Assuming that AES CCM is used with respect of the NONCE unicity // the key life cycle, I wonder about the need of using the highest size for CBC-MAC authentication tag if CTR mode encrypts both payload AND authentication tag :

If no encryption is performed (e.g AES CBC MAC only), I understand the need of highest tag, i.e 128 bits , thus to prevent from brute force attack .

But : if the tag is ciphered using CTR mode as the payload is, I guess it guarantee that an adversary can not pickup any pair (Plain text / tag) and try to get another pair that matches ?

Any suggestions welcome, thanks !


texts: What would the implications be of a single randomly discovered SHA-256 collision?

texts:
Imagine if someone messing around with hashes accidentally came across two inputs to SHA-256 that produced the same output.  Not a concerted effort, not Google/NSA or crypanalysis. No tin foil hats.  Just random chance in say a high school. And they made the two inputs public knowledge.  Whilst highly improbable, not mathematically impossible.  And just that one collision.

What would be the implications?  Would people simply say "Well it had to happen someday" and carry on as normal, keeping the hash as is? Or would SHA-256 have been "broken" and an upgrade sought?

An answer to Are there any well-known examples of SHA-256 collisions? suggests that it would be major.  Even if it happen entirely by chance?


texts: Minmum Key Length for Block Ciphers Required keeping in view futuristic quantum computers

texts:
In an answer to the Question "What are recommended, general strategies to start block-cipher design and/or analysis?", in terms of brute force attack, it is written

  256 bits is considered secure forever, even in the face of futuristic
  quantum computers

is it true? or i can consider 128 or 192 bits secure as well keeping in view the futuristic quantum computers? or it should be more than 256 bits?


texts:
I am generating ECC private keys. however I noticed that since ECC private key is just a BigInteger. e.g. spec256k1 says private key is anywhere between [0~2^256-1].

my question is, if everyone is using Random(32) to generate a 32bytes private key, there is not likely but still possible situation that 2 people could generate the same private key. therefore also same public key.

so if this happens on blockchain like Bitcoin or Etheruem, does that mean those 2 people are in theory sharing the same account? or wallet address?

maybe I am missing some details here. Please guide me.

Edit:

thanks for everyone's answer here.

the reason why I was asking this is because first I wonder if there is any protection against collision in the system. however, if there is, and you are told you had a collision, that basically means you figured out someone else's private key...

second reason is, I was considering generating a long(64bits) and then cast into BigInteger(32bytes) to be the private key. however, that will have a much higher collision chance due to the fact that I will only have a private key space of 2^64.


texts: Testing implementation of cryptography algorithms: Brainstorm

texts:
I wonder what kind of techniques can be used to validate implementation of cryptography algorithms?

The obvious one is to run specific algorithms against publically known test vectors (i.e. from NIST). Other idea would be to run it against some tool for fuzzing like AFL.

Would you have any other ideas, tools? How would you test against side channel?


texts:
I know that Boolean circuits and Arithmetic circuits are two different ways of representing a computation. But I want to know how to instantiate arithmetic circuits and it's computation in practice. For example, when we multiply two l bits numbers, we say that arithmetic circuits are efficient because it represent those two nums as two field elements, and only need 1 multiplication gate. But I don't understand: don't we have to represent those two nums in bits in machine code? And do we have to represent that multiplication gate in basic blocks such as and-gate/xor-gate...or is there a real circuit structure is multiplication gate?
Sorry for such a dummy question, but this confuse me for quite a long time and I can't find the answer by myself. So could anyone give me some guide or some paper to this question?
Great thanks.


texts: How is BCrypt secure when it uses a static dataset for blowfish hashing?

texts:
I'm planning on using this Javascript BCrypt implementation, but as you can see in the code, it uses a 4KB precalculated dataset for the P and S parameters needed for blowfish hashing. I've also tracked a similar dataset back to the original C BCrypt code.

Shouldn't blowfish hashing use a dynamically calculated dataset? How can this be secure? I'm going to do this client-side, so if an attacker reads the statically stored dataset, will it make it easier to find a collision for the BCrypt hashed value?


texts: Schnorr-signature calculating a coefficient

texts:
I need to create program that makes signature for selected file. I simplified algorithm a little, because I draw max 64 bit prime numbers instead of 512 bit - like its recommended in Applied Cryptography book.

I have already drew private key which is for example: $1848661337$, and now I need to calculate public key. I need to choose an $a \not = 1$, such that $a^q = 1 \bmod p$, where $q$ and $p$ are prime numbers.
I have tried a lot of examples and it seems that the second part of this expression always is going to be $1$? If it is true, $a$ must be $1$?

I thought in the book is mistake but, I found other resources that confirm version from book.

I cant handle it. What should I do to solve this problem?

Numbers from trial:

$a^{1034069683} = 1 \bmod 3465190093$
$a^{45900161} = 1 \bmod 95899459$
$a^{200001283} = 1 \bmod 490810459$
$a^{390810929} = 1 \bmod 890811619$


texts: 3DES uses EDE as it is backward compatible to single DES, but consider the following case $K_1$=$K_2$=$K_3$ which one is more secure EDE or EEE.


texts: Can an RSA encrypted message be altered?

texts:
Let´s suppose that I want to send an RSA encrypted message to Alice, so I use her public key. Such a message contains a number only. If Eve intercepts the message, is it possible for Eve to alter the encrypted message (the number) so that, when Alice decrypts it she gets twice the original number?

I can think of the following approach but it seems to me an innocent one.
Eve can intercept the message using sniffer software and watch the binary representation of the encrypted number. Eve can then right-shift this binary number (multipy by 2), replace it and route it to the final destination.

I will very much appreciate any comments.


texts: Most energy-efficient authentication protocol?

texts:
I am looking for a cryptographic protocol that is as energy-efficient as possible. I am talking about battery drain. Alice wants to do a mutual authentication with Bob. Maybe symmetric is good, maybe asymmetric with PFS is better. I am interested in knowing the best state-of-the-art, non-patented solutions for this issue.

It would also be nice to know which primitives for hashes, ciphers, groups etc. tend to be most efficent. The context is for IoT devices.

Thank you!


texts:
Since i cannot comment on questions, I give my own:

If a secret key encrypt algorithm can encrypt messages of arbitrary length and the encrypt algorithm is probabilistic then: suppose the adversary selects two messages of different length, $||m_0||=n$, $||m_1||=l$ and $n<l$. She gets back a ciphertext $c$. How can she tell which message was encrypted? Cause I thought that since the encryption is probabilistic the length of $c$ might as well be $n$ (which is not likely, but just to show that $c$ can have any length), while message $m_1$ was the one encrypted. Right? or very wrong?


texts: Homomorphic crypto allowing anonymous yes/no votes?

texts:
I'd need a crypto system allowing online yes/no votes but without revealing who voted what. Is a "partial" homomorphic crypto system what I'm after? Would, for example, Damgård-Jurik work in my case?

In my scheme there would be a server getting the votes and the server shouldn't see who voted what. However we can consider that the server shall not cheat: he won't modify the voting results. But the votes should still be anonymous.

If I need homomorphism, how does it work? Does each voter need to get the encryption from the previous voter? Or can the centralized server receive all the encrypted votes and then "mix" them himself and, once mixed, get the result?

How does it work it there are say, four voters: does the scheme break if only three people vote?

For example I played with the nice simulator here, which expects 8 voters. You can't put seven voters on that page: is this just an implementation detail of that site or is Damgård-Jurik expecting all the votes from a number of voters known beforehand?

Also the page shows who voted what, but it's not clear to me if it's for instructional purposes or if, when the vote counts happens, the votes aren't anonymous anymore.


texts: I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying function of my hash-based signature. But I'm not sure if it still makes sense to use SHA1 due to its vulnerabilities. Is there a scenario in which would be acceptable to use SHA1?


texts: Paillier cryptosystem, small integers and range of values

texts:
First, this a different take on my previous question: Pailler encryption of small integers to 32-bit integers

I have to encode small integers (range 0-50) using the Paillier cryptosystem. Those values will be encountered many times (100,000) in my dataset.

Version 1

I encode each of this 51 numbers with different r and therefore I get 51 different ciphertexts. The advantage of this method is that each time any ciphertexts are multiplied, e.g., MOD(c(1)*c(2),n2) I always get the same product.

The attacker knows that the range is small (<100) but looking at the 51 different ciphertext values, he can now guess that the range is 0-50 (0 is necessarily the smallest value). Does this make possible for him to actually get the plain texts from the ciphertexts?

Version 2

For each time one of these numbers are encountered in my dataset, I use different r. Therefore I now have 100,000*51 ciphertexts. Now it is impossible for the attacker to actually get the plain texts from the ciphertexts. But the problem is that each time any ciphertexts are multiplied MOD(c(1)*c(2),n2) I do not always get the same product [the plain texts 1 and 2 are encoded multiple times with different ciphertexts], although those different products will always decrypt to the same sum of plain texts.

Obviously, version 2 is more secure. But I would rather use version 1 for its simplicity and easier processing. Does the limited range of the values, makes cracking the Paillier cryptosystem easier?

Version 3

Let's put an intermediate version. For each value in [0,50] I use up to 10 (or more) different random values of r per value. Meaning that for plain text 0, I will get up to 10 ciphertexts. Overall, 51 plain texts => 510 ciphertexts. This should somehow limit the problems of version 1, without blowing up entirely.


texts:
In the article How Does the Blockchain Work? the writer makes the following statements:

Since only you should be able to spend your bitcoins, each wallet is protected by a special cryptographic method that uses a unique pair of distinct but connected keys: a private and a public key.
If a message is encrypted with a specific public key, only the owner of the paired private key can decrypt and read the message. The reverse is also true: If you encrypt a message with your private key, only the paired public key can decrypt it. When David wants to send bitcoins, he needs to broadcast a message encrypted with the private key of his wallet. As David is the only one who knows the private key necessary to unlock his wallet, he is the only one who can spend his bitcoins. Each node in the network can cross-check that the transaction request is coming from David by decrypting the message with the public key of his wallet.

Specifically this: If you encrypt a message with your private key, only the paired public key can decrypt it.
Is it true that you can encrypt a string with a private key and only the public key can decrypt it? I was aware of the reverse, obviously, but this just doesn't seem right.


texts: Is the post-quantum scheme quantum-resistant without regard to QROM

texts:
There are many "post-quantum" schemes have been proposed.
The security of most of them is only proven under random oracle model or uses forking lemma.
As described by Boneh et al. (Random Oracles in a Quantum World), post-quantum schemes should further consider the "quantum-accessible" random oracle (QROM).
However, many schemes that do not take QROM into account claim that they are quantum-resistant because their security is based on certain assumptions, such as LWE or SIS.
In addition, these schemes may only be proven under ROM and the security reduction depending on the time of Hash query.
So, are these scheme really quantum-resistant?
I have known that in some situation the ROM secure schemes can apply to QROM secure schemes (Survey on the Security of the Quantum ROM).


texts: How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?

texts:
According to wiki's definition of Bilinear pairing…

  Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A pairing is a map: $e: G_1 \times G_2 \rightarrow G_T$
  but, there also have different definition such that $G_1$ and $G_2$ be two multiplicative cyclic groups.

How is the decision made if $G_1$ and $G_2$ are two additive cyclic groups or multiplicative cyclic groups?


texts: Is it possible to prove the age of a document?

texts:
Suppose that I have a document and I want to build a proof, for the year of 2020, that this document existed in 2017. I could, for one, use a public blockchain - that is the only method I know for accomplishing this. Is there, though, a more compact and self contained method to achieve the same?

Solution sketch

I pick an inherently sequential hashing algorithm and build an ASIC for it that operates at provably near the thermodynamics limits. I keep "hashing" that document continuously, non-stop, until 2020. Then, at 2020, I publish the resulting HASH^N(document) value. Someone with an equally powerful ASIC will be able to verify my document indeed existed in 2017. The only issue is that it will take him another 3 years to do so. Moreover, if I want to prove that in 2030, a verifier would need 13 years and so on.


texts: Can Blake2 be a replacement for double SHA-256?

texts:
My previous question was closed because it was too open-ended, so let me simplify the question:
Is it a good choice to drop double SHA-256 and use straight Blake2 in a Bitcoin-like blockchain (more POS oriented so it's not a mining problem)?
I'm talking about Blake2 because I've read more about it than Blake3, so this question may even consider Blake3.
I don't want to clone Bitcoin but experiment with variations to see what can be improved at low level, so I want to keep it as simple as possible while maintaining at least the bitcoin security level.
Based on my research, it seems Blake2 hash computation is as secure as double hashing SHA-256, correct?
If I've understood correctly, double hashing SHA-256 is done to prevent length extension attack, as one can read here. That's prevented by default on Blake2. Read about it here.
Is this correct?
I'd like to see the performance difference between using Blake2 instead of double SHA-256, but I don't want to upend security.


texts: Public key cryptography - public key encrypts and cannot decrypt?

texts: I understand the basics behind public key cryptography, in that each party has two keys - the public one encrypts, and the private one decrypts. What I cannot figure out is, How does the public key encrypt and not decrypt, but yet the private key can decrypt?I do understand the possibilities of this, but, does anyone know what cipher can do this, and how does this practically operate?


texts: Is there a possibility to apply Moni Naor and Adi Shamir's "visual cryptography" on text ( paragraph)?

texts:
[Instead of two images I want to consider two paragraphs(text) when combined should give me a secret message]
In their algorithm, the image has been split into two component images. Each component image has a pair of pixels for every pixel in the original image. These pixel pairs are shaded black or white according to the following rule: if the original image pixel was black, the pixel pairs in the component images must be complementary; randomly shade one ■□, and the other □■. When these complementary pairs are overlapped, they will appear dark gray. On the other hand, if the original image pixel was white, the pixel pairs in the component images must match: both ■□ or both □■. When these matching pairs are overlapped, they will appear light gray.
What I would like to do is play around with text watermarking and use text instead of the image! So for images, you can consider pixel values similarly for text what can I consider and how can I similar idea (Algorithm) to the piece of text?


texts: elliptic curve multiplication with negative factor

texts:
I'm learning the multiplication operation on EC. From most material I can found, the multiplication $nP$ is just:

$$nP=P+P+\cdots +P+P$$
For negative factor, i.e. $(-n)P$, by above definition and the definition of $-P$, we can write $(-n)P$ as:

$$(-n)P = (-P) + (-P) + \cdots (-P)$$

My question is: is it possible to expression $(-n)P$ as $mP$ where $m>0$ under reasonable assumption? For example, we can assume the knowledge of the group order.

I'm asking so because $nP$ on EC is analogous to exponentiation in group $\mathbb{G}$ with order $p$. And in the latter case we have
$g^{-n} \equiv g ^{k\phi(q)-n}\pmod q, \forall k\in \mathbb{Z}$ by Fermat's little. So I'm wondering if there is a similar result for EC.


texts:
Generally, differential privacy adds noise to a query result, such as a sum or an average, in an interactive way.

Is there any way for implementing differential privacy such that noise will be added in an non-interactive way, record by record ?

Thanks in advance


texts: How do I apply differential cryptanalysis to a block cipher?

texts:
I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis.

I have a general idea that the application of differential cryptanalysis is to look at the difference between inputs; Wikipedia makes that fairly clear. However, I could take any two inputs for any given block cipher and I am pretty certain I'd be staring at random differences.

I am aware this is the idea of a well written block cipher; however, assuming a broken or vulnerable cipher (feel free to provide simple examples) how do I go about choosing differences to try?
Are there any clues in algorithm design that would inform a decision on which values to choose?
How does being vulnerable to differential cryptanalysis impact a cipher in the wild?
If all I have are differences between known plain-texts and known keys as my analysis and a captured ciphertext as my data to exploit, what can I actually deduce?


texts: I am looking for a comprehensive list of the IOC values of any or all classical ciphers. I can't find a list, only pieces. Each cipher has an average IOC value, and I was wondering if there was a comprehensive list of these values for every classical cipher available. Can anyone share a list of these IOC values?


texts: How do you distribute secret shares without knowing who to first distribute them to?

texts:
Figure 1 on page 1249 of the “Multiparty Computation Secure Against
Continual Memory Leakage” paper shows $m$ committees are elected in step 1 and then later in step 3 are each given a secret share.

But I was wondering if it is possible to pull out the election of $m$ committees from the pre-processing phase and do it in a different phase (like online phase)? The problem with the pre-processing phase is it is assumes no leakage so simplifying it is a step closer to completely getting rid of it.

I am essentially wondering if it is possible to distribute secret shares without knowing the committees (i.e. “don't run election protocol immediately, run it later”)?


texts:
Let PKE $\Pi' = (Gen', Enc', Dec')$ and it is secure in the sense of $S'$.
Let PKE $\Pi'' = (Gen'', Enc'', Dec'')$ and it is secure in the sense of $S''$.
$S'$ and $S''$ may be separation which means that $S' \not\Rightarrow S''$ and $S'' \not\Rightarrow S'$. For example, $S' = \text{IND-CCA}, S'' = \text{NM-CPA}$ or $S' = \text{OW-CCA}, S'' = \text{IND-CPA}$.
Let $\Pi = (Gen, Enc, Dec)$ be the double encryption such that
$Gen(1^\lambda) = (pk, sk)$

$(pk', sk') \gets Gen'(1^\lambda)$ and $(pk'', sk'') \gets Gen''(1^\lambda)$.

$pk = pk' \Vert pk ''$ and $sk = sk' \Vert sk''$.

$Enc_{pk}(m) = c$

$(pk' , pk'') \gets pk$

$c \gets Enc'_{pk'}( Enc''_{pk''}(m)) $.

$Dec_{sk}(c) = m$

$(sk' , sk'') \gets sk$

$c \gets Dec''_{sk''}( Dec'_{sk'}(m))$.

Is $\Pi$ secure both in the sense of $S'$ and $S''$?
In my opinion, it is true.

We define the CPA game of $\Pi$ against an adversary $A = (A_{1}, A_{2})$ as follows:

$(pk, sk) \gets Gen(1^\lambda)$
$(m_{0}, m_{1}, s) \gets A_{1}(pk)$
$b \leftarrow \{\, 0,1 \,\}$ and $c \gets Enc_{pk}(m_{b})$.
$d \gets A_{2}(c, s)$.

We say $A$ wins if $b = d$, and $\Pi$ is IND-CPA secure if $A$ has at most negligible advantage.

For example, if $S'' = \text{IND-CPA}$, assume there exists an adversary $A$ with non-negligible advantage against $\Pi$. Then we construct an adversary $A''$ against $\Pi''$ as follows:
$A''_{1}(pk'') = (m_{0}, m_{1}, s)$:

$(pk', sk') \gets Gen'(1^\lambda)$.

$pk = pk' \Vert pk''$.

$(m_{0}, m_{1}, s) \gets A(pk)$.

$A''_{2}(c, s) = d$:

$c' \leftarrow Enc'_{pk'}(c)$

$d \gets A(c', s)$.

We say that $A''$ wins the CPA game against $\Pi''$ if and only if $A$ would have won the corresponding game against $\Pi$. Thus $\Pi''$ is IND-CPA secure implies that $\Pi$ is IND-CPA secure.
If $S' = \text{IND-CPA}$, assume there exists an adversary $A$ with non-negligible advantage against $\Pi$. Then we construct an adversary $A'$ against $\Pi'$ as follows:
$A'_{1}(pk') = (m_{0}, m_{1}, s)$:

$(pk'', sk'') \gets Gen''(1^\lambda)$.

$pk = pk' \Vert pk''$.

$(m'_{0}, m'_{1}, s) \gets A(pk)$.

$m_{0} \gets Enc''_{pk''}(m'_{0})$ and $m_{1} \gets Enc''_{pk''}(m'_{1})$

$A'_{2}(c, s) = d$:

$d \gets A(c, s)$.

We say that $A'$ wins the CPA game against $\Pi'$ if and only if $A$ would have won the corresponding game against $\Pi$. Thus $\Pi'$ is IND-CPA secure implies
that $\Pi$ is IND-CPA secure.
Am I right? So I conclude that $\Pi$ is a little stronger than $\Pi'$ and $\Pi''$. If it is true, why is there no double public-key encryption scheme?


texts: Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?

texts:
The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only supports input size up to 2147483647 byte" (the message sounds API generic, but the implementation shows the check is specifically for GCM and some other alg don't have that limitation).

It's documented than GCM has a plain text limit at 64 Gb, but could it be that some of the parameters used in that implementation justify the limit to 2 Gb instead ?
The Bouncy Castle implementation doesn't limit to this size, is this expected ?


texts: CVE-2014-1295 (Apple's Secure Transport and Triple Handshake Attack)

texts:
Apple is releasing some updates today. They have not published the bulletins yet, but they are available here: https://gist.github.com/FredericJacobs/11189734.

In the writeup for CVE-2014-1295:

Security - Secure Transport
...

Impact: An attacker with a privileged network position may capture
data or change the operations performed in sessions protected by SSL

Description: In a 'triple handshake' attack, it was possible for an
attacker to establish two connections which had the same encryption
keys and handshake, insert the attacker's data in one connection, and
renegotiate so that the connections may be forwarded to each other.
To prevent attacks based on this scenario, Secure Transport was
changed so that, by default, a renegotiation must present the same
server certificate as was presented in the original connection.

How is it possible to run two instances of a protocol and get the same parameters? Wouldn't nonces specifically neutralize this attack?

(And sorry about the crummy tagging).


texts: Yaos Millionaire Problem: Why distance >= 2?

texts:
I'm  currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf

Alice and Bob want to know which of them is richer.
Let $j \in \{1, \cdots 10\}$ be Bobs fortune, and $i$ Alice's.
They share a public-private key pair where $E_A$ is the encryption with Alice's public key and $D_A$ the corresponding decryption function.

Here is Yao's roadmap:

Bob picks a random $N$-bit integer $x$, and computes privately the value of $E_A(x)$; call the result $k$.
Bob sends Alice the number $k-j+ 1$.
Alice computes privately the values of $y_u=D_A(k-j+u)$ for $u= 1,2, \cdots,10$.
Alice generates a random prime $p$ of $N/2$ bits, and computes the values $z_u=y_u \mod p$ for all $u$ ;
if all $z_u$ differ by at least 2 in the $\bmod p$ sense, stop;
otherwise generates another random prime and repeat the process until all $z_u$ differ by at least 2 ;
let $p, z_u$ denote this final set of numbers.
Alice sends the prime $p$ and the following 10 numbers to Bob:
$z_1, z_2, \cdots , z_i$ followed by $z_{i}+ 1, z_{i+1}+1 , \cdots , z_{10}+ 1$
the above numbers should be interpreted in the $\bmod p$ sense.
Bob looks at the $j$-th number (not counting $p$ ) sent from Alice, and decides that $i \ge j$ if it is equal to $x \bmod p$,  and $i < j$ otherwise.

I understand everything, but I'm at loss at step 4.
Why do the $z_u$ have to differ by at least 2?
What can Bob deduce from Alice's List, if that condition is not fulfilled?

Added 8.5.16:
I found that Bruce Schneier mentions that protocol in  "Applied Cryptography".
He writes:
"All the verification ... is to guarantee that no number appears twice in the sequence ... Otherwise, if $z_a = z_b$, Alice knows that $a \le j < b$'' (Schneier interchanged Alice and Bob and $i$ with $j$). But he does not explain, why the initiator of the protocol can deduce that.

One more idea: Maybe the condition is not needed for all asymmetric encryption schemes but only for RSA (the only one at that time?). But I cannot show that either.

Added 9.6.16

One more thought:
Let's assume, Bob gets from Alice a list that looks like:
[$w_i$] = [11,7,6,22,33,44,55,66,77,88], then he can argue as follows:

Opps, the list contains two elements having distance one (7,6)
Alice follows the protocol, so the $z_i$ differ by at least 2
So Alice, when calculating the $w_i$ must have incremented the smaller one of the corresponding $z$s
So [$z_i$] must have been [11,7,5,21,32,43,54,65,76,87]
So Alice's fortune equals 2

So I think, the distance condition is not only useless but dangerous because it removes entropy from the result set (and adds information).


texts:
In my application, I am trying to prevent counterfeit widgets from being used on our gadgets; think HP ink-cartridges. I will be doing such with UHF RFID tags embedded in the widgets.

Unfortunately, the environment in which the gadgets are used does not allow me to keep a database of every widget in existence. I am operating in a closed, non-connected environment. The gadgets will have a computer and RFID reader installed on them. And the widgets may be used across multiple gadgets and they are reusable for a certain, to be determined, number of cycles.

I'd like to use the unique Tag ID (TID) of each tag as the salt for a common passphrase. These will be used to generate a 32-bit hash which will then be used as the tag read/write enable field. I then want to use some other hash in the user memory as secondary assurance that the widget is indeed authentic. Possibly using some random number and/or the date/time. However, I'm not exactly sure how I'd do that across multiple gadgets without storing unencrypted, unhashed information on the tag.

I know my current plan is not fool-proof (and it won't be without a database), but I'd like to know if there's any other ways to make it stronger. The tags in question (Alien Higgs 3) do not have an onboard microcontroller or any other "smarts" with which to interpret data.


texts: In what ways does encryption differ from proprietary/secret compression schemes and codecs?


texts:
Sorry in advance if this question is silly.
Suppose we want to break RSA, that is find the message $m$ s.t. $c \equiv m^e \pmod n$
Now suppose we know an $x$ s.t. $c \equiv x^e \pmod n$. Could we use that information to somehow find $m$?


texts: AES encrypted data length using WebCrypto

texts:
What I'm trying to do is encrypt 16 byte packets of data using the 128 bit AES-CBC encryption provided by SubtleCrypto.encrypt() in a web browser.

What I expected to find was 16 bytes of encrypted data for 16 bytes of input.

What I actually find is 32 bytes of encrypted data for 16 bytes of input.

Specifically, 15 bytes of input produces 16 bytes of output, 16 bytes of input produces 32 bytes of output, and 17 bytes of data produces 32 bytes of output.

My question is, why does 16 bytes of input data produce 32 bytes of output?  I would have suspected that this might happen only with > 16 bytes of input data, not >= 16 bytes.

Save the following test code to a file and open with a web browser.

<title>WebCrypto encrypt test</title>

See console log.


texts: How to choose the integer m in the general number field sieve (GNFS)?

texts: Given an integer you want to factor $N$, GNFS starts by selecting a monic irreducible polynomial $f \in \mathbb{Z}[X]$ and an integer $m$ such that $f(m) \equiv 0 \text{ mod } N$. In practice, if $m$ is chosen first then $f$ can just be chosen to be the $m$-base expansion of $n$, which is simple to compute. But how is $m$ chosen relative to N?


texts: Homomorphic encryption for multiplication (AND) on bits only?

texts:
I am reading the Wikipedia article https://en.wikipedia.org/wiki/Homomorphic_encryption
and it lists unpadded RSA, ElGamal, Goldwasser-Micali, Benaloh, Paillier as possible partially homomorphic encryption (PHE) schemes.
Of these, only Goldwasser-Micali seems to be for bits and it is XOR-homomorphic. The other encryption schemes seem to be for group elements, and it seems like if you say you only encrypt 0 or 1 then the operations won't hold (because, e.g., $1+1 =2$ now).
Assuming that I only want to encrypt 0 or 1, is there a partial HE that can do ANDs (aka multiplication)? Or, is it only possible to do multiplication on a larger group?
I understand that many fully homomorphic encryption schemes do just work on bits, but then there's issues with noise growing/boot strapping. (Whereas, for example, multiplying two ElGamal ciphertexts together is a "clean" operation).
Is there a simple PHE that works on bits only and allows you to do an unbounded number of ANDs? Or is FHE required?
To try to give some context: what if there are $n$ people who are voting yes/no with 1 or 0 and you want to find out if the vote is unanimous for yes? I guess here there's some issue with having to do some sort of threshold decryption or multi-key encryption as well, and from my understanding from 2016/196 or 2017/956that makes the ciphertext be of size $n$ also, which seems like a big hassle for a simple operation. That's why I thought perhaps a PHE would be enough, and perhaps give you the chance of having smaller ciphertexts.


texts:
I'm trying to implement system for encrypted and searchable audit logs. The system will work in the following manner:

There will be an untrusted audit log server, where all the logs will be saved and which will return audit logs corresponding to search queries. The administrator of the system will generate a public key, that he will upload to the log server and private key, that he will store for later decryption and search.

Other systems will upload audit logs (for simplicity in the format "who did what and when") encrypted with the public key, which they obtain from the log server, alongside with keywords by which the corresponding audit log can be found. The keywords have to be also encrypted because the audit log server cannot be trusted.

At first, I thought the scheme can be implemented by "PEKS" introduced in Public Key Encryption with Keyword Search. However, I think it will be vulnerable for some statistical attacks because there will be an only a small set of keywords generated for log entries (please correct me if I'm wrong).

I also read Building an Encrypted and Searchable Audit Log but the scheme introduced there is not exactly what I'm trying to accomplish. I would use Secure indexes but the scheme uses symmetric encryption. Is it possible to create some kind of secure index that will use asymmetric searchable encryption?

Edit: For simplicity, consider semi-trusted server, it wont tamper stored data (it wont insert, edit nor delete stored audit logs)


texts:
How can I calculate the minimum number of active s_boxes for block cipher algorithms such as present algorithm?
I have read in that, but I couldn't understand the meaning of branch number.


texts: Is it OK to substitute a PRF for a random oracle?

texts:
Random oracles don't exist, but aren't PRFs essentially indistinguishable from them? So why can't we substitute pseudorandom functions wherever we use random oracles?

And if we can do this, why is there any controversy over substituting hash functions for random oracles, when we can instead use pseudorandom functions which do exist and are practically the same as random oracles?


texts: Security of Pohlig-Hellman exponentation cipher?

texts: I am looking into implementing Pohlig-Hellman exponentiation cipher and I would like to know how secure that algorithm is? I am guessing it's security relates greatly to the prime number used in it. Does anyone have some reference that might be helpful in determining the minimal prime number one should use in order to ensure the algorithm is safe enough for various applications?


texts: How is the SHA-1 collision detector so fast?

texts:
The google collision website shattered.it refers to a collision detector: https://github.com/cr-marcstevens/sha1collisiondetection.

It claims a false positive rate of $2^{-90}$ and to take less then twice the time of regular SHA-1. But the counter-cryptanalysis paper mentions that the false positive rate is $C \cdot 2^{-160}$ and it takes $C+1$ times longer then regular SHA-1 - and they suggest using $C=14$.

What am I missing? How many triplets does the detector use? Is there another paper explaining a more advanced technique that explains the performance?


texts: Is it possible to add error propagation to OTP?

texts:
What would be the recipe to add error propagation to a one time pad?
I.e. if I change a single letter in the clear text message, I want
the encrypted message to change starting from that letter and up to the
end of the encrypted message.


texts: How do unkeyed hash functions (for MDCs) provide security?

texts: Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash functions secure, when the message is encrypted with a known, open hash function and without a key?


texts:
Currently a program is loading some files from an untrustworthy source (e.g. a CDN) which could have been tampered with. It has a known SHA-256 hash of the file stored locally, then it downloads the file from the CDN and compares the hash before loading the file into memory.

Because most of the SHA2 family suffers from length extension attacks (except for the truncated versions) this SHA-256 hash seems inadequate for integrity checking files coming from an untrustworthy source. A clever attacker could embed some extra data in the file being downloaded, the program would receive the file, calculate it to be the same SHA-256 hash, unwittingly execute that code and compromise the program.

The program's source code is publicly available, therefore embedding a secret key for HMAC is not an option and would be too slow anyway. SHA3 library code is not currently available either. However the SHA-384 hash is not vulnerable to the length extension attack. Would the next best option be to use SHA-384 for this integrity checking? It would also match up with NSA's recent recommendation to use at least SHA-384.


texts: Deterministic outputs based on non-connected inputs

texts:
I am looking for a one way function that can generate outputs deterministically. However, revealing any of the inputs dont allow the person to generate other inputs.
E.g:
lets say we have a list of inputs: $i_{1},i_{2},i_{3},...$ that look completely random and a list of corresponding outputs: $o_{1},o_{2},o_{3},...$ that also look completely random which are each mapped by one way functions: $f_{1},f_{2},f_{3},...$
These outputs can be generated without knowing the inputs so anyone should be able to deterministically generate the outputs (perhaps by knowing a public shared data which is used in the function). But if one of these inputs is revealed, it should not reveal the other inputs.
If it is not mathematically possible, I need a proof for it.


texts: Why does FIPS 180-4 require the final padding block start with a 1?

texts:
From FIPS 180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length:

Suppose that the length of the message, M, is  bits. Append the bit "1" to the
end of the message, followed by k zero bits, where k is the smallest, non-
negative solution to the equation  + 1 + k ≡ 448 mod 512. Then append the 64-bit
block that is equal to the number  expressed using a binary representation.

A form of this question has already been asked before, and the answer seems to be that it's likely because MD5 did that, and MD4 before that. But while that explains why MD5, SHA-1, and SHA-2 do it, it leaves the initial question unanswered. What is the purpose of starting the padding with a 1? If the correct answer for the SHS is "because that's how MD4 did it", then why did MD4 do it?

For SHA-3 which does not use length encoding, the purpose is to eliminate ambiguity:

  The initial 1 bit is required so messages differing only in a few additional 0 bits at the end do not produce the same hash.

MD4, which has always employed length encoding, still seems to use this padding.


texts: Prover is going to convince verifier that 2 objects are distinct, do you know any Arthur-Merlin protocol for this problem?


texts: Say we have a PRG $G(l,x)$ that expands a random string $x$ to length $l$ and is pseudorandom for any $l$ polynomial in $n$ (where $n = |x|$). Is $G$ pseudorandom for any $x$ of arbitrary length? I'm slightly confused as to what the polynomial restriction means.


texts:
Digital identification using steganography, can it be broken?

I have read a few articles saying that using an I.D. embedded in video, audio, etc can help track down the origin of a copyright violation. OK, then they said it can't be broken, so I got that "I'm gonna do it, just to prove you wrong" feeling and here I am.

I know a little about video and images from working with the OpenCV library. I know OpenCV kind of simplifies things, but in essence an image is a matrix with each coordinate being a pixel, or rather a set of RGB values or a similar set of values representing the pixel's color.

So from what I have gathered, in steganography ia smaller piece of data is embedded through-out the image or video and is used for various purposes. Now, I am assuming that the data is spread out bit-wise within the RGB values of the image or even multiple images in a video, which could be used to identify the source of a copyright infringement. That's all fine and good, just don't tell me I can't break it.

So say in theory I was going to pirate a movie. If I ran the the video and each frame through an algorithm that would add or subtract a random value within a given range that would not distort the quality of the video beyond an acceptable amount, that should completely distort the hidden I.D. — correct?

Would reformatting the image to a format that used something other than the simple RGB values in each pixel also aid in distorting the I.D. beyond recognition?


texts: Can I use PGP key for RSA /AES encrpyption

texts:
My client provided PGP public key for data encryption. Can I use any OpenSSL [RSA or AES or any encryption] APIs to encrypt the data with this key?

What are the different types of keys available for asymmetric key encryptions?
Is it possible to convert keys from one format to another?


texts:
This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation?

For example, if I have the IV value 69dda8455c7dd4254bf353b773304eec (hex-encoded), what would be the result of $IV+1$?

I think that we must consider $IV$ as a hex number by itself and add the $1$ hex number (in general, add the $L$ hex number), but I’m not sure. I hope that someone can help me understand this.


texts: AES-XTS does not guarantee data integrity, like AES-GCM for instance. So, in order to support data integrity it is necessary to add some MAC functionality to it. However, adding an independent MAC, for instance like HMAC, requires additional calculations over the whole encrypted block. Is there a standard way to calculate a MAC over AES-XTS block in a more efficient way?


texts: Simple but secure hand cipher for a computerless world

texts:
this is my first time posting here, so please be gentle! As may be obvious, I'm an amateur who knows very little cryptanalysis.

The goal

I've been playing around trying to make a simple but strong-enough cipher for a fictional world without electricity - like Middle Earth, say. Actually, even better: imagine it is post-apocalypse, so there are still modern-day crypto books, but no computers.

This means that it should be a "hand" cipher, quick to compose, usable for short messages, and hard to attack other than by brute force. Solitaire, for example, is too time-consuming and error-prone to be worth the security in such a scenario. As I figure it, about 20 bits of entropy would be plenty.

The proposed cipher

My thought is basically a much-simplified VIC cipher: use a straddled checkerboard to convert the message to numbers, and then add it (mod 10) to a pseudo-random stream of numbers. The simplest way to get the number stream seems to be lagged Fibonacci - seeded by a secret number key plus a random serial number embedded in each message. (See worked example below.)

It seems very quick to do, and easily teachable - but is there some easy attack besides brute-forcing? If necessary it could be complicated by keying the straddled checkerboard, or even by adding double-transposition in between. But would that be necessary? I couldn't find anything on cryptanalysis for lagged Fibonacci PRNGs - but maybe I'm missing something?

Worked example

So to encode "PLAIN_TEXT" we straddle

  0123456789
  NO-EAT-SIR
2 BCDFGHJKLM
6 PQUVWXYZ#_

to get 60284 80695 36556 (pad with as many of '6969' as needed).

Then we get the seed for the lagged Fibonacci PRNG by adding (mod 10 per-digit) the secret key 92994 and per-message serial number 16747. The result is 08631. (The secret key here is 16.6 bits of entropy, and the period for a 5-digit seed is almost always more than 780 digits from what I can tell.)

Add the first digit of this seed to the second, the second to the third, and so on, continually appending to the end as you go:

08631
-----
84949
23331
56646

Finally, add the generated numbers to the straddled numbers:

60284 80695 36556
84949 23331 56646
----- ----- -----
44123 03926 82192

and add the serial last (or at some agreed spot) to get the ciphertext 44123 03926 82192 16747.


texts:
In the original NTRU proposal from 1998, it says on page 16:

It may be worth mentioning, though, that there is a simple. masking technique that can be used to significantly reduce message expansion. With this approach, Alice sends a pair of polynomials $(e_1, e_2)$. The first polynomial is the encryption $e_1 =r_1 \cdot h+r_2 \mod q$, where $r_2$ is a randomly chosen polynomial with all coefficients equal to -1, 0 and 1. The second polynomial is $e_2 =r_2 \cdot h+ m' \mod q$, where $m'$ is the plaintext message in a suitable digital envelope modulo $q$.
Since Bob can decrypt $e_1$ to recover $r_2$, he is able to recover $m' \mod q$. In other words, at the cost of doubling the length of the encrypted message to $2 n \log_2 q$ bits, Alice is able to send to Bob a $n \log_2 q$ bits of information. In principle, this reduces message expansion to 2-to-1, although the use of a digital envelope will naturally
increase message expansion.

Is this still possible in the current instantiation of NTRU?


texts: Google is using RC4, but isn't RC4 considered unsafe?

texts:
Why is Google using RC4 for their HTTPS/SSL?

$ openssl s_client -connect www.google.com:443 | grep "Cipher is"
New, TLSv1/SSLv3, Cipher is RC4-SHA

Isn't RC4 unsafe to use?


texts: Goofs that could creep in ECDSA signature verification?

texts:
What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test cases for these, and how (perhaps with distinction between various degrees of blackboxness)? How relevant is that in practice (risk of accepting an invalid/forged signature, or rejecting a valid one)?

I'm disregarding as off-topic the ASN.1 formatting checks, and the hashing; and consider that nothing is secret, hence side-channel leakage is a non-issue (the question would be much harder for ECDSA signature generation).

That leaves at least exceptional cases in modular reductions (be it modulo $p$ or modulo the curve's group order $n$); the possibility to hit the point at infinity/neutral element; validating inputs are on the curve, and other input checks.


texts: Maximum value of negligible probability?

texts:
We can see on many papers for cryptography that there are many uses of negligible probability to ensure something (security, correctness, etc).
How can we say that some probability is negligible?

I want to know the maximum value of negligible probability.
In other words, if we have a some probability $1/k$ for some $k$.
What is the minimum $k$ that provides negligible probability?

Thank you.


texts: TLS handshake proof of private key posession

texts:
At what stage in below TLS connection setup did the server prove to client that it possesses the private key corresponding to its public RSA key.

I have used TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Cipher suite to successfully setup a server client mutually authenticated connection. I am just curious how it works. I have a rough idea about Diffie Hellman key generation(I believe it is independent of authentication, and just for generation of secret to create symmetric key) but I could not understand in below sequence diagram, where did the server prove its possession of private key(I know that only private key decrypts what public key encrypts, but any hacker could send a copy of public certificate of any server)


texts:
On paper, it sounds *very* good to me:

secure
fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested, which were ECB, CTR, CBC, OFB, CFB written in order of performance (link to benchmark code) )
simple to understand
does not require padding (which I guess significantly reduces the chance of implementing padding in an insecure manner)
support parallelization (for both encryption and decryption)
support random access

.. the only disadvantage I can think of, is that because it does not require padding, implementations in practice will probably reveal the exact message length, as compared to revealing circa-message-lengths (e.g. padded schemes may reveal something like the message is within 15 bytes of this length, while non-padded schemes may reveal the message is *exactly* this long), and if that's a concern, it's not like it can't be mitigated by just adding padding anyway.
I guess I'm missing something, so...
What are the disadvantages?


texts: I'm working with openssl cryptographic libraries, I'm new to all these cryptographic stuffs and slowly I'm learning all these. I have a doubt regarding random number generator, I'm using RAND_pseudo_bytes() for generating a pseudo random number. I'm providing a seed to it with my required entropy. But my doubt is if we provide same seed twice, will the random number generator generate the same random number ?


texts: Robust stream cipher using AES encryption block

texts: I am implementing a stream cipher in a microcontroller that only has an AES128 encryption block. According to this page, a block cipher based on an encryption only module can be converted into a stream cipher using CFB, OFB and CTR modes. Assuming I have a unique IV, which is the most robust method to use?


texts: Impact of super-polynomial extractors on the security of a zero-knowledge proof

texts:
Interactive zero-knowledge arguments are proven to be secure in three parts:

completeness (the verifier accepts if the prover is honest)
soundness (a dishonest prover cannot convince a verifier)
zero-knowledgeness (the proof does not leak any information to the honest verifier)

Soundness is usually proven using some kind of extractor: by rewinding the protocol, often multiple times over, the verifier can send multiple challenges, and can in the end compute the witness that the prover is holding.
This talk by Benedikt Bünz mentions that there is a problem with the extractor of the original Bootle, J. et al. 2016 protocol (the predecessor to Bulletproofs): the extractor runs in super-polynomial time.
What is the impact of the super-polynomial complexity of an extractor? Is the mere existence of an extractor not enough to show that the prover has to hold a witness?


texts: Can we use a pseudorandom function in both models of a simulation based proof?

texts:
Assume in the real model a party blinds a fixed element $b$ as: $v_i=r_i\cdot b$, where $r_i$ is a output of pseudorandom function. So we give $v_i$ to a semi-honest adversary.

Now we want to sketch the proof and we want to show that we can generate the adversary's view in the ideal model that is computationally indistinguishable from its view in the real model.

So we pick a value $b'$ and blind it as $v'_i=r'_i\cdot b'$, where $r'_i$ is a output of the same pseudorandom function but using a random (distinct) key. We give $v'_i$ to the adversary.

We want to say that $v_i$ and $v'_i$ are computationally indistinguishable.

Question: Is the above simulation correct? In general, can we use pseudorandom value in the ideal model (rather than truly random value)?


texts: Does DES support different keys that lead to the same result?

texts:
While bruteforcing a ciphertext, I've found multiple keys which produce the same result.

Mode is DES with ECB and PKCS5 padding.
ciphertext is TXcmk8KwIPxTHR45zAIGJPEFYj6dsgVOGseZnMcedCOhl/Qp5a8Qig==
keys are used: {      !*}, {       +}, {       *}

The tried keys are delimited by brackets {} and white space included.

The ciphertext will be decrypted as 'Does DES had multiple key for Enc/Dec?' with these keys..

tested at http://8gwifi.org/CipherFunctions.jsp and with pyDES(https://pypi.python.org/pypi/pyDes/)


texts: Does a hash function necessarily need to allow arbitrary length input?

texts:
I always assumed that a hash function allows input of arbitrary length, since that's what all the hash functions I was aware of did. Wikipedia's definition of a hash function is as follows:

A hash function is any function that can be used to map data of arbitrary size to fixed-size values.

However, some functions like bcrypt, which label themselves as password hash functions, define a maximum size input length (in the case of bcrypt, 72 bytes). This seems like a contradiction, and has lead me to come up with two possible explanations:

Password hash functions, although similar in name, are not hash functions.
Arbitrary length inputs is not a strict requirement for hash functions, merely a common feature.

As such, I would like to know how to resolve this apparent contradiction. Is it necessary for a hash function to allow arbitrary length inputs or not?


texts: IES: What security has the asymmetric primitive to provide?

texts:
I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash of some random element which can only be recovered by the legitimate owner of the private key and the sender.

Now Bernstein et. al. "recently" proposed the code-based public key encryption system they call "McBits". McBits works similar to McEliece, meaning you introduce some random error into a "message" which only the owner of the private key can recover as only he has the necessary recovery "tools". In application the system chooses some random valid vector, uses the hash of this as key for Salsa20/Poly1305 and introduces the errors. The receiver can then use the decoding and the authentication check for integrity-confirmation. In their paper Bernstein et. al. claim McBits has IND-CCA2 security, however, I don't see any formal proof for this in the description of the PKCS.

I think that the IND-CCA2 security comes from the fact that they're using the KEM/DEM construction.

Hence my question:
What security assurances does the asymmetric primitive have to provide in order for the whole integrated encryption scheme (IES) to be secure?


texts:
I'm fairly new to cryptography and am starting to understand this weird art of Mathematics and theory. One thing I am trying to understand and do is encrypting a plaintext into ciphertext using AES in ECB mode. For example, I want to encrypt the following plaintext: "Lucozade".

Would be great if someone could help me out with this as I am not sure how to integrate AES in ECB mode.


texts: Appropriate scrypt parameters when generating an scrypt hash

texts:
What values for CPU, memory and parallel difficulty should be used when generating an scrypt hash? i.e.

$N        The CPU difficulty (must be a power of 2, > 1)
$r        The memory difficulty
$p        The parallel difficulty

I'm using the PHP PECL extension from here to generate my scrypt hashes. Is the following usage slow/secure enough?

Password::hash('ThisIsAnExample');

This produces the following hash:

16384$8$1$pl5s1ZnqC4g=$ba6a283f818789bb2b5dcf1d0fcf73b916f44d18ee52ea517c4d788f6e1d02e5

Also, how can I find the appropriate parameters that my hardware can afford for?


texts: Append text to file without decrypting & encrypting again

texts:
Is it possible to add a line to a file which is encrypted symmetrically or asymmetrically (private key refers to readkey below, public key refers to append key then) without decrypting it?

I was thinking about s.th. like:

msg1="hello"
msg2="world"
appendkey=...
readkey=...
file=touch(...)
addLine(msg1, file, appendkey)
addLine(msg2, file, appendkey)
ERROR=decrypt(file, appendkey)
WORKS=decrypt(file, privkey)

Then the WORKS equals to:

hello
world

The idea is, that various number of people can add s.th. to a file without seeing its content. Only the owner of the file can decrypt it once to see all lines (he/she should not decrypt all the lines individually for performance reasons). For me this scenario typically sounds asymmetrically, thats the reason why I thought that there could be a mechanism to use the public key to append s.th...


texts: What is the purpose of ISAAC's randinit() function?

texts:
I am a relative crypto noob; please aim your answers accordingly. :)

I'm planning to port the ISAAC CSPRNG algorithm to modern C++. I'm looking at Bob Jenkins' reference implementations: http://burtleburtle.net/bob/rand/isaacafa.html

As I understand it, ISAAC has an internal state (mm) of ~259 uint32s, and it uses that state to produce a block of 256 uint32 outputs (randrsl) at once. Producing that block of 256 outputs is the job of the isaac() function.

But in Jenkins' reference implementations there is also a function called randinit(). It looks like this function takes in a user-provided 256-word seed and initializes the mm array with a scrambling of the user-provided bits. The code to scramble these bits is 2x or 3x the length of the code for isaac() itself.

Apparently Jenkins' original paper on ISAAC claimed that it "has no bad initial states, not even the state of all zeros."(secondhand source)

The randinit function seems to pre-date by more than a decade Aumasson's 2006 paper that claims to identify many weak initial states; so I deduce that it is not the case that randinit was introduced in order to avoid those particular weak states.

So why go through all this extra scrambling — if Jenkins believed that there were no bad states, why did he not copy the user-provided seed directly into the mm array? Or, why not use ISAAC itself to do the scrambling, by copying the user-provided seed directly into mm and then discarding the first few thousand outputs of isaac()?


texts: Hash 22 byte secret into 512 bit hash: Full entropy?

texts:
Does it make sense to hash a 22 byte secret (which may not have full entropy since it is chosen by the user) into a 512 bit hash (using Keccak-512)?

More precisely, will the 512 bit hash have full entropy even though the input is only 22 bytes?


texts: How can CBC-MAC be secure when message length is fixed?

texts:
I was doing some self-initiated knowledge gathering about digests, signatures and hmacs and I ran across the fact that you can use CBC as a MAC, but if the message size is not fixed; then it is not secure.

In layman's terms why is this so?  Lets say that Johnnyboy has sent a message to QueenElizabeth such that a being the MAC and m being message (m consists of three blocks).  If an adversary saw the transmission, the data would look like $(a,m)$ in this particular instance.

The adversary would not know the key used in the CBC-MAC algorithm (it is still unknown), but it is known that the tag which is $a$, message $m$ and the number of blocks.

How could the adversary generate another valid MAC value $a'$ for $m'$ if $m'=m_1||m_2||m_3||m_1 \oplus a||m_2||m_3$ without knowing $K$?  and how would fixed length solve this?

From what I understand, all you need to do is take $m_1 \oplus a \oplus a$ which would result in $x_1$ then concatenating the rest - $m_2 || m_3$ - would result in $a' == a$ because the last block would be the same as the output from $m_1.

Lastly, to prevent this attack, the application or system receiving the transmission should check for a specific sized message in order to prevent this existential attack, but I am also guessing this is only secure when message blocks == 1?


texts: Some questions about the internals of bcrypt

texts:
I'm attempting to get a better understanding of cryptography and have run into some questions about bcrypt.

Bcrypt relies on the blowfish cipher, which is a reversible method of encryption. But bcrypt is not reversible. How is that possible? Or am I mistaken? What does bcrypt do on top of blowfish to make it irreversible?

Why does bcrypt use blowfish instead of twofish or threefish?


texts:
Which one these alternatives using authentication and encryption will solve this multiple-user database problem?

I'm trying to understand the field of cryptography, so I've started reading a textbook on the subject.

An exercise at the end of a chapter of authenticity asks the following:

I've got a strong feeling that the second alternative is not safe under the security policy / threat-model, but I'm not sure.

Can someone help me justify this, or give an argument on which one of the two alternatives fails?


texts:
https://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-20/#sec-ECKeyValue talks about ECDSA but even the explicit curve parameter stuff won't work with Ed25519 as Ed25519 has a completely different equation with different equations for point doubling / addition, etc.

Does the XML signature standard support Ed25519?


texts: Is there a way to authenticate users online without knowing their real identity yet preventing them from registering twice? If not, what is the least amount of information you would need? If it helps, you may assume the user has a smart phone and you have access to all its sensors. Probabilistic guarantees are quite acceptable (e.g., 1-$\epsilon$ certainty of uniqueness for small $\epsilon$).


texts: Is it actually possible to secure data with gpg DSA keys?

texts:
I think GPG is difficult to understand . All the different versions and policies and algorythms . But today I got really confused . I tried to create a 3072 bit DSA key ( which as far as I undestand DSA can only be used for signing ) and encrypted some data with it . And well ... It worked .
So here are my questions :

1) Why does The Digital Signing Algoryhtm encrypt data and why is this even an option in gpg ?

2) Is with DSA "encrypted" ( if it even is ) data secure ?


texts: What is DLf3072s256mRijndael cipher suite?

texts:
We have a Thales HSMS and upon going into the Cipher Suite, we have the DLf3072s256mRijndael cipher. What is this cipher and how does it work?

Is this an AES encryption? What does DLf mean? what about s256m?

The only information I can find is on here


texts: Why is double encryption used to generate EphIDs in DP3T?

texts:
The most famous proposed COVID-19 application is DP3T. In this app a user constantly broadcasts EphIDs generated from a secret key as follows:

$$EphID 1 || ... || EphID n = PRG( PRF(SK_t , “broadcast key”) )$$

where PRF is a pseudo-random function (e.g., HMAC-SHA256), “broadcast key” is a fixed and public string, and PRG is a stream cipher (e.g. AES in counter mode) producing $16 \cdot n$ bytes, which we split into 16-byte chunks to obtain the $n$ ephemeral Bluetooth
identifiers EphID of the day.

The secret key is composed of 32 random generated bytes, and changes everyday in following manner: $ SK_t = H( SK_t-_1 ) $

As I understand, $PRF(SK_t , “broadcast key”)$ is used as keystream to AES in counter mode. But what is the purpose of this? Why isn't the secret key $SK_t$ used as keystream?


texts: Zero Knowledge auth schemes with weak secret

texts:
In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no attack on the weak secret possible?

I mean the messages can be sniffed and with an offline dictionary attack or simply bruteforce it should be possible to reveal the secret.


texts: Encrypting a TCP connection between two unknown nodes

texts:
I'm writing an application for controlling computers from a client.

I'd very much like it if the connection is secure and only authenticated clients are allowed access.

The workflow will be something like this:

A client use decides to add the server
The server allows the client

Alternative 1; On the server screen a X digit code is displayed that the client has to enter.
Alternative 2; The server presents a dialog which the server user has to accept.

The client and server exchanges keys to remember each other.

I understand that this initial communication won't be 100% secure unless the user manually verifies it, what's important is that future communications are secure.

What are good ways to make this as secure as possible?
None of the data sent is ATM sensitive so as a worst case only authentication is required.

If possible I would like to use HTTP(S) as the protocol.


texts: How many messages needs to be send to server to get AES key in Cache-timing Attack

texts:
I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack.

I read both
D. Bernstein, “Cache-timing attacks on AES,” April 2005. Department of Mathematics, Statistics, and Computer Science University of Illinois at Chicago.
Robert G. Salembier, "Analysis of Cache Timing Attacks against AES"

But it doesn't give me the answer.
At the beginning Bernstein identified one byte of key after sending around 4,2 million 400-byte long messages. Attack described was done on the 128-bit AES key, and it required 32 million 800-byte packages, 32 million 600 byte packets, and 128 million 400-byte packets. But in conclusions (Future works) D.Bernstein write: "I wouldn't be surprised if the first million (2^20) 800-byte and 600-byte packets were sufficient to identify the key"

Additional information can be found in [7]. But there is still no direct correlation between key length and message numbers.

Is there any correlation ?


texts: A questions about SP 800-90A DRBG additional input

texts:
There is four inputs in SP 800-90A DRBG that is entropy sources, nonce, personailisation string, additional input.

I noticed the soundness of entropy_sources is most important thing for DRBG security and then nonce and last is  personalisation string.

I am wonder why additional input is needed? because entropy source is the key for security.

Here is my question

please give me an example of additional input for software cryptographic library (for linux, windows, anything..)
Is additional input is crucial to DRBG security?


texts:
May sound stupid to many, but I would like to have some pointers on what exactly is contained inside a private key. I have decent understanding of public/private keys/certificates (have created them many times) and their purpose but would like to take a step back and see what is inside them using a "dump" utility or something - Would I be able to see big prime numbers etc contained inside the private key?

Is there a utility to show me the "logical content" of the output of the following command as opposed to a bunch of ASCII characters?

openssl genrsa

generates

-----BEGIN RSA PRIVATE KEY-----
MIIBPAIBAAJBANdINmZY7VuoRy5VZYwnVIAE/0sd/HkaDVXfMNpwVeKo7K2XLC6U
jpnPFP2MaDEqxs0T6cKVMmt5FsNGyfdKbvcCAwEAAQJBAMGuPQrtPHY2uftsZtSl
2bbnSAr7qlYFYzP7fYc4g3xLWSc5viAe7KgsU7+jXNCqEvflf4iOxhCadUK07APG
…
-----END RSA PRIVATE KEY-----

Any pointers appreciated. Same question also applies to the public key btw..


texts: Why is the definition of Special-honest verifier zero-knowledge probabilistic?

texts:
Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$.

As found in the literature, $P$ can use a $\Sigma$-protocol for the relation $R$, defined as a 3-move protocol that satisfies the following properties:

Completeness.
Special soundness.
Special-honest verifier zero-knowledge.

My question is concerning the definition of the third property, which is the following:

Definition of Special-honest verifier zero-knowledge (as in the literature): There exists a polynomial-time simulator $M$, which on input $x$ and a challenge $e$, outputs an accepting conversation of the form $(a,e,z)$, with the same probability distribution as conversations between the honest $P,V$ on input $x$.

Clearly, the special-honest verifier zero-knowledge has a probabilistic interpretation (as noted in the part ``...with the same probability distribution as...'') and I wonder what the implications are of omitting it.

In other words, what would be wrong or how this could affect the protocol if the special-honest verifier zero-knowledge property was defined as follows instead?

Alternative (and possibly wrong, but I’d like to understand why) definition of Special-honest verifier zero-knowledge: There exists a polynomial-time simulator $M$, which on input $x$ and a challenge $e$, outputs an accepting conversation of the form $(a,e,z)$.

This other definition doesn't mention probabilities distributions, just the fact that the transcript generated by the simulator should be accepted by the verifier. To me, this implicitly implies that the generated transcript will have to have the same probability distribution as a real transcript (the one obtained from a conversation between a honest prover $P$ and a honest verifier $V$), otherwise the verifier wouldn't be accepting it. Or am I wrong? Do you know of any example in which this is not the case, i.e. the transcript generated by the simulator is accepted by the verifier but still it doesn't have the same distribution as a real transcript?

Any help or clarification with this will be very much appreciated.


texts:
Often in articles homomorphic encryption is praised as the holy grail of encryption for cloud storage. This is done by suggesting that it can do any computation, and as such could be used for encrypted databases.

Performance issues aside, this makes me very sceptical. If such a database is to be any useful you need to be able to do queries. I understand how these work and how you could do the tricks needed to transform a query into a circuit.

However such a circuit only does a modification on the data, but it does not reduce it's size. In fact, the only way I see you can get the results is by executing the circuit and returning the entire modified database.

So is it possible for homomorphic encryption to actually filter and return a small encrypted subset of a larger encrypted database based on a query?