texts: Where is master password for Firefox stored. Is this password is same as the master password asked for NSS?

texts:
While working on FIPS requirement. I found that there is a master password required for LibNSS to access all primary cryptographic module.

Similarly Firefox in FIPS mode also needs a master password although it is the password used to protect user credential information and certificates.

Keeping the fact in mind Firefox uses NSS, I am a bit confused. Both NSS master password and Firefox required master password are different or same.

I also want to know where this master password stored. Can I set it using a script ?


texts: what benefits quantum offer over classical parallelism

texts:
What is the benefits of quantum computing vs parallel processing using classical computer ?

Can classical parallel processors outperform  quantum computing ?


texts: How to select corresponding ciphertext in anonymous Identity-based broadcast encryption?

texts:
In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. It does not describe which user corresponds to which ciphertext part.
User $i$ should decrypt using the corresponding $r_i$ value. How do the users know about that?

In some cases, they use some function
$f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ to get $k$ by replacing $v_{i}^{'}$ in place of $x$.

In real implementation, how to define such kind of function for unknown $x$ for $n$ receivers.

Example paper: Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security (PDF) by Fan et al.


texts: Why does Diffie-Hellman need be a cyclic group?

texts:
Why is Diffie-Hellman defined on a cyclic group? Doesn't it work for any commutative operation which the inverse is hard to find?

Say Alice and Bob agree in a public prime $c$ and both choose a secret prime $a$ respectively $b$

Alice sends $ac$ to Bob and Bob $bc$ to Alice.

Alice then multiplies $a$ with bobs message $bc$ yielding $abc$
Bob then multiplies $b$ with Aice's message $ac$ yield $bac$

which are the same due to commutativity and associativity. Hence they now share a common secret $abc$.

It is hard for Eve to factorize $ac$ and $bc$ into its original primes $a,b,c$  and Eve hasn't got enough information to construct $abc$  so why isn't this a valid Diffie-Hellman key-exchange?


texts: Why are only lattice problems used in cryptography?

texts: There are thousands of NP-hard problems out there. Why have only lattice problems been applied to cryptography?


texts: Change a secret key in an embedded device

texts:
There is a device that uses a secret key Sk to encrypt data.
Assume this Sk is compromised.

Could the following scheme be considered safe, in case we want to change the compromised Sk:

We store some secret random number in the device- SRN.
The new secret key would be equal to Sk = SRN xor RN, where SRN is the stored in the device secret random number (we know this number), RN is some random number that we send to the device when we want to change the Sk.


texts: In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric algorithms. Having read about the meet-in-the-middle attacks here and there I am a bit worried that if I chain, say RSA with ECIES (and why not add an ElGamal?), that I would somehow be undermining my own efforts or  just doing an exercise in futility. Would such a system be more secure over the long-run (i.e. 30 years) than just going with one asymmetric encryption scheme?


texts: How many oracle calls to break an affine cipher in a chosen plaintext attack?

texts: Assuming the ability to launch Chosen Plaintext Attacks (CPA), how many oracle calls does an attacker need to break the affine cipher? How does it work?


texts: SSTP MSCHAP-V2 Authentication before SSL or after SSL Session

texts:
So with the recent news that there's a lovely new tool to crack MSChapV2 packets.

So the question I have is on a SSTP Connection is the MSChapv2 handshake encrypted pre SSL setup or post. Obviously if it was pre then packets could be stolen, if it was post then thats at least an additional layer of security.

I did ponder over whether this should be stack-overflow, server fault or cryptography. I think cryptography is the best place for it...


texts: Can a hash of the original plain text file be used to brute force an encrypted copy?

texts:
I have encrypted files stored on a public cloud, in the same directory on the cloud I have the sha256 hash of the files before they were encrypted in a text file.

The keys used to encrypt the files are stored locally. Is it plausible that someone after downloading the files could use the original hashes to help brute force the encryption?

I am thinking that it would provide no advantage but I just wanted to check.


texts: How could an offline app verify a signature from one of many private keys?

texts:
I have a situation where an offline app needs to be able to verify whether some data was created by a set of privileged users of the app. These privileged users will each have one private key of some sort that can be used to sign this data. Any user (privileged or not) must be able to verify that the data came from a privileged user.

I'm not sure what the number of privileged users is going to be, but for the sake of discussion we can assume it will be no more than 100,000. And the app being offline means it can't rely on connecting to a server to verify any data or update itself.

I know one possible way to do this with public-key cryptography would be to generate all of the needed public/private key pairs ahead of time, include all of the public keys in the app itself, and give each privileged user one private key. Then signed data from privileged users could include some metadata that identifies which public key should be used to verify its signature.

However, I'm not sure what the security implications of that method is. I'd also like to keep my app as compact as possible. If I used 2048-bit RSA encryption then the size of 100,000 public keys would be just under 25 MB. In this day that's not too bad but it'd be nice if that space requirement wasn't there.

So my two questions are:

Are there any significant problems with the above approach?
Is there a cryptography method available that would allow me to do the above without needing to include so many public keys? Ideally it would also a) allow a practically unlimited number of private keys to be generated after the app is released, and b) not have the signatures be anonymous, though neither of those are strictly necessary.

I'm also open to alternative approaches for accomplishing what I'm after. My understanding of cryptography is admittedly not so deep so I may be missing or misunderstanding something.


texts: Is security against semi honest adversary inheritable?

texts:
I have a two party protocol, let's call it $M$. At some point, there are $k$ steps, each one involving an oblivious transfer protocol, which is known to be secure against semi honest adversaries. These OT protocoles have independent input and outputs for different steps. Also, I have shown that $M$ is semi-honest if the parties ignore the inside states of each OT protocol.
Can I say that $M$ is also secure against semi honest adversaries? Or do I have to include in the view of each adversaries the 'tape' of values involved inside the subroutine OT protocol?

Is it possible to give an answer that does not depend on how OT protocols work. For instance, lets say that a protocol $P$ uses independent instances of $M$ as a subroutine, and suppose $M$ is in fact secure against semi-honest adversaries. Can we say $P$ is secure against semi-honest adversaries?


texts: Discrete logarithm problem in subgroup of index 2. ElGamal

texts: I need some insight for the following problem in ElGamal encryption procedure. It is stated that ElGamal problem in a group $\mathbb{Z}_p^*$ becomes easier in subgroups. Assume I have a subgroup of index 2. Can you explain how is easier the discrete logarithm problem in this case?


texts:
How much more entropy gives a Hardware Random Number Generator or True Random Number Generator compared to a Pseudo Random Number Generator?

I know it depends on which TRNG is used, but I'm thinking in general. Does a TRNG generally provide more security than a PRNG?


texts:
I've to prove that RSA still works with a public key $(e,pq)$ where p is a prime and q is a Carmichael number such that $q<p$ and $\gcd(e,(p-1)(q-1))=1$
I know how RSA works wiht $p,q$ primes but when $q$ is not a prime how can I prove that
$$M^{(p-1)(q-1)n}\equiv 1 \mod{pq}$$
with $n$ integer and $\gcd (M,pq)=1$.


texts: Does clustering the AES Sbox look up table to 32 bit entry per index, help reduce vulnerability to cache timing attacks?

texts:
I've been searching for some, easy methods to help mitigate, a cache timing attack on software AES implementations.

Currently, my implementation uses, a usual 256 byte S-box

uint8_t sbox[256] = {0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30... /* and so on*/}

My goal as a developer, is to prevent/increase difficulty for an attacker to know the substitutions or the result of substitutions as a result of the AES SubBytes() operation.

This is a solution that I devised:
Rather than using a 256 entry Sbox table, I decided to cluster the Sbox table into a 32 bit per entry table, where four bytes are grouped to form an unsigned  integer, like this:

uint32_t sboxu32[64] = {0x637C777B, 0xF26B6FC5,  /* and so on */}

Now if I want to get the S-box substitution, for a byte x : I do ExtractByte(sboxu32[x>>2], x&3)
where, ExtractByte is  :

#define ExtractByte(x, n) (uint8_t)(((x) >> (24 - 8 * (n))) & 0xff)

Now, this is my reason for doing this, hoping that the above modifications will help protect my implementation from cache timing attack, without impacting my performance.

For every access to the entry of sboxu32, I'm accessing the index x>>2 which is the truncated  division of x by 4, Assuming that the attacker does not have any knowledge of x&3 , can the above modifications increase the difficulty for the attacker ?
If the attacker knows x >> 2 , then there are 4 possibilities for the exact x and hence x&3 , Since AES operates on 16 byte blocks, I'm guessing the attacker would have to guess $4^{16}$ for the correct sequence of bytes.

I realize that it is trivially brute forceable, but are there
    other    methods,  to, use this as a starting point, to build
    further    camouflage my access to the actual sbox substitutions,
    without impacting performance?

Are there better performance friendly methods to mitigate side channel attacks on my AES implementation ?

Every help will be greatly appreciated!


texts:
I investigated the IPsec Protocol.
I am wondering if I can remove/reduce any field to save space,
is there a way to save overhead in ESP packages?


texts: How to decrypt a simple substitution cipher where space is also encrypted by a character

texts:
I am trying to decrypt a text data encrypted with a simple substitution method with 2 steps. First, shift the alphabet of the source text by a few characters.

For example, if we shift by 2 characters, Hello, world! becomes Jgnnq, yqtnf!.

Secondly, Substitute space (" ") with a lower case alphabet.
For example, when g and " " are to be replaced, Jgnnq, yqtnf! becomes ultimately encrypted to J nnq,gyqtnf!. Now, I am having trouble with finding which character is used to replace " ". I was thinking of using the character with the highest occurrence frequency (except e, since e has the highest frequency in the English language). But I found that it may not work always.

Does anyone has any idea how to


texts: Should I use ECB or CBC encryption mode for my block cipher?

texts: Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?


texts: What is the difference between any secret sharing scheme and arithmetic secret sharing scheme

texts: It looks like that only difference between two of them the variables. But it does not make sense for me and I could not find exact definition of arithmetic secret sharing scheme. I mean what exactly this is? (Most of you understand that I am really new in these stuff.) Thank you.


texts: I watched some videos from Khan Academy explaining the algorithm for RSA encryption/decryption. They explained that there are two trapdoors, modular exponentiation being one and prime factorization being the other. Is this true though? As the videos went on it made it seem like prime factorization was what made the inverse of modular exponentiation difficult to solve. Did I misunderstand something, or is modular exponentiation just a naturally difficult problem to compute?


texts: Why doesn't the GCM spec use a more efficient multiplication algorithm?

texts:
NIST SP 800-38D § 6.3 Multiplication Operation on Blocks describes a multiplication algorithm that, in my testing, appears to be a good amount slower then algorithm 2.40 (arbitrary reduction polynomials) in the Guide to Elliptic Curve Cryptography.

My question is...why? Does the algorithm described in NIST SP 800-38D provide better protection against timing attacks?


texts: Can you explain to me how permuted congruential generator XSL-RR-RR works?

texts:
I found note about XSL-RR-RR on wikipedia:
https://en.wikipedia.org/wiki/Permuted_congruential_generator
But I don't understand what this means:

count = (int)(x >> 122)
low64 = rotr64((uint64_t)(x ^ (x >> 64)), count)
high64 = rotr((uint64_t)(x >> 64), low64 & 63)
return (uint128_t)high64 << 64 | low64

What is difference between rotr and rotr64? What is "int"? Is rotr64((uint64_t)(x ^ (x >> 64)), count) doing rotr64 by count steps (am I understand it right)? What is "|"? And what is "uint64_t"? At least I understand "^", "&" and ">>".
Is XSL-RR-RR eliminate low bits periods known from typical LCG? As I understand that's why it was invented.


texts: What should an identifer in the client-server model?

texts:
I am fairly new to cryptography and I am trying to understand this picture here. I have some questions regarding this picture.

What should be an identifer for a side? For example, in the picture, it says that A sends an identifer with a nonce to B. Should I just set a fix alias for each side, something like String ID_A = "ID_A"?
Would AES make sense here, or would RSA be better?

Again, I apologize if these questions do not make much sense, but I am new and trying to grasp the idea.

EDIT: I have updated some further details.


texts: I am currently reading a paper titled "Another view of division property" and encountered the terms "Affine subspace" and "Linear subspace". I am new to the field and having some difficulties to understand the topics. Can anyone describeb or give any reference about it so that I can read that.


texts:
Let $(w_1,\cdots,w_l) \in (\{0,1\}^\lambda)^l$, and  $r_1,\cdots,r_l $ are  chosed as uniformly random from $Z^*_q$ such that $r_1+\cdots+r_l=0$ and $q$ is a large prime number. Also,  Let $F$is a pseudorandom function with key $k$. What value apear in place "?" in below relation (in o.w. part )?

$Pr[F_k(w_1)\cdot r_1+\cdots+F_k(w_l)\cdot r_l=0] :=
\begin{cases}
   1 & \text{if } (w_1=w_2=\cdots=w_l) \\
   ? & \text{o.w.}
 \end{cases}$


texts: Why can't I use ECB with some obfuscation for transient RAM?

texts:
I understand that ECB does not hide data patterns well. But my understanding is that it cannot be broken to "know" the underlying message. If that was the case, why can't ECB be used with some obfuscation technique like say XORing with the address? I am talking about data stored in DRAM modules - and assume it is not an image data that gives away the information just by its pattern (as is explained in the Wiki page for block ciphers).

If let's say it is some software code and I obfuscate the AES output by XORing the AES output with the address - or some combination of the address, does it still make the data in the DRAM insecure?


texts: The title of the protocol and explanation of the steps required

texts:
The secure third party R generates key $k_1$ to communicate with A and $k_2$ to communicate with B.

A requests a key with which to communicate with B.

R generates k un and encrypts:
$E_{k_1}(k) = s1;\ \  E_{k_2}(k) = s_2; \ \ E_{k_2}(p_A) = s_A$
R sends to A $\ s_1$ and $[s_2, s_A]$.

A deciphers his key:
$E^{−1}_{k_1}(s_1) = k$

and sends to B $[s_2,s_A]$

B deciphers:
$E^{−1}_{k_2}(s_2) \ \ $(the key is received);
$E^{−1}_{k_2}(s_A) = p_A$. (B knows that he is communicating with A).

First, I would like to know the title of the protocol. Secondly, why the third party cannot send the block $[s_2, s_A]$ to B right away, why A is the one that sends it?


texts:
For my use case, I need to maintain a secret key with the client to generate and verify HMAC for requests.

We can have multiple clients and we can not make assumptions such as a client's server will always reside in EC2.

I am considering envelop encryption for our secret keys using AWS KMS.
I have the following concerns:

Secret key will be transferred over the wire as plain text to be encrypted and after decryption by KMS, is this a safe practice?
We will need to store AWS credentials in plain text on servers (our server as well as client's) to call KMS, how is it better than storing the secret key itself? (Given that we could share the secret key once, say in a registration successful email)


texts:
Came across this concept on while reading up on the key-encapsulation protocol SIKE but haven't been able to find a good explanation of what a known answer test is formally.

What is a known answer test, and why is it useful?


texts: ElGamal signature - show that $(\gamma, \delta)$ signs $m$

texts:
We have as a given: $gcd(j, p − 1) = 1$.

$$γ = \alpha^i \beta^j \bmod p $$
$$ \delta = −\gamma j^{-1} \bmod (p−1) $$
$$m = i \delta \bmod (p − 1)$$

I want to show that $(\gamma; \delta)$ is an ElGamal signature for message $m$.

In this book, they show an example:

How can I take the proof that $(\gamma, \delta)$ signs $m$?


texts: security of a block cipher mode of operation

texts:
Consider the following block cipher mode of operation:
\begin{align}
tag_0 &= mac\:key\\
plaintext_0' &= plaintext_0 \oplus iv\\
E(tag_0 | plaintext_0') = C_0 &= tag_1 | ciphertext_0\\
E(tag_1 | plaintext_1) = C_1 &= tag_2 | ciphertext_1\\
...\\
E(tag_N | plaintext_N) = C_N &= tag_{N+1} | ciphertext_N\\
cryptogram &= tag_{N+1} | ciphertext_0, ciphertext_1, ... ciphertext_N, iv\\
D(tag_N + 1 | ciphertext_N) &= P_N = tag_N | plaintext_N\\
D(tag_N | ciphertext_{N-1}) &= P_{N-1} = tag_{N-1} | plaintext_{N-1}\\
...\\
D(tag_1 | ciphertext_0) &= P_N = tag_0 | (plaintext_0 \oplus iv)\\
\end{align}
$tag_0$ is then validated against the mac key.

An explicit description, which demonstrates using a 128 bit block cipher (i.e AES) and 64 bit tag:

the the first block of a message that is encrypted consists of a mac key,
denoted as $tag_0$, concatenated with the first 64 bits of plaintext
$plaintext_0$ is xor'd with an IV
the block $(tag_0 | plaintext_0)$ is encrypted
the first 64 bits of $ciphertext_0$ are used as $tag_1$ for encrypting $plaintext_1$,
this is repeated for the entire message
The cryptogram consists of the final tag prepended to the ciphertext, and the iv
Decryption is the same process with the messages in reverse order, and
the tag validated against the mac key at the end.

Does the described mode of operation provide integrity and authentication of the plaintext?

Assuming so:

Does it have a name already/is there any established research?
What is the minimum acceptable value for the tag size? My guess is 64 bits.
Too much larger would seem to preclude usefulness with ciphers that have a
block size of <= 128 bits.
With a 128 bit block cipher, performance is 2 two block cipher operations
per 128 bit block of plaintext, which could be better
The number of block cipher operations would appear to become more
efficient with a larger blocksize + longer messages?

The ratio of required block cipher operations per block of plaintext appears
to be given by: \begin{align}blocksize / (blocksize - tag\:size)\\
\end{align}

Edit

Astute commentators have pointed out the construction is similar to the way a
sponge provides authentication. This is certainly not a coincidence! I have
been studying the sponge construct for a while. The tag in the mode of
operation described here fulfills a conceptually similar role as the capacity
of a sponge function does.


texts:
Please refer to this secure index paper. On page#6, a trapdoor is defined as

Trapdoor(Kpriv, w): Given the master key  Kpriv = (k1, … , kr) and word w,
output the trapdoor for word w as:     Tw = (f(w, k1), … , f(w, kr))

Can someone please explain it to me using an example?

Let's say we've a word hello for which we want to generate a trap door. So, do I first encrypt it with k1 and then take its hash. And do the same with key k2, k3 etc. Once we have all the hashes, simple concatenate them. Is my understanding correct?


texts: How much time to generate a proof in ZK-snark?

texts:
I know that zk-SNARK takes in range of milliseconds to verify statements. But what about the time to generate the proof. For example, if I have a circuit that tests the There is key s.t H(key)=s

Thanks for anyone offers help in this question since I need an answer to it urgently in my thesis.


texts: What is the right tool to MPC linear equations system

texts:
Given two parties who have private inputes

Player 1 - $X_1,...X_n$
Player 2 - $Y_1,...Y_n$

We want to compute a solution to a linear system equation:

$f_1(X_1,...X_n,...Y_1,...Y_n) +h_1(X_1,...X_n)+g_1(Y_1,...Y_n) = 0 \bmod p$

...

$f_{2n}(X_1,...X_n,...Y_1,...Y_n) +h_{2n}(X_1,...X_n)+g_{2n}(Y_1,...Y_n)= 0 \bmod p$

where $f_i$ are a linear function for  $1 \leq i \leq 2n$

What is the best (MPC) tool to compute the solution of that system between the two parties, in the semi-honest adversry model?
- I appreciate a survery of approaches to that kind of question.


texts:
A function $f$ is a worst-case OWF if there is no adversary $\mathcal{A}$ such that $$\forall x,Pr[y=f(x): f(\mathcal{A}(y))=y]=1$$

A weak OWF is a function that the probability of inverting it is bounded by some $1-\frac{1}{q(n)}$ for some polynomial function $q(n)$. The question is suppose $f$ is a weak OWF, can we define a function $g$ that is a worst-case OWF but not a weak OWF?

My idea is to make $g$ easy to invert for (exponentially) most inputs. This make $g$ "weaker than" any weak OWF. For example, consider $$g(x) = \left\{\begin{array}{ll}0 & x < 2^{|x|}-1 \\ f(x) & \text{otherwise} \end{array}\right.$$

Clearly $g$ is weaker than any weak OWF. But how can I show that no adversary can always invert $g$ then?


texts: Computing Logarithm using homomorphic encryption

texts:
Let's say we have $Enc_{pub}(a)$, the encryption of an integer $a \in \mathbb{Z}^*$ under the public key pub with a Homomorphic encryption scheme that supports both addition and multiplication.

Is there an efficient way to compute $Enc_{pub}(log(a))$?

I tried with Taylor Series approximation, but this one won't work unless we have the Taylor  series of $log(x)$ about a point $b$ that is very close to $a$, which we cannot afford given that we don't know the value of $a$.


texts: Why group signature based CL signature is in "sign-encrypt-prove" paradigm

texts:
In this paper, it referred that there are two paradigms used in constructing group signatures: the "sign-encrypt-prove"(SEP) paradigm and "sign-randomize-proof"(SRP) paradigm.

As said in this paper, SEP paradigm is

  Here, a signature is an encrypted membership certificate together with a signature of knowledge, where the signer demonstrates knowledge of some signed value in the ciphertext

SRP paradigm is

  Essentially,they use a signature scheme which supports (1) randomization ofsignatures so that multiple randomized versions of the same sig-nature are unlinkable, and (2) efficiently proving knowledge of asigned value. In their construction, on joining the group, the issuer uses such a signature scheme to sign a commitment to the user’ssecret key. The user can then produce a group signature for a mes-sage by randomizing the signature and computing a signature ofknowledge on the message, which demonstrates knowledge of thesigned secret key.

In my understanding, if using the non-randomized signature scheme to construct group signature scheme, maybe I should follow "SEP", otherwise(using the randomized signature scheme), I should follow "SRP", because in this way I just need to prove the knowledge of signed secret key in the signature, which is easier to prove than that in "SEP".

However, when I read the group signature proposed by Camenisch, J., and Lysyanskaya, it said that it followed "sign-encrypt-prove" paradigm. The CL signature has re-randomize property, why it doesn't seem to follow the "sign-randomize-proof" paradigm ? In other paper proposed by David Pointcheval and Olivier Sanders, it first proposed the similar randomized signature like CL and followed "SRG" paradigm to construct group signature(concrete construction in Appendix A).

And if CL-group signature indeed follows the SEP, why does it only encrypt the group member public key but not the certificate? That seems to contradict with the SEP as well.


texts: Threshold signatures vs. certificate authority+voting verification

texts:
Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes:

$(t,n)$-threshold signature with a trusted dealer, i.e. the dealer generates a public/private key pair, broadcasts the public key, and distributes shares of the private key to n parties such that any subset of t parties can generate signed messages. The verifier possesses the dealer's public key and signed messages are verified the usual way with the dealer's public key.
Certificate authority method: A trusted dealer generates a public/private key pair for itself (call it a CA), broadcasts the public key, and for each of n parties, generates a key pair $P_i,S_i$, signs the public key $P_i$ with the dealer's private key, and distributes the signed key pair to that party. Each message $M$ can be signed by a subset of the parties (i.e. each party can sign $M$ with their private key $S_i$ and also attach $P_i$ and the dealer's signature of $P_i$)
The verifier possesses only the dealer's public key, and can verify signed messages by checking that $M$ is signed by $t$ distinct keys, and that each of those keys is signed by the dealer.

Right now I'm mostly confused when one would use scheme 1 (threshold cryptography) when scheme 2 seems more practical. I like the theoretical elegance of scheme 1, but it seems difficult to justify.

Possible advantages of scheme 1 that I can think of:

Slightly smaller final signatures and slightly simpler verification
The verifier can be ignorant of $t$ (or $t$ can be hidden) or even that more than one party signed
$t$ parties can usually recover the dealer's secret key if needed (this could also be a disadvantage)
'Forward revocation' can be done without knowledge or participation of verifier; the dealer can distribute new shares of the same private key (in case some old shares were compromised)

Possible advantages of scheme 2:

Fairly simple to implement with any crypto library
The dealer can send a key revocation list to the verifier, ensuring that all signatures from a malicious party can be removed after the fact
The verifier can choose $t$ (or change $t$ at any time)
Infeasible for all parties to recover the dealer's (CA) secret key
Possibly less interaction needed between parties

Of course the situation could change without a trusted dealer, as well.


texts:
I wonder if it's possible to have a peer-to-peer group chat protocol, where anybody is free to join the chat and broadcast with a chosen username to all others who have joined it, but with a strong anonymization property.  The property desired is that it is impossible, or at least difficult, for a man-in-the-middle to determine which IP address is associated with each username in the chat.  To be clear the man-in-the-middle is able (like anyone else) to join the chat and observe everything being said, and he can also be assumed able to monitor all transmissions of at least some members of the chat.
Naturally, the timing of packets could give away who is who, so it would be necessary for all users to be sending packets at regular intervals to hide which users are actually speaking.
If the chat system uses a server, the man-in-the-middle can be assumed to have access to the server.  So it's no good to simply encrypt all messages between each user and the server.
I'm thinking about a scheme where users are constantly passing "pieces" of messages between each other, and trying to assemble pieces into completed messages by XORing recent pieces, in a way that it's not clear who first sent all the pieces required for a message.  Each peer to peer link could be encrypted with the recipient's public key.
However, the man-in-the-middle may be free to create as many users as he wishes, which might defeat this scheme.  If man-in-the-middle users greatly outnumber other users, then the man-in-the-middle can trace most of what's going on.
Is it possible?


texts: Is padding of the digest needed in SHA256 with RSA-2048 scheme?

texts:
For a signing scheme involving generating a $256$ bit digest using SHA256 followed by RSA with $2048$ bit modulus, the signature would always be 256 bit without padding even though signatures of up to $2048$ bits are allowed in the RSA scheme that follows.
As such, is there a need to pad the $256$ bit digest to improve security?


texts: Authentication and encryption using a simplex communication channel

texts: Is it possible to authenticate a client with encryption on a simplex communication channel without the use of authoritative root certs?


texts: Optimal compression ratio in compression function

texts:
So we'll have a transform that maps any of $A=2^a$ possible inputs to $B=2^b$ possible outputs. $a$ is generally fixed as the number of bits in the input, and $b$ is determined by the transform used. We'll name the difference $d=a-b$.

There's 3 main groups:

$d$ is large and the output is much shorter than the input - we see this in SHA1, SHA2 and a lot of other hashes like it, where they use it to absorb blocks.
$d=0$, so it's bijective. As far as I know SHA3 is the only hash that does this, and it has a large hidden internal state. Side question, for cases where there isn't some extra internal state, it being bijective implies it's reversible, which is quite bad for hashes right?
$d<1$ is small and the output is the same length as the input - a compression function, the interesting one and the one I'm concerned with. Around what value of $d$ should I aim for? Some considerations are obvious, like keep $d$ very small if the transform is iterated such as in a password hash, but otherwise I'm at a loss. Of course we can't just choose $d$ since it's based on the transform, but we can design the transform and pick constants to get $d$ around the desired value. So what order of magnitude should $d$ be? Maybe $d\approx a^{-\frac{1}{2}}$?

Main purpose of this is for hashing. I was going to try making my own hash.


texts: Question about proof of knowledge definition

texts:
I am just reading the "soundness" definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ of his knowledge of a secret value. The idea is to define a knowledge extractor $K$, which can calculate the secret. They write

  There exists a constant $c > 0$ and a propabilistic oracle machine $K$ such that for every interactive function $P$ and every (public) $x$, machine $K$ satisfies the following condition:

  If $p(x) > \kappa(x)$ then, on input $x$ and access to oracle $P_x$, machine $K$ outputs a string from the set $R(x)$ (i.e. the secret) within an expected number of steps bounded by $\frac{|x|^c}{p(x) - \kappa(x)}$

$p(x)$ is the probability that prover $P$ convince $V$ to accept on input $x$.
$\kappa(x)$ is the probability that prover $P$ convince $V$ to accept on input $x$ but $P$ doesn't know the secret.

I don't understand why they write $\frac{|x|^c}{p(x) - \kappa(x)}$?

1.) Ok, $p(x)-\kappa(x)$ is the probability that $V$ accepts and $P$ really knows the secret, but what does $|x|^c$ mean? It is a polynomial relationship, right, but e.g. why they use the absolute value of $x$.

2.) What it the "result" of the term? They write it bounds the number of steps but $p(x)$ and $\kappa(x)$ are probabilities.

Can someone please give my some hints on how to "read" this term?


texts: Authentication tag length and post-quantum security

texts:
The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum security.
A 256-bit authentication tag offers 128-bit collision resistance, but it's not clear whether that's sufficient for post-quantum security due to use of the MAC key (typically the same key size as the tag length - e.g. 256-bit for a 256-bit tag).
I've never found the security level of MACs to be explained well. Does the key mean a shorter tag length is safe? Or is the tag length still crucial for achieving a high security level?


texts: Given a certain entrophy per character, how long should a passphrase be to guarantee key strength?

texts:
Given an entrophy of 1.5 bits per character, how long does a passphrase have the be to guarantee a key strength of a 128 bit random key?

Assuming an alphabet of 26, one character takes log2(26)=4.7 bits to be represented. Given this entrophy of 1.5 bits per character, can one simply answer this by:

(128/4.7) * 1.5 = 40.85

Meaning that the passphrase will have to be 41 characters long to guarantee key strength?


texts:
https://iopscience.iop.org/article/10.1088/1742-6596/978/1/012116/pdf

Each operation performs a nonlinear function on three of a, b, c,and d.

      F(X,Y,Z) = XY v not(X) Z
      G(X,Y,Z) = XZ v Y not(Z)
      H(X,Y,Z) = X xor Y xor Z
      I(X,Y,Z) = Y xor (X v not(Z))

So MD5 Algorithm is nonlinear?


texts:
I have a customer with an existing ticketing system that generates tickets for events like theaters, movies, football and so on.

The information in each ticket is encoded in a 16 decimal digit numeric string. The information contains fixed positions for event date, event identifier, seat row, seat number and so on.
This system has a numeric barcode on each ticket with room for 20 decimal digits. (https://en.wikipedia.org/wiki/Interleaved_2_of_5)

The main problem is that it is too easy for adversaries to generate false tickets with valid barcodes.

My customer now wants to encrypt the information in the barcode to make it more difficult to generate false tickets.

The requirements are as follows:

The plaintext is a 16 decimal digit (0-9) string.
The ciphertext is a 20 decimal digit (0-9) string.
Consecutive ticket numbers might differ only in a single digit position in the cleartext, the ciphertext for consecutive tickets must still be completely different.
It should be impossible to calculate the encryption key even if you have access to many valid tickets.
The encryption key is the same for all tickets for a certain event.
It must be difficult for an adversary to generate a valid ticket number, especially for a specific event.
Barcode readers used for validating tickets should work completely offline - it is not possible to have a complete database of valid ticket numbers available to the barcode readers.
Note that the 20-digit encrypted barcode after decryption must contain the full 16-digit plaintext. This means that we only have room for a 4-digit hash.

What kind of encryption and authentication should we use in this case? As I see it, the main problem is that the space in the barcode is very limited, so we can not use a real HMAC.

Any suggestions?


texts: How to generate safe primes in a verifiable way?

texts:
FIPS 186-3 (APPENDIX A: Generation and Validation of FFC Domain Parameters)
specifies how to generate Finite Field Cryptography Domain parameters and how to perform an explicit domain parameter validation. These parameters consist of the set of values: (p, q, g {, domain_parameter_seed, counter}).
The Standard specifies the following bit lengths of p and q:

p: 1024, q: 160

p: 2048, q: 224

p: 2048, q: 256

p: 3072, q: 256

I would like to generate FFC Domain parameters when p is 2048 and q is 2047 bits (p=2q+1). Is there any way to adapt the methodology proposed in FIPS 186-3 to these bit lengths? or is there any way to generate safe primes in a verifiable way?


texts:
I want to know whether the following problem is considered as a hard problem in complexity theory or not?
Given $g,g^a,g^b \in G_1$ (for unknown $a,b\in \mathbb{Z}_p^{\ast}$), compute $e(g,g)^{ab^2}\in G_2$.
If yes, could you please help me to know the name of this problem in the literature?


texts: Can I encrypt user input in a way I can't decrypt it for a certain period of time?

texts:
I run a baseball league and would like to do silent auctions for free agents.  This would require teams to enter their highest bid and the highest bidder at the end of the auction period would win.  Unfortunately, my league, my code, my server, I have access to the information if I choose to look at it.  I'd like to not put myself in that position and have that information available.

Is there any way I could encrypt the inputed data so that I can't unlock it for a specific amount of time (2 days)? Is this possible?

An alternate way of doing it would involve md5'ing the users input, but that would require them to come back and 'unlock' their bid.  I don't like this b/c if a player gets injured after their bid, they'll 'forget' their bid and not unlock it...

I'm running LAMP/LAPP.

UPDATE - Solution (for my case...)

To answer the question of league trust, there are three factors.

will I cheat?  the smallest issue I actually have b/c I don't think I will
will the league think I cheated?  it doesn't matter if I do if them thinking I do causes an issue
if a donut is sitting on the table you can choose to not eat it, but you'd rather it not be sitting there.  even if you can restrain yourself, it isn't always pleasant to do so.  I'd like to think I wouldn't actually cheat, but don't want to have to restrain myself.

Solution:

It seems there isn't a good general solution to this problem.  Several of the solutions required a fair amount of technical knowledge from the majority of the league, which unfortunately, isn't the case - but there are 2 other programmers in the league.  Here's what I'm settling on:

I'm extending the auction from 2 days to 3 days.  I'm going to bid in the first day and md5 my bid with a salt "jibberish-text-salt-3.5M" and display that encrypted text on the auction page.  I won't change my bid after that, others can bid over the next 2 days.  At the end of the auction, I'll post my salted bid so the other programmers can confirm I haven't cheated.  Anybody else that is concerned can learn to use md5, I feel I've done enough to keep myself honest at this point.

Without being able to change my bid, and being forced to bid early, I'm at a slight disadvantage - a player could get injured, etc.  To even this out, I'm instituting an option for me to appeal to the league that my bid be canceled should something huge happen (since I would wait until the last minute otherwise to prevent this from happening).  The league will then vote on it.  There's also the possibility that someone I'm not interested in gets nominated and then 2 days later I gain interest (promoted to Closer for instance).  This can't really be accounted for, so I'm just going to risk it for the sake of the league...

Thank you all for your suggestions.  They didn't work for me in this exact situation, but I learned a lot in the process and was exposed to some new interesting ideas.

I'm going to accept mgorven's answer as I feel the trusted 3rd party approach is the most correct general use case solution.  I'm not sure what the protocol is for this...


texts:
I'm reading up on the ideal cipher model and can't wrap my head around some basic calculation.

Let $E$ is an ideal cipher with $n$-bit key and $n$-bit block. For each key $K$, $E_K$ is random permutation chosen uniformly random from the $2^n!$ of them. My question is, given an ideal cipher, and $q$-queries to it: $(m_i, E_K(m_i))$ for $i\in[q]$, what does it leak about $K$?

For any given $q$ mappings $\{ m_i \to E_K(m_i) \}$, there are $2^{n-q}!$ permutations that respect the mappings. So $E_K$ could be any one of them. Does this mean those $q$ queries leak nothing about the key?


texts: Risks of full length KCV (components and full keys)?

texts: We have to comply with third-party security requirements for the loading of 3DES keys. I'm a little confused about the reason behind why Key Check Values (KCVs) can't be full length. As KCV are hashes, I'm wondering what the security implication and risks are?


texts: Can I discard a specific X509 signature from file?

texts:
I'm writing a program to sign files using X.509 certificates and .NET framework classes. My users can sign the same file more than once without any problem (like a revision process). So, a file may contain one or more signatures.

I'm using the CMSSigner class and I don't encrypt the file. I just sign it.

But now a user asked me the following: "By mistake I signed a file and I would like to take off my signature from that file. Can I do this?"

I see no problem when the file has only that one user's signature (only one X509 certificate within). But I'm not sure if I can unsign the file if it has many signatures there. The routine that I use to strip a signature from a file picks the original data and, in that case, I lose all of its signatures.

So, using .NET classes (X509Certificate2), can I just delete the user's signature from that file, without loss the other certificates there?

Thanks for any help.


texts: Advantages of Montgomery Ladder-based Scalar Multiplication

texts:
I do not quite understand what the greatest advantages are of using the Montgomery ladder algorithm for scalar multiplication?

Can someone help me out?


texts:
This question is a generalization of this old, unanswered question.

Suppose we're given a strong PRP $E:\mathcal K\times\mathcal M\to\mathcal C,(K,M)\mapsto C=E(K,M)$. Suppose further we pick a constant parameter $S\in\mathcal M$.

Is $F_S:\mathcal K\to \mathcal C, X\mapsto E(X,S)$ a secure one-way-function?
If the above is not answerable: Is $F_S$ at least a secure OWF for practical purposes?

As example instances one can imagine $S=0^{128},E=\operatorname{AES}$ or $E$ being a fixed-key AES instance within an Even-Mansour construction.


texts: Password in first line of file for AES-256 encryption

texts:
I'm using openssl with aes-256-cbc encryption to encrypt a file. The password is on the first line of the file and the encryption script automatically reads the first line of the file for encryption. Is this procedure secure? OpenSSL stores the salt at the first 8 bytes of the file.

The file looks like this:
1: randomly_generated_password
2: data
3: data
...

And the command to encrypt the file is as follows:

openssl aes-256-cbc -a -salt -in data.txt -out data.txt.enc -k 'head -n 1 data.txt'


texts: Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors?

texts:
In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter.

Why is it so? Order of $g$ has to be large, otherwise, the discrete log would be easy. But I couldn't see any other reason why the order of $g$ should have a large prime factor. And why should it be at least $2k$ bits long (instead of $k$ bits long)?

It also says the private keys $a$ and $b$ should also be $2\text{k}$ bits long. They should be large, otherwise, the discrete log would be easy. But why should they be $2\text{k}$ bits long, instead of $\text{k}$ bits long?


texts:
Consider RSA public-key encryption with public modulus $N=3953$.

Suppose we know that the public keys $e_1=337$ and $e_2=23$ correspond with the decryption information $d_1=3385$ and $d_2=2663$. That is: $e_1d_1=e_2d_2=1$ mod $\phi(N)$ and $m^{e_1d_1}=m^{e_2d_2}=m$ mod $N$, for all integers $m$ that are relatively prime to $N$.

How do I find the prime factorization of $N$ from the above information? I want to find the prime factorization without any brute-force method.

I have noticed that $m^{e_1d_1-e_2d_2}=1$ mod $N$. I have also noted that $e_1d_1-1$ is a multiple of $\phi(N)$. Does this say somehting about the prime factorization of $N$?

Edit:

$gcd(e_i,\phi(N))=1$ and $e_id_i=1$ mod $\phi(N)$ by assumption, for $i=1,2$.


texts: Deciphering text encrypted with a changing cipher

texts:
I know there are many ways to crack basic ciphers were each letter is mapped to some other letter, but what ways are there to decode something that was encrypted using a cipher that changed after every letter, in a way that is based on the letter just coded?

For example, imagine using a Caesar cipher where the number of letters the alphabet was shifted over changes by $n$ after every letter coded, where $n$ is the position in the alphabet of the letter just encoded.

That would seem to null the efficacy of observing letter frequency, double letter patters, common short words, etc.  How would a code like this be cracked?

Sorry, I might have been unclear.  The Caesar cipher was just an example, but say that the positions shift over $f(n)$ letters instead of just $n$, how would $f(n)$ be determined?


texts: Meaning of epsilon in proving a PRG is predictable/ un predictable

texts:
I am quite confused, I have been following a course on crypto provided by Dan Boneh, this is the lecture I am confused with - https://www.youtube.com/watch?v=EjWap3szsPk time stamp 8:58 - 11:00

I don't understand the meaning of epsilon in this situation, I know epsilon is a symbol in math that is used for a positive number approaching 0.

What does he mean by the PRG is predictable if the probability is greater than 1/2 + epsilon for some non negligible epsilon?

if someone could explain this in a little more dept and in more laymans terms if possible would be greatly appreciated.

transcript - we say that G:K -> {0,1}^n is predictable if

∃ "eff" algorithm A and ∃ 1 < i < n-1 s.t

k <- K pr[ A(G(K) |1,...., i =  G(K) | i+1] > 1/2 + ε for some non negligible ε

we say that G is predictable if there exists a efficient algorithm A and there is some position 1 between 1 and n-1 such that we look at the probability that we generate a random key, if I give this algorithm the prefix of the output (the first i bits of the output) the probability that it's able to predict the next bit of the output is greater than half + epsilon for some non negligible epsilon.


texts: What is the threat to a PKI when the root CA certificate is generated using SHA1?

texts: We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our purposes what exactly is the threat to our infrastructure if our root CA certificate was signed using SHA1?


texts:
I am reading this paper Toward Secure Multikeyword Top-k Retrieval over Encrypted Cloud Data.

I am trying to work out an example of the FHEI (Fully homomorphic Encryption over Integers) scheme mentioned on the paper, but unable to prove it. Can anyone explain the scheme with a working example?

Edit 1: I am unable to understand how to choose value of $r$ for equation $(pq + r)$. I am getting expected solution when using $r = 0$, but any other value of $r$ in range of ($-2^ρ, 2^ρ$) gives incorrect solution.


texts: Multiple iterations of AES for key derivation?

texts:
The keepass password manager uses multiple rounds of AES for its key derivation, as described here.  I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common.  Essentially, the key derivation is:

key = sha256(password)
cipher = AES(random_seed1, ECB)
for i in number_of_iterations:
  key = cipher.encrypt(key)
key = sha256(key)
key = sha256(random_seed2 + key)

Is there a name for this kdf?  Are there other systems that use something similar?  I'm mostly interested in general background info on the above approach.  Are there any weaknesses in this approach?  It seems considerably simpler than pbkdf2 and bcrypt.


texts: Optimizing SHA-256 implementation for fixed input prefix

texts: Is it possible to optimize/precalculate some results in SHA-256 if the input starts with fixed values? My input is always 1111||message. Can I precalculate the 1111 in SHA-256 to save some cycles?


texts: Private Set Intersection using a subset of the larger set

texts:
Alice has a set $S_A$ with a low cardinality (say ~30k). Bob on the other hand has a set $S_B$ with a much higher cardinality than of Alice's (say ~100M).

We're trying to create a reduced cardinality set ${S_B}'$ which satisfies the following:

$(S_A \cap S_B) \subset {S_B}' \subset S_B $

Is there a way for Bob to sample $S_B$ (with some privacy preserving input from Alice) in such a way that the cardinality of ${S_B}'$ (say ~1M) is significantly smaller than  the cardinality of $S_B$?

Note: As the title of the question suggests, the purpose of the ${S_B}'$ is to implement a (lighter) Private Set Intersection (with associated data). Assume we can already do a PSE between $S_A$ and $S_B$; however due to the size of $S_B$ it's not feasible.

Due to the nature of the sets, both $S_A$ and $S_B$ can grow or shrink over time (but not dramatically); and we need to ensure forward-privacy (is this a term?), and assume this sampling and subsequent PSI will be applied periodically. Subsequent executions of this protocol should not undermine the privacy of $(S_A \cap S_B)$ or $S_A$ altogether.

One possible attack I can already see is:
For every execution of this protocol, if the elements in ${S_B}'$ would be selected randomly; intersection of different instances of ${S_B}'$ would converge to $(S_A \cap S_B)$. So the entropy(?) of ${S_B}'$ should be maintained consistently.

A good example dataset having this behaviour would be user ids being active on different systems over days/months.


texts: Is libsodium's `box` construct secure without additional manual padding of the plaintext before encryption?

texts:
I have read the following questions and answers:

How safe are Libsodium Crypto Boxes?
What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

However, neither of these discuss an important detail that caught my attention while reading the libsodium documentation on the padding API:

  Most modern cryptographic constructions disclose message lengths. The ciphertext for a given message will always have the same length, or add a constant number of bytes to it. For most applications, this is not an issue. But in some specific situations, such as interactive remote shells, hiding the length may be desirable.

As far as I can tell, this also applies to boxes, because they use a stream cipher, XSalsa20, under the hood. However, the docs for the Box API claim that:

  The _easy and _detached APIs are faster and improve usability by not requiring padding, copying or tricky pointer arithmetic.

I've also read in various places that unpadded symmetric key cryptography is not secure for several reasons (e.g. malleability caused by determinism). However, in the Box implementation, the asymmetric keys are not used for encrypting the plaintext itself, but for deriving the shared secret key for the XSalsa20 symmetric cipher.

Overall, this made me wonder whether the problem of padding is still relevant, and whether I should manually pad my messages before passing them to crypto_box_easy (and obviously, unpad them when they are returned from crypto_box_easy_open) for better security? I can't quite connect the dots, and I don't want to uselessly complicate the crypto code I'm writing either (because that in itself could grow the security attack surface).


texts: Attack on a Feistel Cipher given the key and half of the ciphertext

texts:
Consider a classical Feistel Cipher, with the round functions given and the keys used in the ciphering process.

Is it possible to reconstruct the original data if half of the ciphered text is given? Furthermore, is it possible to reconstruct the original data if less than half of the ciphered text is given?

What would be the complexity of these tasks?

Example:
Suppose that we have a text that "makes sense" (e.g. it belongs to a dictionary or some set $S$). Let's say that "Salsifis" is ciphered into "abcdefgh". Suppose that "efgh" is revealed as well as the keys. Can "Salsifis" be reconstructed other than using an exhaustive search?


texts: Is there any known differential-linear attack on full round DES? I couldn't found any and couldn't work on this due to time restriction.


texts: Is AES restricted to only 64 characters for the key/password?

texts:
I am wondering if AES only supports 64 character passwords?

When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters.

What determines the length of passwords I can use with AES?


texts: What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

texts:
I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing.
I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-efficiency at the cost of security, but will be at most 196 bits.
This article by IETF, describing the overhead of TLS, appears to state that the GMAC/MAC is 128 bits long - which I'll understand as an average value
-----------------------------------------------------------------
AES_128_GCM, AES_256_GCM
-----------------------------------------------------------------
Per-packet overhead (TLS 1.0, 1.1, 1.2)                  29 bytes
   TLS header                                             5 bytes
   Explicit Nonce                                         8 bytes
   GMAC                                                  16 bytes
-----------------------------------------------------------------

My first question is: If we're using the cyphersuite TLS_AES_128_GCM_SHA256; and GCM is using Encrypt-then-MAC (which appears to be always?) and is configured to use a 128-bit tag; and AES_128 is encrypting plaintext in blocks of 128 bits; then is GCM adding a 128-bit tag onto each one of those blocks (thus, halving the amount of cyphertext that can ultimately fit into the data payload of the L3 packet)? Or, is each tag XORed (or transformed in someway) into the next, to produce a single 128-bit tag (2) that is the result of all the previous operations?
The Wikipedia page for GCM repeatedly mentions "authentication", however it seems to be using it in place of "integrity" - ie. ensuring data hasn't been manipulated/corrupted in transit. I have a very basic understanding of the three types of EtM/MtE/EaM functions, of AEAD and of PKI... so my second (multi-part, sorry...) question is:
How/where exactly is SHA and RSA (or any signature algorithm) used in this process?

SHA I know to be a hashing algorithm - used in HKDF during the initial DHKE. It's also used to create small hashes/"fingerprints" of large pieces of data, such as Certificates - which I suppose are then signed by the private key of the private/public RSA key pair for the sake of "authenticating" each message/session.

(1) Is the RSA private key used to sign the tag/tags after they're generated, or are they used in the generation of the tags themselves?

(2) Is the RSA private key of the sender used to "sign" each tag of each block, or just the single 128-bit tag after the whole payload of plaintext is encrypted?

(3) Is the client signing hashes/MACs as well after communicating their public key, or is that usually only done by the server/owner of a signed RSA Certificate?

This thread seems to state that symmetric keys are used instead, but discussion kind of made me more confused.


texts: What is the complexity to break second preimage resistance?

texts:
In the context an of hash functions we have three required properties.

Preimage resistance
Second preimage resistance
Collision resistance.

The bounds for Pre image collision is $O(2^{n-1})$, the bounds for collision resistance is $2^{n/2}$, what are the bounds for breaking second preimage resistance?


texts: Selection of the noise application position in differential privacy

texts:
In DP-SGD proposed by M Abadi in 2016, noise is applied to the gradient, so every round of training needs to be applied. My questions are:
Can I choose to apply noise that meets the DP requirements to the final model after the model training is completed? Will the total amount of noises applied by this operation be less?


texts: What does a linear function with huge order mean?

texts:
I am reading this paper "Farfalle: parallel permutation-based cryptography", and there are some terms that I do not understand.

Page 4 says

ratio efficiency vs. safety margin.

What does ratio efficiency and safety margin mean?

Page 5 says

Typically, rollc is a lightweight linear function with huge order,

My question is: What is a linear function with huge order?

Naturally, rolle should have a negligible amount of states in short cycles (preferably none) as they would lead to periodic output sequences

My question is: What does it mean for a permutation to have a negligible amount of states in short cycles?


texts: Why does Apple use One-Pass Diffie-Hellman for file encryption?

texts:
I was reading the iOS Security Guide (snapshot) and stumbled upon the following file protection class on page 15:

(NSFileProtectionCompleteUnlessOpen): Some files may need to be written while the device is locked. A good example of this is a mail attachment downloading in the background. This behavior is achieved by using asymmetric elliptic curve cryptography (ECDH over Curve25519). The usual per-file key is protected by a key derived using One-Pass Diffie-Hellman Key Agreement as described in NIST SP 800-56A.
The ephemeral public key for the agreement is stored alongside the wrapped per-file key. The KDF is Concatenation Key Derivation Function (Approved Alternative 1) as described in 5.8.1 of NIST SP 800-56A. AlgorithmID is omitted. PartyUInfo and PartyVInfo are the ephemeral and static public keys, respectively. SHA-256 is used as the hashing function. As soon as the file is closed, the per-file key is wiped from memory. To open the file again, the shared secret is re-created using the Protected Unless Open class’s private key and the file’s ephemeral public key, which are used to unwrap the per-file key that is then used to decrypt the file.

Here the document explains that ECDH key exchange is used, but gives no explanation as to why it is needed at all.
It would be more obvious if there was some kind of network between two parties involved, but in this case the only network I can think of is the communication channel between the CPU and the Secure Enclave.
I guess that the answer lies in the "One-Pass Diffie-Hellman Key Agreement" scheme described in §6.2.2.2 of the NIST SP 800-56A (snapshot) document and how it is different from "normal" Diffie-Hellman, but the document goes straight into details that are rather hard to digest.


texts:
Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve.

She could find out by going to all of the banks and asking if they have the account number. However, if Eve learns Alice's account number, then Eve will go to Alice's actual bank and steal all of Alice's money.

Alice could hash the bank account number, and ask about the hash, but since the account number is only 8 digits, Eve could bruteforce the hash anyway. Then, Eve will go to Alice's bank and steal all of her money.

Alice could use a Zero Knowledge Proving Protocol, but how would the bank know which account number to check against without repeating the ZKPP for every account number? Each of them has thousands of customers.

Context: I'm writing a program to retrieve an encrypted copy of one's keys and friends-list for a project called Tox (http://wiki.tox.im/index.php/Proposal:Friendslist_Server). I'd like to make it automatically detect which server has it.


texts: Is base64 the best two-way hash function to encrypt and transmit a set of integer numbers via the internet?

texts:
I am writing a mobile game and I need to save my game data on my game server, so crackers can not find and access the saved files(data) on their mobile. The game data can be expressed by numbers, so it does not really matters if I use Base64 as a means to securely pass the data via a network and/or to prevent data corruption while sending the data via wire.

I need a hash function to prevent the deciphering the game data. So I digged a little and found some, but I am not sure if I can and/or should use them.

MD5 – Can I use MD5 as a two-way function? If I can break the data in 64 bit portions, will I be able to recover the original message without a pre-calculated lookup table?
Base64 – that can be easily used in both ways which is good cause it is easy, but this is also easy for hackers and crackers.

I don’t know how SHA and other kind of checksums and integrity checks work, or if they are aproperiate for this kind of data (numbers).


texts: What is the difference between different corona tracing protocols?

texts:
At

https://corona-tracing.org/  and
https://www.cryptool.org/en/cto-highlights/corona-tracing

an easy to understand way was presented how such contact tracing apps work from a cryptographical point of view as it lets users simulate the process.

The "Background" tab at the 2nd webpage describes the differences in the two protocols DP-3T (European approach) and Exposure Notification (Google/Apple) in more details.

Q1: As I understand, the difference is marginal from a cryptographical point of view.
Is this really true?

Q2: The 2nd webpage is the first page I saw containing a detailed comparison of the two protocols. Are there other sources for a detailed comparison too (again I am asking only for the cryptographical aspects of the protocols)?


texts: What work goes into creating new asymmetric cryptosystems?

texts:
It's seems to me that it is rather easy to create a symmetric encryption algorithm (though not necessarily a secure one). They're a dime a dozen. The number of asymmetric encryption algorithms probably could probably be counted using the fingers on one hand (all of the RSA-like algorithms, the ECC smorgasbord, McEliece variants, multivariate ones, and lattice-based ones).

A trapdoor function is needed, but are they hard to find? And is the number of possible candidates from which it could be pulled small?


texts: Round counts and permutation usage for hashing for a Merkle tree

texts:
Are there any current recommendations for performant hashing in a Merkle tree?

It appears the hash based signatures in Sphincs use Blake2 everywhere (see Table 1 on page 22 of https://sphincs.cr.yp.to/sphincs-20150202.pdf) but I'm unsure how later improvements like Sphincs++ updated this.

A priori, we're hashing together two 16 byte outputs each time, so we've no reason to use blake2's adaptation of chacha, which consumes only 16 bytes per iteration.  I'd therefore expect hashing in a Merkle tree to use chacha directly, not a general purpose hash function like blake2.

We'd probably never use heap indexing in practice, meaning node i's two children are 2*i and 2*i+1, but if we did then I'd think a reasonable strategy might be

node[i] := chacha8( key = node[2*i] ++ node[2*i+1], nonce = i )[0..16]

In other words, we run one chacha8 iteration per node, which sounds almost four times faster than blake2, which consumes only 16 bytes per iteration, and uses almost twice as many rounds.  I'm currently unsure about how blake2 actually counts rounds though, like maybe it runs 8 quarter-rounds where chacha runs 4 or something.

I'd also think one should use some stronger and more general purpose hashing scheme like a full blake2s at the leaves.  Is this initial hashing step somehow be sufficient justification for using only chacha8 at each node?

Edit: The above construction suffers from a birthday bound attack, so one needs 256 bit hash outputs, which makes this optimization not workable for chacha.


texts: DROWN - decrypting ServerVerify message is not enough?

texts:
I have read this article, but I can't understand why after decrypting ServerVerify, the client needs to send the export grade PMS again...

  When exploiting these flaws the attacker will send its candidate
  cipher-text to the server and receive the “ServerVerify” message. The
  attacker will then perform a brute-force search over all 2^40
  possibilities for the export-grade PMS to find the PMS that derives a
  server session key that successfully decrypts the “ServerVerify”
  message. The attacker will know when a brute-force attempt is
  successful because the message will then decrypt into the random
  number he has previously chosen.

  Having found the PMS of the first message the attacker then submits
  the same candidate cipher-text again and receives the “ServerVerify”
  message. He now uses the PMS found from the first message to derive
  the server session key for this second session. If this server session
  key successfully decrypts the “ServerVerify” message then the attacker
  knows that the server has arrived at the same PMS twice, turning the
  server into a Bleichenbacher oracle.

If the ServerVerify is decrypted successfully, the attacker will get the random number generated at the begining of the handshake. Is it not enough to confirm that the derived session key he has generated with his PMS is the correct one?

I already know that if after re-sending the same packet, the decrypted ServerVerify is the same, so the session key is the good one (acting like an oracle). But I don't think we need to do this step...

Is it a mistake?


texts:
One Time Pads and Vulnerability to "Bit-Flip" Attacks:

I've seen it in this group, and apparently there are a (small) number of voices on the 'net opining that those relying on OTP are essentially "amateurs" (or otherwise oblivious) to the possibility of "bit-flip" being a fatal flaw in OTP and they should NOT be used. Given my own professional experience using One Time Pads, I found these claims astonishing and was interested in learning if there was chink in the OTP armor rendering it an insecure system to protect data secrecy.

"Bit Flip" in the context of these claims being that the OTP message can be tampered with in transit- that there's no validation the recipient has received exactly the message that was originally sent. But even tampering doesn't imply that the attacker can read the text they tampered with sans a key. So as far as I can see at this point, the secrets still remain protected.

Further, in order to tamper with the contents of the OTP encrypted message would imply that the attacker knew exactly "when", "where", "how" and most importantly "who" the message was being transmitted to.  Those decrying One Time Pads as an insecure, flawed system are thin on details how an attacker would obtain this key these key pieces of data.

Such a claim is bold and it contravenes accepted wisdom that OTP encrypted messages are secure & unbreakable- if the system is operated correctly of course.  Am I missing something here?


texts:
In some protocols, a key is derived from a hash of many parameters (K=H(param1,param2,param3))

Is there a hash function that takes many parameters as input ?

Or we can simply use a function like SHA-1 by concatenating these parameters as input ?


texts: How optimize elliptic curve point multiplication?

texts:
For 256 bits "Double-and-add" multiplication uses about 128 addings and 256 doublings, where "Montgomery ladder" uses near 256 addings and 256 doublings.
"Double-and-add" in my Intel(R) Core(TM) i3-8130U CPU @ 2.20GHz takes 0.02 s, it is normal or too big?
In adding we compute $\lambda = \frac{y_q - y_p}{x_q - x_p}$. Main cost is computing inverse of $x_q - x_p$ and inverse uses extended_gcd and modulo:
def extended_gcd(aa, bb):
    lastremainder, remainder = abs(aa), abs(bb)
    x, lastx, y, lasty = 0, 1, 1, 0
    while remainder:
        lastremainder, (quotient, remainder) = remainder, divmod(lastremainder, remainder)
        x, lastx = lastx - quotient * x, x
        y, lasty = lasty - quotient * y, y
    return lastremainder, lastx * (-1 if aa < 0 else 1), lasty * (-1 if bb < 0 else 1)

# calculate `modular inverse`
def modinv(a, m):
    g, x, y = extended_gcd(a, m)
    if g != 1:
        raise ValueError
    return x % m

I must many times compute this inverse to obtain $\lambda$ or between [n]P and [n+1]P is the same $\lambda$ (or can be fast comnputed) as is between [n+1] and [n+2]P ?


texts: ECRYPT Salsa20 Test Vectors Interpretation

texts:
I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I wanted to test my encryption function. Unfortunately, there are no test vectors for the full encryption in the specification paper:

I have found test vectors for Salsa20/20 from the ECRYPT Stream cipher project here.

But for some reason, the first 64-byte sequence matches with the output of my expansion function with the given key and IV and counter set to 0 but the second 64-byte sequence differs.

Actual:

0xa360370ff47dd714684fd47584e46fe89e031b59072be978f7c0a56936151a3e9c52f7be26c687a5bc234640efed47b79b02d70dd666dc39cea9288e69427318

Expected:

0x57be81f47b17d9ae7c4ff15429a73e10acf250ed3a90a93c711308a74c6216a9ed84cd126da7f28e8abf8bb63517e1ca98e712f4fb2e1a6aed9fdc73291faa17

I have used the IV 0x0 (64-bit) and counter 0x1 (64-bit) concatenated such that the nonce given to the expansion function is

0x00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 01

(big endian). But this leads to an incorrect result as shown above.

I have tried to write the bytes of the counter in littleendian since the specification paper mentions this in the last section about encryption:

0x00 00 00 00 00 00 00 00    01 00 00 00 00 00 00 00

but that only lead to a different wrong result:

0x8da2b74eef1b6283e7e20166abcae538e9716e4669e2816b6b20c5c356802001cc1403a9a117d12a2669f456366d6ebb0f1246f1265150f793cdb4b253e348ae

I am assuming I am interpreting the test data incorrectly since my expansion function passes all the tests with the test data given in the specs.

I have found out here that the test vectors are using the NESSIE format but couldn't find a explanation about the data which solves my problem (probably there is no explanation because I am doing something quite obvious wrong?)

I am also confused what "(stream is generated by encrypting 512 zero bytes)" should mean. The stream is independent from the plaintext thus I am wondering what they mean by that it "is generated by encrypting 512 zero bytes"?

I would be very glad if anyone could help or lead me into the right direction since I am stuck with this for quite some days already. :)


texts: Question about SHA-2 (and potentially similar hashing algorithms)

texts:
I have been educating myself recently about the SHA-2 hashing algorithm, and in the midst of this pursuit, I've encountered a question:

This algorithm uses a set of constant hexadecimal values, derived from the cube root of prime numbers, as a starting point for the process. Because these values can be known to anyone, does this not open some level of vulnerability to the hashed values? Would it not be better to use a set of less predictable values?

I don't know a great deal about cryptography, so forgive me if this question is silly in some way I do not understand, but I am very curious about the answer.

EDIT: I'm not asking why they are constant. I understand how hashing works and what it is used for. I am asking if the security of the algorithm would be increased if constant but unknowable (to the outside) values were used instead of the array of constants currently used.


texts: What are the roles of the simulator in simulation based proofs

texts:
I'm trying to better understand simulation based proofs in the UC model - but the guidelines to construct a simulator confuse me. To my understanding, the simulator is activated in two ways:

Outbound: S simulates the real world adv. A and as such, it intercepts all its messages and sends them to the ideal functionality.
Inbound: The ideal functionality F leaks some information (depending on the protocol) when an honest node interacts with F.

Assuming the above is true (please correct me if I'm wrong or if it's incomplete), what does the simulator try to do? Does it run the real world protocol somehow? Does it alter the output when called in #1 or #2 such that it matches the real world execution, and then sends it back to the env.?


texts: Is there a way to systematically calculate the public exponent $e$ in RSA?

texts:
I'm learning RSA in one of my classes and we were given a problem:

  $p = 5$, $q = 11$

I have done the following steps:

  $n = 5 \cdot 11 = 55$
  $\phi = (5-1)\cdot(11-1) = 40$

I know that to find $e$ we have to find an integer co-prime with $\phi$, where $\phi$ is $40$ and $\gcd(e,40) = 1$.

Is there an algorithm I can use by hand that can give me $e$? I know there can be numerous values. The method the professor has shown is to just enumerate each prime and find the first divisible into the totient $\phi$. I assume he will give us small numbers in the exam but still, doing it by trial and error can be time consuming.

I understand one can use extended Euclids algorithm to find the inverse of $e$, which I can do provided I know what $e$ is.

I just struggle with finding $e$.


texts: Perfect Indistinguishability in shift cipher

texts:
I have the following question:

  Which of the following attackers can be used to demonstrate that the
  shift cipher for 3-character messages does not satisfy perfect
  indistinguishability?

  Output m0 = 'aaa' and m1 = 'bbb'. Given challenge ciphertext C, output
  0 if the first character of C is 'a'.

  Output m0 = 'abc' and m1 = 'bcd'. Given challenge ciphertext C, output
  1 if the three characters of C are all different.

  Output m0 = 'aaa' and m1 = 'abc'. Given challenge ciphertext C, output
  1 if the three characters of C are all different.

  Output m0 = 'aaa' and m1 = 'abc'. Given challenge ciphertext C, output
  0 if the first character of C is 'a'.

I assumed it was "Output m0 = 'aaa' and m1 = 'bbb'. Given challenge ciphertext C, output 0 if the first character of C is 'a'." since the shift cipher would be predictable (this is what I think) if the messages had the same characters in a row.

Can anyone explain why it should be :
Output m0 = 'aaa' and m1 = 'abc'. Given challenge ciphertext C, output 1 if the three characters of C are all different.


texts: Why is Pearson hash not used as a cryptographic hash?


texts:
Within a closed computer network, I am ciphering some plaintext data as an added security measure. This is below several other layers of protection. For various technical reasons, I am restricted to plain-text, UTF-8 data. To that end, I have been using a Vigenère cipher with pre-shared key database. The keys range from 30 to 100 characters, and are not dictionary words.

My question is regarding the Vigenère cipher: It is my understanding that the security of this cipher is directly related to the length and security of the keys. Long and tightly secured keys bring this cipher on par with many more complex techniques. Is that true, or is this a "kiddie" cipher that could be cracked while you sleep?

Edit It may bear mentioning, the text that is being ciphered is JSON encoded data arrays, which is human readable but not "natural language" -- it contains many symbols interspersed with the actual data.

EDIT 2 Plaintext length varies unpredictably, from 100 characters to 5,000 plus. The data is being transported via SSL, so this is, as I mentioned, intended as yet another added layer, not the whole and sum of security used.


texts: In the proof that weak OWFs imply strong OWFs, why must the position of $y$ be random?

texts:
When proving weak OWFs imply the existence of strong OWFs, the standard construction goes by concatenating several applications of the weak OWF (see, e.g., here). That is, given a weak OWF $f$, the following is a strong OWF:
$$F(x_1, \dots, x_t) = (f(x_1), \dots, f(x_t))$$
where $|x_i| = n$, $t = n p(n)$, and $p \in \text{poly}(n)$ such that
$$\text{P}_{x \in \{0,1\}^n}(A(f(x), 1^n) \in f^{-1}(f(x))) < 1 - \frac{1}{p(n)}$$
for every PPT $A$.

The proof is by a reducibility argument in which one presupposes there is a PPT $B$ which inverts $F$ with non-negligible probability (i.e., $F$ is not strong one-way) and then constructs a PPT $A$ which inverts the weak OWF $f$ with probability greater than $1 - \frac{1}{p(n)}$.

Most versions of the construction(*) I have seen are as follows: $A$ receives input $y = f(x)$ and $1^n$, where $x \in \{0,1\}^n$ is picked uniformily (but not revealed to $A$). $A$ then picks $i \in \{1, \dots, t \}$ and $x_j \in \{0,1\}^n$ uniformily for $j \neq i$ and runs $B$ on $Y = (f(x_1), \dots, f(x_{i-1}), y, f(x_{i+1}), \dots, f(x_t))$, thus (with non-negligible probability) inverting $y$. If $B$ does not produce a preimage, the procedure is repeated a certain number of times.

My question is: Why must $y$ be in a random position in $Y$? Why cannot, for example, $i = 1$ be fixed? After all, $y = f(x)$ and $x$ is guaranteed to be picked uniformily (as every other $x_j$).

These lecture notes here hint that this is to "balance the probabilities", which is unfortunately too vague for me to comprehend.

(*) I have also found an alternative construction in Oded Goldreich's "Computational Complexity: A Conceptual Perspective" in which $A$ does not pick $i$ randomly; instead, it iterates over each possible value of $i$. However, I can see how the two are equivalent.


texts: Encrypting multiple small messages with a single reused symmetric key

texts:
What is a good way of doing this? Practical and Secure.

This is for a browser environment.

For example, let's say there are a few 100 independent messages of about 100 characters each that you want to send to the server independently and in an arbitrary order and you want to encrypt them with the same key before they are sent to the server because you don't want the server to have the contents of the messages. The next day the server may return some of those messages and the user should be able to decrypt them in the browser with the same key.

How would you do this?

What encryption scheme and what block cypher? Why? What library is recommended?

NOTES:

This is in addition to HTTPS not instead of it.
The user does trust the server to send a trustworthy encryption function and use it.


texts: What is an example of a secure sigma proof?

texts:
I want to implement Threshold Elgamal as described in section 6.3.1 and in the decryption phase each party must broadcast a sigma proof to show that it actually has a valid secret share of the secret key.

I read about Schnorr protocol as a solution for sigma proof but it is said to be insecure, in chapter 5 of the same lecture notes.

What secure sigma proof could I use ?

It would be great if the sigma proof is non-interactive.


texts: How do I verify a reset token if the token is hashed in DB?

texts:
I've been searching around the web for best practice how-to on secure password reset system (email with reset url), and the idea to hash the token in the database, which I did not implement at first, seems to be the the most secure way to store the token.

Im currently following this guide, and he does not mention it (why?)

Im using bcrypts for password hashing allready, so thats what im using for this aswell.

How ever, the syntac for the verify is like this: Bcrypt.verify(non-hash, hash);

So my question is this:  If the reset-link only contains the token (which is not in db, the hash is) - how can I find the user in the db?

is it safe to append email/userID to the reset-link as well? None of the other services Ive seen have does this (afaik), only the token (do they not hash the token in the db?).

I dont want to make my own scheme that will create a security issue, so how do I proceed with this ?

Using asp.net web forms and c#


texts: Can you explain what an NP statement is when they refer to it in Zero knowledge proofs?

texts:
When I read about zero knowledge proof, I keep encountering the term NP-statement. I am aware of complexity classes but I am a little unclear on how it ties up to NP-statement.

I came across the following here: C++ library for zkSNARKs

A computation can be expressed as an NP statement, in forms such as the following:

"The C program foo, when executed, returns exit code 0 if given the
input bar and some additional input qux."
"The Boolean circuit foo is satisfiable by some input qux."
"The arithmetic circuit foo accepts the partial assignment bar, when
extended into some full assignment qux."
"The set of constraints foo is satisfiable by the partial assignment
bar, when extended into some full assignment qux."

A prover who knows the witness for the NP statement (i.e., a satisfying input/assignment) can produce a short proof attesting to the truth of the NP statement.

Can any body show how an NP problem can be described in the form of an NP statement with an example?


texts: Given paramaters of an Edward's curve and x, determine a y value if it exists

texts: I'm making a demonstration cryptosystem using ECC ElGamal. I've currently got a working implementation of Edward's Curve operations and a basic ElGamal implementation (Encrypts only points on the curve), and in order to perform the mapping operation described in this answer, I need to determine the $y$ value of a point on an Edward's curve $g$ given an $x$. I have a basic understanding of the way an Edward's curve works but the finite fields are a bit much for me to be confident in properly implementing this based on intuition. Any help is appreciated.


texts: What is the difference between anomalous elliptic curve and ordinary elliptic curve?

texts: Probably this is a silly question but an anomalous curves and ordinary curves are the same things?


texts: Second pre-image resistance vs Collision resistance

texts:
From Wikipedia:

  Second pre-image resistance

  Given an input $m_1$ it should be difficult to find another input $m_2$ such
  that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = \operatorname{hash}(m_2)$. Functions that lack this
  property are vulnerable to second-preimage attacks.

  Collision resistance

  It should be difficult to find two different messages $m_1$ and $m_2$ such
  that $\operatorname{hash}(m_1) = \operatorname{hash}(m_2)$. Such a pair is called a cryptographic hash
  collision.

Could someone explain the difference between these two please? They very much appear to be identical to me, as in both definitions $m_1 \neq m_2$ and $\operatorname{hash}(m_1) = \operatorname{hash}(m_2)$.


texts: What is the approximate effort to break one additional round of a primitive?

texts:
Many of the cryptographic primitives currently in use have a number of their rounds already broken.  Generally and with no particular primitive in mind, what is the scale of the effort to break one more round? Is is anything like $O(n)$, or more like $O(n^{something})$ where $n$ is the number of rounds for any individual primitive? In short, is breaking each additional round as easy or harder than the previous one? Or are there impediments other than simple computational time & effort?

So for example, assume an iterated primitive of $n$ rounds in total, where each round is $r_i$.  I'm asking is it as easy to break $r_{i+1}$ as it was to break $r_{i}$? It seems to me that this relationship should be independent of $n$ itself within the particular primitive. I'm not comparing between primitives.

This question is loosely based on the numbers of broken rounds identified in Origin of values for "security margin"?.


texts: How to perform decryption in this single-bit PKE scheme?

texts:
Consider a cyclic group $G$ of order $q$, and let $g$ be a generator for $G$. Assume $(G, q, g)$ is public. Consider the following 1-bit public-key encryption scheme.

To $generate (pk,sk)$:

$x \xleftarrow{\$} {1, , 2, . . . , q}$
$h ← g^x$
$pk ← h, sk ← x$
Return $(pk, sk)$

To encrypt the message $M = 0$, we define $E_{pk}(0)$ as:

$y\xleftarrow{\$} {1, 2, . . . , q}$
Return $(g^y, h^y)$

To encrypt message $M = 1$, we define $E_{pk}(1)$ as:

$y\xleftarrow{\$} {1, 2, . . . , q}$
$z\xleftarrow{\$} {1, 2, . . . , q}$
Return $(g^y, g^z)$

Define $D_{sk}(C)$ and prove that this 1-bit public key encryption scheme is $IND-CPA$ secure if the DDH assumption holds for $(G, g)$. (To be clear,
this means doing a reduction.)
(Why would no one ever actually use this scheme in practice?)

I haven't been able to come up with proper decryption yet. And I was thinking proving it to be $IND-CPA$ secure would be along the lines of ElGamal security proof. Am I right about it?

And practically, I don't think this is used much because the work involved in 1-bit encryption multiplied across the number of bits in the message would be much larger than the alternative option of using a multiple bit encryption. Am I right about this?


texts: Figure out algorithm to numeric key generator with one known input and output

texts:
I have a software program running on a piece of hardware. To access a specific functionality it runs a challenge-response-like authentication, that is it generates a numerical 4-digit PIN and expects a 4-digit numerical PIN in response. I'm now looking for whether it is possible to come up with the algorithm that is used to generate the response and if so how.

Right now I have one sample pair (7153 - 9533) to work with. Ideally there would be some utility or a formula that I could apply or tweak here. I'm confident that once I figure out what the underlying algorithm is to convert from one 4 digit challenge to the 4 digit response then I will be able to code me a little utility to always get the response.

Since the response is always a 4 digit number that is generated from another 4 digit number I assume that there is only 10,000 possible codes that relate to the 10,000 possible "seeds" so I don't think this should be very hard for me to reverse engineer or brute force, essentially I'm looking for a direction where to start.

So my question (in short):
How would I approach such a problem and can it even be done at all?


texts: Do all PAKE assume that all parties already have a password?

texts:
I was looking for a means to perform a key exchange without relying on a PKI. I discovered Password Authenticated Key Exchange (PAKE) and after reading J-PAKE; I have the following questions:

Do PAKE assumes that involved parties already have a shared message?
 in J-PAKE, they used an extension of Diffie-Hellman Key agreement to establish the shared message. However, I don't understand how they prevent Man-in-the-Middle attacks.
 In general, how does PAKE prevent Man-in-the-Middle attacks?


texts: number of blocks, and size of padding at 64bit

texts:
A message has 2003 characters, encrypted using a block cipher of 64 bits. What is the size of the padding and the number of blocks?

I tried this, but I'm sure it's not the right thing:

2003 mod 64 = 19, this is the number of bits that needs padding.
2003 / 64 = 31, this is the number of complete blocks, this + 1 = 32 is the total number of blocks.


texts:
I’m trying to wrap my head around zero knowledge proofs, but I’m having trouble understanding it.

In my current understanding, zero-knowledge proofs prove to the recipient that the sender has a certain knowledge without disclosing it. Like trying to say your password without actually giving it.

Many sources go at it with a convoluted method like a tunnel where there’s a hidden gate, and Bob is trying to know if Alice can go through the hidden gate. But then it starts saying that Bob should not see Alice enter. Wouldn’t it be easier for Bob to just see Alice go in one tunnel and come out the other? That would not disclose the secret way of opening the tunnel, right?

In that line of thinking, given a one-way function like a hash, couldn’t the other person just hash their secret and let the other see that the hashes compare?

I must be missing something (as there’s a lot of research going into it and hashes are well-known), but I can’t wrap my head around it.

Can someone tell me what’s wrong with my understanding of zero knowledge proofs?


texts: Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs

texts:
The following two cipher suites were reported by Qualys SSL Labs as being 112-bit:

SSL_CK_DES_192_EDE3_CBC_WITH_MD5
TLS_RSA_WITH_3DES_EDE_CBC_SHA

However, all other references I can find say that they are 168-bit, which aligns with my understanding of 3DES EDE: three independent 56-bit keys.

I trust Qualys to be correct on the matter, and I presume that they have some sort of justification for classifying these suites as 112-bit rather than 168-bit, but I don't know enough about the SSL and TLS implementation of EDE to understand why.

I also have no idea why the CK_DES suite has a 192 in the name.

Are they correct? What's the deal with the discrepancies?


texts: Summarize the mathematical problem at the heart of breaking a Curve25519 public key

texts:
It's pretty easy to generate a Curve25519 private key: generate 32 random bytes of data and then do:

e[0] &= 248
e[31] &= 127
e[31] |= 64

You can then generate a public key by doing fancy math on the private key. For example, here's a random keypair I just generated:

public: e40ed268dff20db8497d0691421d00b086aad1efedcd5bd223d9eb6c0b85665f
secret: e3c0e8b20ba7894882ddb37522dbe90867befcf9f31a5ce29c0d7997e0bd856d

The whole safety of public key encryption is that it is hard to take a public key and reverse the operation. Elliptic curve cryptography, as I understand it, relies on the fact that a discrete logarithm is hard to find. In particular, for a given large b and g, it is hard to find an integer k such that

$b^k = g$

How does that equation relate to Curve25519? Specifically, if I had a public key like the one above, how would I express, in math terms, the problem I need to solve to find the private key? How does it relate to the equation I see from time to time - $y^2 = x^3+486662x^2+x$, and the number $2^{255} - 19$?

I am guessing it is not as simple as "the private key is k and the public key is b and/or g" in the equation above. I'm also a little confused because the keys would appear to have roughly the same number of digits, which would seem to imply that there aren't many feasible values for k?


texts: How to improve entropy on a router running Linux kernel 2.6.x without TRNG or RTC?

texts: How could you improve entropy on a router running Linux kernel 2.6.x without TRNG or RTC ?


texts: Get RSA PlainText without Knowing Private Key

texts:
If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there be an efficient algorithm that uses RSA-Crack() as a building block, and can decrypt any message - without knowing the private key.

Now, I know that I can use the factoring algorithm to devise the value of p & q from N (that is a part of the public key), after which I can use the Euler function to generate the new decryption exponent (e) and all.
But my main criteria is how do I use RSA-Crack() as a Building Block to decrypting the message.


texts: Is it safe to use signed messages from a private key to send to clients as tokens?

texts:
My custom web server software uses a 'server identity' which is a public/private bitcoin keypair. It's for extremely limited resource environments ie..IOT, which is why I don't use a common stack with OAuth etc..
I use the private key to sign certain messages I send to the app clients, so they can verify authenticity.  The server is very much stateless, I don't wish to store any more data that I need to (auth tokens).
Are there implications to just signing a message, sending it to client as token, which they will send back in the authorization header with an expire timestamp? I will verify on the server. Not storing any tokens.


texts: How is overflow handled in word addition steps in Salsa20?

texts:
I feel like I'm completely missing something there. The quarter-round proceeds as follows:

b ^= (a + d) <<< 7;
c ^= (b + a) <<< 9;
d ^= (c + b) <<< 13;
a ^= (d + c) <<< 18;

So at each step, we're adding words a, b, c, d together. And at the end of 20 quarter-rounds, we add the current state matrix with the previous state.

What I don't see is how overflows are handled. If two words added exceed the value of a word, does it simply wrap around?


texts: Is it possible that a SHA256 hash has the same hex character over and over again?

texts:
In theory, there are infinite inputs, that you can hash with SHA-256. So theoretically it would be possible that one hash string would read 0xaaaaaaaa...
But would that also be possible practically, or do the algorithms check that this is not happening?


texts: Strange for loop in salsa20_word_specification function

texts:
This is wrt to implementation of the salsa20_word_specification function at https://cr.yp.to/salsa20.html
The 2nd for loop goes like this
 for (i = 20;i > 0;i -= 2) {
....
....
....
}

The value of i isn't used inside the for loop. So I am wondering why this loop starts with 20 & goes down to 0 decrementing 2 in each iteration?
The same thing could be done the regular way i.e.
for (i = 0; i < 10; ++i) {
...
}

Am I missing something here?


texts:
Scenario: I have to protect the integrity of some files that will be exchanged between entities $A$, $B$, $C$. Entity $A$ creates the file (e.g. configuration) and sends it to $B$ and $C$. Entities $A$ and $B$ are considered trusted but entity $C$ is semi-trusted (by default it is trusted but we assume it could be compromised at some point). The communication channel between $A \leftrightarrow B \leftrightarrow C$ is considered secure (e.g. VPN).

Now, I obviously cannot rely on HMAC since I would have to share a secret with potentially compromised $C$. But I would prefer to avoid implementing a PKI and digital signatures for this purpose. Is there any way around a PKI that will protect the integrity of my files?


texts: Is a key ratchet effective against replay attacks?

texts:
In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric encryption key is replaced with a hash of itself. The receiver can then reject any messages that use previous keys.

The benefit of this approach is that a counter doesn't need to be sent on the wire, so bandwidth is saved. I'm designing a system where bandwidth is constrained, but computation not so much so performing a hash with every message is not a problem (and having the receiver possibly try multiple keys in the case of message loss is not a problem either).

Is using a key ratchet any less effective at protecting against replay attacks than a message counter? Are there any other reasons not to use such an approach?


texts: Is it possible to construct dataset for only another party to consult?

texts:
Is it possible to construct a dataset made of some kind of probabilistic encrypted indexes such that anyone can update the information contained in the set but only the one with a secret key could be able to retrieve the information for a given index without the need to retrieve the whole set?

For example, if I have a set of messages sent to me hosted remotely, like an e-email service, indexed by dates, is it possible to obfuscate the dates such that anyone can still send me a message and index it (by inserting into the set), but no one with access to the set can gain no information about the dates distribution except for the ones with the secret key? With the restriction that when I want to retrieve messages from a given date, I only need to receive those and no others.


texts:
$GF(2^m)$ Galois fields are widely used in different cryptographic algorithms, for example, in Rijndael.

However, $GF(p^m)$ fields are possible with any prime $p$, not only 2, but $GF(2^m)$ fields are, as Wikipedia puts it, "especially popular choices for applications", because arithmetic operations in $GF(2^m)$ are much easier to implement that, say, in $GF(5^m)$: polynomials in the former can be expressed as simple binary numbers, and addition and subtraction are simply bitwise $xor$, which gives a great performance boost.

The question is: are there any cases where a $GF(p^m)$ with $p \neq 2$ would be preffered over a $GF(2^m)$ field? Or do such fields have only theoretical value?

I'm asking this because part of my cryptography homework involves calculations with such fields, and the last two tasks are to calculate a message encrypted with ElGamal, and to calculate an ElGamal signature, using a $GF(31^3) = \mathbb Z_{31}[x]/(29*x^3+14)$ field. Is this an example of a practice that has some benefits (besides the "security through obscurity" principle)?


texts: Is it possible to test 15-bit PRNG with the library TestU01?

texts:
The library TestU01 inconvenient for generators that don't produce 32-bit outputs.  But is it possible to somehow test say a 15-bit generator with it?  How could that be done?

For instance, the generator included in the book ``The C Programming Language'' by Brian Kernighan and Dennis Ritchie is a 15-bit generator.  Is there any way to test it against the TestU01 library?

For example, I could take 2 numbers from the generator and concatenate its bits, giving me a number with 30 bits.  I still need 2 more bits to make 32 bits.  I can get these two last one from another number from the generator (and ignore the 13 bits left of the third number).  But this is changing the generator.  It's a different thing now.