texts: Proof that a hash matches an encrypted file

texts:
Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob.  Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as well as a compact message authentication code which could be the hash of the file $H = {\rm hash}(F)$, which is used as a unique blinded identifier of the file.  It's assumed that multiple users may have the same file, encrypted with different keys, and we wish to detect that they are the same by virtue of $H$ being the same, but Bob needs to know that $H$ matches $F$ without having $F$ unencrypted.

Does there exist any kind of proof that the hash $H$ (or other compact MAC) corresponds to the file $F$?  The hashing/MAC algorithm and encryption algorithm (symmetric, asymmetric, homomorphic) are secondary to being able to prove this.


texts: What is the largest bit RSA encryption to be cracked?

texts:
This article shows a 4096 bit key being cracked by using a microphone and listening to your computer's cpu. I do not know if this is true at all.

I am doing a presentation on RSA Security and I would like to include the largest RSA encryption to be cracked.


texts: How can the Rijndael SBox be written as a linearized polynomial?

texts:
In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk state (in Appendix A) that the Rijndael SBox can be written as a "linearized polynomial" $S(x): GF(2^8) \rightarrow GF(2^8)$:

$S(x) = 63+8F\cdot x^{127}+B5\cdot x^{191}+01\cdot x^{123}+F4\cdot x^{239}+25 \cdot x^{247}+F9 \cdot x^{251}+09 \cdot x^{253} + 05 \cdot x^{254}$

I want to understand how this can be derived from the SBox calculation usually described as:

$Sbox(x) = M \cdot x^{-1} + \vec{t}$

I understand that $x^{-1}$ can be written as $x^{254}$, but what are the necessary steps to get to the linearized form?


texts:
In order to understand the construction of a zK-SNARK, I have recently been trying to understand the KEA1 assumption in The Knowledge-of-Exponent Assumptions and 3-Round Zero-Knowledge Protocols by Mihir Bellare and Adriana Palacioy.

I do not understand the meaning of this assumption. For example, why is this "hard problem" used in cryptography?

On page three of the paper, the authors roughly outlined the assumption, but this didn't clarify things for me. I have a strong math background, so if someone could explain the KEA1 assumption to me in a mathematical way, that would be great.


texts: If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?

texts:
If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN?

Or does WPA2 negotiate sort of a per-client encryption key, so that while an intruder can access the WLAN, he's still not able to decrypt the other clients' traffic?


texts: Order of target group in bilinear pairing

texts:
Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers.

Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ respectively, and $a$ is a random integer. What is the output of $e(g_1^p, g_2^a)$? Is it equal to $(g_t)^{ap}$?

What is the order of the result? Is it equal to $pq^2$?

I know usually in the pairing cryptography the order of groups is set to a prime integer, but, i just want to know what happens if the order is a composite integer $p^2q^2$.


texts: Can an adversary distinguish a private key from a pseudo-random string of the same length?

texts:
Apologies if this is a dumb question but allow me to describe the dilemma I have:

Suppose that I am protecting a private key on a device using a password & PBKDF2. The obvious attack would be an offline bruteforce by which an attacker would know the password used to protect the private key and would also have access to the private key.

For a very important & undisclosable reason, the password used to protect this private key has a small search space i.e. it is not complex and is of a short length.

The controls I have in my mind are:

Have the key pair generated on the device but send the public key to the backend. The public key will not be stored on the same device as the private key. This will mitigate the bruteforce attack as the attacker would not know if the decrypted blob is the private key without being able to correlate it to it's corresponding known public key. (Hope that makes sense)
Encrypt just the private key using PBKDF2 and provide no "Known Plaintext" to the adversary like -----BEGIN RSA PRIVATE KEY----- or -----END RSA PRIVATE KEY-----
The private key is used to generate a signature which is verified by the back end and this will have limited attempts thereby mitigating an offline attack
I will be using a salt and a slow derivation function

My hope is (and I could be wrong) is that the attacker would not be able to distinguish such a private key from other pseudorandom blobs received after decrypting it using various password attempts in a bruteforce attack. Am I correct in my understanding? Am I missing some fundamental mathematical understanding in the RSA cryptosystem or any asymmetric cryptosystem that debunks the above controls? I wish to understand if the distinguishability of a private key from a pseudorandom string (of the same length) is close to negligible.


texts: How can DNA Computing solve very complex problems that can present in cryptography?

texts:
This field was originally founded by Leonard Adelman of the University of Southern California in 1994. He proved the use of DNA as a computational form that solved the Hamiltonian problem.

By parallel search, it aims to solve some of the very complex problems that in cryptography.

How can it solve such complex problems?


texts: What choices of $a$ and $b$ of the affine cipher lead to proper encryption functions

texts:
Suppose I consider the affine cipher defined by $E(x) = ax + b \bmod n$  on the standard alphabet of 26 letters. Which choices of $a$ and $b$ lead to
proper encryption functions?

Using the information provided from this website:

They say that $a=5$ and $b=8$ works, but $a=4$ and $b=5$ does not work.

My understanding is that in cases where it does not work then different letters prior to applying this cipher results in the same ciphertext having applied the cipher.

However, I consider this explanation to be quite woolly. How would I know which choices would work prior to applying the cipher?


texts:
How to produce a binary output sequence using LFSRs but with increased linear complexity?

I have tried searching but i got confused on equation details. So can anyone help me with rather simple explanation on how to increase linear complexity i.e. with some diagram or so.
Thanks


texts: Why are RSA ciphertexts different for the same plaintext?

texts:
I am using SpongyCastle for a project on android. I have used RSA to encrypt the data and then decrypt it in another activity, the keys are stored in the shared preferences.
I discovered a thing I cannot explain.
My keys are generated only once and stored for future use without being changed. On encrypting the same plain text, I get two different outputs.
I encrypted the plaintext a and got the following outputs :
"G4srxAxUnoikOIQdlj30rmyUiGz3P0R0VE6BflSTo4UQqJVSBpQtyFSB6tt73Z693D0LMkykDEPB
    lPg0IEH/R6tOJCyCU8HxKQ8nfo5OGUYFgkup3aGPkRqb+gCLpc5YGSmLztaynKq1H6kplryx0q1+
    KTCchc6PswAMpaMwMTk="

"j2r5MsaGRNazElAxG4BIBgZYtrjdxaErbs+19ObsCyOuVwTiu0cvKcKTOPuUOOjcGVaDup53wdEk
    AHHsy8zA1gR29uSdW4C2JIDnQVGCcfzqOcbzeS4WgV+2WpLTahBj6Df8pya2YksIp3KSLSnhH3nn
    B2kf/Wi53SQmJJWSf84="

"Yz3xhiObUI5C8UA31VNH3VqUXGmotGpTz9A3U2n81lJ7p1//x4CI15r4JUZGJlN1aPnSayIuk6D8
    hMIp32o53YEmm69gve91+dCVDQkZOUE9UuA2nEcjR21nUgWPQJdwqQ7P4XFeWsBaokpwNCA6j2qb
    b1Glfp+AVpUNm7syiUY="

...

I know that RSA is $Y = X^e \pmod{n}$
Since neither $X$ (plaintext) nor $e$ (public key) changes, I'm guessing $n$ changes each time.
The decryption works just fine for each case.
So, if $n$ changes each time, for decryption to know the value of $n$ it has to be passed on with the message itself.
My questions:
Am I correct in assuming the above? If yes, where is $n$, and what is the format for storing the message? If No, what is the correct method?
The output is 172 characters each time? How does that work out?
P.S. : I am following this.
Edit:
I can conclude that from the answers that padding is responsible for this. If padding is different each time, shouldn't it be mentioned or the length of the actual message be mentioned with the ciphertext so that deciphering code can differentiate the padding from the actual message? If it is the same, wouldn't it give the same result each time, we would still need to pass the length of the actual message encrypted as it may be. (I think it's random)
I also found out that I can't encrypt more than 86 characters. Why? Is there a limit on the number of characters by RSA?
Giving me this:
06-12 18:09:37.192    9217-9217/? E/AndroidRuntime﹕ FATAL EXCEPTION: main
Process: com.chatr, PID: 9217
java.lang.RuntimeException: java.lang.RuntimeException: java.lang.ArrayIndexOutOfBoundsException: too much data for RSA block
        at crypto.RSA.encryptWithKey(RSA.java:87)
        at crypto.RSA.encryptWithStoredKey(RSA.java:93)

Also, the same error comes when I try to decrypt the ciphertext when I replace = with something else, and obviously hash fails when I change some other character. What does = signify. I'm assuming padding.


texts: Can a PGP subordinate key be used as a web of trust signing key?

texts:
I already understand the desire to segregate a PGP master key from subkeys, allowing me to keep the master key in some off-site non-networked location while making use of the subkeys to do things like encryption and authentication. I also understand that I can then revoke the subkeys later if they are lost or compromised, allowing me to maintain my identity within the web of trust while being forced to shift to new keys.

The model I've seen employed so far looks like the master key is used to sign others' keys. This has the unfortunate side effect of necessitating that I take the master key out of cold storage any time I choose to sign a key. While I do not think this will be a frequent activity, I would like to minimize my interaction with the master key as much as possible.

Can a subordinate key be used to sign others' keys instead? I know I can create the signing key, but specifically the two important points to this are:

Others that trust my master key's signatures will trust these signatures that were created from the subordinate key
If the subordinate key is lost or compromised, can I revoke the subordinate key in a way that either (a) invalidates all signatures it has ever made or (b) invalidates all signatures made after a certain date. While (b) would be preferable, it's fairly trivial to let (a) happen and then just re-sign the keys I still want with a new subordinate signing key.

I think #2 is a given. The #1 is primarily what I'm not sure about. When computing the trust path to a target, are my subordinate signatures taken into account? And furthermore, does this model even make sense?


texts: PKCS#11. Possibility of performing Ecryption/Decryption in hardware

texts: Cheers. I'm dealing with HSM via PKCS#11 C/Python interface. I'm wondering is it possible to do some C_Encrypt/C_Decrypt in hardware. By saying "in hardware" I mean encryption/decryption without exposing the result to the caller space. This is mostly aboud decryption as I want to call C_Decrypt and leave the result inside the HSM as arbitrary data to do some other transformations on that data later, saying re-encrypting it on some other key. Thank you in advance.


texts:
Let $\mathcal{G}$ be a cyclic additive group for an elliptic curve $E\, / \ \,\mathbb{F}_p$, and let $p, n$ be two large prime numbers (e.g., we can consider  $\texttt{secp160r1}$ with $p = 160$ bit and the reasonably even $n$ is $160 $ bit long).

I have read several papers in which hashing functions were defined, but I do not understand how the definitions were reached. Let me give you an example:

$H_1:\{0,1\}^* \times \mathcal{G} \times \mathcal{G} \rightarrow \mathbb{Z}_n^*$

$H_2:\{0,1\}^* \times \{0,1\}^* \times \mathcal{G} \times \mathcal{G} \times \mathcal{G} \times \mathcal{G} \rightarrow \mathbb{Z}_p^*$

My questions are:

Why do the authors multiply the value $\{0,1\}^*$ by $\mathcal{G}$ more than once ? One time is not enough?
Why, in the second function $H_2$, do they multiply the value $\{0,1\}^*$ two times with itself? What changes?
If I want to define a third hashing function $H_3$, do I need a third prime number or can I leverage $p$ or $n$ (in $H_1$ the output is in $\mathbb{Z}_n^*$, and in the second in $\mathbb{Z}_p^*$)?
What is in practice the difference between $H_1$ and $H_2$?
Supposing that $n = p = 160$ bit, may I estimate the output length for each hashing function? Is this long $160$ bit right (e.g., could be SHA-1)?
Why not simply define a hashing function as $H:\{0,1\}^* \rightarrow \{0,1\}^l$?


texts:
Say $G$ is a $PRG$ that expands its input by a single bit, so we define:
$$G'(x_1||x_2)=G(x_1)||G(x_2)$$
The exercise states to prove that $G'$ is also a PRG.
Now here is my confusion. $PRGs$ are defined for random seeds as input.
But as an adversary I know $G$. So for $x\in\{0,1\}^*$ I could always input
$$x||x$$
And now, I can check if both halves of $G'(x||x)=G(x)||G(x)$ are equal and know that this isn't random.

In the solution they assume that $x_1,x_2$ must be randomly selected as well. But then what is the point of an adversary?


texts: What is the entropy of a Mersenne Twister (MT)?

texts:
From Serious Cryptography:
"Entropy is maximized when the distribution is uniform because a uniform distribution maximizes uncertainty: no outcome is more likely than the others. Therefore, n-bit values can’t have more than n bits of entropy."

The MT strives to have as uniform a distribution as possible, so one would think the entropy is maximized and equal to the bit length of the seed.

But the MT becomes entirely predictable after 624 iterations, at which point its entropy should be considered to be zero, but the subsequent distribution is still uniform.

These two ideas seem to contradict each other.


texts:
Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance, in TLS, the PRF (MAC) is calculated over the messages produced before key agreement.

TLS 1.2 solves this by producing a separate secure hash:

    PRF(master_secret, finished_label, Hash(handshake_messages))
        [0..verify_data_length-1];

That's great but somewhat inefficient as it requires a separate hash (both regarding processing time and configuration options). Are there any MAC algorithms that can configure the key afterwards without caching the data? Or are there any reasons not to do this?


texts: On page 46 of these lecture notes, it seems to say that if we have a Feistel cipher, and plaintexts $(L_0, R_0)$ and $(L_0^*, R_0^*)$ with corresponding encryptions, then we can determine the key? But isn't this not the case by Luby-Rackoff? I'm not entirely sure what the slides are even saying. They say that we can compute $R_3 \oplus R_3^*$, but so what? How does this help determine the key?


texts: Does the generator size matter in Diffie-Hellman?

texts:
For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators.  What is the benefit of using these very large generators if they are just as safe as the generator 3?

If 3 is not the safest generator, how could one calculate the shortest length generator that would be considered secure?


texts: How to encrypt and decrypt a transposition cipher?

texts:
I encrypted the text hello there with a 3x4 table with the key 2 1 3. I fill in the text into the table row by row and got the ciphertext eohehltrl_ex(reading by column). So if I were to decrypt this ciphertext into the plaintext what should I do? I made a 3x4 table again and filled it in row by row (according to online tutorials). However, I couldn't get the same text anymore. Do I fill in the ciphertext into the table by columns? I did my homework on decrypting a transpostion cipher(I fill in the ciphertext into the table by rows and I got the answer); however when I tried encrypting and decrypting my own text I couldn't do it.

Does anyone know what I am doing wrong?


texts:
History contain many example of old steganography. We also have digital steganography.

Is there any kind of “Perfect Steganography”, in a sense that only the designer can extract the concealed message?

Update
Is there a (formal?) definition of 'perfect steganographic hiding' where only the key-holder / designer can provably recover the data and if so are there any known constructions satisfying it?


texts: ElGamal with massage hashed ind-cca secure?

texts:
It is well known that text book ElGamal  is not IND-CCA secure, because an attacker can just have $$(Y,W)\leftarrow E_{x}(LR(M1,M2,b))$$ where M1, and M2 can be any message in the group, and than just query the decryption oracle something like $$M\leftarrow D_{x}(Y,W\cdot g)$$ and test if M = M1 . g, return 0, otherwise 1.
But what happen if we added a sort of "mac and hash" to the textbook ElGamal ? like if you want to encrypt message M, it actrually running $$E_{x}(M) \Rightarrow E_{x}(M||H(M))$$, and the decryption oracle check $$M* \leftarrow WK^{-1}$$, and break M* back to M || N and only return if N = H(M). Is this fix the the ElGamal security issue and make it IND-CCA?


texts: Does a masked look-up table prevent cache timing attacks?

texts:
When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \oplus r_{out}$ (see, e.g., this paper).

On the other hand, for processors using cache techniques, look-up tables have been proven vulnerable against timing attacks (see this paper). Therefore, it is recommended to use regular implementations (e.g., bitsliced implementations).

My first impression is that the masking technique described above also acts as a countermeasure against the timing attack introduced by Bernstein (as the look-up table accesses do no longer directly depend on the internal state, but also on a random mask $r_{in}$). However some works study bitsliced masked implementations to prevent timing and power side-channel attacks (see, e.g., this paper).

So my question is, does a masked look-up table as described above (assuming $r_{in}$ and $r_{out}$ are renewed at each execution) also prevent from cache timing attacks? Are there any published papers on the link between this countermeasure and timing side-channels?


texts: Pedersen commitment on binary field $GF(2^n)$

texts: I am curious whether one can do Pedersen commitment on $GF(2^n)$. One method I thought of was to get a prime order multiplicative subgroup of $GF(2^n)$. But for efficiency and security, what would be an appropriate value of $n$ for a security strength of 128-bit security?


texts:
Is the probability of distinguishing HMAC from a random oracle is the same as the probability of forging HMAC?
Can we say that the following statement is trivial?

$\Pr[\text{Forging $\operatorname{HMAC}_k(m)$}] \geq \Pr[\text{Forging $\operatorname{HMAC}_{f(m)}(m)$}]$

where $f(\cdot)$ is a random oracle and $k$ is a random number.
Can we use equality in the above statement?

This is not a homework exercise. I think they are trivial but I am afraid if I am wrong.


texts: Why in BCNS protocol both parties don't follow the exact same key extraction approach

texts:
Why in BCNC key-exchange protocol (page 8), Bob instead of:

$K_B \leftarrow \lfloor \bar v \rceil_{2q,2} \in \{ 0, 1\}^n$

do this instead:

$K_B \leftarrow rec(2bs', c) \in \{0, 1\}^n$.

or they are the same thing ... am I missing something? I don't understand the purpose of modular rounding function as defined by Peikert in Lattice Cryptography for the Internet (page 9) and BCNS (page 6)

Because the idea is one party (i.e. Bob) sends a signal or reconciliation information (i.e. $c$) to other party (i.e. Alice) and then both should follow the exact same approach to get one bit from every coefficient.


texts: Hash Function with Same Output for Similar Data

texts:
I have some code that creates a 3D mesh. The way I process the mesh I end up with a lot of vertices that are extremely close to each other but not identical.  I want to create a hash from those vertices I can put in a dictionary to quickly look up if a vertex is in the dictionary before adding it or getting its index.
But the important thing is I need Vector3(0.001, 0, 0) and Vector3(0, 0, 0) to produce the same hash. And I need the function to be fast.
Is there a hash function that will let me do this?


texts: What is difference between Yao's "Garbled Circuit" and ther "Garbling Scheme" given by Bellare et al?

texts:
What is difference between Yao's "Garbled Circuit" and the "Garbling Scheme" given by Mihir Bellare, Viet Tung Hoang and Phillip Rogaway in "Foundations of garbled circuits"?

I also want to know is it possible to use the garbling scheme / garbled circuit for multi party computation or it is only for 2 party computation.

Link for garbling scheme is given in :
Mihir Bellare, Viet Tung Hoang, and Phillip Rogaway. 2012. Foundations of garbled circuits. In Proceedings of the 2012 ACM conference on Computer and communications security (CCS '12). ACM, New York, NY, USA, 784-796. DOI: http://dx.doi.org/10.1145/2382196.2382279


texts: Decision R-LWE parameters for spherical error with worst-case hardness

texts:
In Peikert et al.'s most recent work (STOC 2017) a direct reduction of worst-case lattice problems to decision R-LWE is achieved for $\alpha q \ge 2 \cdot \omega(1)$ (Theorem 6.2), where $\alpha q$ is the Gaussian standard deviation.

However, it is unclear to me how this parameter constraint translates to the spherical error case (Corollary 7.3). Does the hardness guarantee in this case require a potentially wider standard deviation or does it remain the same?


texts: Using a one-time pad with a block cipher

texts:
The one-time pad is often described with a simple XOR cipher.

This is nice for showing the theoretical strengths of the one-time pad, but not so great in real-world scenarios where key reuse is a danger.

So, is it feasible to use an n-bit block cipher with an n-bit key to replace the XOR operation (which itself is a 1-bit block cipher with a 1-bit key)?

So the encryption operation becomes

for each pBlock is n bits of plaintext
     take kBlock as the corresponding n bits of the key
     encrypt pBlock with kBlock as key using the block cipher and the result is cBlock
     append cBlock to the ciphertext

Decryption is the same.

Am I correct that this will make it more resistant (but not fully) to key reuse and known plaintext attacks than using the simple XOR? Or did I add a big vulnerability into the scheme?


texts:
I recently answered no to Is there a floating point CSPRNG? Unpredictable rounding errors, especially across dissimilar hardware were my reasoning.

In it's most basic form, a CSPRNG can be constructed by securely hashing a randomly initiated counter. This is what happens inside the secure random function for Java. So if we can find a hash that operates with floating point numbers, we'd have a floating point CSPRNG as originally asked for.

The following abbreviated abstract is from this paper:-

  This paper shows how one of these systems can hash messages at
  extremely high speed—much more quickly than previous systems at the same
  security level—using IEEE floating-point arithmetic.

My problem is that I can't understand the working. It's all Greek to me, but I can spot multipliers of 0.98 , 2.2 and 1.01 which are clearly floating point numbers.

Was I wrong, and floating point CSPRNGs are actually possible if not common?

Clarification:  Some comments are appearing that are only relevant to a non deterministic RNG or generating floating point output.  The original question asked for a native floating point deterministic generator. So internally it should only work with floating point numbers, as does (I think) my linked paper. It's clarification of this last fact regarding the linked paper that I'm looking for as that would pave the way for a native floating point CSPRNG.

Addendum

I've now come across Uni64() which is a random number generator that uses double precision variables.  It's by George Marsaglia.  This is an extract of the initialisation:-

const double r=9007199254740881.0/9007199254740992.;
const double d=362436069876.0/9007199254740992.0;
static double c=0.; static int i=97,j=33; double x;

Without doubt, r,d and c are double precision variables.  So for example, r = 999.999999999987676524e-3 and d = 40.2384869730987304592e-6.  To be honest, I don't know what this means.  Is r meant to be 1 an I've rounded, or it this correct?  Not sure what d could be rounded to.

"the uni64() doubles have been multiplied by 2^53"

Is this the secret?  Rounding /accumulation errors do occur as expected.  But by shifting left 53 times, they effectively become part of the randomness in the lower significance bits.  What seems like random errors in precision become part of the randomness.  And if so, this would appear to be a floating point random number generator...


texts: Zero knowledge / proof of knowledge sudoku solution

texts:
I recently started a coursera course "cryptography 1" provided by Stanford university. In one point when explaining zero proof knowledge the instructor mentions the following:

  Almost any puzzle that you want to prove you have an answer to, you
  can prove it is your knowledge. For example let's say that you have a
  sudoku puzzle which you wanna prove you know the solution to, you can
  prove it to Bob In a way that Bob would learn nothing at all about
  the solution but he would still be conviced that you know the solution
  to it.

I am terribly confused by this. How would one prove that he can solve a sudoku puzzle and prove it to X (in this case Bob) without transmitting the actual solution?


texts: “Prime conspiracy”'s effect on cryptography

texts:
Recent news reported about the discovery of a "Prime Conspiracy" which can be read about here.

In summary, researchers have discovered that the last digit of prime numbers have a greater predictability than random. The cited example is that primes ending in 9, have a 65% chance of the next prime ending in 1. I am curious if any thought has been generated around the impact this might have to cryptography, namely popular encryption methods like RSA?


texts: How does the certificate authority generate a signature F?

texts:
E=encrypt(K,M) - is message M encrypted with key K gives encrypted text E

M=decrypt(K,E) - is encrypted text E decrypted with key K gives message M

KCA−pub,KCA−priv - is the private-public key pair for a certificate authority, such as Verisign

D=MD(F) - MD is a message digest function, applied to file F giving digest D

F - is a file containing Bob’s public key, KBob−pub, and email address, EmailBob

How does the certificate authority, CA, generate a signature S from the file F using the functions above, in order to build a certificate for Bob consisting of file F followed by the signature, S?

this is my answer:
Firstly, Bob will need to go to a well-known authority (such as Verisign) to prove who he is using a passport or driving license or something to prove it is him. A public-private key is generated paying a fee and receives a certificate consisting of his public key and a statement of his identity (such as name, email, address etc.) all hashed and signed with the private key of the authenticating company.

Anyone can verify his public key belongs to him by comparing it with the signature decoded with the public key of the authenticator.

Signature
Encrypt - ED = encrypt (Kca-pub-bob, MD(F)

Decrypt - MD(F) = decrypt (Kca-private-bob, ED)


texts:
I write some certificate Authority that has it's own private/public cert keys .
This CA signs public keys of user.
If for example i have user that has a public cert that signed by the CA.
How I can verify later that the user's certificate as indeed signed by that CA if he has the public cert of the CA ?
I'm using cryptography module in Python, and there are some functions that i can use but I'm not sure how:
The representation of both certificates is X.509 , which means that one can grab the public key of the user and use verify method, this is how i used it :

caCert.public_key().verify(clientCert.signature,clientCert.tbs_certificate_bytes,padding.PSS(       mgf=padding.MGF1(hashes.SHA256()),salt_length=padding.PSS.MAX_LENGTH),clientCert.signature_hash_algorithm)

But i still get invalid signature error


texts: Why use randomness in digital signature algorithms?

texts:
I understand why randomness has to be employed in encryption, because deterministic ciphers are not IND-CPA. I don't understand why digital signature schemes that employ randomness, like RSA-PSS, are any better than purely deterministic ones like RSA-FDH. Isn't it still likely that RSA-FDH is EUF-CMA?

Acronyms:

IND-CPA: indistinguishable under chosen plaintext attack
RSA-FDH: Hash the message, then apply textbook RSA
RSA-PSS: Another RSA variant
EUF-CMA: Existentially unforgeable under (adaptive) chosen message attack


texts: Why not use random world events instead of a proof-of-work algorithm?

texts: Taking a combination of world events-- thunder, astronomical imagery, vote outcomes, stock index value-- and deriving the ID of the source of truth from a hashed combination of them could be used instead of a proof-of-work algorithm. Why isn't it used?


texts:
I frequently stumble upon the term "lightweight crypto". It tends to be used is a for special algorithms that use less resources, for constrained systems. Yet, it's somewhat unclear to me where to draw the line between "regular algorithms" and "special algorithms".
Since even some well-known cryptographers use the term "lightweight cryptography", I assume there must be an official, generally accepted definition for it. Yet, I fail to find it... since every source I trace down seems to define the term a bit different. For example: some even put AES into the basket when they were able to make it run on some limited-abilities piece of hardware, while others explicitly exclude AES from the lightweight crypto group. Same for ChaCha20, etc.
To avoid confusion, knowing the official definition (and maybe even having a reference to point to) would definitely help.
TL;DR
What is the official, generally accepted definition of "lightweight crypto"? And where (reference) is it defined?


texts: Alice and Bob each secretly chooses an integer between 1 and 10, a and b. They want to know (with high probability) whether or not a equals b, without revealing any other information. Can they?


texts: What's happens if we use the weakest S-BOX for AES?

texts:
I'm in research of generating Dynamic Secret S-BOX for AES based on 2 Keys (Encryption Key and *I Called S-BOX key). If (worst scenario) I randomly generate the worst S-BOX in an encryption. What would happen? How much it affect to the security of the encryption? I need a reference about this issue.
Thanks


texts:
The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 execution, for either known plain text, or known cipher text. In addition, the attacker has the ability to change the cipher text (CPA attack). Nevertheless only one of them, either the plain text or the cipher text need to be known to the attacker.

Suppose one avoids exposing both of them, for instance by using secret internal key AND secret internal counter for counter (CTR) mode encryption. In that case the AES-128 block cipher encrypts a counter that is not known with a key that is not known.

Additionally the cipher text is located in an external Flash. And finally, the attacker cannot change the cipher text, as described in the article.

Is such a scheme still exposed to side channel attacks?


texts: Why does Smart's attack only work on anomalous curves?

texts:
Nigel Smart's attack solves the discrete logarithm problem in linear time. It requires the curve, however, to be anomalous, i.e. to have a trace of Frobenius equal to one or, equivalently, to be of the same order as the underlying field, $\#E=p$.

Smart's paper is here: http://www.hpl.hp.com/techreports/97/HPL-97-128.html

I'm trying to understand why it doesn't work for other curves? I'm guessing that it has something to do with the properties of the p-adic logarithm but I can't quite put my finger on it.

Any hint or explanation will be appreciated.


texts:
I've just used the FIPS 140-2 tests as implemented in rngtools, the rngtest.  I ran it on a 12.3MB file of pak8 compressed ASCII text.  It passed most of the tests, with a 0.2% failure rate.  Monobit and Continuous runs tests actually complete without any failures.

It seems very lax at detecting randomness.  What's the point of this test if it (effectively) passes off a highly structured zip like file as good quality random numbers?

Here is the detail...

cat /tmp/raw.txt.fp8 | rngtest

rngtest: starting FIPS tests...
rngtest: entropy source drained
rngtest: bits received from input: 98327312
rngtest: FIPS 140-2 successes: 4906
rngtest: FIPS 140-2 failures: 10
rngtest: FIPS 140-2(2001-10-10) Monobit: 0
rngtest: FIPS 140-2(2001-10-10) Poker: 1
rngtest: FIPS 140-2(2001-10-10) Runs: 1
rngtest: FIPS 140-2(2001-10-10) Long run: 8
rngtest: FIPS 140-2(2001-10-10) Continuous run: 0


texts:
I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption.
Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What would a process of finding the key look like (brute forced strategy)?


texts: PKCS#7 Signed Data contains always different signature

texts:
I am wondering why CMS (PKCS#7) Signed Data contains always a different signature of the original data when the SHA256withRSA signature algorithm is used. (using Bouncy Castle by the way)
The SHA256withRSA is using the SHA-256 as a message digest algorithm and EMSA-PKCS1-v1_5 for encoding the message digest before signature generation operation with the RSA private key.
As these algorithms are deterministic, I would expect that each time I would create a CMS Signed Data the signature of the data will be the same. However, it is not. I can verify it with the opposite process. I will decrypt the signature using the RSA public key, decode EMSA-PKCS1-v1_5 and the resulting hash is different than hash of the original message.
Someone able to explain me how it works, why the signature is always different?
This is what should be equal from my point of view:
Message1 -> generate CMSSignedData(private key)
Generated CMSSignedData -> get signature -> decrypt(signature) -> decode -> MD2

SHA256(Message1) = MD1

MD1 != MD2 <---- I would expect that this will be equal !!!


texts:
Recently I encountered an interview question related to XOR and I have no idea how to figure it out.
The question is as below:

The algorithm is: $A\oplus B$ (operation) $C = D$

We have the value of $A$, $B$ and $D$. Please figure out the value of $C$ and the (operation). The $C$ is being dump as per the interviewer.

Is there a way to figure out the value of $C$ and the operation as in the question?


texts: Deterministic Encryption with AES GCM - how to choose the IV (nonce)

texts:
I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build the following.

I've seeking and reading for several hours now and didn't find any answer that fulfills my concerns. Therefore, I've came out with a solution which I want to have some feedback.

The Problem

I want to provide a stateless micro-service for deterministic encryption of sensitive information. Some of this information (i.e.: personal identification number) might be used as primary keys in databases, that's why the cipher text needs to be deterministic.

This microservice will have an oauth2 schema, so it will be the unique point for encryption and decryption. There won't be key sharing at all.

Different applications will call this service for encrypting sensitive information, sharing it among others and at some point, another application with right credentials will ask for it's decryption.

API pseudocode:

encrypt (sensitiveInfo: String): String
decrypt (ciptherTextStruct: String): String

Considerations

Using AES-GCM, IVs must be unique
IV must be returned along with ciphertext
IV should not be a hash of the plaintext since they don't provide confidentiality.
Ciphertext will be returned within a structure (which will contain a key "version" used for key rotation)

Proposed solution

Basically, I thought the IV to be another ciphertext:

mail (input) +--> hash() --> IV        \
             +--> mail   --> PlainText |-> Cipher text 1 (C1)
password (secret) ---------> Key       /

Then:

Cipher text 1 (C1) --> IV        \
mail ----------------> PlainText |-> Cipher text 2 (C2)
password (secret)  --> Key       /

Finally, the method encrypt (sensitiveInfo: String): String will return a structure with C1+C2 (maybe a json structure), and the method decrypt (ciptherTextStruct: String): String will take C1 from the structure, use as the IV, C2 and the secret key and return the plaintext as expected.

Feedback

I'm worried about having any kind of information disclosure on playing with C1 and C2 that I'm not seeing in this picture.

Edit: I could also use the second IV as a hash of C1, that way no playing between C1 and C2 would be possible.

I'm pretty sure that I am kind of reinventing the wheel on this, so I really appreciate some help about which is the best way to proceed.

Thanks!


texts: why are non singular curves used in elliptic curve cryptography?

texts: It is not possible to draw  tangent at all the points of a singular curve. What is the specialty of this and how it is related to cryptography and elliptic discriminant?


texts: RSA: What would happen if you chose n to be a prime?

texts: If Alice were to choose n to be a prime, instead of the product of two primes, what exactly would go wrong in the RSA cryptosystem? How would Bob decrypt her message?


texts: Does a strong dynamic accumulator exist yet?

texts:
I’m looking for a one-way accumulator which can safely add new members (deletion is not necessary) and does not rely on a trusted party in any way. Unfortunately it appears that it does not exist yet.

My project has an authentication based on a block chain (like Bitcoin) so it's manually initialized and after that it runs on its own. If I put a hash in every block, nodes relay special packets only for the authenticated users, hence the need for a simple authentication scheme without a group manager, no one is to be trusted more than yourself in his honesty. After a round of votes all the nodes agree on the entrance of a new member and the hash is changed accordingly (or witnesses depending on the scheme) and the ban of a member is simply another "black list" hash (or some other method depending on the scheme).


texts: There is a protocol similar to SRP but where a part of the secret is stored on the client side?

texts:
SRP is very useful but if our DB is leaked, an attacker could brute force a user's password with his associated salt/verifier found in the DB. I'm searching a solution to prevent this.

My first idea is to not store the salt/verifier in DB, but inside a separate binary file encrypted with our company password. The password isn't hard-coded in the source code, it's loaded (ideally in TPM) from our external USB key when we start the RESTful service. This prevent some kind of attacks but not all.

May be we can solve the problem only if the server himself can't check alone when a password is good or not. I mean, the solution is may be to store one piece of the secret on the user's device. Like if in the SRP protocol, the salt wasn't sent by the server but sent by the user's device. Of course, it's not good if the user send each time the same bytes to the server because of possible MITM interception (even if we mitigate the risk because we uses HTTS, HSTS, HPKP and TLS 1.2 minimum required).

My question is, there is a recommended protocol to do this kind of « shared-verification » please?

The best way I've found currently is this one (inspired by the FIDO UAF/U2F challenges) :

When the user sign up:

A random salt of 32 bytes is generated,
the user's password is derived with Argon2id and the salt,
the salt is saved on the user's device DB (indexedDB),
we use the derived key as a private ECDSA P-512 key and deducing the matching public key associated,
we send this public key to the server, the server store it in the DB

Then, when the user sign in:

The server generate a 512 random bits as a challenge,
the user's device derive the inputted password with Argon2id and the saved salt,
we use the derived key as a private ECDSA P-512 key and sign the server's challenge,
we send the signature of the challenge to the server,
the server use the user's public key to verify the challenge

With this solution, even a sysadmin of our staff can't brute force the password of a user in the DB because he doesn't have all the required elements to known when the password match. Of course, we can also store the user's public key encrypted with our password in a separated binary file to increase the security.

And yes, I known this technique requires that the user authorized each device he want to uses to save each time a new salt on the indexedDB, it's not a problem for our case.

Another idea, more simple, should be to keep SRP, but rather than using the derived user's password directly in SRP, to firstly use a random binary mask (XOR) on the password. The mask is saved on the user's device indexedDB.

I known the « don't roll your own », it's why I'm asking if there is a recommended protocol for that please? :)


texts: Need help understanding public key format of Barreto-Naehrig signature

texts:
I have a 256bit signature and a certificate with a public key to verify it. I had little information about the signature scheme used, but I know now that it's "ECBNwithSHA256". I have never come across these Barreto-Naehrig Curves until now.
My question to the community is: The certificate contains two point pairs (each 32 bytes) as the public key.

Can someone explain to me why the public key consists of 4 points here?
This is a Screenshot of the certificate:


texts: Does Kasisky test for Vigenère cyphers assumption always hold?

texts:
In the notes from which I'm studying I read about Kasisky test:

"Key observation: Two identical segments of $l ≤ L$ plaintext letters,
will be encrypted to the same $l ≤ L$ ciphertext letters."

Where $L$ is the length of the keyword in the sense that

$$k=(k_0, k_1, . . . , k_{L−1}) \ with \ k_j \in (0, . . . , 25)$$

Is the cypher keyword with, obviously, the number $0, ... 25$ representing each one a different letter of the english alphabet ($A=0, B=1,...,Z=25$)

But if I think about an example like this one

$ptx: $ "Our is the fury" $\Rightarrow$ "Ouristhefury"

$key: $ "$BCDEF$"

Which denoting the $ptx$ as

$$ptx = p_0p_1... , p_i,... $$

applies the encryption:

$$c_i  = (p_i + k_{i \pmod L}) \pmod {26} $$

Represented with a table:

$$\begin{array}{|c|c|c|}
\hline
\text{$ptx$} & \text{O} & \text{u} & \text{r} & \text{i} & \text{s} & \text{t} & \text{h} & \text{e} & \text{f} & \text{u} & \text{r} & \text{y}
\\
\hline
\text{$key$} & \text{B} & \text{C} & \text{D} & \text{E} & \text{F} & \text{B} & \text{C} & \text{D} & \text{E} & \text{F} & \text{B} & \text{C}
\\
\hline
\text{$ctx$} & \text{p} & \text{w} & \text{u} & \text{m} & \text{x} & \text{u} & \text{j} & \text{h} & \text{j} & \text{z} & \text{s} & \text{a}
\\ \hline
\end{array}$$

Following the definition above the two segments "ur" should be encrypted to two equal letters in the cypertext, but instead they are encypted respectively to:

"wu", first occurrence
"zs", second occurrence

I think that they're encrypted into the same two letters of the $ctx$ only when the two couples of $ptx$ letters are located in positions where the same shift occurs (same letter of the keyword).

So my question is: is there some imprecision in the statement from my notes or I'm interpreting something wrong?


texts: Question about OR operation in fully homomorphic encryption

texts:
This page (which won't let me post a comment, sadly!) describes how the original FHE paper by Craig Gentry describes FHE.

(Other references to this stuff can be found on this question.)

It mentions that once you have your key (an array of bits) and your encrypted values (arrays of floats in the range of $-1$ to $1$, with as many entries as there are in the key), that you can do an OR operation by adding the floats of two encrypted values together, and then modding by $2$.

I seem to be hitting a counter example to this so I was wondering if anyone could point out where my problem is.

Let's say that we have a key size of $1$, where the key is $[1]$ and we have three encrypted bits:

$A = 0.01$ (plain text was false)
$B = -0.99$ (plain text was true)
$C = 0.99$ (plain text was true).

If we want to compute $Y:=A \lor B \lor C$, ($\lor$ is logical "or"), we do this:

$X := (A + B) \bmod 2$
$Y := (X + C) \bmod 2$

When we actually do this, here's what we get:

$X = (0.01 - 0.99) = -0.98$
$Y = (-0.98 + 0.99) = 0.01$

If we decrypt the result $0.01$ by rounding it to the nearest integer and then taking the absolute value, we get $0$ (false).

However... false OR true OR true should be true.

Where did i mis-step?  Thanks!


texts: X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s

texts:
I created a X.509 certificate with ECDSAwithSHA256(OID=1.2.840.10045.4.3.2) by openssl.
ECC parameter is secp256r1.

Following is the signatureAlgorithm and signatureValue.

30 0A 06 08 2A 86 48 CE 3D 04 03 02 // signatureAlgorithm field
03 49 // the starts of signatureValue indicating bitstring length of 0x49 bytes.
00 // what is this?
30 46 // the sequence of r and s as specified in RFC3279
02 21 00 98 21 1C AE A4 03 EA 1C 3A 9F 4B 9A AB 94 2E 89 97 67 F1 51 76 F8 00 A8 3B 72 57 1D 95 FA C6 B8 // this is r
02 21 00 A9 79 69 AC 04 A0 8C 2E 40 7C EF 81 B4 E2 1B DE 58 BB E4 EB 3D 4A 0D 7E 2D 80 EB FA 89 B5 B6 E8 // this is s

I don't get what '00' does here.

Is it related with following statements in the X.690 specification?

  8.6.2.3 If the bitstring is empty, there shall be no subsequent octets, and the initial octet shall be zero.


texts: implications of SSH server key compromission when authenticating users against a public key

texts:
Friday we had a disagreement with a colleague of mine about the implications of SSH server key compromission

The question was stated as this :

  What could a hacker do while provided with the SSH server private key
  and a MitM position specifically when the client is authenticated with a
  public key (server configuration disallow password-based authentification)

after 20 minutes we could agree on the following facts :

Stream decryption (eg. Is SSH using temporary keys encrypted with both public keys ?)
Stream tampering (same question with HMAC keys)

Identity theft : (being able to tamper a root connexion and replace users public keys with the hacker's in the server ; user's private key is safe in his computer ... is it ?)
Identity substitution : being able to hijack the auth dialog to the compromised server and replay it in real time with an other non-compromised server auth dialog (==> hacking server A, hijaking client C connection to server A and connecting the pirate as C to the non-compromised server B)

(placeholder for any other ideas :) )

Can anyone help us to sort these out ?

Answer see @PauloEbermann answer below or this article http://www.gremwell.com/ssh-mitm-public-key-authentication


texts: Schnorr identification protocol security proof

texts:
I read about security proof of Schnorr identification protocol against impersonation attack. For the sake of comprehensibility let me sum up the protocol: Given group $G$ with generator $g$. Verifier is initialized by prover's public key $g^a$, where the knowledge of secret counterpart is to be proven by prover. The protocol runs as following:

Prover generates random $a_t\in G$ and sends $g^{a_t}$ to verifier
Verifier responds by sending random $c$ to the prover.
Prover responds by sending $a_z = a_t + c\,a$
Verifier checks whether $g^{a_z}\overset{?}{=}g^{a_t}\,(g^a)^c$

Now, the idea of the security proof was: Given adversary $\mathcal{A}$ being able to issue valid $a_z'$ against arbitrary public key $g^{a'}$, we can turn $\mathcal{A}$ into an efficient $\mathrm{DLog}\,_g(g^{a'})$ oracle.

The proof assumed we can "rewind" the adversary so that it issues 2 different $a_z$'s with respect to a single $a_t$. I didn't understand this assumption. It seems somehow incomplete to me. What if I have non-cooperative adversary? This can't be turned into DLog oracle, since such adversary were indistinguishable from honest prover who knows secret key, thus breaking zero-knowledge protocol property. So is this a complete proof, which I merely didn't get or is the fact that malicious adversary might break the protocol without breaking DLog on $G$ essentially unprovable?


texts:
Static Diffie-Hellman (cipher suites with DH in their name but neither DHE or DH_anon - requires that the server owns a certificate with a DH public key in it.

When static DH key exchange is used, the server provides a certificate containing fixed Diffie-Hellman parameters signed by the certificate authority (CA) - (ServerKeyExchange message is not used in this case).

Examples of static DH cipher suites:

TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DH_DSS_WITH_AES_128_CBC_SHA
TLS_DH_RSA_WITH_AES_128_CBC_SHA
TLS_DH_DSS_WITH_AES_256_CBC_SHA256
TLS_DH_RSA_WITH_AES_256_CBC_SHA256

From Diffie–Hellman key exchange
Alice and Bob publicly agree to use a modulus p = 23 and base g = 5 (which is a primitive root modulo 23) where p is prime, and g is a primitive root modulo p.
My question is.

Are the fixed Diffie-Hellman parameters provided in the certificate p and g ?


texts: How to generate a 128 bit IV from a 32 bit value for AES-128 OFB

texts: I have no clue how to determine suitable 128 bit IV (initialization vector) from a 32 bit IV. Encryption AES-128 OFB. The 32 bit IV has value  0x9a23773c (transmitted in front of the data). Any ideas?


texts: I've heard that textbook RSA is insecure when decryption exponent $d$ is smaller than  $N^{1/4}$ where $N$ is the public modulus. Why is it the case and what would be  a simple explanation of the attack ?


texts:
we generate heralded single pho- tons via spontaneous parametric downconversion using a 5 mm long periodically-poled potassium titanyl phosphate (ppKTP) crystal pumped with a 405 nm diode laser (200 mW). The photon pairs (signal λs = 775 nm and idler λi = 850 nm) are separated via a dichroic mirror, coupled to different single-mode fibers (SMFs). The signal and idler are obey the conversation of energy such that,
omega_p= omega_s+omega_i        (1)

I did not understand ? can some help me with this part ? how  is omega_405= omega_775+omega_850?


texts: Why is a one-time MAC secure for MAC-then-encrypt with randomized-CTR but not randomized-CBC?

texts:
The Coursera cryptography 1 course says:

  If you want to use MAC-then-encrypt mode then you should either use
  randomized-CTR or randomized-CBC. And if you use randomized-CTR then
  one-time-MAC is sufficient.

Here is the slide:

I have two question regarding this:

How we can use one-time-MAC without negotiating the different keys for each message?
What is wrong with randomized-CBC that doesn't allow us to use with one-time-MAC?


texts: Verify authenticity of TLS/HTTPS communication

texts:
I have a question regarding https/tls. Lets say a client requests a website from a server via https. The client stores the entire traffic and his secrets to disk. Can i afterwards verify the authenticity of the data in the recording?

To my understanding after the initial key exchange (which is signed by the server certificate) the client and server use the same keys for synchronous encryption and hmac calculation. Thus a malicious client can afterwards (before storing the conversation to disk) generate a fake response and encrypt it with the same key the server would have used.

Is my assumption correct?


texts: How can I calculate the feasibility of brute-forcing missing secret shares against the secret checksum?

texts:
Secret sharing has the problem of player cheating, where a forged share $s'_i$ can be sent to generate a fake secret $m'$ during reconstruction (and the cheaters can even collude to generate the real secret $m$). The literature covers that issue under the term cheating-detection on the Secret-Sharing researching field. The "naive" solution is to check the reconstruction output against the secret checksum (generated during the sharing phase as $c = H(m)$). Other approaches also include Message-Authentication of shares (akin to "signed" JWT tokens).

I'm using a XOR-based secret sharing instead of original Shamir's polynomials (referring to his paper How to share a secret). To make a $(k, n)$-threshold scheme, I'm using duplicate XOR-entries during the sharing phase (and eliminating duplicates during the reconstruction). But even with duplicates, it's possible to have missing pieces on the secret reconstruction matrix (assuming both share duplicates are not sent).

Here comes my solution for such problem: just brute-force the missing pieces against the secret checksum. I just want to know how I can make feasible the brute-force with $k$ of $n$ shares, and infeasible with $k - 1$ shares (following the definitions of Shamir's paper). The brute-force can be exponential due the number of combinations (suppose an offset of $\{1, \ldots, 255\}$ numbers - an ASCII character space/range without $0$ to not mess up the XOR-operation, $x$ rows with missing entries means $255^x$ to brute-force, that is, I would brute-force every incomplete $m_i$ instead of doing $\oplus$ on guessed entries missing here).

I know that there are issues regarding dedicated mining hardware (ASICs & FPGAs) as found on the cryptocurrency space, so a Password-Based Key Derivation Function such as Argon2 and Lyra2 could help. My headache and struggle is how to map the exponential curve of brute-forcing to be in pair with the minimum $k$ threshold requirement, including the reconstruction matrix duplicates.

Proof-of-work uses a variable difficulty balanced by the active number of mining nodes. Is there any calculations regarding the work needed to find a nonce data matching a specific kind of hash? Here in my case, the hash is fully known and the nonce would be the missing reconstruction matrix entries...

Notes about this scheme:

I'm working on this scheme here (disclaimer: I'm not an expert cryptographer). Suppose that:

$m$ is the message secret;
$m_i$ is the character of the secret at position $i$;
$l = \#m$ is the secret length;
$r$ is the matrix $k \times l$ of random integer numbers $\{1, \ldots, 255\}$;
$d$ is the random matrix with some duplicates ($n \times l$, for $n \ge k$);
$s$ is the matrix of shares with possibly missing pieces (a subset of $r$ if we remove the duplicates);
$\oplus$ is the xor operation on integer level (bitwise);
$n$ is the number of shares to generate;
$k$ is the threshold;
$c$ is the privately known checksum of the secret message.

Then, the split/share, for every character $1 \le i \le l$ is:

$
m_i = r_{(i,1)} \oplus r_{(i,2)} \oplus \ldots \oplus r_{(i,k)}
$

It's resistant for the plain-text attack and never reuses the values applied on the $\oplus$-operation (due the randomness axiom). I have tested this part of the whole idea here: https://gist.github.com/marcoonroad/e9339e462755f868500762ffb1287f90 (note: an insecure and unsafe silly code). So, with that we have:

$
(c, d) \leftarrow {\rm S{\small HARE}}(m, k, n)
$

The dealer $D$ would recover her secret key/message by running ${\rm R{\small ECOVER}} (c, s)$ (which checks if the output message matches the previously generated checksum or fails with an error $\perp$). As a side note, I can use this secret checksum to encrypt the shares, every one is a "vertical" vector of the $d$ matrix (while the secret characters are $\oplus$-applied on "horizontal" vectors), the encrypted shares make it easy for validation of invariants and sort of that.


texts: How is it possible to prove that Shanon entropy does not change applying any bijective function to X?

texts: I was wondering how is it possible to mathematically prove that Shannon entropy does not change when applying any bijective function to X? For instance H(X) = H(f(X)) assuming that f is invertible and X takes only finitely many possible values. In addition, I saw that this holds for block ciphers also but I could not figure out why?


texts: What padding algorithms are there that are MD-compliment so two different inputs don't pad to the same thing? Which would cause a collision in a hash function.


texts: Question on recovering a key in the algorithm

texts:
Let $E$ be a block cipher that has block size and key size both equal to 64 bits. Let $E'$ be a block cipher that has 64-bit block size and is defined as follows:

For a 128 bits key $K \mathbin\Vert K'$ where $K$ and $K'$ are of 64 bits and a given 64-bit plaintext block $P$, we defined

$$E'_{(K,K')}(P)=E_K(P) \oplus K'$$

Suppose I can perform a brute force attack on $E$ to recover the key in a known plaintext attack. Can I recover the corresponding encryption key if I have access to more than one plaintext/ciphertext pair for $E'$? Why?


texts:
I have been doing a study about the enigma machine for the past weeks. I managed to get ahold of the formulae used in "Cryptography, Information theory and error-correction" book for the enigma machine coding calculations.
I am aware that when the electrical signal travels towards the reflector the susbtitutions of the rotors can be represented by:

b = Rem[a+r1, 26]^α1
c = Rem[b+r2, 26]^α2
d = Rem[c+r3, 26]^α3

The reflector by:

e = (d)^β

And when the signal travels to the keyboard the formulae are inverted:

c' = Rem[e^(α3^-1) - r3, 26]
b' = Rem[c'^(α2^-1) - r2, 26]
a' = Rem[b'^(α1^-1) - r1, 26]

I am using the numeric alphabet from 0 to 25, the rotors III left, II middle and I right with the permutations

Rotor I (α1): (AELTPHQXRU) (BKNW) (CMOY) (DFG) (IV) (JZ) (S)
Rotor II (α2): (A) (BJ) (CDKLHUP) (ESZ) (FIXVYOMW) (GR) (NT) (Q)
Rotor III (α3): (ABDHPEJT) (CFLVMZOYQIRWUKXSG)(N)
Reflector B (β): (AY) (BR) (CU) (DH) (EQ) (FS) (GL)(IP) (JX) (KN) (MO) (TZ) (VW)

And the initial settings: "D", "O", "I" (r1=8, r2=14, r3=3).
When I try to code the letter "L" this is what I get:

Rem["L"+ 8, 26]^α1 = "P"

Rem["P"+ 14, 26]^α2 = "K"

Rem["K"+ 3, 26]^α3 = "N"

("N")^β = "K"

Rem["K"^(α3^-1) - 3, 26] = "R"

Rem["R"^(α2^-1) - 14, 26] = "S"

Rem["S"^(α1^-1) - 6, 26] = "K"

I checked in multiple enigma machine simulators and the correct output with the same settings is "V". Can anyone explain me why?


texts: How does MD5 divide the padded message in 16 words?

texts:
This is the image from a website that shows all the steps of the MD5 Hashing algorithm:

The original message is 'Hello World!'. I don't understand where these values are coming from:

For example the 1st word '[0]' is 1819043144. What is that number representing from the original message?


texts: How is the x coordinate of a "point at infinity" encoded in a Secp256k1 signature?

texts:
I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity ($0$) if present in a signature. For example, r could be the x coordinate of the encoding of the point at infinity.

How is the $0$ encoded? Can it be encoded?

I found that bouncycastle prefixes the encoding of 0 with 0x00, and has some other defined prefixes (ECCurve.decodePoint()) but I don't known how this information applies (or even if it does apply to) to the encoding of $(r,s)$. This info seems to be in the X9.62 standard.


texts: How to compare the efficiency of public key cryptosystems, i.e., RSA vs El Gamal?

texts:
As part of my Mathematics degree I'm taking a Discrete Mathematics module which partially covers Public Key Cryptography but does not at all enter it in depth.

I'm currently working on a project that involves writing about the process, security and efficiency (in terms of calculation/processing speed) of a few PKC systems.

I understand the processes and how to discuss the security of these systems, but I'm struggling with what makes a PKC system "good" in terms of efficiency, at least comparatively. I'm only considering the following 3 systems:

RSA,
El Gamal, &
Knapsack.

On a basic level I can compare key sizes and ciphertext expansion, but further than that I'm a bit lost; especially in terms of terminology when attempting further reading. Any direction or advice would be greatly appreciated.


texts: Selection of rotation constants in ARX design

texts:
My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ and $b$ values (shown in SIMON-like figure below) must comply with the condition $\text{gcd}(n, a-b) = 1$ where $n$ is the size. Attached ARX structures with $2/4$ branches of SPECK and Marx (Mix + arx).

How have the rotation values been selected? Was the selection it ad-hoc (then tested against common cryptanalysis such as differential/linear or rotational) or systematic such as the selection of $a$ and $b$ in SIMON-like? does the size of plaintext size (32/64/128 bit) influence the round constants?


texts: (Impossibility of?) Associative Pseudorandom Permutation

texts:
I'm not sure whether this had been a long-standing open problem in cryptography.

Definition

An associative pseudorandom permutation $f(k,m)$ is a permutation such that:

$f(k_1, f(k_2, m)) = f(f(k_1, k_2), m)$
Given $s = f(k, m)$ and $k$, the only way to find $m$ is brutal-force search.
The output of $f$ is indistinguashable from random using polynomial-time algorithms.

With such a permutation, constructing key encapsulation and digital signature would be as easy as calculating 1+1. But as of 2017, the best approximation seem to be homomorphic encryption.

Question

If everyone can infer that APP is the ideal solution to PKC, then why isn't there a concrete instance of one? What are the practical difficulties and open problems standing in the way?


texts: How can I prove ownership of hardware wallet?

texts:
I’m applying for a mortgage loan and I recently made a large deposit into my bank account from crypto stored on a ledger hardware wallet .  I sent the funds to Coinbase where I converted to usd and withdrew into my bank account.
The mortgage lender is giving me trouble about providing proper documentation. I mined most of it a few years ago so I don’t have a record of purchase.
Is there anyway that I can provide proof that I own the original source wallet?


texts: Using KDF output for password validation

texts:
I am currently revising an AES data format. I would like to determine whether a provided password/key is incorrect. Previously this was done by validating the HMAC, but this makes it impossible to distinguish between data corruption and a bad password. It also requires reading the entire stream before validating the password, which is problematic.

My new design is as follows (the HMAC step is HKDF):

prk = PBKDF2(SHA512, password, salt, rounds, 512 bits)
(validator[16], iv[16]) = HMAC(SHA512, prk, "rncryptor.validator+iv" || 0x01, 256 bits)

The validator is 16 bytes that are written to the header. During decryption, I recompute the validator to check the password before proceeding.

I believe this scheme is secure. Common best-practice for password validation is a salted and stretched hash. I believe HKDF is providing the same. My one slight concern is NIST SP 800-56a, Section 5.8:

  An Approved key derivation function (KDF) shall be used to derive secret keying material from a shared secret. The output from a KDF shall only be used for secret keying material, such as a symmetric key used for data encryption or message integrity, a secret initialization vector, or a master key that will be used to generate other keys (possibly using a different process). Non- secret keying material (such as a non-secret initialization vector) shall not be generated using the shared secret.

The validator is not "keying material" at all, so I don't believe this is relevant, but I don't understand the restriction even for "a non-secret initialization vector." Why would it be dangerous to use a proper, salted KDF to generate a non-secret IV? Does this impact my use as a key/password validator?


texts: Can the birthday attack be extended in this case?

texts:
Let $H:\{0,1\}^*\to\{0,1\}^n$ be a cryptographic hash function as a black-box, and suppose we have unlimited space.

As I understand, finding $x$ such that $H(x)=0$ (if such exists) would require a preimage attack, and avg. time $O(2^n)$ (linear in the size of the output).
On the other hand, finding $x\neq y$ such that $H(x)\oplus H(y)=0$ could use the birthday attack, and therefore avg. time $O(2^{n/2})$.

My question is, if something better can be said for finding 3 (or more) distinct values $x,y,z$ such that $H(x)\oplus H(y)\oplus H(z)=0$. It seems clear that this could be done using less samples of $H$, but it's not clear to me if the time complexity could be improved.


texts:
The Scrypt paper here defines memory-hard and sequential memory hard functions as follows:

Definition 1. A memory-hard algorithm on a Random Access Machine is an algorithm which uses $S(n)$ space and $T(n)$ operations, where $S(n) \in \Omega (T(n)^{1-\epsilon})$

Definition 2. A sequential memory-hard function is a function which  (a) can be computed by a memory-hard algorithm on a Random Access Machine
in $T(n)$ operations; and  (b) cannot be computed on a Parallel Random Access Machine with $S∗(n)$ processors and $S
∗(n)$ space in expected time $T∗(n)$ where $S∗(n)T∗(n) =\mathcal{O}(T(n)^{2-x})$ for any $x > 0$.

Put another way, a sequential memory-hard function is one where not only the
fastest sequential algorithm is memory-hard, but additionally where it is impossible
for a parallel algorithm to asymptotically achieve a significantly lower cost. Since
memory-hard algorithms asymptotically come close to using the most space possible given their running time, and memory is the computationally usable resource
general-purpose computers have which is most expensive to reproduce in hardware8
,
we believe that, for any given running time on a sequential general-purpose computer, functions which are sequential memory-hard come close to being the most
expensive possible functions to compute in hardware.

However the specification for Argon2 refers only to 'memory hard' functions.

In the case of the password hashing, we suppose that the defender allocates certain amount of time (e.g., 1
second) per password and a certain number of CPU cores (e.g., 4 cores). Then he hashes the password using the
maximum amount M of memory. This memory size translates to certain ASIC area A. The running ASIC time $T$ is determined by the length of the longest computational chain and by the ASIC memory latency. Therefore,
we maximize the value $AT$. The other use cases follow a similar procedure.
Suppose that an ASIC designer that wants to reduce the memory and thus the area wants to compute $H$
using $αM$ memory only for some $α < 1$. Using some tradeoff specific to $H$, he has to spend $C(α)$ times as much
computation and his running time increases by at least the factor $D(α)$. Therefore, the maximum possible gain
$E$ in the time-area product is:

$E_{max} = max α  \frac{1}{(αD(α)}$
.

The hash function is called memory-hard if $D(α) > 1/α$ as $α → 0$.

Questions

Is Argon2 sequential memory hard per the specification set out in the Scrypt paper?
If not, why? Is it a case of different definitions or a completely different approach?


texts: Paillier subtraction for negative result

texts:
I am trying to figure out subtraction on Paillier.

From what I read so far, given $m_1$ smaller than $m_2$ ($m_1<m_2$)
I can compute $E(m_2-m_1)$ as $E(m_2)\cdot E(m_1)^{-1}$ where $E(m_1)^{-1}$ produce $-m_1$ when decrypted.

What is unclear to me is if I can calculate $E(m_1-m_2)$ which should result in a negative number when decrypted.


texts: Complexity of solving the discrete logarithm problem for the group formed from product of 2 safe primes

texts:
The complexity of solving the discrete logarithm problem depends on the choice of the group $G$. A popular choice is $Z_p^*$ where $p$ is a safe prime (${p=2p' +1}$ and $p'$ is also prime). In this case, $G$ is a group of prime order so every element in it is a generator. We can do then:

Pick ${g}$ as a random element from $Z_p^*$
Pick a random $x$
Evaluate ${y = g^x \: mod \: p}$

Now we can assume solving $x = {log_g(y)}$ is hard if $p$ is large enough.

However, I often see the group $G$ is chosen as $Z_N^*$ where $N=pq$ and both $p$ and $q$ are safe primes. The algorithm is as follows:

Pick $g$ as a random element from $Z_N^*$
Pick $x$ as a random element from $(0, N')$ where ${N' =  p' q'}$ where ${p=2p' + 1}$ and ${q=2q' + 1}$
Evaluate ${y = g^x \: mod \: N}$

This construction is used in various publications from MacKenzie and Fujisaki&Okamoto.

What's that group? Does $Z_N^*$ guarantee computing discrete logarithm is hard? Since ${Z_N^*}$ is not a group of a prime order, is there any guarantee $g$ is a generator?


texts:
In older versions of PKCS#12 there was a key derivation function that, near as I can tell, isn't used anywhere outside of that standard:

https://tools.ietf.org/html/rfc7292#appendix-B

That discusses it. So in that standard there's a loop:

   6.  For i=1, 2, ..., c, do the following:

       A.  Set A2=H^r(D||I). (i.e., the r-th hash of D||1,
           H(H(H(... H(D||I))))

       B.  Concatenate copies of Ai to create a string B of length v
           bits (the final copy of Ai may be truncated to create B).

       C.  Treating I as a concatenation I_0, I_1, ..., I_(k-1) of v-bit
           blocks, where k=ceiling(s/v)+ceiling(p/v), modify I by
           setting I_j=(I_j+B+1) mod 2^v for each j.

   7.  Concatenate A_1, A_2, ..., A_c together to form a pseudorandom
       bit string, A.

There's an open errata against the RFC that suggests that step A ought to read more like this:

Set A2=H^r(D||I). (i.e., the r-th hash of D||I, H(H(H(... H(D||I))))

ie. it ought to replace D||1 with D||I. My question is...  should A2 be replaced with Ai? Because if not then it doesn't appear that A2 is actually used anywhere whereas AI is.

Of course, even if that's done...  if I is being changed each time then it seems to me like you'd have to be doing hash a lot. Like instead of performing the hash operation c times you'd need to do it this many times:

$$\sum _{ n=1 }^{ c  }{ n  } $$

Is that a correct interpretation?


texts:
I read The Three Ballot Voting System by Rivest. This paper-based voting system can be attacked with chain voting. But can't find any description of what "Chain voting" is mentioned in section 4.9.

Would anyone explain what it is?


texts: Which is the irreducible polynomial in GF(2^256) used in AES256-GCM?

texts:
I was able to find the irreducible polynomial used in AES128-GCM: $x^8+x^4+x^3+x+1$.

But I cant' find the one for AES256, I'm searching in OpenSSL implementation of AES256 but with no luck so far.


texts: OpenSSL: Call X509_verify_cert on a certificate with OIDs unknown to openssl

texts:
I have a DS and a csca certificate that contain special OIDs from the BSI.
They are:

0.4.0.127.0.7.4.1.1 ECDSA with SHA1 (BSI)
0.4.0.127.0.7.4.1.2 ECDSA with SHA224 (BSI)
0.4.0.127.0.7.4.1.3 ECDSA with SHA256 (BSI)
0.4.0.127.0.7.4.1.4 ECDSA with SHA384 (BSI)
0.4.0.127.0.7.4.1.5 ECDSA with SHA512 (BSI)

openssl does not seem to know them so when calling X509_verify_cert() I get this error:

stdin: C = DE, O = MyFooBar, OU = Document Signer, CN = foobar ds
error 7 at 0 depth lookup:certificate signature failure
28308:error:0D0C50C7:asn1 encoding routines:ASN1_item_verify:unknown signature algorithm:.\crypto\asn1\a_verify.c:159:

I am not a crypto nor an openssl expert, but I know that there are other OIDs for "ECDS with SHAxy" that are known to openssl.
Would it be possible to just replace the OIDs in the certificate so that openssl applies the correct algorithms? Or this there a way to "configure" openssl and make it "learn" new OIDs?
Thanks!


texts: Coding of unsigned int to prevent guessing next ID

texts:
Suppose we are assigning records an unsigned integer ID from a N-bit space (say 32-bit) in a sequential manner. Is there a way we can code this ID before showing it to the public such that someone can't guess the next ID in the sequence. It should be two-way, such that given the coded int, we can determine the original ID and 1:1 such that every ID has exactly one corresponding coded int (ideally of the same bit-length).

This doesn't need to hold up to any kind of brute force attack, but should be non-obvious to viewers if two coded integers represent IDs close together or far apart.

Any ideas? The simpler the implementation the better.


texts: RSA: How to compute plaintexts knowing ciphertexts, public key and relation between plaintexts

texts:
I'm trying to solve an exercise where you have to compute two plaintexts $p_1$ and $p_2$, knowing the corresponding ciphertexts $c_1$ and $c_2$ and the public key, of which $e=3$, and $n$ is a large number.
Also given is a relation between $p_1$ and $p_2$. $p_2 = c_1 \cdot p_1 + c_2$. Where $c_1$ and $c_2$ are constants.

I'm guessing I should use the fact that $e$ is a low number (3) since RSA is unsafe in this case. I'm not sure where to start, how should I go about solving this exercise?


texts: Where was the stand-alone model for simulation-based MPC proposed first?

texts:
The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential composition whereas the UC model provides security under concurrent composition.

It is typically cited that the UC model originated in a paper by Ran Canetti at FOCS 2001. However, I can't find such citation for the stand-alone model.

  Which work(s) introduced the stand-alone model?

As far as I understand, MPC in the 80s and 90s was not as formal as it is today, and perhaps this model was used but not formally defined. However, I still would like to know where and when the term was coined, and which works used the concept first (without perhaps naming it).


texts: Is 3 rounds more secure than 2 in this simplified DES?

texts:
Consider the following simplification of DES: a plaintext message block of $2n$ bits of length is divided into two blocks of length $n$ (left half $L_0$ and right half $L_1$). In other words, the input to the algorithm is $L_0 \mathbin{\|}L_1$, where $\mathbin{\|}$ denotes concatenation. The same key $K$ of $n$ bits is used in all rounds. The function $f(L,K) = L \oplus K$ (bitwise, modulo 2 addition) is used instead of the standard DES function. One round of encryption takes the input $L_i\mathbin{\|}L_{i+1}$ and produces the output $L_{i+1} \mathbin{\|} L_{i+2}$, where $L_{i+2} =L_i \oplus f(L_{i+1},K)$.

Describe how would Bob perform decryption of this scheme.

What is more secure, using two rounds or three rounds? Justify your answer, and point out what is the most important weakness of the proposed scheme.

Is it possible to use only 2 rounds in this case?


texts:
For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure.

I have a case where I need to regenerate an EC private key (that can be constructed by a special method) with as little stored information as possible. Fewer than 128-bits is not possible without compromising security against an exhaustive search.

I'm curious if I can use the following method:

Generate a random 128-bit value. This is the value I would store to recreate the private key.
Use a 256-bit hash, say SHA256, of the random value as the private key. (I have a method to do this that doesn't bias any keys over any others.)
The corresponding public key would be made public.

Thus, I can regenerate the private key from the 128-bit value. It seems to me that the private key and 128-bit value should be just as secure as using a random 256-bit value for the private key and storing that. Exhaustive search is clearly impractical, and the properties of the EC key shouldn't be capable of being walked backwards either from the public key or through the hash. In principle, the EC search space is halved, but it doesn't seem like there would be any practical way to take advantage of this.

Is there anything I'm missing? Is there any reason this wouldn't be just as secure as storing the full 256-bit key? Assume the public key and the algorithm are known to potential adversaries. The adversary's goal is to get the private key. It seems to me that this is obviously as secure as the underlying algorithms, but I know enough not to trust myself.


texts:
I'm researching RC4 and I am trying to recreate a condition where RC4 is crackable. However I can't quite find the article/resource I need to find the weakness for an implementation like this (python):

from Crypto.Cipher import ARC4
f = open('key.txt')
key = f.readline().strip()

o = open('output.txt','w')
f = open('input.txt')
for line in f:
    cipher = ARC4.new(key)
    print >>o, cipher.encrypt(line).encode('hex')

I know the weakness is that the same key is used to encrypt the traffic, however I need a hint as to how this might impact the security of the algorithm.


texts: Practical quantum attacks on AES - Is AES-128 used in a block mode vulnerable to attack using quantum algorithms

texts:
Can Grover's (or similar) algorithm be used to attack AES-128 when used in cipher modes like CTR?  It seems like the answer is no...  Also I have a similar question for SHA256 when used for a MAC.  It looks like using quantum attacks on SHA256-MAC would only produce only a parallel key that generates a collision for a single MAC value.  So the recovered key would be of no real value then right?

The question stems from my use of secure hardware elements for key storage and for AES.  The elements support only AES-128-mode and SHA256 MAC.  So I am being asked if we should consider updating the modules in future designs.  This is an embedded product where cost and power are limited.


texts: What's the difference between these hash functions H, H1 and H2?

texts:
These are hash functions, but I don't understand their notations, can anyone tell me what's the difference between H, H1 and H2?
$\mathbb{G}_1$ is an additive group and $\mathbb{G}_2$ is a multiplicative group. Both groups have the same prime order p and their bilinear mapping is $e: \mathbb{G}_1 \times \mathbb{G}_1 \to \mathbb{G}_2$
Source:https://www.cs.nmsu.edu/~misra/papers/T-ITS-2011.pdf
\begin{align}
H&:   \mathbb G_1\to\{0,1\}^n\\
H_1&:  \mathbb G_2\to\{0,1\}^n\\
H_2&:  \{0,1\}^n\times\{0,1\}^n\to\{0,1\}^n
\end{align}


texts: Is that possible to calculate modular inverse of a point on elliptic curves?

texts:
Imagine that you are given a point $P$ so that $P=a\times G$. If you have no knowledge of $a$ is that possible to calculate point $I$ so that $I$ is the modular  inverse of $P$?

We know that over prime fields each member has a modular inverse, which means for $a\in \Bbb F_n$ there exists $x$ so that $ax\equiv 1\pmod n$. Now, My question is, is that possible to calculate point $I$ on the same curve as $P$ for which the equation  $I=x\times G$ holds. This is to happen with no knowledge of either $a$ or $x$.

If such algorithm exists or become discovered in future will that be considered a weakness to the security of elliptic curves?


texts: Groups for which DDH is easy but CDH is hard

texts:
For prime p, is $\mathbb{Z}^{*}_{p}$ a group for which the Decision Diffie-Hellman problem is easy (because one can compute the Legendre symbol of ($g^{ab}$) while CDH is thought to be hard? Of course, computing the Legendre symbol won't always help differentiate right? But it'll work enough times to beat the DDH assumptions ("non-negligible probability"?)

Are there any more examples? For example with bilinear pairings on elliptic curves?

Many thanks.


texts: AES with shuffleBytes instead of shiftRows

texts:
I was examining how AES provides diffusion and noticed that indices of the shiftRows transposition step can be modeled as inputs/outputs of a 4x4 table:

`0123 4567 89AB CDEF -> 0123 5674 AB89 4567`

Where the input is the index of each byte of the 4x4 state, and the output is the destination index that the byte will be transposed to.

I was curious about the effect of changing the above mapping to one with strong cryptographic properties, like those found in this paper.

I have seen this question and this answer which discuss what purposes the shiftRows operation fulfills.

There is the requirement that each column should be spread evenly across the state, so as to ensure diffusion. I found that only certain S-Boxes in the above paper fulfill this property.

The first S-Box I found that does fit that criteria was the third S-Box from the second variation of the Hummingbird cipher (found in the appendix of the paper above). It looks like this:

0123 4567 89AB CDEF -> F458 9721 A30E 6CDB

If I understood the paper correctly, this mapping is among those that offer ideal differential, linear, and branch count properties. We can refer to this operation as shuffleBytes, as it's a generalization of shifting rows.

How would I go about calculating the branch count and active S-Boxes with AES using the proposed shuffleBytes operation in place of the shiftRows operation, with all the operations otherwise the same?

Is there some (obvious) reason this would be bad, assuming the transposition + mixColumns operations still ensures diffusion at least the same rate?

Addendum

After further testing, the complete diffusion over two rounds is only realized with certain configurations of bytes, and not in all cases. Maybe stacking a combination of multiple ideal S-Boxes over multiple rounds might be applied. But with just the one S-Box, diffusion does take longer then two rounds in some cases, so it probably won't be considered an improvement.


texts:
The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message.

Does the lHash field play some role in the security (confidentiality of M under IND-CCA2 or similar), or security reduction to RSA? Does that depend on lHash being checked on decryption? On lHash not leaking on decryption of malformed cryptograms?

Would removing lHash and accordingly increasing the maximum size of M harm security?

Update: Squeamish Ossifrage answers, essentially by yes. Accordingly, PKCS#1v2.2's EME-OAEP decoding wants lHash to be checked, as well as other padding, and that it be done in constant time:

  Care must be taken to ensure that an opponent cannot distinguish the different error conditions [on 00, lHash, PS, 01], whether  by  error  message or timing, or, more generally, learn partial information about the encoded message EM. Otherwise an opponent may be able to obtain useful information about the decryption of the ciphertext C, leading to a chosen-ciphertext attack such as the one observed by Manger [35].

James Manger's A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0, in proceedings of Crypto 2001, essentially shows that decryption implementations leaking if the leading 00 is present can be converted into a decryption oracle.


texts:
I am a newbie to cryptography and am stuck on decrypting a message. This message was received from a friend and I would like to crack it in order to respond. I have decrypted part of it but am unable to complete the rest due to my incompetence.

This is the message:

"ITKT'L Q LTEKTZ, O SGCT VHAHIGV!"

This is what I have decrypted so far:

"HERE'S A SECRET, I ...E ....H..!"

Firstly, I used the apostrophe as a guide to what the letter could be. The word itself is too long or too short to be a 'can't' or 'would't' word and therefore I thought it was an 's' instead of a 't'. This means that the letter 'l' is 's'.

Next, the most common letter used in the English alphabet is 'e'. The letter 't' appears more times than any other so I presumed that this was and 'e'. Thus meaning that 't' is equal to 'e'.

After that, I took a stab in the dark and guessed the first word as 'here's'. The next word is a single letter which has to be either 'i' or 'a'. With the first word now being 'here's', I assumed that the single letter after had to be 'a' and therefore the next single letter is 'i'.

This is as far as I have got and I am now stuck on the ending. I have realised that the final word contains two 'v' (one at the start and end). Also there is two 'h'. There is also a 'g' which, once cracked, could help to reveal the the other word.

I cannot determine the type of cipher this message has used and I am unable to crack the final words simply because I am a newbie and don't really know what I'm looking for.

Any help is greatly appreciated!


texts: Does GCM need to incorporate the length of the associate data and the length of the ciphertext to be secure?

texts: What is the reason for incorporating the lengths of the associated data and ciphertext into the calculation of the authentication tag in GCM? Is it for security?


texts: Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

texts:
How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. Otherwise with encryption algorithms like AES-256 it's the perfect size already.

Do I just manipulate the keylength of the second PBKDF2 output?
If I'm correct, this technically wouldn't be SCRYPT anymore but just a close variant?

Would it be at all practical to use the SCRYPT hashing algorithm as the PRF in HKDF or PBKDF2 output?

I understand how to use it as an authentication hash but as a full fledged KDF perhaps I don't have the right code and documentation is extremely unclear to me.


texts: For which RSA moduli, precisely, is $e=d$ for all $e$?

texts:
This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$
Reading the linked question, I wondered if there is a "simple" description of the set of numbers $n$ that have this property. In particular, are there infinitely many such numbers?


texts: Can one use a Cryptographic Accumulator to efficiently store Lamport public keys without the need of a Merkle Tree?

texts:
One of the problems of one-time Lamport signatures is that public keys are disposed after use, so you must generate many keys and store them in a Merkle tree. The root is the "real" public key and each signature is supplied with a Merkle branch from the root public-key to the one-time public key.

I was thinking of using a cryptographic accumulator to store efficiently the one-time public keys. The root public-key would be the the digest of accumulated one-time public-keys. A signature would only include the proof that the one-time public key belongs to the accumulator. This proof may be shorter than a Merkle branch if the number of public keys is over 256, for comparable security thresholds.

The only drawback I see is that known cryptographic accumulators (e.g. Benaloh and M. de Mare) are based on number-theoretic assumptions (such as factoring), and using Lamport signatures one is usually trying to avoid those assumptions, probably to get quantum computing resistant schemes.

Nevertheless, I suspect there are cryptographic accumulators which are quantum computing resistant, so the argument may not be strong enough.

To summarize, may cryptographic accumulators serve as a more efficient method to distribute Lamport public keys ?


texts: Difference between single-pass and two-pass MACs

texts: I am having trouble understanding where the count of "passes" come in. What constitutes a pass in the context of message authentication codes? How are single-pass MACs achieved?


texts: How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

texts:
So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a few years. With Shor's algorithm, elliptic curve cryptography will likely be the first to fall as it has lower key lengths and therefore a lower number of qubits are required to break it. If using RSA with larger key sizes e.g. 2048 bits, this may buy a few more years of time, hopefully then a transition to post-quantum algorithms can be made.

Does anybody know:

How many qubits are required for breaking RSA 2048 and RSA 4096 in real-time with a quantum computer?
How many qubits are required to break Curve25519?
I want to work out the relationship between the key length and number of qubits required to break that key length. Is there a simple layman's formula for working out how many qubits are required using the number of key bits and number of qubits as inputs into the function? E.g. n = number of public key bits, q = number of qubits the machine has, a = the answer (number of qubits required to break it). Maybe the formula is just a = n = q, i.e. 2048 qubits are required to break RSA 2048.

If you can prove your answer with citations to any papers or research that would also be beneficial.

Edit: I have found this answer. Anyway if I plug in N = 2048 to the Θ(log(N^2)) equation, this gives me 15.25 qubits required to factor RSA 2048. RSA 4096 bits is not much better, requiring only 16 qubits. Is that correct?! Why is everyone not running around with their hair on fire?


texts: How much would this AES modification improve security?

texts:
How much would using AES-CTR like 3DES improve security?

Like so (Using a 512-bit key split into two; $K_1$ & $K_2$, and seperate nonces for all stages):

Encrypt plaintext $P$ with key $K_1$
Decrypt ciphertext $C$ with key $K_2$
Encrypt muddled text $M$ with key $K_1$

How much would this improve AES's security?

EDIT:
After being asked to clarify my idea pseudocode (python like) is available below:

nonces = urandom(16), urandom (16), urandom(16)
key = 'legorooj'*8 # Example purposes, IRL I use Scrypt

msg = 'random message'

data1 = aes_ctr.encrypt(msg, key[:32], nonces[0])
data2 = aes_ctr.decrypt(data1, key[32:], nonces[1])
final_data = aes_ctr.encrypt(data2, key[:32], nonces [2])

Decryption would be the reverse operation of course.


texts: Recovery of RC4 key when S-box 0 stage or 1st stage known

texts:
I've been exploring around, trying to understand if such thing is even possible. I have some RC4 ciphertext which I know it's plaintext and I would like to extract the key just from cipher and plaintext. While reading through "RC4 Stream Cipher and it's variants" by Goutam Paul I came a cross (4.1.1) PRGAreverse algorithm on p.65 (Chapter 4.1) providing candidates for S by supplying to it a state of S and state number:

As both KSA and PRGA are deterministic, I guess this PRGAreverse algorithm should work but I'm having difficulties understanding the probability for each candidate. I mean, let's say I get 5 candidates for S[i], i=0, then how should I know which is the right one without trying to use it against the ciphertext nor plaintext?


texts: Functional encryption for inner products from DDH

texts:
I have been reading this paper by Abdalla, et al. But there's something I don't get about the security proof (Theorem 3.2) for the basic IP scheme from DDH--how are they simulating the mpk's using $g^a$?

I understand that for each basis vector they are sampling secret keys, and for $x_1 - x_0$ they are implicitly setting the secret key $a$. Now, my question is, are they generating the mpk's by finding the canonical vectors and representing the mpk's as a linear combination of the public keys of the corresponding basis vectors? If so, then why is this needed at all?

They can simply sample the secret key for $x_1 - x_0$ as they did for the other basis vectors and represent the mpk's in this way: $(g^a)^{\alpha_i}$, where $\alpha_i$ is the secret key for the i'th basis vector. And, in this way they will be able to answer for queries where the predicate $y_i$ is orthogonal to $(x_1 - x_0)$; the simulator will not answer for $y_j$ where $y_j$ is not orthogonal for $x_1 - x_0$.

I may be missing some crucial point; but, at this moment, I am even unsure of that. So, any help will be highly appreciated.


texts: Is it safe to AES-CBC and AES-CMAC both using the same key?

texts:
There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not).

I have a situation where I need to transfer some data. My data has variable length (but padded to 16-byte blocks, of course) and I encrypt it using AES-128 in CBC mode. It is done like this:

I first prepend the data with last 16 bytes of previous ciphertext I sent out, append data if it needs to round to 16 byte block, and then finally encrypt it. Therefore my plaintext looks like this: [random_16_bytes_as_IV] [DATA] [PADDING]
Then I calculate AES-CMAC over the entire ciphertext (using the same key used for encryption) and append it to the ciphertext and finally transmit to the receiver. So my transmission looks like this: [CIPHERTEXT] [CMAC]
Receiver receives, verifies the AES-CMAC, decrypts and discards first 16 bytes of IV and whatever was appended for 16-byte block padding.

A while ago it was suggested to me to use AES in CBC mode along with CMAC for a pet-project I am working on (Is this an acceptable implementation of ARC4 encryption for my system?) and now I wanted to check if this is the right way to do it. Even though it is a pet-project I should at least give my best to do it correctly.

My concerns are bolded above. Also, please note that those 16 bytes that I prepend are actually the AES-CMAC of preious transmission, maybe I should not use those 16 bytes but use the last 16 bytes of actual ciphertext instead? - or it doesn't matter since they are both known from previous transmission...


texts:
We are working on a project in which we will need to encode and encrypt 1 - 1.3 kb worth of data at a time. We need the result of each piece of data to be the same size it was before, or be smaller, or be only slightly bigger. Basically as small as it can be while still being secure and still being able to get the original data back by decrypting and decoding.

If you were doing something like this how would you best approach it? Is there an encryption algorithm that only adds minimal (if any) size compared to the size of the unencrypted data?

This is in JavaScript and will run in browsers.


texts:
The original HMAC paper based the security proof on the fact that the compression function of the Hash is already a MAC (appropriately keyed).

How does this relate to common assumptions for compressions functions?
Is it required to show security of the Hash function?
Conversely, can a good hash function have a weak compression function which is not a MAC?

This is of course related to my question about which compressions functions are PRFs.


texts: Will CT (Certificate Transparency) override the use of CAA and/or DANE/TLSA records?

texts:
I'd want to know if some of these competing technologies has more chance to survive. It seems they are thought to solve a similar problem by different manners and I'd want to stick to the most compatible/used/foreesable to win.
It seems it's CT but I'm not sure.
Thanks!


texts: Need help cracking a Vigenère cypher with a period of 2

texts: How do you crack a long Vigenère cypher when the key is unknown? I have tried frequency analysis, but I'm not making any progress.


texts:
I am unable to find a reliable, tested library for a decent password based key derivation function e.g. Scrypt in the programming language I am using, but I have a reliable library for PBKDF2 (which by default uses SHA2-256) and it also allows me to replace the hash function to use Keccak-256 (C=512) instead.

Is there anything wrong with swapping SHA2 for Keccak for use in PBKDF2? For example, maybe Keccak is not designed for this usage?

Would it be considered a better PRF than SHA2?

I understand it's not a memory hard function, so not as effective as Scrypt in slowing down a serious attacker, however I can compensate for that by restricting password length to at least 30 characters and 100,000 or so iterations.


texts: I know that it is possible to define RSA over elliptic curves just as DSA and Diffie-Hellman have been. I know that it doesn't offer much of a speed advantage, but does it at least reduce the size of the keys?