texts: Induction is problematic in computational cryptography - Why?

texts:
In Dr. Lindell's lecture The Yao Construction and its Proof Of Security, in briefly explaining the hybrid argument, he makes the statement that mathematical induction is a problem in computational cryptography. He is explaining that a hybrid argument is "like" mathematical induction, but not the same.

As far as I know, mathematical induction and hybrid arguments are not the same because for a hybrid argument, you need a finite ($k$) sequence of distributions for the proof to work (that is, eventually bounding the sum of the $k$ negligible differences by the max difference * $k$, which is negligible). For an infinite sequence, this doesn't work.

Does anyone know what Dr. Lindell means? I have a suspicion that it's a deeper point related to computability, but I'm not sure.

Thanks!


texts: Quite a specific question, but are there any threshold signatures that are also homomorphic? Preferably ones that work in the discrete log setting and don't require any pairings.


texts: Does the security proof of HMAC somehow change if it's instantiated with sponge-based hash functions with small rate and large capacity?

texts:
HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function.
The hash functions considered in that paper were ones based on the Merkle-Damgaard paradigm where in most cases, block sizes that messages're chunked into are greater than the output length of the hash function. For keys larger than then block size, the key will be hashed before use.
After the success of Keccak/SHA-3, permutation-based cryptography becomes increasingly popular, and I noticed something a bit strange. The Gimli hash function as proposed in its current form [2] in the Round 2 of NIST Lightweight Cryptography project, has capacity only capable of 128-bit overall security, for both collision and pre-image resistance, but with a 256-bit output.
Q: What will happen if HMAC was instantiated with Gimli? Will the security strength of HMAC-Gimli256 decrease from 256-bit to 128-bit and why and how? Can it use keys larger than 128 bits?

[1] Keying Hash Functions for Message Authentication Mihir Bellare, Ran Canettiy, and Hugo Krawczyk

[2] https://csrc.nist.gov/CSRC/media/Projects/lightweight-cryptography/documents/round-2/spec-doc-rnd2/gimli-spec-round2.pdf


texts: Bouncy Castle elliptic curve from explicit parameters (E-521)

texts:
I'd like to use a curve that's not included in the Bouncy Castle EC named curves spec, specifically E-521.

According to the BC javadocs, you need a few values in order to do this: q, a, and b for the curve, then G and n for the parameter spec.

import org.bouncycastle.math.ec.ECCurve;
import org.bouncycastle.jce.spec.ECParameterSpec;
...
ECCurve curve = new ECCurve.Fp(
            new BigInteger("883423532389192164791648750360308885314476597252960362792450860609699839"), // q
            new BigInteger("7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc", 16), // a
            new BigInteger("6b016c3bdcf18941d0d654921475ca71a9db2fb27d1d37796185c2942c0a", 16)); // b
ECParameterSpec ecSpec = new ECParameterSpec(
            curve,
            curve.decodePoint(Hex.decode("020ffa963cdca8816ccc33b8642bedf905c3d358573d3f27fbbd3b3cb9aaaf")), // G
            new BigInteger("883423532389192164791648750360308884807550341691627752275345424702807307")); // n
KeyPairGenerator g = KeyPairGenerator.getInstance("ECDSA", "BC");
g.initialize(ecSpec, new SecureRandom());
KeyPair pair = g.generateKeyPair();

I think q is the field.

Would a and b be base points?

What should be used for G and n?


texts: Is TLS finished message encryption at record protocol redundant?

texts:
TLS finished message is encrypted under the record protocol's current cipher state. Being able to authenticate FINISHED message at record protocol proves that the genuineness of peer endpoint. Verifying handshake_hash proves that the handshake has not been tampered by MITM.

The verify_data in FINISHED is calculated using PRF and master secret. So the verification of verify_data should be a sufficient proof of both the authentication of peer and handshake message sanity.

Why additionally the record protocol does cipher operation on FINISHED message?
I think it could have been equivalent if FINISHED message were sent before change_cipher_spec.


texts: For KEM's, do you only exchange a private key once via the public key encryption and then do all further encryption with this private key, or is a fresh private key sent out with each message?  The latter seems inefficient, but I could also see issues in having to store private keys for everyone.


texts: Signal Protocol: What extra features does double ratchet algorithm add to Diffie-Hellman ratchet?

texts: I have been reading the documentation of Signal protocol and could not find out why they came up with double ratchet instead of using Diffie-Hellman ratchet which was available at first place in OTR?


texts: I am looking for typical input lengths for key derivation functions like the HKDF. I know the parameters of HKDF, but can not find any information about typical input sizes to HKDF or any of the other KDFs. What are the typical input lengths for KDFs? If possible, can you also point me to (a) relevant reference paper(s)?


texts: Is it true that 7zip doesn't use any salt with its KDF?

texts:
This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679

If that's true, wouldn't that mean you can crack multiple 7z files at very little extra cost?


texts: Why does SHA2-224 use different IV's than SHA2-256?

texts: Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.


texts: How exactly to extract information base 10 from a PGP RSA key pair?

texts:
I think I understand the mathematics of RSA ok. I'm not so computer savvy though. How, exactly, can I extract $n$, $e$, $d$, $p$ and $q$ from a PGP RSA public key pair? Is there like a converter online? What exactly is the language used when you see a PGP key? Is it Base64 or something?

So, for example (and I am well aware that you shouldn't post private keys online). Where are $p$ and $q$ in this private key?

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v1.2.3 (OS/2)

lQHWBD3X7JABBADfDcT9WgUZsAXC2jaLXbVRbkI/vmZWqFT1bBTicnHEOf0EZRKl
o2eIJWf0UIMvBC840efecOGKEmtubHyyas5aSDThQZM8PyCKRrJhGX02UHwCvNRi
XzAD1wteFyGtkVYmlHTR84fjyk9V1BlsZLNTZdTbKQ//Yuxww1qPTrlqNwAGKQAD
/2ddy62aG1bUsX/CyBse8B9+BbmjKS5m+6ntZ1Y1CQOFBNySvbbn0lHS5T9Eh7gh
KJ10AU4bVclZtOg+wyb5TORKNJ6ywjvj+DDMFekoWlfMwhw+utZVEpbJkK7vJNQg
jGBX0+L2uEbv/Z5wFpucoLxNX5fg+nDUxzP+d3VXAlLJAgDrZOc2usLMfMXNh+p0
5xfSAa8QmpumEM/1ARyV12BLhf0/nuVIZPkK9mfTdO5xk/OC35FhJLqQzHSoyNeW
wPRvAgDylFK+/3F5O1ssj2SQ4KRmULhoOs/Lpj9XgTPOFcbkoT58XYmkNvNbKCxS
It1QS0LQNHtOOqIvZKbagnckopq5Af9IGvyE53vEmp6lfop0yZFmO8NQPbcv+B5k
rUAValTyeDTyH7Qc2pdm/SGok47vSc+5Uyyx6/X6hUHF1sfSIoVVrC60hFJ1c3Nl
bGwgU3RldmVuIFNoYXduIE8nQ29ubm9yIChMT1cgU0VDVVJJVFkgLSBzZWUgPGh0
dHA6Ly9tYXRoLmJlcmtlbGV5LmVkdS9+cm9jb25ub3IvcHVibGlja2V5cy5odG1s
PikgPHJvY29ubm9yQG1hdGguYmVya2VsZXkuZWR1Poi4BBMBAgAiBQI91+yQAhsD
BQkB4TOABAsHAwIDFQIDAxYCAQIeAQIXgAAKCRBNPmjuaEZDWZ9vBADQCY9J5ZnV
VYfQBf5F3d6yhNxzXJaFIHEemsBA37dgwCJc3+49KBBJFB91PFlVwgz9PCgux8YJ
yUDsDh56pzXycCxcBav0O/MBapN1rq5/X22vtKrKxSfKjMLfQlto7VWv9vNwzlZA
ClJPYBDOZt5DxA3RECsuNxEvb28bfT5epQ==
=VufU
-----END PGP PRIVATE KEY BLOCK-----

And in general, given anything like this or a public key, how do I go about extracting the actual integers base 10?

Thanks!


texts: Possible to decrypt every fragment of an ecrypted file on its own?

texts: I have a project where I want to encrypt a file and split it up into several fragments and place these files on different systems. I want to do it on mobile phones as well, so I chose poly-chacha20 as encryption. In my tests it was faster than AES based encryptions. The concern of my tutor is now, that because of the nature of stream ciphers, it would be possible to decrypt each of the several fragments on its own, as long as you have the key, which would be a no go. In my tests I could decrypt the starting fragment, but not the fragments after that, so I'm not sure what is correct now. Is it possible to decrypt every fragment with the given key? Or is it needed that you have all the fragments first before decrypting them?


texts: Is there a way to find the two generator polynomials of a JPL sequence?

texts:
I am decoding a binary sequence that was detected as an unpractically long LFSR by the Berlekamp-Massey algorithm. First of all, the generated sequence is far longer than it needs to be and since it needs to be decoded in real-time in the application, the LFSR is so long that the latency would be unpractically high. It doesn't make sense really.
So I am suspecting this to be a JPL sequence, which as far as I understand is comprised of two LFSRs that are relatively prime to each other and can generate much longer sequences. Literature says that it was developed to decrease synchronization time of long signals. Please correct me if I am wrong!
If so, is there a way to find the two single LFSRs of the JPL sequence?
If not, what other type of sequence could this be?
Here is a sample of the sequence:
0000011100111111111100000111110001100000111111111100011111110000011111111001111100000111001111111111111000000011111000111111111100111111110011111111001110000011111111110011100111111110011111000110001100000111110000011111000110001111111000001110011100111


texts:
For this question, the following caveats and assumptions hold:

There exists a 2048-bit RSA key pair used exclusively for signing/verification
The private key is kept completely private
There exists a group of users who have the public key
There is a group shared password
I (mostly) understand the functional difference between encryption/decryption and signing/verification for RSA, but not the specific math differences
I am aware of hashing

Given the Following Operation

"ciphertext" = RSA_sign( public_key, random salt + password )

What are the security implications if using PKCS#1 old-style v1.5 padding?

Obviously, this is not the accepted way of doing things -- one does not sign with a public key.  Basically, the end result is a deterministic "encryption" of the password which can ultimately be compared among the members of the group.  That is, because there is no randomization of the padding, each member can perform the same procedure and arrive at a comparable result.  So member A and member B (neither of which have the private key) can perform this operation (as long as they have the salt) and determine that the password is the same.  (Hashing, of course, would be a much better solution.)

The above scenario is susceptible to known plaintext attacks.  eg. Similar to a hash, a malicious user can attempt to brute-force the password by simply trying combinations until they get a comparable result (the salt is, for all intents and purposes, public knowledge).

Is the private key at risk (I don't believe it is)?
Is this weaker than a hash such as SHA1?

UPDATE: After thinking about the relative security of this "RSA-hashing" mechanism to SHA1 for collisions, I realize that there would be an increased chance if msg.len > RSA.n.

(Please don't tell me to just use hashing. This is not the point of the question.  I have seen questions asking if it's okay to "encrypt" using the private key which is a clear security problem, but I've never seen an answer to the question of signing with the public key.)


texts: In RSA encryption, why does the public exponent (usually, 'e') have to be coprime with $\varphi(n)$?

texts:
I have seen that there is a similar question here but none that really answers the question. I understand that if I choose the encryption exponent $e$ not coprime with $\varphi(n)$ then there is not a unique way to decrypt a message.

What I am wondering is what is the mathematical reason behind this? It seems to me that since $m^{(k \varphi(n)+1)} = m \bmod N$ and $d$ is defined as $(k\varphi(n)+1)/e$ then $d\cdot e$ is always going to be $k\varphi(n) +1$. What am I missing?


texts:
During the key exchange, Alice and Bob both select a random natural number.

The question is how big this integer is? How many digits/bits it must have at least/most?


texts: In their Technical Guideline TR-02102-2 Cryptographic Mechanisms: Recommendations and Key Lengths the BSI is giving minimal key lengths for - e.g. the TLS handshake protocol. All of these are not integers that are a power of two. I always thought, that it was the norm to give key lengths as powers of two. Is it not?


texts: Is it hard to find a big random easy to factor number?

texts:
Suppose that I give you the challenge of successfully factoring any very big random number. That is, you pick a big random number (say, 65536 bits) and try to factor it. If you manage to, you win. If you don't, you can keep trying, or pick another random number, until you factor any big number. How hard is to win this challenge?

To put it in another way, suppose that I offer you a lot of money if you give me a tuple (nonce, rnd, factors), where nonce is any number selected by you, rnd is the 65536-bit variable length SHA3 output of the nonce, and factors is the list of prime factors of rnd. Will you be able to take my money?


texts: Where can I double check my elliptic curve results?

texts:
I am trying to do some elliptic curve calculations by hand, just to refresh myself on how the system works. I calculated some points and did some operations by hand. I am trying to double check my work with some web calculators, but I have tried several different calculators and each gives me a different result...

Is there a verified implementation or library somewhere that I could use, rather than pet projects that people have on their websites?

I am working with the curve

$y^2 \equiv x^3 - 2 \pmod 7$

I calculated the points to be

$(3,2),(3,5),(4,1),(4,6,),(5,2,),(5,5),(\infty, \infty)$

I calculated $(3,2) + (5,5) = (3,5)$ I'm fairly confident in this answer.

The problem I'm struggling with however is $(3,2) + (3,2) = (3,5)$. I have tried several times and have gotten the slope between the two points to be $27/4$. When I convert this to an integer $\mod 7$, I get the slope equal to either $3$ or $5$. When $m=3$, I get the point $(3,5)$. When $m=5$, I get the point $(5,1)$, which isn't on the curve, so I'm assuming I'm doing this step incorrectly.


texts: Encrypt user email but be able to find user by email

texts:
Sorry for my dumb question, but it's better to ask dumb question than to do dumb things silently.

I want to encrypt user email in my DB so that if someone stole the DB (and not the key) - he won't be able to restore the email adresses. But I need to be able to find user by email in my DB. And I can't iterate over all the emails in the DB, decrypt each and compare - this is too slow (minutes, hours).

If I encrypt emails with AES with random IV - then each time I encrypt the same email - the encrypted value is different. This is great for security but this way I can't just encrypt the given email and search for a value. If the IV is the same each time - then as far as I understand if attacker have enough encrypted values - he can easily find the key, right?

I was thinking about storing original email hash alongside the encrypted value, but this way attacker will be able to recover original email values by encrypting emails from some dictionary with the same hash algorithm and comparing hash values with values in the DB.

I thought about storing hash of original email+some_fixed_secret. Is this secure? If not - is there a secure solution to my problem?


texts: What are the weaknesses in a block cipher that uses modular addition, rotations with fixed amounts, and XOR? Can substitution boxes or permutation boxes be replicated with these three operations? Would the weaknesses in an ARX block cipher be present in an ARX stream cipher?


texts:
Is the CECPQ2 key exchange, as deployed by Google[1] and Cloudflare[2] in TLS 1.3 forward secure against quantum computers?

I know that it is using HRSS+SKY as the post-quantum part of the key exchange, but the papers I could find that were describing it do not speak of forward secrecy (either as a present or an absent property).

I do know that the CECPQ2b variant is based on SIKE, and that one has a Diffie-Hellman like operation[3], so it can provide forward secure operation.

I'm mostly interested in how the post-quantum algorithms can provide forward secrecy and at the same time not require use of either HelloRetryRequest handshake in TLS 1.3 or out of band server key distribution.


texts: Secure way to compare two secret numbers without disclosing them?

texts: For example, two people want to know who is the older, without disclosing their age. Is there a secure way to do this without a third party involved?


texts: DH key exchange with only one end authenticated

texts:
We know there is a man in the middle vulnerability with unauthenticated DH key establishment. And the way to negate that is to use authenticate the keys used. But what if I only verify the signature of one end. Is there any vulnerability then?

EDIT: To be clear, I am not referring to the fact that the authenticated party does not know who its talking to. I am specifically thinking about a cryptographic vulnerability where someone who does not have control over the machine (of the unauthenticated end) can do some damage.


texts: Question about publication "Efficient (k,n) Threshold Secret Sharing Schemes Secure Against Cheating from n − 1 Cheaters"

texts:
In the paper on section "4 Proposed Scheme", I suppose that the scheme does not protect if an adversary has access to the $k - 1$ original shares, am I correct?

If the adversary has $k - 1$ of both polynomials then it can obtain the difference: $\sum^{k-1}_{j=1} (g_{j} \cdot l^{'}_{j} - f_{j} \cdot l^{''}_{j}) = (f_{n} \cdot l^{''}_{n} - g_{n} \cdot l^{'}_{n}) = d$ and perform an attack by selecting polynomials and values such that $\sum^{k-1}_{j=1} (g_{j} \cdot l^{'}_{j} - f_{j} \cdot l^{''}_{j})^{'} = d$ to get the forged values for $v_{n}$. Would this be feasible?

I don't see this as part of their threat model, but in practice it is a reasonable assumption.


texts: RSA Encryption: What happens if n is a factor of the message M?

texts: From what I have learned about RSA encryption, the message M and the modulo n must be coprime because Euler's theorem only holds for coprime numbers? for example, what happens if I choose p = 3, q = 11, n = p*q = 33, ϕ(n) = 20, e = 7, d = 3, and I choose the message M to be 66? when I try to encrypt the message : m^e mod n, i get 66^7 mod 33 which equals 0? Am i doing something wrong here, or does RSA not work when M happens to be a multiple of n?


texts: Are there any symmetric cryptosystems based on computational complexity assumptions?

texts:
Are there any symmetric cryptosystems which are provably secure in the sense that there exists a reduction from their security to the hardness of some underlying hard problem such as integer factorisation?

If not, why not?


texts: Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key?

texts:
Consider a case where we have a master key MS that is used in pseudo-random function to generate a set of pseudo-random values. Then we use key derivation function to derive a key from each of pseudo-random values. Assume all the keys are long enough (in security context).

Question: In the above scenario can I use the keys derived from the pseudo-random values (or the derived keys) as a encryption key or a key for pseudo-random function?

In other words, is there any situation where we should not consider a derived key as an actual random key?


texts: Should Ed25519 signature verification check the order and canonicity of its inputs?

texts: Studying different implementations of Ed25519 I see that some of them check the order and canonicity of input public key and signature and some other not. Why this difference? Are these tests relevant in the sense that points specially chosen points to be non-canonical or have an small order reduce the strength of the algorithm against forgery or tampering?


texts: Why has the McEliece cryptosystem not gained much acceptance, but now is a candidate for post-quantum cryptography?

texts:
I understand that the McEliece cryptosystem is an asymmetric encryption algorithm developed in 1978 by Robert McEliece, almost around the same time RSA came about.

Why has the McEliece cryptosystem never gained much acceptance in the cryptographic community, but now is a candidate for post-quantum cryptography?


texts: Why use indexing for searchable encryption?

texts:
Searchable encryption can be separated into sequential scan and indexing. Besides increasing search speed, why do we use indexing in searchable encryption?

As an end-user, we do not usually make a keyword list of our document. So, if we don't build an index for our document, is there a method to do searchable encryption (which considers the full text)?


texts: Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key of a choose One Time Signature. My question is What's is a trapdoor between these two keys?


texts:
I have a question about linear block erasure codes that are described in this paper.
I briefly describe the idea behind the linear erasure codes and then I ask my question.

Given a set $d=\langle x_i \in GF(2^q)|i=1,\cdots,k\rangle$ of data packets, the general idea of (systematic) erasure codes is to generate $n-k$ extra packets $e=\langle y_j \in GF(2^q)|j=1,\cdots,n-k\rangle$, such that given any $k$ packets out of the set $\{x_1,\cdots,x_k,y_1,\cdots,y_{n-k}\}$ one is able to decode the original set $d$.

To generate the extra packets, we consider an $(n-k) \times n$ generator matrix $G'$ and compute $e=G'd$.

The paper claims that if the rows of the generator matrix are selected from a Vandermonde matrix:

$$
V=\begin{bmatrix}
1 & \alpha_1 & \alpha_1^2 & \dots & \alpha_1^{k-1}\\
1 & \alpha_2 & \alpha_2^2 & \dots & \alpha_2^{k-1}\\
1 & \alpha_3 & \alpha_3^2 & \dots & \alpha_3^{k-1}\\
\vdots & \vdots & \vdots & \ddots &\vdots \\
1 & \alpha_m & \alpha_m^2 & \dots & \alpha_m^{k-1}
\end{bmatrix}
$$
where $\alpha_i \in GF(2^q)$
then the computed vector $e$ has the desired property.

Now my question: Assume $n-k=2$, i.e., any loss of 2 packets can be recovered.
Let,
$$
G'=\begin{bmatrix}
1 & \alpha_1 & \alpha_1^2 & \dots & \alpha_1^{k-1}\\
1 & \alpha_2 & \alpha_2^2 & \dots & \alpha_2^{k-1}
\end{bmatrix}
$$

By definition of the erasure codes, the submatrix consisting of any two columns of the matrix $G'$ must have rank 2. But we know that for $\alpha_1, \alpha_2 \in GF(2^q)$ and $\alpha_1 \neq \alpha_2$, we may have $\alpha_1^s = \alpha_2^s$ for some $s$.
It means that the matrix

$$
\begin{bmatrix}
1 & \alpha_1^s \\
1 & \alpha_2^s
\end{bmatrix}
$$
has rank 1 rather than 2. So, it means that if packets $x_1$ and $x_{s+1}$ are lost, they cannot be recovered using the set $e$.
Generally, the fact that an $m\times m$ Vandermonde matrix is non-singular,
does not mean that any submatrix of it has full rank, does it?

Did I misunderstood the concept or is it the fault of the paper?


texts: Elliptic curve in Binary Field implementation

texts:
For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$.
In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm
, there is a usage of prime numbers, particularly for the calculation of multiplicative inverse. It works fine for the Weierstrass form of Elliptic curve over $GF(P)$.
Now, I want to implement ECDSA using a binary form of Elliptic curve (like Hessian curve), but every time I am doing it, it is giving the wrong answer. My question is, is it not possible to use any curve over $GF(2^n)$ for an implementation like this?


texts: Is a composition of clocked entities a clocked entity in the UC model?

texts:
In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering both synchronous and asynchronous protocols in the UC model. A clocked entity is an interactive agent which has certain rules that define how the activation token is passed.  The exact formulation of interactive agents, interactive systems and clocked entities can be found in the above mentioned book.

I have two doubts regarding the concept of clocked entities, which are described below:

Is the composition of clocked entities a clocked entity?  The authors claim that this is trivially true and does not require a proof, however, I'm not convinced with this claim. I have constructed the following counter example for the same:

Consider an interactive system $\mathcal{IS}$ composed of three clocked entities A, B and C. Further, consider a clocked entity D outside the system $\mathcal{IS}$. Let say the activation token enters the interactive system $\mathcal{IS}$ at port A.infl. Further A calls B, which in turn calls D. At this stage, A, B and $IS$ are in the calling state by definition. Now let say D calls C, which is currently inactive, hence C is activated now. But if $\mathcal{IS}$ was a clocked entity in the calling state, it should have bounced back the activation token when it receives activation token on any port other than D.leak. Hence $\mathcal{IS}$ does not follow the satisfy all the requirements of a clocked entity.

Please let me know as to what is wrong with my construction above and how the composition lemma follows from the definition of clocked entities and interactive systems.

How do clocked entities help implement synchronous protocols? What does the word "clock" signify in the word "clocked entities"?


texts:
I am looking into the GMW protocol's evaluation for multiplication in 2 parties. I have referred to different materials on it but I didn't exactly understand how $a_i b_j + a_j b_i$ is calculated in a 2 party setting.

As you know multiplication in GMW is given as $$(a_1\oplus a_2\oplus \cdots \oplus a_n)(b_1\oplus b_2\oplus \cdots\oplus b_n) = \bigoplus_i(a_i b_i) \bigoplus_{i<j}(a_i b_j \oplus a_j b_i).$$

Finding the first term in this equation is easy where we just multiply $a_i$ and $b_i$ share. I have trouble understanding the second term which involves Oblivious Transfer.


texts: Elliptic Curve Cryptography, decrypting returns false result

texts:
I build some application to encrypt and decrypting some text using ecc

My curve paramaters are

p = 59
a = 2
b = 2

resulting in 64 points including infinite point.

for encrypt and decrypt process i use

e1 = (3, 25)
d (private key) = 53

Here's the problem that i faced

let say i want to encrypt point (45, 48)
first, i generate random number k = 47 and i calculate e1 * k

C1 = k * e1
   = 47 * (3, 25)
   = (43, 57)

C2 = P + k * e2
   = (45, 48) + 47 * (53 * (3, 25))
   = (28, 11)

But, when i decrypt the c1 and c2

M = c2 - d x c1
  = (28, 11) - 53 * (43, 57)
  = (43, 57)

I tried to check my calculation in online calculator, but the result is not even in the curve

Can someone explain to me why? where did i go wrong?
Sorry for my english
Thank you


texts: What are the uses of arbitrary length output hashes (other than OAEP)?

texts:
Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications.

I know that SHAKE-128 and SHAKE-256 can be applied for OAEP.

My question is: Are there currently any other applications found for such functions?


texts:
How often such mechanisms are used by application.
Is it real requirement to support these features for TLS ?


texts: RSA key pair generation using PRNG with same seed

texts:
I see a lot of Q/A where persons are trying to generate a specific key pair using static data such as a password. Now say we use a known PRNG (dangerous assumption), seeded with a the data as a static seed, would this always generate the same key pair?

I presume it would generate the same key pair if you would use the exact same generation method - the application would be deterministic. I would however expect differences between implementations. The random data could be used differently, the sizes of p and q could differ and there may be subtle differences when choosing the prime numbers themselves.


texts: Are the receivers in stateless broadcast encryption assumed to be computationally bounded?

texts:
I started to read about the broadcast encryption problem, specifically, the first, seminal work of FN93 followed by the subset cover technique presented at NNL01, and something really trivial and inherent bothers me.

Consider the complete subtree method presented at NNL01 (section 3.1), which is claimed to have information-theoretic security, and say that there is broadcast w.r.t. two keys of sets S1, S2. Every user in S2 has seen the ciphertext that corresponds to S1's encryption (and also knows the plaintext because it is in S2).

Therefore, since it is unbounded, it can find S1's key by brute-force, and break the security in all subsequent broadcasts that use S1's key again.

What am I missing? Are the receivers assumed to be computationally bounded? Or does this attack fail due to some other reasons?

Thanks!


texts: Is it possible to subtract/multiply numbers using homomorphic encryption?

texts: Most of the libraries I've seen allow you to add encrypted numbers. Is it possible to subtract and multiply them?


texts: Usage of pairings in proxy re-encryption algorithm

texts:
I am having trouble understanding one part of the AFGH algorithm for proxy re-encryption (my background in discrete mathematics is lacking a bit).

The paper describes the algorithm setup the following way:

"To minimize a user’s secret storage and thus become key optimal, we present the BBS [Blaze et al. 1998], Elgamal-based [Elgamal 1984] scheme operating over two groups $\mathbb{G_1}$, $\mathbb{G_2}$ of prime order $q$ with a bilinear map $e$ : $\mathbb{G_1} × \mathbb{G_1}$ → $\mathbb{G_2}$. The system parameters are random generators $g \in \mathbb{G_1}$ and $Z=e(g,g) ∈ \mathbb{G_2}$."

Both the key and re-encryption key generation parts are easy to understand, they're the same as in a regular ElGamal scheme. My question is in the first level encryption description, where the authors state that a $c$ must be computed such that $c = (Z^{ak}, mZ^k)$, where $k$ is a randomly selected element from $\mathbb{Z_q}$.

I don't understand exactly what $(Z^{ak}, mZ^k)$ are. Is $Z^{ak}$ the same as  $e(g^a, g^k) = e(g,g)^{ak}$ ?

And is $mZ^k$ the same as $e(g^k, g^k) = e(g,g)^{k^2}$ ?

EDIT: The paper can be found here.

EDIT: To clarify further:

While I can break down the maths behind an ElGamal scheme as

${c_1^{p-b-1}}{c_2} = ({g^k})^{p-b-1}m{(g^b)^k} = m[({g^{p-1})^k}{({g^k})^{-b}}]({g^k})^b  = m1^k(g^k)^{-b}(g^k)^b = m$

I can't do that for $(Z^{ak}, mZ^k)$ or $mZ^k$. I would like to understand the intermediate steps like I have for an ElGamal.


texts:
How can I find the known plain text P2 based on the given information? Assuming that the encryption is made using a common initialization vector and the mode used for encryption is OFB.

Plaintext  (P1): This is a known message!
Ciphertext (C1): a469b1c502c1cab966965e50425438e1bb1b5f9037a4c159
Plaintext  (P2): (unknown)
Ciphertext (C2): bf73bcd3509299d566c35b5d450337e1bb175f903fafc159


texts: Why is computational zero knowledge the most generic notion of zero knowledge?

texts:
GMR88 (Goldwasser, Micali, Rackoff) in chapter 3 mentions that computational zero knowledge, in comparison to statistical or perfect zero knowledge is the most general amongst the three definitions.

Why is that the case? Why isn't perfect zero knowledge the most general notion of zero knowledge?


texts: How hard is the DLP in that simple group?

texts:
Let $p=4q-1$ be a prime with $q$ an odd prime. Let $G=\{0,1,\dots,p-1,\infty\}$. The following law $*$ makes $(G,*)$ a commutative group of order $4q$ with neutral element $\infty$:
$$a*b=\begin{cases}
a&\text{if }b=\infty\\
b&\text{if }a=\infty\\
\infty&\text{if }a\ne\infty\text{ and }b\ne\infty\text{ and }a+b\equiv 0\pmod p\\
{ab-1\over a+b}\bmod p&\text{otherwise}\end{cases}$$
The inverse of $a$ for law $*$ is $p-a$, with the exceptions of $0$ and $\infty$ which are their own inverse. Proof of associativity requires care, and uses $p\equiv3\bmod4$ at some point.

Computation can be simplified by keeping an element of $G$ as an integer fraction $x\over y$ with $x$ and $y$ integers modulo $p$, and the neutral element $\infty$ represented as $x\over0$ with $x\not\equiv0\pmod p$. The group law becomes, without any special case:
$${x_a\over y_a}*{x_b\over y_b}={(x_ax_b-y_ay_b)\bmod p\over(x_ay_b+y_ax_b)\bmod p}$$
and we need only 4 multiplications, 1 addition, 1 subtraction, and 2 modular reductions for $a*b$; down to 2 squarings, 1 multiplication, 1 doubling, 1 subtraction, and 2 modular reductions for $a*a$.

Since we have a group law, we can define exponentiation. Exponents can be reduced modulo $4q$, the order of the group.

Let $g$ be an element of order $q$. It can be found heuristically, perhaps starting from $g=2$ incrementally and checking $g^4\ne\infty$ and $g^q=\infty$ (Poncho's comment gives a faster way when we don't care that $g$ is large).

Question: How hard is the Discrete Logarithm Problem in the cyclic subgroup of prime order $q$ generated by $g$? Is it somewhat related to a well known group?

Update: The formulas $x_{a*b}=(x_ax_b-y_ay_b)\bmod p$ and $y_{a*b}=(x_ay_b+y_ax_b)\bmod p$ are the same as for complex multiplication in cartesian coordinates, except they are for integers modulo $p$. Now associativity is less surprising.

By going thru polar coordinates, we can express of $g^k$ for law $*$ without iteration: that's $((y^{-1}\bmod p)x)\bmod p$ for $x=(g^2+1)^{k/2}\cos(k\cot^{-1}g)$ and $y=(g^2+1)^{k/2}\sin(k\cot^{-1}g)$. Quantities  $x$ and $y$ are integers even though intermediate values use reals. This is computationally impractical, because we need so extreme precision. And it does not lead to a trivial way to solve the DLP.


texts: Ciphers in CBC mode reveal place of change in plaintext

texts:
Theoretically, when using a symmetric block cipher in CBC mode, the current block is dependent on the previous block. Suppose one plaintext is encrypted using CBC, and then one bit of it is changed, let's say somewhere in the middle. Then the new ciphertext will change from the middle onward. Would it be better if I used CBC like this?

encrypt plaintext
reverse the ciphertext
continue encrypting (now from finish to start)

That would ensure that one modification to the plain text will change the entire new ciphertext. Right?


texts: How does threshold decryption with secretly shared exponents actually work?

texts:
Imagine the case where you have a sufficiently large finite field (or any multiplicative field for that matter) $\mathbb{Z}_{p}$ where p is some large prime.

Now, I have a number $g \in \mathbb{Z}_{p}$ (for this example let us say some RSA cipher text) and a secret shared key $k\in \mathbb{Z}_{p}$ (using shamir secret sharing).

My objective would be to use some threshold decryption techniques to do so. Mainly having each party holding a share of the key calculating $g^{\alpha \cdot  k_{n}}$ and then multiplying them.

Given that when we operate on the exponent, we are working on $\mathbb{Z}_{p-1}$ instead of ${\mathbb{Z}_{p}}$… would that be a problem? If so, how can we avoid it?

An example of what I mean:

The base and the exponent in this case are on $Z_p$. When the reconstruction happens, each party does base to the power of its share \times $\alpha$ but exponent operations are base $p-1$.  E.g. Base $7$.. $3^6$ is $1$ if I secret share the $6$ and get $\alpha \times s : 6,6,1$ that added are $13 \pmod 7 = 6$.  But if I do $3^6 \times 3^6 \times 3^1= 3$ which is $3^{13 \pmod 6}$.


texts: Which encryption is recommended for own messenger

texts:
I wrote my own messaging-app and now I would like to encrypt the data transfer between my client (app) and my server. What kind of encryption is easy to implement and can be recommended? I am very very knew to the whole encryption thing. I would love to get some hints or ideas as input.

I use TCP/IP for delivering the messages.


texts:
Before explaining my question, please let me introduce the scenario:

There are 2 type of actors: 1 server and N clients
Each actor has a RSA 2048 bit private/public key
The server knows all the clients public keys
The clients know the public key of the server

The desired goals are the following:

Clients must authenticate themselves to the server
Integrity must be guaranteed for all exchanged messages
Secrecy is a plus but not mandatory

A solution that came to my mind is to share a secret between all server-client pairs and then proceed by sending the messages concatenated to the MAC

Server ---- M | MAC(M) ----> Client
Client <--- M | MAC(M) ----- Server

Then on top of this, a challenge-response protocol is used to guarantee the authenticity of the clients.

However, by searching online I was not able to find a "standard" way to generate a shared secret using RSA. I was only able to find DH or ECC protocols for this.

There is a well-defined scheme based on RSA to obtain a shared secret or the aforementioned goals?


texts:
For transmitting a ciphertext (or any other binary data) over means which only support 5bit ASCII/Baudot characters (for example morse code or RTTY) I am looking for a way to armor my data and have it output in capital letters  and numbers only, making sure that a certain amount of characters can be sent or received wrong.
The codegroup utility does one part (ASCII armor to only capital letters) but lacks the FEC, whilst par2 FECs my data but outputs binary.
Does such a combined mechanism exist, posdibly even including the encryption part?
I am not specifically looking for programs, any description of how such a thing works would be greatly appreciated and my assumption is that the crypto community would know best.


texts: Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?

texts: Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?


texts: Difference between UF-CMA and UF-CMVA security

texts:
I didn't understand the difference between this two definitions, and why UFCMA is weaker than UF-CMVA. Given a $MAC=(Gen,Tag,Vrfy)$ we define

$G_{\pi,\mathcal{A}} (\lambda):$

1) $k \leftarrow \$ \{0,1\}^{\lambda}$

2) $(m^*,\phi^*) \leftarrow \mathcal{A}(1^\lambda)$

3) Output $1$ if and only if $Tag_k (m^*)=\phi^*$ and $m^*$ is fresh (never queried from $\mathcal{A})$.
We are assuming that $\mathcal{A}$ can make $Q$ queries to $Tag_k()$.

$G^{UF-CMVA}_{\pi,\mathcal{A}} (\lambda):$

1) $k \leftarrow \$ \{0,1\}^{\lambda}$

2) $(m^*,\phi^*) \leftarrow \mathcal{A}^{Tag_k(),Vrfy_k()}(1^\lambda)$

3) Output $1$ if and only if $Vrfy_k (m^*,\phi^*)=Accepted$ and $m^*$ is fresh (never queried from $\mathcal{A})$.
We are assuming that $\mathcal{A}$ can make $Q_T$ queries to $Tag_k()$ and $Q_v$ queries to $Vrfy_k()$.

In pratice this new game is identical to the precedent game but here $\mathcal{A}$ has also access to the oracle $Vrfy$. But I can't understand why they are different and why if the tag $\phi$ is unique (that's for every key $k$, there exist a $\phi$ for every message i.e the algorithm $Tag$ is deterministic) the two Games are identical.


texts: What is the fastest block cipher in the (Intel) world?

texts:
In AES competition,Rijndael cipher obtained first rank and become Standard and Serpent, Twofish, RC6 and MARS obtained another ranks and I know that Serpent took second rank because it was slower than Rijndael.

My questions are:

Is Rijndael the fastest block cipher in the world?
What is the reason of 10 negative votes for Rijndael in AES2 conference?
What is the fastest block cipher in the world? (for software implementation on Intel processor)

In my question, suppose that I implement all known block ciphers with equality of condition (key size, block size, software implementation on PC) then which secure block cipher is fastest?


texts: Question about DES-CBC : how to know IV if I have key, input buffer (plaintext),  output buffer (encrypted) and decrypted result where first 8 bytes are incorrect but all other bytes are correct ?"


texts: Is it possible for an element to be swapped with itself in RC4?

texts: Given the design of RC4, is it possible or impossible for the values $i$ and $j$ to be equal to each other when $S[i]$ and $S[j]$ are swapped?


texts: Is there a pseudo message that will encrypt and decrypt correctly if one of the primes is a pseudo prime in RSA

texts:
For prime number generation, one can use a probabilistic prime number generation algorithm like the Miller–Rabin primality test that will yield a composite as a probable prime with probability $\frac{1}{4^r}$ for $r$ rounds. If we use $r=50$, this has probablity $2^{-100}$. This is enough to believe that it is prime due to the high probability, if the collective power of Bitcoin miners is not searching a candidate, we will not see one around.
What if we want to make sure that it is 100%? We can use the deterministic AKS primality test and its faster variants to see that it is prime or it was a pseudoprime for the Miller-Rabin. AKS primality test, however, is very slow, and that is why we use probabilistic methods.
Now, instead of AKS, we want a faster approach and use it in the RSA cryptosystem to encrypt and decrypt a message. If everything works we will assume it is prime (should we?)!
Take a well-known prime like Fermat or Mersenne primes call it $p$ and the pseudo-prime (a real one can be found if we use fewer rounds but assume that we found one with 50 rounds) and call it $\bar{p}$. Construct the RSA as usual with the exception that instead of choosing firstly $e$ then finding primes, choose a suitable $e$.

$n = p \cdot\bar{p}$
$\varphi{(n)} = (p-1)(\bar{p}-1)$, (actually we can use $\lambda{(n)}$)
find $e$ such that $\gcd(e, \varphi(n)) = 1$
find $d \equiv e^{-1} \pmod{\varphi(n)}$

and the rest is textbook RSA encryption and decryption.
Question(s):

We expect that the encryption will fail since the incorrect $\varphi(n)$. Is there a pseudo message that correctly encrypts and decrypts under this pseudoprime $\bar{p}$?

If, so, how we can find one?
If, so, what is the probability of the pseudo messages?


texts: How can we tell if there is a Zero-Knowledge Proof for a given problem?

texts: I remember my cryptography instructor saying that in math, we can use logic to find out what we can prove and what we can't prove. Assuming this, how would we use logic to find out if a given problem has a ZKP or if it does not? On a similar note, is there a ZKP to show that a file (that one wants for someone else to download) is not malicious? Not sure if that applies to ZKP's well, though. Still curious on what you guys have to say about it. Thanks.


texts:
In What is the advantage of AEAD ciphers? Maarten Bodewes used the term 1.5 pass cipher in his answer.
What is the difference between a 1.5 pass cipher and a 2 pass cipher?
And why is Poly1305 a 1.5 pass cipher? Isn't the authentication tag in ChaCha20-Poly1305 calculated after the encryption in a separate step?


texts: Can I find the encryption key if I know the plain text and the encrypted text (DES and AES)?

texts:
If I have the plain text and its output after encryption with a key K1, is it algorithmically feasible to find K1?

I am specifically interested in the cases of DES and AES encryption algorithms.


texts: What does it mean for a random number generator to be cryptographically secure?

texts:
I've never heard a good answer. I'd like to hear details about:

What are the criteria that make an RNG cryptographically secure?
Why must your RNG be cryptographically secure? I.e., what are the consequences if it is not?
Examples of secure and insecure RNG's
Would a non-pseudorandom generator be cryptographically secure? E.g. one based on radioactive decay of a particle.


texts:
I there a way to calculate two similar pseudorandom periodic sequences by exchanging some sort of initial value and generator polynomial?

Like a linear-feedback shift register but with a finite field of numbers and each number occurring only once in the sequence?


texts: generating prime p and q, with alpha of element of order q

texts:
I'm working on VSSS (Feldman) but I cannot understand the statement as follows:

I'm not good in reading mathematical statements (but working on it). Can anyone explain this in simple mathematics. Example will be appreciated. Thank you.

Edit:

This is what I got so far.
Given the following values: n=4, k=3, s=12, p=5, q=3, g=4
wherein n is no. of shares, k is threshold, s is the secret, p and q are prime, g is the generator

Using the polynomial function f(x) = 12 + 3x +2x^2.
then, f(2) = 68 mod q = 68 mod 3 = 2

Computing on commitment:
c1 = g^12 mod p = 4^12 mod 5 = 1
c2 = g^3 mod p = 4^3 mod 5 = 4
c3 = g^2 mod p = 4^2 mod 5 = 1
wherein, cx are commitments and 12,3 & 2 are coef
Verifying:

g^f(2) mod p = 4^2 mod 5 = 1

c1^x^0 mod p = 1^2^0 mod 5 = 1
c2^x^1 mod p = 4^2^1 mod 5 = 4
c3^x^3 mod p = 1^2^2 mod 5 = 1
where x is the value of x in f(x) which is 2.

1+4+1 <> 1 ????

What's wrong??? Am I doing it right?


texts: Do garbled circuits run in constant time?

texts: It seems like garbled circuits should not be input dependent, and hence should always run in constant time. Just wanted to clarify if this is true.


texts: RSA encryption. Does message have to be coprime to n?

texts: If I understand correctly, for RSA to work we need the message(cleartext) M $\in Z_n$ and gcd(M,n)=1. That is M coprime to n. This is to fulfil the requirement for Eulers theorem. How does RSA make sure this is the case, and wouldn't this mean that some cleartext cannot be encrypted? Thanks,


texts:
Lets say I need to update a project and allow anyone to distribute the updates, however I need it to be secure, so I hash the data and sign the hash, this project uses MD5.

How likely would it be that a person could obtain the signing key or falsely sign files that could be distributed using the following information? If so would switching to MD6 fix this issue or is it deeper. Do I need to pad my messages?

Signing:
$ \textrm{MD5}(M)^D \bmod(N) = S$

Retrieving hash:
$ \textrm{MD5}(M) = S ^ E \bmod (N)$

Variables:

$M$ = File contents (public)
$\textrm{MD5}(M)$ = Hashed file contents (public)
$S$ = Signed hash (public)
$D$ = Decryption key (private)
$N$ = Modulus (public)
$E$ = Exponent (public)


texts: Why did Rabin use $x(x + b)$ instead of just $x^2$ in the original paper?

texts:
Encryption in the original Rabin scheme took a message $x$ and computed $x(x + b) \bmod n$, where $0 \le b \lt n$ and $n$ is the product of two secret primes $p$ and $q$. The private key is defined as $(p,q)$ and the public key as $(b,n)$. Modern Rabin encryption however is defined as $x^2 \bmod n$, which is equivalent to the original scheme with $b = 0$. Why is $b$ now ignored?
This question is based on another question which I found interesting but which was mysteriously self-deleted.


texts: Best method for storing cryptographic secret key and generation of IV in Trivium?

texts:
How the secret key for Trivium cipher is stored and managed in an embedded system (IoT sensor node)?
How the IV is generated in a Trivium?
How to justify the fact that storing a fixed value (for example, the secret key) requires less area size (MROM, PROM etc.) than realizing a normal register for storing the key of same length?


texts:
I know this is a difficult subject but would a good defense against timing attacks be not sending a message if the decryption or authentication fails? So if the attacker provides a wrong HMAC for example and this is compared and found to be false you simply return nothing to the attacker (this is considering a network environment though i do not want to limit it to a network environment)

Are there other ways to defend against timing attacks? I've found papers like this and this the 2nd one seems to be a proposal to change AES to help it prevent feasibility of timing attacks, I don't think i should just go ahead and implement it my self.

All these papers are great but they are such a long read and to be honest sometimes they just loose me. So are there any real life implementation examples against timing attacks? I'd prefer these examples to work on any cipher but cipher specific would be good as well.

I should note I've found some answers on this topic: like this one aes-timing-attacks but again the answer (as it is everywhere) is: take the worst possible time and make it last that long. this, for implementations, just isn't a feasible way to go is it?

TL;DR

is simply not returning a message when something failed to decrypt or authenticate a viable option?
are there other good implementations against timing attacks.


texts: Is there an algorithm to hide text in another text, while preserving the meaning of the latter?

texts:
Is there a way to hide a text message $A$ inside another text $B$ using a cryptographic cipher/algorithm, while preserving the sense/meaning of $B$ and without anybody being able to notice there is a message $A$ hidden in text $B$?

I am looking for something that can be processed either manually or by a computer.

For clarification: I don't mean to hide a message like “Attack X” saying “I went to X on holiday this summer” but an actual cipher/algorithm.

I know for sure there must be something, but being new to cryptographic and not knowing much about it, I don’t know where to look or what to look for. Is there a way to achieve this? If there is, could you (besides a reference) also provide a short example?


texts: How to convert from curve25519 33 byte to 32 byte representation

texts:
According to the curve25519 paper a x25519 public key can be represented in 32 bytes.

The x25519 library I'm using (bouncycastle) however gives me a 33 byte representation according to this standard.

My 33 byte hex representation always begins with the hex 02 or 03.

How do I convert a 33 byte representation to a 32 byte representation?

And when I am provided with a 32 byte representation, how do I know whether to prepend 02 or 03 to it to convert it back to a 33 byte representation?


texts:
I refer to the LM-OTS specification in RFC8554.
It seems that
after having hashed all the chains, including the checksum’s ones, the signature is essentially the concatenation of the hash results.
Apparently one can make the signature much shorter, by hashing the above again.
Boneh and Shoup define Winternitz signatures in this way. Why the RFC doesn't?


texts: How to realize a hash function H:{0,1}* × G × {0,1}* -> Zq ？

texts:
I read papers about cloud storage data integrity audit, which needs PBC library and GMP library.
The author define encryption hash function  $H:\{0,1\}^* \times G \times \{0,1\}^* \to \Bbb Z_q$, used as $H(ID,R,RN) \bmod q$, $G$ is a cyclic multiplicative group with order $q$ ,$q$ is a large prime, $R, ID,RN$ are elements of $G$.
I don't know how to compute $H(ID,R,RN) \bmod q$ ,they may multiply or do exponent arithmetic ?or use hash function like SHA1 ? How can I construct this function?


texts: Proof that secret sharing based scheme is CPA secure as long as one of the scheme is CPA secure

texts:
I want to construct a CPA-secure schemes using two given schemes $\prod_1$ and $\prod_2$ if only one of them is CPA secure.
Taking suggestions from this answer, I am able construct a scheme as follows.
Given a message $m$,
Generate a random string $r$, of same lenght as $m$.
Compute $r_2 = r \oplus m$
Encrypt $r$ using $\prod_1$ to get $c_1$ and $r_2$ using $\prod_2$ to get $c_2$.
Send both $c1$ and $c2$
The scheme must be CPA secure because both of the ciphertexts need to be decrypted to get back the message.
However, I am not able to prove that the resultant scheme is CPA secure other than intuition.
How do I prove it rigorously?


texts: Are there any known values for common hashes known to have no preimage

texts:
In a system which requires a user to have a password, as a quick workaround I wrote random junk as the bcrypt hash so that no one will be able to login to that user.
However theoretically there probably is a password which matches this randomly selected hash value.

I was wondering if it could be possible in such a scenario to specially craft a hash value (possibly using a different supported algorithm other then bcrypt) for which it would be guaranteed that there is no preimage.

For bcrypt I suspect this wouldn't be possible, since if my math is correct the expected number of hashes with no 75 char password preimage is (1/e)^(2^416) also known as 0.

But perhaps for another common password hashing algorithm these values would not only be expected but there will also be a way to find such a value.


texts: What are the cryptographic assumptions in the Dolev Yao model?

texts:
In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox.

Does blackbox here mean that the primitive is to be considered CPA secure, or does it even require CCA security?

My guess is that CPA is sufficient (and it is the minimum requirement), since the adversary model is rather passive. But could someone confirm this?


texts: How does the TLS Client Hello message choose the TLS version?

texts:
Im looking at a Client Hello message in wireshark, the client supports 1.2 and 1.3, but Wireshark says the client used TLSv1.3 record layer when the server hasn't replied yet the choosen version.

How can this be explaned?
Also, why after that i see version 1.0 and version 1.2 if version 1.3 was used?


texts: Toy public/private key example open to frequency analysis?

texts:
I've been looking at an online Public Key Encryption Example (summarized below). It seems to me that choosing cyphertext = plaintext^(key) mod n would produce the same ciphertext letter for a particular plaintext letter, leading to easy frequency analysis of the output. Would there be a way to modify the example so that this isn't the case? Is there something I'm missing in the results? Thanks!

Summary of method:

Pick a pair of large prime numbers at random (e.g., 3, 11 (not large in this case))
Compute product: n = p × q = 3 × 11 = 33
Compute the value of Euler's totient function of n: φ(n): φ(n) = (p-1) × (q-1) = 2 × 10 = 20
Pick any number less than and relatively prime to φ(n) (e.g., 7)
Compute the matching private or decryption key d, as the inverse of e modulus φ(n). d = inv of e mod φ(n) = inv(7) mod 20 = 3
Encrypt: cyphertext = plaintext^(key) mod n


texts: How to change hash checksum of a text file without changing the contents in the file

texts:
I have created a text file called test.txt and the content of the file is Hello World
I would like to change the SHA checksum hash without modifying the contents and filename. Is there any way to do that without using any third party tool on the internet.


texts: ECC public key encryption without symmetric cipher

texts:
Imagine the following scenario. A process is running in background and permanently encrypting some data. An adversary has full control of the process, e.g. it can dump the process memory any time and read the symmetric key. It is essential that the adversary cannot decrypt the data, therefore only public-key encryption without any symmetric cipher component is feasible.

What would be the best method for data encryption in this scenario using ECC?


texts:
I'm working with the elliptic curve $\mathcal{E} : y^2 = x^3 + 11x^2 + 17x + 25$ over $(\mathbb{Z}_{31},+,\cdot)$ and am trying to double $P=[2,7]$.

Following the instructions here, I'm doing the following:

$$s = \frac{3\cdot2^2+17}{2\cdot7} \equiv 29\cdot14^{-1} \equiv 29\cdot20 \equiv 22 \pmod{31}$$

$$x_R = s^2 - 4 = 480 \equiv 15 \pmod{31}$$

$$y_R = s\cdot(2-x_R) - 7 \equiv 22\cdot18 - 7 \equiv 17 \pmod{31}$$

That would then give $P+P=R=[15,17]$.

However, when I verify my result with sage, it seems incorrect:

sage: E = EllipticCurve(GF(31),[0,11,0,17,25]); E
Elliptic Curve defined by y^2 = x^3 + 11*x^2 + 17*x + 25 over Finite Field of size 31
sage: P = E(2,7); P
(2 : 7 : 1)
sage: P + P
(25 : 17 : 1)

What am I doing wrong?

Note: this is a homework assignment. Please provide just a hint, if at all possible.


texts:
The AEAD scheme SpongeWrap based on the sponge construction gets only a header (additional data), a body (the message) and a key as input values, according to the paper where it is defined.

What is missing compared to other AEAD schemes is a nonce to make the key stream unique. I am wondering, why this is possible. The way I understand it, the sponge state for the first message block only depends on the key and the AD, thus an adversary is able to decrypt at least that first block, if key and AD are reused.


texts: Is this client-side password hash scheme secure?

texts:
I want to build an app that uses client-side encryption for storing encrypted data on the server. A user-specific master key would be used, so to easily share it between devices a encrypted version of it would be stored on the server.

The user's passphrase would be used for both 1) encrypting the master key and 2) authenticating the user. For this reason the server must not know the passphrase.

The passphrase would be used twice for stretching with PBKDF2, HMAC-SHA256 and a good number of iterations:

First, the encryption key used to encrypt the master key would be derived. A random salt would be used here (also stored on the server with the encrypted key).
Second, a hashed version of the passphrase would be derived. The user email would be the salt.

The stretched passphrase (#2) is then sent to the server instead of the plain passphrase. The server would then use bcrypt to further secure that hash and authenticate the user.

Assuming that all communication happens over HTTPS and the user is forced to pick a strong passphrase, I don't think there is anything wrong with this. Am I wrong?


texts: Opinion on my idea for storing credit cards securely

texts:
I've been thinking of ways to store credit cards securely, I thought of this:

Take the users credit card info
Put the card info in a standard format

  "Full Name/Card Num/Security Num/Expiry Date"

Then encrypt the data using a 512 bit private key:

  Then I'll have something like this:

  0c72233aeb2de52bce867baf54a93dd3052d52ad0820d535ddfda87e47f2da963c5076418fa893434738f191f97c75b61258e314e1e077aa1a52eadd6da12002

Then my idea would be to store that encrypted string with the public key in a database.

Then when the user tries to pay for something with their card they just pay like you would with PayPal, but instead of logging in, the user provides their private key.

Would this be useful? Or is there already better alternatives?

I thought of this because even if the database was compromised the credit card data stored within the database would be completely useless, even to the people who run the service.


texts:
If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, will I always have the same signature?
A Java example always return different byte array :
PKCS11Provider provider = new PKCS11Provider(this);
List<PKCS11Slot> slots = PKCS11Slot.enumerateSlots(provider);
PKCS11Session session = null;

if (slots.size() > 0) {
    session = PKCS11Session.open(slots.get(0),
    PKCS11Session.OPEN_MODE_READ_ONLY);
}

PKCS11KeyStoreSpi keyStore = new PKCS11KeyStoreSpi(provider, "PKCS11");
keyStore.engineLoad(null, "PIN".toCharArray());
PKCS11PrivateKey privateKey = PKCS11PrivateKey.getPrivateKeys(session).get(0);
Signature signature = Signature.getInstance("NONEwithRSA", provider);
signature.initSign(privateKey);
signature.update("HELLO".getBytes(), 0, "HELLO".getBytes().length);
byte[] realSig = signature.sign();


texts: Asymmetric Encryption - How is the Public Key Being Shared?

texts:
I've been reading up on the relationship between private keys and public keys (as well as hashing), and I watched a few videos, but I am still a bit confused.

I don't have a programming background, and I want to be able to explain these things to an "everyday person".

What I found is that before a message is "encrypted" with a "public key" that key FIRST must be shared with the receiver.

How is the public key being shared?

Thanks for your help.


texts: Does a bigger key mean more security - if we do not change the structure of the algorithm?

texts:
Let's say I have 128-bit cipher in which each round needs to get 768 key bits. Let's consider 10 rounds.
It can be easily 128-bit key cipher. I can do key schedule and produce 7680 bits of keys (let's say with HKDF). But I can also use for example 512-bit key. Then I still need key schedule, but the main key is stronger. And cipher still works on the same 128-bit blocks with the same speed (because it is using still 768 key bits in every round).
Will only by increasing the size of the main key from which I create the round keys I make the algorithm more secure? It is harder to broke main key in this case, but rounds remains the same weak (attacker still have to broke just 768-bit in every round). So maybe we should say that it make stronger key schedule only, not actual cipher? Is it make sense to increase the main key size in that case?


texts: In the AEAD scheme described in https://tools.ietf.org/html/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide any advantage over simply not padding the data?


texts: Koblitz encoding a message to a point, what is the "associated auxiliary base parameter"?

texts:
I am looking at the Koblitz method for encoding a message as an elliptic curve point.  The first step given in the paper I'm reading is:

  "Choose an elliptic curve and its associated auxiliary base parameter, k."

I have not heard the term "associated auxiliary base parameter" before.  Does it mean the order of the curve, or something else?


texts: IND-CPA security of mode of operation using triple AES with plaintext || IV+counter

texts:
I have found this figure of a mode of operation using a triple AES with m||IV+ctr input:

I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-CPA, and how to prove it in an adversarial model?


texts: General-purpose non-interactive multi-party computation protocol

texts:
Most of general purpose multi-party computation protocols are highly interactive.
Especially the ones with Shamir's secret scheme, as there is a degree reduction step in multiplication that needs the parties to interact with each other.

For example, say a client (trusted dealer) distributes the secret among several servers via secure channels, and the client also provides inputs to all the servers needed for secure function evaluation. Now the servers should evaluate a function on their own, they cannot talk to each other. At the end, the client receives all the partial results from different servers (via secure channels) and constructs the complete result locally.

There are non-interactive and robust threshold decryption protocols of RSA which are specialized multi party protocols. But are there any general-purpose non-interactive multi-party computation protocols? Or is it an open problem ?


texts: fuzzy commitment implemenation to make secure biometric template

texts:
I want implement some ideas from an article that is about making secure biometric templates using fuzzy commitment and fuzzy vault. I need to implement just the fuzzy commitment (fuzzy commitment is a biometric cryptosystem).

This schema is explained in mentioned paper in page 6. I implemented fuzzy commitment encoding and decoding in matlab. I'm sure my encoding implementation is correct but I'm not so sure about my decoding implementation. I could not understand the paper's decoding explanation so I used this paper (page 12) for a more understandable explanation of decoding.

My implementation for decoding is:
(NOTE: best_Binarized_LDA_I_auth_Samp is authentication sample for test)

for  ind=1:size(best_Binarized_LDA_I_auth_Samp,1)
yc=database(ind).yc;
C_prin=bitxor(yc,best_Binarized_LDA_I_auth_Samp(ind,:));
n=power(2,m)-1;
k=n-m;%L in article

K_star=decode(C_prin,n,k,'hamming/binary');
HK_star=whirlpool(K_star);
equality=find((HK_star==database(1).database(ind).hkc)==1);
if length(equality)==512
    disp('succes')
else
    disp('faild')

end

end

in this line :

K_star=decode(C_prin,n,k,'hamming/binary');
HK_star=whirlpool(K_star);

I decode c' to find k* and then I hashed k*, and then if this will is equal to hk, the key should successfully be revealed. When I run this code, however, none of genuine user could not log in successfully. I'm not sure that I find out well fuzzy commitment decoding or not, and I do not know  what is the problem with my code?


texts: addition of shares from shamirs scheme and additive scheme

texts: Assume we have two secrets $s_1$ and $s_2$. We use Shamir's scheme to produce $\{(x_i,y_i)\}$ as $n$ shares of $s_1$ with a threshold $t$. Then, we use the additive scheme to generate shares for $s_2$, denoted by $z_i$. Is there any way to combine the shares of $s_1$ and $s_2$ to get shares of $s_1+s_2$?


texts: Do all ciphers have equivalent decryption keys?

texts:
Do all ciphers suffer from the problem of multiple equivalent decryption keys? Is the existence of equivalent keys an essential property for the security of a cipher?

If you could prove that a cipher had no equivalent keys, would that lead to a procedure for recovering the key under the known-plaintext attack model?


texts: what is the difference between one way function and hard core predicate?

texts: Does anyone know what the difference between a one way function is and a hard core predicate? Are they related to each other or different?


texts: Can you tell if this ECB mode mitigation idea is "OK"?

texts:
The context: you have to encrypt passwords (reversible, for accessing external services), and also some customer data for privacy reasons, and you need to use AES-ECB mode...

The idea to mitigate the worst of ECB is, we encrypt each single ''message'' with a new random key. Then we encrypt this unique key with a master key, and store it alongside the ''message'', while the master key is kept somewhere else completely.

(As additional measure, also ensuring that the encrypted unique key has its padding block filled with randoms, so the padding doesn't show up as repeating pattern either between the unique keys.)

When considering the general ECB issues, I take note of the fact that:

the master key will ever encrypt only random, single-block ''messages'' (the unique keys), and that
the most critical data to be protected is passwords, also of a single-block nature.

Makes any sense? Has any major issue? I was mainly concerned with avoiding the textbook-messup situation of an ecb mode password db where you could see every repetition of common passwords, making for extremely easy, non-specialist ''attacks''.


texts:
A standard deck of $52$ shuffled playing cards can be used as a source of randomness.

Assuming cards are not replaced as they're drawn, a full deck of cards provides $225.58$ bits of entropy $- 52!$ combinations $= \log_2(52!)$ bits of entropy.

What is the correct way to calculate the bits of entropy supplied by multiple decks of cards?

For a single deck reshuffled 3 times in a row I would expected $\log_2(52!^3) = 676.74$ bits. But for 3 decks shuffled together, what is the value?

Also, if $N$ cards have been drawn of $X$ decks, how much entropy has been accumulated?

This sounds like a homework question but I'm trying to develop this as a feature in a project - https://github.com/iancoleman/bip39/issues/33


texts:
I read some where in crypto.stackexchange answer (related to EC-SRP protocol) that there is pattern in points on elliptic curves, i.e. if given some points containing mix of correct and wrong points and all points are less than prime number (p), now my question is:

is it possible to identify the correct points if so what is that logic? Please someone explain (I am not an expert in ecc).

@fgrieu and @CodesInChaos: Thank you both for your answers and I understood your point but if x and y co-ordinates of a point are encrypted using a shared secret e.g. password like in encrypted key exchange, my question is that is there any other attack other than checking x or y value greater than prime p to derive password?

It appears from your answer that after decrypting the point (x, y) by a candidate password the equation allows easily determining if a point of given coordinates x,y valid or not and thus password can be derived after observing few transactions over a period of time, please confirm/clarify with some details?


texts: Attacks against RC4 when index $i$ is unknown

texts: RC4 uses two 8-bit indices. One, $j$, is key-dependent and secret, and the other, $i$, increments by one for each byte output. The $i$ index is typically considered to be public, but what if the RC4 keystream starts at an unknown position, putting $i$ anywhere in the range of $0$ to $255$ with equal probability? I can think of a few inefficient and naïve techniques, but what would be the most efficient technique to discover $i$?


texts: Algorithm to factorize $N$ given $N$, $e$, $d$

texts:
I have an RSA public key (public modulus $N$ and public exponent $e$), and the private exponent $d$ of matching private key.

How can I compute $p$ and $q$, the primes factor of $N$ ?


texts: Finding CRC collisions for specific divisor

texts:
My current textbook (Information Security: Principles and Practice by Mark Stamp) discusses how to determine the CRC of data via long-division, using XOR instead of subtraction to determine the remainder.

If our divisor has N-bits, we append (N-1) 0 bits to the dividend (the data) and then use long-division with XOR to solve for the CRC.

For example:

Divisor: 10011
Dividend: 10101011

101010110000 / 10011 = 10110110 R 1010, where 1010 = CRC

I'm able to perform this computation fine. However, the book mentions that in the case of the divisor being 10011, it's easy to find collisions.

I'm missing something here -- why is it easier to find a collision when the divisor is 10011?


texts: Security of (2,2) Shamir's visual secret sharing scheme : How are the 2 shares random?

texts:
From the Visual Cryptography by Shamir and Noar.

Let us take the pixel expansion as 2. Therefore, each pixel will be represented by 2 pixels (also called as subpixels) in a share. Since this is a (2,2) scheme, we will have 2 shares. In order to create share1 for a white pixel, a fair coin is tossed with 2 possibilities of subpixels - Black&White or White&Black - either one of these 2 choices is chosen to represent a white pixel. It is clear that Share1 is random.

In order to create share2 for a white pixel, is a coin tossed again?
If yes, then how is reconstruction of a white pixel assured?
If no, then how is share2 random?
Assuming that in the reconstructed image, the white pixel will be 50% black and 50% white.


texts: Can you help me with this Random Number Generator function?

texts:
By someone's suggestion, I am posting this question from math.stackexchange.com.

I want to find out a suitable function or algorithm, which can provide a random sequence like this…

Input: $3$
Output: $\{1,2,3\}$ or $\{1,3,2\}$ or $\{2,1,3\}$ or $\{2,3,1\}$ or $\{3,1,3\}$ or $\{3,2,1\}$

Same as if I will enter a number $N$, output will be a random permutation of the set $\{1,2,...N\}$.
How can a I write this type of algorithm? And can you help me understand the logic behind it?


texts: Stern identification scheme to signature scheme

texts:
I'm trying to understand the comment in the page 103 of the book Postquantum Cryptography. about convert the identification Stern procedure for signing. Can you write an example of signature of this conversion?

  The standard method to convert the identification procedure into a procedure for signing, is to replace verifier-queries by values suitably derived from the commitments and the message to be signed.


texts: Does the block size of a symmetric cipher impact the security of the cipher itself?

texts: Will a 128 bit block have some security implication in post-quantum cryptography?


texts: Encrypt UDP packet with time-generated encryption key

texts:
I'd like you to help me solve a dilemma of mine. I am currently building a home automation from scratch for my next house.

The basic gist of it is that I will send UDP packets over a local network.

I created the clients in Electron/Web App (so Js backend) and also used a RPi with a C program(I can change the language to something else if necessary) as the server with the database. The client will send a ~10byte package to the server. Speed is key here, and from my testing, over Wi-Fi turing on a LED is almost as fast (to the human eye) as a normal light switch. So I'd like to keep my speed.

Since the packets will hold string that basically say "turn on this light in this room" or "lock the door and activate the alarm" or "change the temperature in that room" I obviously need to encrypt the package, thus I arrived here.

Here is what I tried or thought of so far:

Use (D)TLS to send the Packages. While this would normally be a good idea, the libraries for it in JavaScript, Python or C are junk. There is no Python 3 library and the JavaScript's documentation is basically non-existant. One more thing to note is that this whole ordeal will be on a local network, so I don't know quite sure how to distribute the certificates in a secure way so they can't be replicated.
Use TLS and switch to TCP. This would probably be a good idea but the overhead of TCP and TLS seem so big in comparison to my mere 10byte packet. Again, the certificate issue rises up, since I don't know how to make a DIY CA.
Encrypt the packets with AES256. I wanted to do this until I realized that I don't have an extraordinarily good way to store the encyption key. I don't know how secure it is to store the key in plaintext in something like a NodeJS app. It a tad better in the binary of my C program but that is still not bulletproof. Maybe encrypting it in a file, but how do I keep that file safe.
The most secure thing to me is to still use AES256 but generate the key based on some factors like: a passphrase, the time, the server's and client's IP address "mumbo-jumboed" together. Like this, the attacker would have to guess my algorithm instead of a key which will always change(maybe once an hour).

One thing to note, the packets will be a one way road. The clients will send the command and the server will act upon it.

What are your thoughts? Am I wasting my time? Should I just buy an already made board with for alarms with sensors and such? Has anyone done something similar (I know home automation with Pis is a big thing, but I only see little things and I want something bigger, more comfortable).

EDIT: I removed the unnecessary things from the post, as suggested by DannyNiu.


texts:
I am trying to understand MD5 hash algorithm from the link http://www.ietf.org/rfc/rfc1321.txt

At first I was not able to understand padding of MD5. Then I asked a question in this link: To understand a fact related to padding in MD5

From this answer I can understand padding. Now I have faced another problem: to understand the second step of MD5.

I am trying to understand the second step from the same link: http://www.ietf.org/rfc/rfc1321.txt

But I have failed to understand a sentence and a phrase as before.
Here is the phrase:

  A 64-bit representation of b

what does 64-bit representation stand for?

Here is the next sentence:

  In the unlikely event that b is greater than 2^64, then only
     the low-order 64 bits of b are used.

what does lower-order bits mean?

Can anyone explain the above phrase and sentence with better clarity?


texts: Probability of $D_k(a*k+b) =p$ for a PRP

texts:
I'm wondering what the probability of a PRP having numerous keys (say 3 or more) with the same simple idempotent, or near identity, function.  For example, does there exist values of $p, a, b, x_1,$ and $x_2$ where more than two keys, $k$, have the property:

$
AES_k(p) = (x_1 \oplus (a*k) + b) \oplus x_2
$

I can abstract out E_k(p) as some PRP that yields an "unrelated" value:

$
R_1 = (x_1 \oplus (a*k_1) + b) \oplus x_2 \\
\wedge
R_2 = (x_1 \oplus (a*k_2) + b) \oplus x_2 \\
\wedge
R_3 = (x_1 \oplus (a * k_3) + b) \oplus x_2
$

Then, entirely informally, I reason that since there are $2^{128} R_i, k_i$ pairs the probability here is pretty high. Is that other peoples gut instinct?  Could someone help me formalize the math here a little since I'm stabbing around a little blindly?

EDIT:
Addition ($+$) and multiplication ($*$) are mod $2^{128}$.  The $\oplus$ operator is bitwise addition (exclusive-or).  Algebraically, I can see how two keys with this property trivial to derive ($x_2$ yields obvious flexibility) but I am unsure about the probability of this property holding for $N$ keys ($N>2$).

Edit 2

Adding more details on my thoughts:  We can get two keys for which this property holds through simple algebraic rewriting:

$
k_1 = random\\
b = 0, a = 1\\
p = D_{k1}(k_1\oplus x_1 \oplus x_2) \\
k_2 = random \\
x_2 = E_{k2}(p) \oplus x_1 \oplus k_2 \\
x_1 = E_{k3}(p) \oplus x_2 \oplus k_3 \\
$

At this point $x_2$ and $x_1$ are defined in a mutually recursive manner.  We are left with:

$
x_1 = E_{k3}(p) \oplus E_{k2}(p) \oplus x_1 \oplus k_2  \oplus k\\
0 = E_{k3}(p) \oplus E_{k2}(p) \oplus k_2 \\
$

I.E. Removing $a$ and $b$ from consideration, for an equation with two xored values the probability of two keys meeting this property is 1.  However, finding the value (if any exists) for the third key appears to be more involved - the above construction yields $E_{k3}(p) = E_{k2}(p) \oplus k_2$ which is similar to obtaining a key from a single chosen plaintext.

It is not obvious to me that adjusting $a$ or $b$ can be leveraged efficiently to solve this problem or make it computationally tractable.  This is the heart of my question.  Is it computationally feasible to find constants, including three keys, for which this property holds?


texts: DES- If LSB is removed, are the key B and C the same?

texts: I believe that in DES every 8th bit is ignored of the key. That means B and C are same if the LSB is ignored. So, shouldn't encrypting a message by the key all Bs be able to be decrypted by key with all Cs? I tried doing it but did not work. I used this tool to check : http://extranet.cryptomathic.com/descalc/index


texts: What is the Advantages and Disadvantages of digital signatures over HMAC?

texts:
I want know the advantages of using digital signatures over HMAC for message by message authentication.

I know that HMACs are inexpensive to implement compared to DS, but DS provides a very strong security also uses more processing power. Are these two the main differences?


texts: Homomorphic (encrypted) comparison to an integer

texts:
When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted  value of a comparison test to an integer value (I realise that an unencrypted comparison test would make the encryption scheme worthless)?

I know there are (rather costly in number of rounds and broadcast complexity) methods to compare two encrypted values, that is: given $Enc(x)$ and $Enc(y)$, obtain $Enc([x < y])$, which decodes to $1$ or $0$.

If we do not necessarily need $y$ to be private, but are instead willing to use a public integer value $d$ (presumably of the form $2^k$), are there any faster methods (in number of rounds) to get $Enc([x < d])$?

Edit 1: it is worth mentioning that, in this instance, $Enc(x)$ is itself obtained from homomorphic operations, so any method relying on having a binary decomposition of $Enc(x)$ would not be applicable (or more exactly: would require a costly pre-treatment protocol to binary-decompose the input)...

Edit 2: While I am definitely interested in hearing any generic answers to this problem (if they exist), my personal case can accommodate the following relaxations (by order of acceptability):

$y$ very small relative to the size of the modulo field (say, less than 3 bits).
$x$ small (say, less than 8 bits).
a secure comparison protocol not relying on pure homomorphic operations (e.g. requiring communication rounds).
if nothing better: testing for inequality ($Enc([x ≠ y])$)


texts: Where can I get information on how to implement AES?

texts:
I want to write AES from scratch without using the built in libraries of java. I know there are hundreds of AES programs (and websites) out there but I can't seem to find a site that gives me the details I think I would/should need to write my own Java program.

I know that AES has S-boxes like DES has. Were would I look for them? Also, I would like more info on the AES "counter mode".


texts:
I am not rolling my own crypto or anything - just trying to learn about
the Dos and Don'ts of cryptography: specifically about AES encryption and
ways to generate keys for that.

As far as I've understand, one of the options when creating
cryptographically secure keys would be to gather entropy from
/dev/urandom and then feed that data through the Salsa20 cipher.

However I am not quite sure about the next steps, because that’s where search engines stop being useful to me.
From what I understand, using the output Salsa20 generates doesn’t seem to be secure enough to be used as key material as-is.
If that's correct, what would be the "cryptographically" correct next step after getting the Salsa20 output?

Also, if you know of any relevant papers and are happy to share, they would be very welcome!


texts: Open source implementations of Symmetric Searchable Encryption and Order Preserving Encryption

texts:
Are there open source implementations of SSE and OPE?
Can anyone please point to sample codes, if available.

EDIT

If cryptDB is not an option, what other options are available?
(Indeed, these schemes are weak — which is why cryptDB proposes onion layers for encryption.)


texts:
How can padding be disambiguated from data, when encrypting using a block cipher?

I'm by no means an expert in cryptography, but rather a programmer with a keen interest.

Suppose, I've X bytes of data, message M, that I want to encrypt using an N-byte block cipher, where N >> X.

How can M be padded using N-X bytes of padding O, such that there would be no ambiguity between decrypting the padded message M´ and the (concatenated) message M|O?

How is this done in practice? Normally, when encrypting using a block cipher, I don't see a header being output describing the original length of the message M?


texts: Why can't we construct a PRG from a one-way function and hc, but only one-way permutation

texts:
From Katz & Lindell's book, theorem 7.19:

Let f be a one way permutation with hard-core predicate hc.
Then the algorithm $G(s)=f(s)||hc(s)$ is a PRG with expansion factor $\ell(n)=n+1$.

But what about if we use a one-way function? I know that there could be $f(x)=f(x^{'})$ when $x\neq x^{'}$, we lost some entropy here, but what breaks the theorem actually?


texts: Non interactive ZKP that encrypted additive elgamal message is in set of valid messages

texts:
This is taken from Anonymous voting by two-round
public discussion by F. Hao P.Y.A. Ryan P. Zielinski

Votes are encrypted using the additive variant of ElGamal. I am also using ECElgamal. The idea is that to vote for a particular candidate, you set your message as one of the following $v$ calculated below.

One problem is that if the voter sends a vote not specified in the valid set of $v$'s, then the resulting sum of $v$'s would affect the tallying of votes. For example, if you vote using $2\times2^0$, you are able to vote to candidate 1 $2$ times which not ideal. Or $2\times2^m$ to vote for candidate 2 twice.

How would one verify that the vote that is recorded (which is encrypted) is in one of the valid $v_i$ without decrypting the ciphertext of the vote or showing $v_i$?


texts: Diffie-Hellman Key Exchange - Key Derivation before Execution

texts:
I am dealing with protocol design regarding the Diffie-Hellman Key Exchange (DHKE). The DHKE is performed by the Key Master and some Slave Component. Afterwards, a session key is transmitted using the secure channel provided by the DHKE (i.e. the session key is protected using the shared DH key).

From a logical standpoint, I would suppose that the session key is derived after the DHKE was performed. However, for performance reasons it may be better to derive the session key berforehand (see diagram below).

I am asking myself whether there might be security issues by doing so and whether there are other things that need to be considered w.r.t. order of executed actions.

Edit: The session key is not derived from the shared DH key. Reasoning: The DHKE is performed among the Key Master and multiple Slave Components.

Furthermore, the session key is just used for integrity protection (by calculating a MAC).


texts: Are there historical examples of Occam's Razor being useful to cryptography research?

texts:
Previously, I asked what is the simplest digital signature scheme known, under the assumption simpler implementations could provide valuable insights on the nature of the problem.

  Among competing hypotheses, the one with the fewest assumptions should be selected. (...) In science, Occam's razor is used as a heuristic technique (discovery tool) to guide scientists in the development of theoretical models
  https://en.wikipedia.org/wiki/Occam's_razor

I specifically asked for implementations that didn't use number theory, because numeric operations (division, modulus) require some added complexity to implement in any "neutral" language that doesn't have numbers.

I received a plenty of negative comments claiming simpler schemes aren't proven to be secure, that simplicity is subjective and the general sentiment was that the question was pointless.

My question, thus, defies my own beliefs: has Occam's Razor ever proven useful for cryptography at all? Is there, for example, any historic occurrence of someone starting with a complex cryptographic scheme, looking from simpler solutions, and eventually finding answers that led to a better understanding of the problem itself?


texts: Using digital signature to reduce storage requirement

texts:
Below question is a part of my assignment and I was completely clueless about where to start from. So, I am posting it here for the purpose of getting hints/resources to help me get started.

$ \ '' $To store $k$ blocks of data/information (say each block is of $b$ bits) in a fault-tolerant way, you may
encode the $k$ blocks into $n$ blocks (using some error-correction code) such that if any $e$ of the $n$ blocks
are corrupted, it is still possible to retrieve the original $k$ blocks of information. Specifically (for
large enough $b$), coding theory suggests that this is possible if and only if $n \geq (k + 2e)$. However,
show that using digital signatures, it is possible to achieve the above fault-tolerant storage even when
$(k + e) \leq n \lt (k + 2e)$, assuming a PPTM-adversary(Probabilistic polynomial time) and a negligible probability of error is permitted.$ \ ''$


texts: Which data encryption mechanism to use for data transfer?

texts:
I have high performance nodes communicating with each other sending logs and data over network.
The communication is heavy and over public network.

I would like to know how to know which is the best encryption algorithm to be used to encrypt and decrypt the data so that it has minimal affect over performance simultaneous making the encrypted data unbreakable and secure?

Currently according to my survey i have considered 2 Algorithms to be best i.e.

TwoFish - Have heard that this is the fastest
AES 128 - Have heard that this is the most efficient
AES 256 - HAve heard that this is the most secure
Any other algorithm would also do fine

  Security and performance overload of the system is to be kept in mind


texts: Why does the recommended key size between symmetric and asymmetric encryption differ greatly?

texts:
In various articles it is mentioned that for secure communications, the recommended key sizes are 128-bit key size for symmetric encryption (which makes it $2^{128}$ possible keys?) and 2048-bit key size for asymmetric encryption ($2^{2048}$ possible keys?).

Why do they differ so greatly? It seems like I am missing a very big part of the equation.


texts: Are there official test vectors for historic ciphers?

texts:
In many cases when cryptographic algorithms are published the paper also provides a set of test vectors that can be used by developers to verify their implementations.

For historic ciphers such as vigenere or ceasar there of course are no official papers. Is there any sort of "offical" test vector/KAT that is commonly used when testing implementations of historic ciphers?


texts: What is the meaning of $1$ in provable security?

texts:
Sometimes, we use $1$ to represent "succeed". In CPA, if the adversary guesses $b'=b$ outputs $1$.
But I am confusing about the meanings of the following $1$.

Take the DDH for example,
$$|\Pr[\mathcal A(g,g^a,g^b,g^{ab})=1]-\Pr[\mathcal A(g,g^a,g^b,g^c)=1]\le\operatorname{negl}(n)|$$ where n is security parameter.

Does $1$ mean succeed  or output the same thing？


texts: How does the nonlinear function of KeeLoq work?

texts:
I want to know how the nonlinear function of KeeLoq works.

Here at Wikipedia it says that:

  The NLFSR feedback function is 0x3A5C742E

I understand that F(a,b,c,d,e) = 3A5C742E.

Now, he did not say anything about encoding of a, b, c, d, e. I consider them as in ASCII. But each letter will have 8-bit. So total would be 40. Could someone explains to me how to compute this function or what is the encoding scheme of a, b, c, d, e in order to apply Karnaugh map?


texts: difference between the math of RSA problem and DH problem

texts:
I'm trying to understand why the RSA problem is not related to the Discrete Log problem, and how breaking the Discrete Log problem does not directly compromise RSA.

I will explain my reasoning of why it seems to me that they are the same in hope that someone will find the flaw in my reasoning and correct me.

If you don't take into account how you generate the public and private keys and just assume they exist, we could minimize the RSA problem to just modular exponentiation in this way:

$M$: Plain text
$C$: cipher text
$E$: some number
$D$: some other number
This is easy (encrypt): $M^E \bmod N = {?}$
This is hard (decrypt): ${?}^E \bmod N = C$

Now, according to this khan academy video, ${?}^E \bmod N = C$ is equivalent to $C^{D} \bmod N = {?}$ for some unknown $D$, this will act as our private key.

Now my question is: If I can identify if I have decrypted $M$, by some file header for example. isn't finding $D$ for $C^{D} \bmod N = M$ the Discrete Log problem? Given this khan academy video about the discrete log problem, it would appear it is.


texts:
Say party A wants to make sure they are communicating with party B, and not an eavesdropper E. Then they will use an authentication scheme to do this.

But what if there is an eavesdropper on the line, who waits until the authentication is complete, and then steps in a poses as party B when it is finished? Then A will still think she is communicating with B. How is this prevented?


texts:
Let $\mathbb{F}_2=\{0,1\}$ be the field with two elements. I wonder if there is any known algorithm/construction that, given any $n\geq 1$, returns a boolean function $f:\mathbb{F}^n_2\rightarrow \mathbb{F}_2^m$ (for some $m\geq 1$) such that:

$f$ is injective;
for each $S\subseteq \mathbb{F}^n_2$, with $|S|<n$, the image of $S$ under $f$, $f(S)$, is a set of linearly independent vectors in $\mathbb{F}_2^m$ (seen as a vector space over $\mathbb{F}_2$).

Both $m$ and the returned representation of $f$ should be "succinct", that is, of size polynomial in $n$.

The algorithm might also be probabilistic, in the sense that the two required properties might hold with "high probability" (possibly approaching 1 as $m-n$ grows).


texts:
For NVIDIA TESLA V100 I know a hashcat performance for SHA1: it is about 17000 MH/s. Performance index for V100 is FP32 5120,  FP64 2560.
But what about supercomputers? For example Summit supercomputer from USA is 200
petaFLOPS in peak. Is any was to calculate it's hash per second performance for SHA1 for example?


texts: Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?

texts:
In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter seems arbitrary and forces the scrambling pattern to repeat every 232 16-byte block.

Is the algorithm expected to be secure for significantly longer stream lengths if for example the IV were a 128b nonce XORed with a 64b or 128b counter, or are there known cryptanalysis issues that begin to arise?


texts: Is there a secure multi-party computation (SMPC) scheme that doesn't use secret sharing?

texts:
According to the Wikipedia article about SMPC:

  Secure MPC is closely related and builds on to the problem of secret
  sharing, and more specifically verifiable secret sharing (VSS), which
  many secure MPC protocols use against active adversaries.

So, is there an SMPC scheme that doesn't use secret sharing? Are any in popular use?

Context: I'm not familiar with the literature on SMPC, and I've only studied it as an extension of secret sharing.


texts: Unable to understand coin variable used in hash(H2)function querie

texts:
I have some hash function queries representations, which I find it hard to understand.

I have searched a lot but didn't found anything helpful. Please help me understand the hash(H2) function query
I saw this from this paper "Certificateless searchable public-key authenticated encryption
with designated tester for cloud-assisted medical Internet of Things" (security proof)


texts: Discrete Gaussian Sampling role in Lattice-Based Crypto?

texts:
I'm reading up on how post-quantum cryptography works, and stumbled upon the notion of discrete Gaussian sampling. However, I can't understand where it fits in the greater picture - currently it feels to me like a solution to a problem nobody put out.

Where exactly in a SVP problem (or any other commonly used lattice problem) would Discrete Gaussian Sampling provide a benefit?

I'm still new to PQ so pardon the highly likely banality of the question


texts: Algorithm for Boneh and Durfee attack on RSA

texts:
I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private Key $d$ less than $N^{0.292}$) but after spending hours I am having problem writing the algorithm needed to implement the code. A small hint to help me implement the code would be appreciated.

I am familiar with LLL (lattice reduction) and how RSA works, so just small hint would be really helpful.

I understand that we want to solve the polynomial $f(x, y) = x(A + y) - 1 = 0 \ (mod \ e)$ s.t. $x = k$, $y = -p-q$ and $A = N+1$, but I don't understand the shifting part and construction of lattice basis to be used in LLL.


texts: Can Poly1305 be used with block ciphers running in CTR mode?

texts: Is the use of Poly1305 limited to stream ciphers? (note, I'm not talking about Poly1305-AES )?  Can it be used with block ciphers running in CTR mode?  If so, what other considerations/limitations are there?  I like the simplicity of using a single key for encryption/authentication, but authenticated modes like GCM are limited to block ciphers.


texts: Algorithm to transform plaintext to a key of desired keysize, when using input plaintext as key for FPE?

texts:
Using a format preserving encryption scheme that uses AES internally as its block cipher, for a plaintext that I encrypt I want to use that input plaintext as the key.

However using AES-128, my keysize is required to be 128 bit.  But i cannot guarantee my plaintext to be exactly this length - they are words or numbers of variable length.

Is there a computationally efficient and acceptably secure way to convert the plaintext to exactly the keysize required by the AES algorithm?  Does it even matter what algorithm I use?

EDIT:  The FPE I'm using is BPS.  I'm using it as a one way encryption on plaintext values such as SSN, names, dates, etc.  (Note: not using this for any authentication purposes - merely trying to eliminate the need to store or reuse a single key - I also have no need to use a single key anyway because I have no need to decrypt the original plaintext)

Further context on the answer to “Is there a format preserving cryptographically secure hash?”

EDIT 2:  Although it is convenient in the sense that this approach doesn't require storing a key anywhere I realize now that using the input plaintext as key is flawed especially for smaller plaintext which the attacker can brute force rather trivially. This is definitely not the way the FPE was designed to be used.


texts: RSA: How effective is this keypair-trash attack

texts:
A question that could very well be part of xkcd's "what if?":

Let's say Monica made a piece of software that sends all RSA keypairs to a central database after they're not used anymore. Something like a keypair-trash. Let's say Monica has convinced everyone in the world to use this piece of software. Monica starts collecting keypairs on January 2015 and waits X years and collects all keypairs.

1) Given the current evolution of electronics and use of RSA, how many years would Monica have to wait so that a new keypair created has a 10% chance of being in the database? (you can apply certain limits like key length never changing)

2) If Monica had a DB that has 10% of all the possible RSA keypairs (within certain limits like length). Will the database be so big that searching a match is still too hard?

3) Would the attack be any more effective if Monica managed to put a keygenerating program in every consumer-grade device (with internet connection) of a country the size of the USA? The program uses all the devices spare time to generate keys and send them to her DB.