texts: blinding a hash vs. sending the hash directly

texts:
So with blind signatures you have two parties - A and B. A has a message that they want B to sign so A creates a hash of their message, blinds it, and then sends it to B to sign. That, as I understand is how blind signatures work.

My question is...  what's the point of blinding, in that step? If all you're sending is a hash then that, in and of itself, should obscure the message. And if you wanted to protect against an attacker knowing when you're sending the same message you could send salted hashes to the signer B to sign instead of blinding the hash of the message.

Am I wrong?


texts: Order-Preserving Encryption (OPE) and leakage

texts: I recently came across OPE and Order-Revealing Encryption (ORE), but I didn't exactly got the idea why they are important. What's exactly important about them? Are they actually used in practice? My recent interest is leakage-resilient cryptography, and I saw there are some papers on leakage in OPE and ORE, but why is leakage important in OPE and ORE?


texts: Android app cryptography does it fall under US Export laws?

texts:
Basically, I want to encrypt some strings in my app, strings like access tokens or passwords. I planned on using AES, and mainly saw a good library at https://github.com/tozny/java-aes-crypto. Note that this is used only for protection of sensitive data while the app's purpose is other. As I said, simply add a bit of extra security to saved tokens if a root-ed user gains access to the database which stores these values.

However, after reading a bit about cryptography it seems that there are some US Export laws to consider for apps published on Google Play and available to other countries outside US.

Does using AES library in the link above fall under the requirements of US Export laws or because it uses the integrated android libraries and not uses own cryptography library is fine? Or maybe using xor would be better?

Thank you.


texts: Exploiting weak hash functions in RSA-PSS

texts:
I'm just trying to understand how a Weak/broken hash can break RSA-PSS or any other signature/encryption that uses it.
I know you can forge another message that has the same hash but that message probably doesn't mean anything, sending random numbers isn't really worth the trouble.


texts: Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

texts:
I have some code that accepts a password in string format, and hash it with SHA3-512 before passing it to bcrypt for hashing. However, by some coincidence, I found a test case that produces a hash that contains '\x00' in the middle of the hash result, as seen below:
password_str = 'tes15!tes15!tes15!tes15!tes15!tes15!tes15!tes15!tes15!tes15!tes15!tes15!.'
password_bytes = password_str.encode('utf-8')
hashed = hashlib.sha3_512(password_bytes).digest()

The hashing result that contains '\x00' in the middle of the hash:
b'u~"\x98\xac\xc8E2eV\xbb\x8e#}\x92R\xdc\xa2\xab\xab\xcb\x8d.~\x9f\x82a\xbf\xec]k\xdb\xc55\x1d\xa4\x00\xe8\x03\x94\xb0\x91\x14\xf0\x9ec\x9a\x9ay\xfeP\xe3\x07J\x00\xb5\xbd\xba\xcb(\xf5\xdb\xab\x1a'

As we can see, there is an '\x00' found in the middle of the hash, but not at the end. bcrypt detects this a ValueError exception:
if b"\x00" in password:
    raise ValueError("password may not contain NUL bytes")

I understand that '\x00' is a reserved character and possible attack vector due to hash-length extension attacks. However, I do not think that I have done anything outside the ordinary. Is there a best practice that sanitizes the hash prior to passing it to bcrypt that I am missing, or is there another type of byte-encoding that should be used with passwords?
It would be weird to reject a normal password just because it's derived hash conflicts with the auth library used.. Any help or advice is greatly appreciated. Thank you!
EDIT: After posting, I found some issues on bcrypt that describes my problem
https://github.com/pyca/bcrypt/issues/55
https://github.com/pyca/bcrypt/pull/57


texts: Can an analog of ChaCha with 64-bit words be defined, and would it be secure?

texts:
Blake2b has a lightning fast compression function with more-than-overkill security even against quantum attacks.  It seems to be based on ChaCha, but with 64-bit words and different rotation constants.

Is it possible to use this compression function with feed-forward as a stream cipher?  If not, would a different variation on ChaCha with a 64-bit word size be secure?


texts: Necessary conditions for construction of $n$ to $p(n)$ pseudorandom generators from $n$ to $n+1$ generators?

texts:
Given a polynomial time deterministic algorithm $G_1:\{0,1\}^n \rightarrow \{0,1\}^{n+1}$, consider the function $G:\{0,1\}^n \rightarrow \{0,1\}^{p(n)}$ constructed as follows:

Let $s \in \{0,1\}^n$ be the input seed and denote $s =s_0$.
For every $i = 1,\ldots,p(n)$, compute $(s_i,\sigma_i) = G_1(s_{i-1})$.
Output $(\sigma_1,\ldots,\sigma_{p(n)})$.

Now, we know that if $G_1$ is a pseudorandom generator, then $G$ is also a pseudorandom generator - i.e. in order for the construction of $G$ to yield a pseudorandom generator it is sufficient for $G_1$ to be a pseudorandom generator.

My question is as follows: Is it also necessary that $G_1$ is a pseudo-random generator? In other words, is it true that $G$ is a pseudorandom generator if and only if $G_1$ is a pseudorandom generator - i.e. is it possible to prove that if $G_1$ is not a pseudorandom generator, then $G$ is not a pseudorandom generator?

More generally, if the above is not true, given $G_1$, is there any way to construct a deterministic poly-time algorithm $G:\{0,1\}^n \rightarrow \{0,1\}^{2n}$ such that $G$ is a pseudorandom generator if and only if $G_1$ is a pseudorandom generator?

Or, if this is not possible, given a permutation $f:\{0,1\}^n \rightarrow \{0,1\}^n$, is it possible to construct a deterministic polynomial time algorithm $G:\{0,1\}^n \rightarrow \{0,1\}^{2n}$ such that $G$ is a pseudorandom generator if and only if $f$ is a one-way permutation?

For context: I am working through each step of the classical construction of pseudorandom functions from one-way functions:

OWF $\rightarrow$ hard-core predicate $\rightarrow$ $n+1$ PRG $\rightarrow$ $2n$ PRG $\rightarrow$ PRF

we know that if $f$ is a one-way permutation, then this construction yields a pseudorandom function. I would like to understand whether it is necessary that $f$ is a one-way function for this construction to work - i.e. if I am given an inversion adversary for $f$, can I construct an adversary for the pseudorandom function given by the above construction? More generally, given a permutation $f$, I would like to construct a function which is pseudorandom, if and only if $f$ is a one-way permutation, and I was curious whether the typical construction of pseudorandom functions has this property.


texts:
when i was reading the latest source code of openssl, i found openssl enc has
an 8-byte (64-bit) salt length; because the same (password, salt, iter) will
generate the same (key, iv), birthday paradox tells that you may reuse a
(key, iv) pair within about 2^32 encryptions;

openssl source:

//  apps/enc.c;
int enc_main(int argc, char **argv)
{
    ...
    unsigned char *buff = NULL, salt[PKCS5_SALT_LEN];
    ...
}

//  include/openssl/evp.h;
# define PKCS5_SALT_LEN                  8

personally i do not think 2^32 (around 4 billion) is a very large number; there
are almost 8 billion people around the world now; in some use cases there are a
lot of personal data records that need to be encrypted; the number is even larger
when you include other animals such as cats and dogs;

pkcs #5 (in 2017) recommends at least 64-bit salt length; while
nist (in 2010) says you shall use at least 128-bit salt length; there is
also a github issue proposed in 2017;

my questions:

is 64-bit salt length deemed secure right now? if so, why does nist said you
shall use at least 128-bit salt length 7 years earlier?
is openssl enc meant for production use or only a demo of the openssl
library?
if the salt length cannot be easily improved in openssl, what other
libraries and shell tools are both secure and easy to use?


texts: Is it possible to see whether different EC encrypted messages are (likely to be) encrypted on the same public key?

texts:
There are two non-equal (different at least in one bit) messages $M_1$ and $M_2$ both encrypted with elliptic curves on public key $K_{pu}$: $E_1=\mathsf{Enc}(K_{pu}, M_1)$ and $E_2=\mathsf{Enc}(K_{pu}, M_2)$.

An attacker possesses $E_1$ and $E_2$ but does not know whether they are encrypted with the same key.

Is it somehow possible for at attacker to establish that $E_1$ and $E_2$ are encrypted with the same key, or to make such judgement with reasonable probability?


texts:
If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts).

I do not understand why encryption system (E,D) where D(k,0)=0 is considered as ciphertext secure.

Imagine CPA security game where an attacker just submits two plaintexts, m0 = 0 and m1 = (any value != 0). In that case if poor challenger returns 0 then we are certain that we're in experiment 0 and win CPA game.

What I am missing here?


texts: How many of primitive point on the elliptic curve?

texts:
In elliptic curves for cryptography, I know  $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$.
For example, $P(0,6)$ is a primitive point on the elliptic curve $y^2\equiv x^3+2x+2 \pmod{17}$.

I ask about points on elliptic curve. How many numbers point that is generator or (primitive point).

Is any point on elliptic curve is generator or no.

also. How can I determine this points?


texts: Keccak follows a sponge construction. Can we say that Keccak employs a compression function?  Generally speaking, for sponge constructions, can we say that there is an underlying compression function?


texts: How to use Homomorphic encryption for secure computing Arctan() function?

texts: In the multi-party communication(MPC), if partyA has the coordinate(x1 y1) and partyB has the coordiante(x2,y2), how two parties can securely compute Arctan((y1-y2)/(x1-x2)) without revealing their coordinates to each other?


texts: What form of ECC can we use to make sure our newly invented ECC based crypto-systems are quantum secure?

texts:
It seems a lot of crypto-systems that are based on elliptic curves are susceptible to quantum computing attacks.

Hence, what forms of ECC cryptosystems are quantum secure, and how can we prove that?

Is there any good place to start with ECC (before moving on to different adaptations of ECC)? I have seen some resources but the math behind those papers seems very confusing, I don't even know what kind of math it is.


texts: Is it necessary to have a certificate when we use TLS

texts: When we say a communication is secured by the latest version of TLS, can we say that Man-in-the-Middle attack is not possible? Do not consider the situations that we can down grade the communication protocol. With TLS, is it necessary the have certificate for the server?


texts:
EDIT: Just wondering why was this question closed as a duplicate of a question asked almost 2 years after this one...
I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV.
Why is that needed?


texts: Is there a way to use bcrypt with passwords longer than 72 bytes securely?

texts:
From my understanding BCrypt truncates the password to 72 bytes. If a password is longer than 72 bytes, what is a way to store that password using bcrypt securely without compromising it? Or is this incorrect and we should just let bcrypt truncate it?

The reason why I ask is that I've seen some implementations where they SHA-256 the password first then enter it into BCrypt (e.g. PassLib bcrypt_sha256). However the SHA-256 output is a 32 byte digest. If the original password before the SHA-256 was longer than 32 bytes doesn't hashing it with SHA-256 compromise bcrypt by shortening it to 32 bytes?

If that is the case with SHA-256 would SHA-512 be a more secure option with 64 bytes?

I've seen in some places like Wikipedia and SE Cryptography where they say 56 bytes is the max password byte length. What password byte length is optimal for bcrypt passwords if it isn't 72 bytes?

If that is the case, then with passwords less than the optimal byte length is it better to hash them to a longer byte length?


texts: Is it a bad idea to make multiple SHA-* with the same header?

texts:
I'm trying to figure out a simple way to verify ownership over a short period of time (typically 8 - 24h), to be used in a mobile application.

One of the ideas I came up with is to hash the following concatenated sequence:

user pincode + user unique ID + payload
where
    pincode   is a 6 digit passcode, provided by user
    unique ID is a GUID identifying the device, generated once
    payload   is a rather long JSON payload, different each time

Provided I'm using an algorithm like SHA-512 or similar, what's the risk of using always the same header (pincode + ID) for multiple hashes?

Is it easier for an attacker to figure out a header if used for multiple hashes?

Optionally, do you think this would be a valid ownership verification, knowing an attacker could potentially replicate a payload.


texts: How many required known plaintexts for an attack are considered insecure?

texts:
I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit.

When I was looking at more common block ciphers with a 64 bit, I learned that they can be considered secure when the number of plaintexts required for a known/chosen-plaintext attack is relatively high ($~2^{40}$ - $2^{64}$).

I have two questions.

Firstly, is this a correct threshold for considering a cipher secure?
And secondly, does this mean that all 32-bit block ciphers are inherently insecure?

Another question that I asked after discussing my original post: Speaking in general terms, assuming that you have found an optimal attack for a block cipher that requires x known plaintexts or y chosen plaintexts. How large would x/y have to be so that the cipher could be considered secure?


texts: How to take SHA-1 safely for my particular case?

texts:
Let me ask about my toy passwords generator program X5 which I want to improve.
X5 uses a secret key and a public key to generate a password.Where any public key is supposed to be known to hackers in the worst case.

pwd = sK + pk

To describe details, let me define some expressions.

each of K and k denotes a seed key but k corresponds to just one password generation,
   whereas you use K for all password generations;
K(n) means a seed key of n length;
pwd(n) means a password of n length;
sha1( s, n ) returns the first n characters of sha1(s),
where sha1 means recursively applying sha1 algorithm
on the input string for a constant many many times.

Using the new expressions, my algorithm can be written as follows.

pwd(n) = sha1(
               sha1( sK(5) + pK(3 or longer) , 5 )
         , n);

I want to X5 prepares for the following context of a user .

The algorithm of X5 is in public.
HackerA knows just one generated password pwd_X ;
HackerA knows all public keys, of past and of future .
HackerA even knows that pK_X was used to generate pwd_X.
HackerA tests all possible patterns to know sK.
HackerA knows all pairs of account names and servers.
HackerA tests all passwords possibly generated by X5 against all servers.

Let me ask , if the following algorithm differs much than the previous one.

pwd(n) = sha1(
               sha1( sK(5) + sha1( pK(3 or longer) ,3 ) , 5 )
          , n);

And which one is more secure?

Thank you in advance.


texts: Is it possible to enumerate the possible RSA keys?

texts:
As far as I understand ECDSA keys are smaller than RSA because all of the value of the ECDSA (up to a high number) are valid private keys.

Is there any method of compressing RSA keys, based on some form of description of the key?

e.g. This is the $M^{\text{th}}$ possible value of $n$, given that $e = E$ and $A \leq n < B$.


texts: Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

texts:
I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says

/* Keep track of how much of the current hash block is full
     *
     * Why the 4294949760 constant in this code? 4294949760 is the highest 32-bit
     * value that is congruent to 0 modulo all of our HMAC block sizes, that is also
     * at least 16k smaller than 2^32. It therefore has no effect on the mathematical
     * result, and no valid record size can cause it to overflow.
     *
     * The value was found with the following python code;
     *
     * x = (2 ** 32) - (2 ** 14)
     * while True:
     *   if x % 40 | x % 48 | x % 64 | x % 128 == 0:
     *     break
     *   x -= 1
     * print x
     *
     * What it does do however is ensure that the mod operation takes a
     * constant number of instruction cycles, regardless of the size of the
     * input. On some platforms, including Intel, the operation can take a
     * smaller number of cycles if the input is "small".
     */

It then goes on to do

state->currently_in_hash_block += (4294949760 + size) % state->hash_block_size;
state->currently_in_hash_block %= state->block_size;

I don't understand why you would want to add a number that's congruent to zero modulo state->hash_block_size - what does it achieve? How does it guarantee a constant number of instruction cycles?


texts: If $E_{k_1}(p_1) = c_1$, what is the probability that there exists key $k_2$ such that $E_{k_2}(p_1) = c_1$?

texts: Let $k_1$ be a 56 bit DES key that performs $E_{k_1}(p_1) = c_1$. What is the probability that there exists another key $k_2$ such that $E_{k_2}(p_1) = c_1$?


texts: If pseudorandom functions (PRFs) are deterministic in nature, how can encryption schemes using PRF be CPA secure?

texts: I am new to crytography. Can anybody tell me what I might be missing here?


texts:
What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user?

For example say I have a database table with 50 columns

col1, col2, col3, col4......col50

Now I want to reveal the data such that

user1 can see (have access to) col15 and col17 only  at time t1 and
user2 can see (have access to) col7, col9 and col20 only  at time t1
user3 and user4 can both see data only in col40 at time t1.
user1 can see (have access to) col24 only (which means access to previously assigned col15 and col17 will be disabled) at time t2
user1 can have access to additional column say col 42 at time t3. so At time t3 user1 has access to both col24 and col42

I am thinking if I can issue tokens to users such that each token would hold access to set of columns in a database table or something like that.

What kind of efficient protocol or algorithm I can use to construct such scheme ?

My scalability requirements

At most I will have is probably 1000 columns (maximum)
I can have millions or billions of users. Algorithms than can scale for millions is also ok


texts: I know that a perfectly random unbiased and not reused OTP cipher is perfect. An OTP under cryptanalysis has a very strong bias (up to 30 % of symbols are represented by 5 out of 255 possible symbols) but no repetition could be found. This OTP encryption is theoretically vulnerable. May I know the possible sequence of steps to exploite the vulnerability?


texts: Mapping between subgroups and the integers

texts:
This question is a companion to the equivalent question on elliptic curves.
Preliminaries
Diffie-Hellman, Elgamal, DSA, etc. are examples of protocols that work in the integers modulus a large prime $p$. However, for security reasons, we do not use all the integers in $\mathbb{Z}^*_p$ but only a subset of them. The subset is of size $q<p$ and $q$ is also a prime number. The subset is also chosen so that it also forms a group, $\mathbb{G}_q$, with closure under multiplication (a multiplicative subgroup). Number theory tells us that such a group can be found iff $q$ divides $(p-1)$.
With Elgamal in particular, messages must be encoded into $\mathbb{G}_q$. If the message is an $\ell$-bit bitstring $\{0,1\}^\ell$ and $\ell<|q|$, then it can be treated like an integer and will be in $\mathbb{Z}_p$ (and $\mathbb{Z}_q$) (we'll ignore the corner case of all zeros). The problem is that it is unlikely to also be in $\mathbb{G}_q$ (depending on how much smaller $q$ is than $p$).
Questions
How can you map numbers from $\mathbb{Z}_q$ to $\mathbb{G}_q$ and back when:

$p=2q+1$
$p=aq+1$ with an $a$ such that, e.g., |p|=1024 and |q|=160

(I'll accept the best answer for the second case)
(As the second case appears not to be possible—see my answer—I've accepted an answer for the first case)
Format
This question is somewhat rhetorical for me personally, but I think it is a good place to gather different answers in one place (and things have been slow). With that in mind, use one technique per answer. Also relevant could be encoding-free Elgamal (such as hashed Elgamal) that sidesteps the problem.


texts: Validating JWT works with small changes to public key, why?


texts: Can data stay encrypted unless I'm eliminated?

texts:
I work as a spy for a top secret and ruthless government organisation with a three letter acronym.  I know all their dirty secrets and where the skeletons are literally buried.  In order to protect myself from being eliminated when I’m no longer required, I’ve downloaded all the organisation’s data and securely encrypted it.  I’ve then distributed that encrypted data to friends and reporters.

Is there a technique whereby the data remains encrypted whilst I’m still alive?  Clearly I would have to actively take steps to ensure this, and these steps would end upon my disappearance.  So whilst I’m alive I do “stuff” perhaps every month, and the shameful secrets remain impossible to decrypt.

I’m aware of secret sharing and key /certificate revocation but not of their flavours.  It seems like the very opposite of revoking a public key though.  Would I have to keep sending newly encrypted copies out?  Is there a cryptographic way to protect myself like this?  I’ve read somewhere that Edward Snowdon has such a protective scheme.

Edit:  The things I know would bring down the organisation and my friends being reporters, they would publish it as soon as possible.  Hence the notion of them not mathematically being able to decrypt unless I'm eliminated.  I do not want to rely on their assurances that they won't break the story at the earliest possible opportunity.  This allows the organisation to leave me alone.


texts: CTR mode nonce with aggressive key rotation policy

texts:
I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce.

Normally I would never disregard best practices like this, but I think in this context it is acceptable because the encryption keys will be rotated frequently. As I understand it, the weakness in CTR mode occurs when the same nonce AND key are used to encrypt. If the key is rotated, say, every 2 months, it's unlikely that there would ever be a nonce collision.

This is a heterodox use of CTR mode - feel free to savage my idea if it is flawed. Thanks for your help.


texts: Is the private key static or variable key in the elgamal algorithm?

texts:
I read about elgamal algorithm it work like the follow steps

Bashir chooses a large random prime p and a primitive root α modulo p.
Bashir then chooses a random integer a with 2 ≤ a < p - 1 and computes α^a  mod p.
Bashir’s public key is (p,α,α^a) and his private session key is a.

Enciphering stage consists of the following steps:

Amina obtains Bashir’s public key (p,α,α^a).
She chooses a random natural number b < p - 1.
She computes α^b  mod p and mα^ab  mod p.
Amina then sends the cipher text c = (α^b,mα^ab) to Bashir.

Deciphering stage consists of the following steps:

Bashir uses his private key to compute (α^b )^(-a)  mod p.

Then he deciphers m by computing (α^b )^(-a)  .mα^ab  mod p.
I understood this algorithm but I have Wondered simple

Imagine that we have a message consists of four parts (block data) and want Amina encrypted and sent to Bashir.
Is Amina used the same Private Key (b) Of four parts or generate a new private key for each part of the message During the session encryption.


texts: Distance between consecutive primes distribution

texts:
In several prime generation schemes I saw we pick a random number uniformly at random from a wide range and find the next prime after it.

Obviously with such a scheme some primes are more likely than others, a prime is as likely as the distance to the previous prime.

The question is how unbalanced is this? If a friendly alien gave me a list of the top X most likely primes from a much wider range how likely would a random prime from the scheme above be on the list?


texts: how do you calculate the private exponent in asymmetric key encryption

texts:
Here is an excellent paper on the math of asymmetric key encryption: http://www.mathaware.org/mam/06/Kaliski.pdf

See the example on Page 6.

The public key = $55$
Primes used to calculate public key are $5$ and $11$.

$e = 3$

Now see the appendix:
$L = \mathrm{LCM}(p-1, q-1) = 20$

The paper states $de = 1 \mod L$

I can't figure out how he gets the value of $d = 7$


texts: What's the difference between trapdoor and encryption?

texts:
Trapdoor is a function taking as input $x$ and givings us output $y$ where it is hard to convert $y\rightarrow x $ back without knowing a secret $s$.

I think that $y$ is an encryption of $x$ under a some certain key($s$ or its associated public key).

So is trapdoor encryption?


texts: Determine whether a given function is a pseudorandom generator/function

texts:
I am trying to solve the following three tasks (for exam practice, not as a homework):

Define $ : \{0,1\}^* \rightarrow \{0,1\}^*$ by $G(x_1,...,x_n) = _1 \oplus _2,_1,⋅⋅⋅,x_n.$ Prove that this $G$ is not a pseudorandom generator.
Let $G$ be a pseudorandom generator, and define $G'(x_1, ..., x_n) = G(x_1, ..., x_n)|(x_1 \vee x_2)$. Is $G'$ a pseudorandom generator?
Define $ : \{0,1\}^* × \{0,1\}^* \rightarrow \{0,1\}^*$ as follows: $_{_1,...,_} (_1,..., _) = \bigoplus_i _ _$, where $_, _ \in \{0,1\}^*$ (Note that, different from the usual convention, $F$ takes an n-bit key and an n-bit input, but has only a single-bit output). Prove that this  is not a pseudorandom function.

My guesses are:

Not a pseudorandom generator since a distinguisher can always distinguish G(s) from a truly random string because the first bit of G(s) is always equal to the XOR of the second and third bit.
Not a pseudorandom generator because a distinguisher could simply check whether the last bit of the string equals $x_1 \vee x_2$ and could thus distinguish G(s) from a truly random string.
I cannot determine how to solve this.

Are my guesses correct? Can someone provide an idea for 3?


texts: Has Telegram security been significantly improved with MTProto 2.0?

texts:
Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, making unusual applications of hashing and key generation/exchange protocols; and not having been created by someone credited by infosec community. Although it has never been actually broken, organizations like EFF do not recommend it for privacy concerned users.

Last year Telegram rolled version 2.0 of MTProto, which changed SHA1 for SHA 256, among other specifications, and is now safe against IND-CCA. Are these changes enough to redeem Telegram's reputation? Do they make it a valuable choice for safe messaging (at least in the secret chat/e2e mode) or does it still needs more improvement (if it's even possible)?


texts: Does anyone have any hard ciphers to be cracked for fun?

texts:
The title says it all. Do you have any ciphers or encoded messages that you could post as a brainteaser?
Thanks!


texts: How Pairwise Transient Key is derived or generated?

texts:
I recently study WPA/WPA2 security and I want to know how PTK is derived. I found these parameters in the IEEE 802.11 standard (2012):

PRF - X(PMK, “Pairwise key expansion”, Min(AA,SPA) || Max(AA,SPA) || Min(ANonce,SNonce) || Max(ANonce,SNonce))

where X = 256 + TK_bits. The value of TK_bits is cipher-suite dependent

And only one page is about PRF in the IEEE 802.11 document.

The mystery for me is the PRF or pseudorandom function. How does it work? Does it have any algorithm or method? I have searched, but I have not found any concrete examples with concrete numbers and step by step tutorial or any code implementations.


texts: LR-Oracle Experiment in Lindell and Katz

texts:
In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for multiple encryptions if (to use the notation of Lindell and Katz)

$$\begin{equation} \textbf{Pr}[\textbf{PrivK}_{\mathcal{A},\pi}^{LR-cpa}(n) = 1] \leq 1/2 +  \textbf{negl(n)}\end{equation}$$

Some questions:

I'm assuming that this implies that for $\pi$ that satisfies the above, it's safe to provide oracle access to $Enc_{K}(\cdot)$ to a CPA adversary $\mathcal{A}$, and by implication its safe to expose a counter mode encryption oracle to a CPA adversary
If not, what is the exact definition that tells me the conditions under which it's safe to expose an encryption oracle to a CPA adversary?
Since CCA security requires non-malleability in the cipher, is it true to say that adding authentication to a CPA secure scheme in the manner of an AEAD scheme is the sole requirement to additionally provide non-malleability / security against a CCA adversary, thereby making it safe to additionally expose a decryption oracle to $\pi$ to the adversary?


texts: SSL pinning - how to safely hide the certificate?

texts:
We are doing an iPhone app and read multiple forums which says SSL pinning makes it possible to avoid man in the middle as we trust our web services server through the certificate which will be pre bundled along with our app to appstore.

How can i protect the certificate ? We tried storing inside the app in base 64ed DER format but the string commands on the binary executable prints that data. Is there a way where the certificate is hidden from the attacker so that the IPA file is not vulnerable from giving up the certificate.


texts: Hash functions such as SHA are considered as non-algebraic statements. How can one construct a NIZK proof to show that the output of a hash is computed correctly in an efficient manner.


texts: In RSA, what's the risk of revealing $p^e\bmod N$?

texts:
Assume a common RSA public key $(N,e)$ with $N$ the product of two unknown distinct randomly chosen large primes $p$ and $q$ of about the same size.

Does revealing $p^e\bmod N$ (in addition to the public key) allow factorization of $N$, or otherwise makes it markedly easier to solve the RSA problem? What about also revealing $q^e\bmod N$?


texts: Is there an escrow-like mechanism that doesn't involve a trusted 3rd party?

texts:
We know that escrow mechanisms are easy to implement when it involves a trusted 3rd party. For example if A and B don't trust each other they can simply send their goods to C whom they both trust. Then C can distribute the goods to them fairly.

However, is there a primitive that achieves the same when there isn't a trusted 3rd party? Basically, A and B don't trust each other and they want to exchange something. Can they do this without involving any trusted party?


texts:
I understand that if you have a message $m$, you can blind it by selecting a random $r$ and then multiplying $r^e\times m \pmod{n}$ Someone else then signs it with $d$, raising to the power of $d$:  $(r^{ed}\times m^d) \bmod n = r \times m^d$.  Finally to unblind: $r^{-1}\times r \times m^d = m^d$ and $\left(m^d\right)^e = m$.  I understand that.

However, what if I wanted to blind twice?  So after the first blind:  $r_1^e\times m \pmod{n_1}$.
After the second blind:  $r_2^e \times [(r_1^e \times m) \bmod n_1] \bmod n_2$.
Then someone signs it with $d_2$:  $\big(r_2^e \times [(r_1^e \times m) \bmod n_1] \bmod n_2\big)^{d_2} = r_2 \times [(r_1^e \times m) \bmod n_1]^{d_2}$.
Then to unblind the first round:  $r_2^{-1}\times r_2 \times [(r_1^e \times m) \bmod n_1]^{d_2} = [(r_1^e \times m) \bmod n_1]^{d_2}$.
Next:  $[(r_1^e \times m) \bmod n_1]^{d_2e_2} = (r_1^e \times m) \bmod n_1$.
Finally to unblind the second round:  $[(r_1^e)^{-1} \times r_1^e \times m] \bmod n_1 = m$

Am I going wrong somewhere in my math?  Because I wrote a program to do this and the strangest thing — sometimes it gives me the original message and sometimes it does not.  However, it does work perfectly when I comment out either round 1 or round 2.  So my program doesn't work for both rounds, but works for a single round.  I know this isn't the place to ask for programming help, but I'm thinking my math is off somewhere.  Does it have to be the case:  $\gcd(r_1, n_1) = \gcd(r_1, n_2) = \gcd(r_2, n_1) = \gcd(r_2, n_2)$ that both values of $r$ cannot have a common factor with both values of $n$?  Or did I make a mistake somewhere else?


texts: Given $ g^s, g^y , g^r, g^t, g^{st-rs}, g^{(yr+d)/t}$ , is it hard to distinguish $e(g,g)^{syr}$ from a random value?

texts:
Where $g$ is a group element in bilinear group $G$, $e(g,g)∈GT$ and $s, y, r, t, d$ are randomly chosen.

I understand it is very similar to the conventional DBDH problem, but $g^t, g^{st-rs}, g^{(yr+d)/t}$ are also known, possibly making it easier???

Does anyone know the answer or suggest some material for reference?

Many Thanks


texts: Is the following protocol perfect zero knowledge or computational zero knowledge?

texts:
So I have this protocol for the hamiltonian cycle:

repeat t times:

Peggy chooses a random permutation $\pi$ on $V$, and computes $G_1=\pi(G)$
For each of the $\frac{|V|(|V|-1)}{2}$ possible edges of $G_1$ Peggy computes a different commitment and sends the commitnet to Victor. ($\forall v_1,v_2\in \pi(V)$ if $(v_1,v_2)\in \pi(E)$ then the commitment is on 1, and 0 otherwise)
Victor chooses a random $i\in {1,2}$ and sends it to Peggy
If $i=1$ the Peggy sends $\pi$ to Victor and reveals all the commitments on $G_1$. Otherwise, Peggy revelas the commitments on $|V|$ edges which form a hamiltonian cycle on $G$.
Victor checks Peggy's answer

So it's pretty easy to see that this is a zero knowledge protocol. How do I show if it's perfect zero knowledge or computational zero knowledge?


texts: Homomorphic Encryption - Smart Vercauteren Batching

texts:
I'm going through Smart and Vercauteren's paper "Fully Homomorphic SIMD operations" and had a question about some notation used in the paper.

In section 2 of the above it is stated that for each monic polynomial $F(X) \in \mathbb{F}_2[X]$ of degree $N$ that splits into $r$ distinct irreducible factors of degree $d = N/r$ viz. $F(X)=\prod_{i = 1}^{r}F_i(X)$, the polynomial $F(X)$ defines the field $\mathbb{K} = \mathbb{Q}(\theta) = \mathbb{Q}[X]/(F)$ where $\theta$ is a fixed root in the algebraic closure of the base field.

Questions:

Should it not be stated that $\mathbb{Q}(\theta) \cong \mathbb{Q}[X]/(F)$ rather than $\mathbb{Q}(\theta) = \mathbb{Q}[X]/(F)$ ?
I assume that $\theta$ is just a root of $F(X)$ in the extension $\mathbb{Q}/\mathbb{F}_2$?
In the expression $\mathbb{Q}[X]/(F)$, is what is being referred to the

quotient of $\mathbb{Q}[X]$ by the ideal generated by $F(X)$, i.e. $\mathbb{Q}[X]/(F(X))$?


texts:
i have been recently learning about different types of hashing and the encryption/decryption methods of such hashes. Im currently trying to find the preimage of this hash i have been given as a homework question.

user2222:$6$l4w8Hnu1/ZHGGd.p$BHENd1yKnjRcW.KcAtqcOY096A6HtQBFaWGaXkQ0TofWRy.bngwrVTlLlzdwOLRvHtesGPIrY4LGSUIDnpA9w1:18011:0:99999:7:::

However, i am not quite sure what type of hash it is or if it is a combination of multiple. At first glance i believed it to be NTLM due to the username at the start. However if it is split into parts based on fullstops or colons, this is what it looks like:

["user2222","$6$l4w8Hnu1/ZHGGd", "p$BHENd1yKnjRcW", "KcAtqcOY096A6HtQBFaWGaXkQ0TofWRy", "bngwrVTlLlzdwOLRvHtesGPIrY4LGSUIDnpA9w1","18011", "0", "99999","7"]

As such:

user2222: i think is the username
a combination of the middle elements seems to be SHA512-Crypt:

$6$l4w8Hnu1/ZHGGd.p$BHENd1yKnjRcW.KcAtqcOY096A6HtQBFaWGaXkQ0TofWRy.bngwrVTlLlzdwOLRvHtesGPIrY4LGSUIDnpA9w1

However, i am fairly new to this so im not really sure what all of this means together as i have only really done MD5. Any help would be greatly appreciated. Thanks.


texts: How does RSA compute such enormous numbers?


texts: Is CRC32 birthday attack independent of input?


texts: Security of Deterministic Encryption Scheme

texts:
A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm.

Although we cannot achieve semantic security or indistinguishability for deterministic encryption due to lack of randomness in cipher text, there is an analysis of maximum possible security for deterministic encryption.

I could not understand much from these papers though. Can somebody say what that means in simple terms? How can we achieve it, if we want to implement it?
I suppose I need deterministic encryption because I want to be able to search on the ciphertext.

The papers I tried to understand:

Bellare, Mihir, et al. "Deterministic encryption: Definitional equivalences and constructions without random oracles." Advances in Cryptology–CRYPTO 2008 (2008): 360-378.
Boldyreva, Alexandra, Serge Fehr, and Adam O’Neill. "On notions of security for deterministic encryption, and efficient constructions without random oracles." Advances in Cryptology–CRYPTO 2008 (2008): 335-359.


texts: Is there a cryptographic approach to availability

texts:
Background

Cryptography can be said to provide the tools used to fulfill the goals of information security.

The three pillars of information security are confidentiality, integrity, and availability.

For confidentiality, we have ciphers. The relevant security models here consider ciphertext-only, known-plaintext, chosen-plaintext, and chosen-ciphertext scenarios (IND-KPA, IND-CPA, IND-CCA, etc). On a finer-grained level, there are attacks such as linear/differential cryptanalysis, and resistance to them.

For integrity, we have MACS and digital signatures. The relevant security models here are UUF-KMA, SUF-KMA, EUF-KMA, UUF-CMA, SUF-CMA, EUF-CMA (see link for full explanation of terms)

The question

Are there analogous security models and goals for availability?

Basic approaches to availability include redundancy in various forms, such backups and distributing content among many machines. A blockchain provides some level of availability from a cryptographic approach.

But is there any approach that defines/proves resistance against a formal consideration of an adversaries powers and goals in the same way that there is for confidentiality and integrity?


texts: Hash Function - Pre-image resistance and Strong collision Resistance

texts:
Why does pre-image resistance not guarantee strong collision resistance?

Logically I can make sense of this, but I am wondering if there's any general theorem that proves this?


texts: Do very short values make a peppered hash less secure?

texts:
Given many very short (or low-entropy) values – like 6-digit numbers – that are stored as hashes using a fixed secret pepper, e.g.:

value  | pepper               | hash = SHA265(value + pepper)
-------+----------------------+-----------------------------------------------------------------
100001 | e03c920babf6325ac56d | 75e3283fe3dbc8e1f86ac5ea7ac5325896a6036d5d2d73f355dca41b9dab4a42
100002 | e03c920babf6325ac56d | 20b50e24dc8a984905de5850e67167928f937f171a2e6cb9998c0a8131a11dda
100003 | e03c920babf6325ac56d | f555173d08ebd020b45a655cee159c2684ad98cd4901dc85ec047b565d3a4a05

... and assuming that an attacker knows that the values are 6-digit numbers and that the hashes were computed that way.

Could the attacker retrieve the values (or even the pepper) from the hashes? Do the short values make the hash more vulnerable / less secure?


texts: Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?

texts:
In standard RSA, the modulus $n=p_1 p_2$ is a product of two primes $p_1,p_2$ of the same size.  Suppose we construct the modulus as a product of multiple primes $p_1,\dots,p_k$, i.e., $n=p_1 p_2 \cdots p_k$, where all the primes are of about the same size.  I'm wondering how much this reduces the security of RSA, for typical modulus sizes.

Let me be more concrete.  I want security comparable to that obtained with standard RSA with a 2048-bit modulus.  Can I use $k=3$ (three primes) without significant loss of security?  $k=4$?  What's the largest number of primes $k$ that I can use, without significant loss of security?  Assume that each prime is $2048/k$ bits long, so all the prime factors are of equal length.

Related: see also Who first published the interest of more than two prime factors in RSA?, which asks about the inventor of this technique.  I'm asking something slightly different; in this question, I'm not asking about its inventor; I'm asking about concrete security levels.


texts:
The paper regarding curve25519 presents a theorem in chapter 2 (specification). The extension field $F_{p^2}$ is used in this theorem. I don't understand why this extension field is needed for the curve25519. This is how far I got:
The theorem implies that for some elliptic curves $E$ exists a unique $s \in F_p$ for every point multiplication $n \cdot Q$ ($s$ is the x-value of the resulting point). Point multiplication can be done using the Montgomery Ladder. Curve25519 has a base point $P = (9,y)$, where $y$ is not used in the Montgomery Ladder. Because $P$ is a point on the Curve, the point multiplication $P' = n \cdot P$ has also to be a point on the curve. Now one can multiply another scalar with $P'$ which again results to point on the elliptic curve.
In this context, only $F_p$ should be needed for the curve25519.
Hence, I think that the extension field is only used, if you consider the point multiplication for all point $Q = (q,r)$ for every $q \in F_p$. That means $Q \notin E(F_p)$ but $Q \in E(F_{p^2})$. I don't understand why this case in considered, when it is never used.


texts: Computational Diffie-Hellman problem over the group of quadratic residues

texts:
Suppose that $N=pq$ where $p$ and $q$ are safe primes. $\mathbb{QR}_N$ is the group of quadratic residues which is a cyclic group with order $\frac{\phi(N)}{4}$. Let $g$ be the generator of $\mathbb{QR}_N$.

The computational Diffie-Hellman problem is defined as : given $U=g^u\in\mathbb{QR}_N$ and $V=g^v\in\mathbb{QR}_N$ where $u,v$ are chosen uniformly at random from $\mathbb{Z}_{\frac{\phi(N)}{4}}$, compute $CDH(U,V)=g^{uv}$.

Now, if $N$  can be efficiently factored, then computing  $CDH(U,V)=g^{uv}$ is still hard ?


texts: What is the difference between data compression and compression in cryptographic algorithms?

texts: What is the differences between data compression as used in e.g. the ZIP protocol and compression as performed in cryptographic hashes? Are there common properties as well, apart from creating a smaller representation of the data?


texts: Is SHA-1 still practically secure under specific scenarios?

texts: It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algebraic construction. The same happens for MD5 but MD5 has been practically broken by finding collisions in real world. Can we still use HMAC with SHA-1 and be secure against preimage, second preimage and collisions?


texts: Is it possible to perform a meet-in-the-middle within a block cipher?

texts:
Standard meet-in-the-middle explanations show that you can perform a meet-in-the-middle attack on a repeated block cipher such as double-DES (performing DES twice in a row).

However, block ciphers themselves commonly consist of a number of rounds internally. Would it be possible to use a meet-in-the-middle attack on a single block encrypt?

In other words, will encryption / decryption meet a common middle state that allows us to see $\newcommand{\E}{\text{E}} \newcommand{\D}{\text{D}}$ $C = \E_k(M) = \E_{k''}(\E_{k'}(M))$ and $M = \D_k(C) = \D'_{k'}(\D''_{k''}(C))$ so that $S = \E'_{k'}(M) = \D''_{k''}(C)$ where $S$ is a middle state?

Related question: Understanding Meet-in-the-Middle attack on block ciphers.
Related Wikipedia page: Meet-in-the-middle attack with additional references to Multi-Dimensional Meet-in-the-Middle attacks on e.g. GOST.


texts: Why can´t an attacker find the key if he has the plain text, the IV and the ciphertext?

texts:
I am reading a book about web security and they are now talking about AES CBC.
After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain text and the ciphertext.

Is this possible? If not why?

Thanks.


texts: Would using two keys for Salsa20 or ChaCha increase security?

texts: Would using the keys (as in two passes with a key each) increase security for Salsa20 or ChaCha stream ciphers increase security?


texts: Where does bootstrapping occur, client side or server side?

texts:
In Fully Homomorphic Encryption, where does the bootstrapping procedure performed, in the client-side or the server-side?

Also, which side holds the secret key and the public key?


texts: Are EC public/private keys significantly weakened by having a known byte?

texts:
I would like to use different EC keys for different purposes in an app, and I would like to easily see the purpose for which particular key (pair) was generated.

With ~65K attempts, I can generate a key-pair where the first byte of both the public and private key are equal to a particular "purpose code" byte value.

(e.g. 0x01 is for signing Xs, 0x02 is for signing Ys, 0x03 is for encrypting Zs, etc.)

Does this significantly weaken the keys, in ways other than lowering the brute-force workload from 2^256 to 2^248?

(The obvious approach is to keep the full 256 bits and use an extra byte for the "purpose" information.  Generating a key, chosen to store a little data, has the advantage that this extra data can be encoded in all common key serialization formats, whereas a new "purpose" byte would need all new tools.)


texts: Is there any protocol for proving that a message was written at a certain time?

texts: Does there exist a way to cryptographically prove that a message was written at a certain time? I know that one can write messages in bitcoin transactions to that the message is preserved in the blockchain, which can be used to prove the message was written at that time, but I'm wondering if there is any protocol that exists specifically for the purpose of proving the time of a message.


texts:
Suppose Bob wants to give Alice a large file, in such a way that:

Bob cannot keep the file, but is able to use it to precompute anything he needs before he gives it to Alice
Bob must be able to challenge Alice periodically, and Alice can only successfully answer the challenge if and only if she is in possession of the file at the time the challenge is made (no shortcuts are permitted)
The challenge cannot consist of Alice sending Bob the file for him to check (each challenge must consist of an exchange of small, constant-size messages)

The naive approach is for Bob to generate a bunch of random nonces $N_0, N_1, \cdots$ and precompute $S_i = HMAC(N_i, file)$ and for the challenge to consist of sending the next $N_i$ and expecting back the corresponding $S_i$, but this has the downside that you can only prepare finitely many challenges in advance (Bob needs to get to the file to make some more) and Bob's space usage is proportional to the number of prepared challenges.

Can we do better? Is there an on-line protocol for this that doesn't require precomputing challenges in advance?

Basically I'm looking for a way to challenge a device to prove that it has access to a specific, potentially unbounded in size, piece of information (which the challenger only knows by some unique identifier and some kind of fingerprint) at the exact time the challenge is made without having to send the entirety of it over.

Thanks


texts:
Asuming this scenario:

Bob and Alice each have the public key of the other party for a D-H function and want to exchange data.

Now, if they each generate their shared secret, is it safe to assume that:

They can exchange messages safely without the fear of a MITM
Can reuse the shared secret n times

And what would be a estimated count for how many messages may be exchanged before the need for new public and private keys arises?


texts:
We all know that textbook ElGamal falls due to chosen ciphertext attacks, because of its multiplicative homomorphic property ($E(A)*E(B)=E(AB)$).

However these attacks require the ciphertext ($E(A)$ or $E(B)$) to be given, meaning as per this answer this would mean ElGamal isn't IND-CCA2, but IND-CCA1 as the access to a decryption oracle before the ciphertext is known doesn't help anything.

Hence my question:
Is the ElGamal encryption scheme IND-CCA1 or "only" IND-CPA?

"Bonus" question:
If the ElGamal encryption scheme isn't IND-CCA1 how would the CCA1 attack look like?


texts:
Is it true that $p^e\equiv p \pmod n$ and $q^e\equiv q \pmod n$ for RSA?

Here $n=p\cdot q$, $p$ and $q$ are different prime numbers as required by the RSA system.

I have to find four examples of $w$: $w^e\equiv w \pmod n$ that always hold. My candidates are $p,q,-p,-q$.

It works on examples but I can't prove it.


texts: Non-post quantum primitives in MPC protocols: for and against?

texts:
Is it acceptable from a security point of view for an MPC protocol to use non-post quantum cryptographic primitives?
Note that except for secret sharing, which provides information-theoretic security, many primitives are based on computational security.
I am interested in general (system level) and specific (individual primitive level) arguments to answer this question.


texts: Shall I use individual or common signing keys for different roles?

texts:
I have a server S to which a client system can establish connections using predefined roles R1, R2, ...Rn.

For mutal exchange of data and for authentication with GCM/GMAC a set of symmetric AES-128 keys are used for each Role.

The symmetric keys are agreed between the parties by use of elliptic curve Diffie Helmann key agrement (ECDH).

For that purpose, the intermediate DH "public keys" (Q=d*G, G=Base point, d=random big integer), needed to create the shared secret are signed with a signing key Ks and sent to the other side. This is to guarantee authenticy.

The ECC key pairs for the signing keys Ks (public and private on each side) are preestablished and can be regenerated on demand (out of scope here).

Question:

Should each client role have an individual private signing key Ks(Role) whose public key must be known by S (certificate for signature verification) or is just one Ks for all roles adequate? I think, because the roles are different entities (users), they should naturally also be separated in terms of their signing keys.

But: should the server keep a private signing key Ks(Role) assigned to each role, or would it be OK just to have one common private key Ks for the server as a whole? I tend to plan only one common server side key, but cannot really argue why or why not.


texts: What is degree of randomness in individual bits of MD5 hash?

texts:
I am researching on Hashing Algorithms and would like to know if we take individual bits of MD5, say we take first 8 bits or any random 8 bits of MD5 then what is the randomness probability of having same 8-bits (at exactly the same position) in any two different MD5 hashes ?

I´ve read somewhere that MD5 being good PRF has uniform randomness in each individual bit. Is this statement true? Also, is there any reference for this?


texts: What's the `ticket_age_add` and `obfuscated_ticket_age ` used for in TLS 1.3

texts:
In RFC, I only find such description:

This addition prevents passive observers from correlating connections unless tickets are reused

ticket_age_addis generated randomly and obfuscated_ticket_ageis computed by adding obfuscated_ticket_age to aging time of ticket.

In my opinion, cause the PSK is sent in plaintext and it need contain the aging time which is also in plaintext, man-in-middle may know the aging time of this ticket, so we need use  obfuscated_ticket_age not the aging time directly.

Question1:
If we don't want the man-in-middle know the aging time，we can remove the  obfuscated_ticket_age simply, right? Why the server need this information ?Just using it to check the ticket's real lifetime ?

Question2:
If the client using the ticket's real aging time not the obfuscated_ticket_age, what is the harm for endpoints if a man-in-middle knows the the ticket's aging time ?


texts: Are one time pads still secure when using randomly generated words as the pad?

texts:
I was researching the US military's DIANA one-time-pad system and came across the following quote purportedly from a former US Special Forces soldier:

  Special Forces were one of (if not the only) units in Vietnam to
  utilize Morse code on a regular basis. We used a method of encryption
  called the Diana Cryptosystem.

  The basis of these one-time pads, is that there were only two matching
  pads in existence, and they would only be used one time. They were
  booklets that contained randomly generated groups of 5-letter words,
  30 words to a page. The person sending a message would first write the
  letters to the message, over these random groups of words. Included in
  the front of each one-time pad was a one-page encryption table. If I
  wanted to send the letter P, and the letter under the P was an A, then
  I would send a K. The person listening on the frequency at the other
  end, would have the other matching pad. They would write the letter
  they received (a K) over the letter in their one-time pad (an A), and
  decipher it based on the table, yielding the original letter P.

(source: https://dodona.ugent.be/en/exercises/2088793301/)

Wouldn't the use of random words as reported by the soldier rather than groups of random letters diminish the security of the system, as the letters in 5 letter English words are not randomly positioned?

I am aware that "secure" in this context--messages between Special Forces camps during wartime--may just mean keeping messages secure long enough that they are no longer useful even if broken.


texts:
I'm trying to understand the Paillier Scheme but there's something I can't understand in the  keyGen algorithm:

  Ensure $n$ divides the order of $g$ by checking the existence of the following modular multiplicative inverse: $$\mu = (L(g^\lambda \bmod  n^2))^{-1} \bmod n.$$

I'm trying hard to find the relation between $n$ divides the order of $g$ and $\gcd(n, L(g^\lambda \bmod n^2))=1$ but I can't find it. I hope that somebody can help me understand it.


texts: PBEWithMD5AndDES Cipher does not check for integrity first?

texts:
I am running FindBugs with findsecbugs plugin to scan java code for security issues. I am getting "Cipher With No Integrity" error for a Cipher function implemented with "PBEWithMD5AndDES". The legend says "The ciphertext produced is susceptible to alteration by an adversary. This mean that the cipher provides no way to detect that the data has been tampered with. If the ciphertext can be controlled by an attacker, it could be altered without detection."

For the solution it suggests to "Use a cipher that includes a Hash based Message Authentication Code (HMAC) to sign the data. Combining a HMAC function to the existing cipher is prone to error. Specifically, it is always recommended that you be able to verify the HMAC first, and only if the data is unmodified, do you then perform any cryptographic functions on the data." Examples at http://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY

My statement is like below

Cipher engine = Cipher.getInstance("PBEWithMD5AndDES");

Doesn't the "PBEWithMD5AndDES" option verify the HMAC first? Or should I use other cipher option like "AES/GCM/NoPadding" as suggested?


texts:
Ok, so this is a very possible stupid question, but one of those things that has sat at the back of my mind for a while.

We all know that MD5 has issues, and these have been known for about a decade.  So this is theoretical.  I'm not considering using it for anything.

Question is this.  If MD5 generates a 32 digit number in hex, given that 32 is finite, and we can hash longer and longer values, didn't we know from the offset that MD5 had to have collision issues?


texts: NIST's Public-Key Post-Quantum cryptographic public calling

texts:
Is NIST's public calling:
https://csrc.nist.gov/news/2016/public-key-post-quantum-cryptographic-algorithms
...for a post-Quantum Cryptographic Algorithm a public calling for a public key distribution method (ex. Diffie Hellman) or a public key encryption method (ex. RSA)?


texts: Is it possible to use the root function to attack RSA?

texts:
Sorry for my silly question, but I have some doubts on this point. I'm trying to explain it better with an example.

Suppose you use RSA to sign a package and you have the public key. If the signature is generated by the server with its secret key you are able to decipher it because you have the public key and verify the integrity of your package. Suppose I make a "fake" package and I'm able to create a correct signature like this:

00 01 FF .. .. FF 00 ASN.1 SHA1

due to the deciphering process:

cleartext = C^e mod n

I can encrypt my signature in this way:

C mod n = root(cleartext,e)

and make a correctly padded signature without knowing the private key?

Example:

e = public exponent = 3

C mod n = cubicroot (cleartext)


texts: Security implications of using hash as a MAC

texts: What are the security risks, if I use a hash function $H$ such that $Y=H(K||M||N)$ where $K$ is a secret key, $M$ is a message, $N$ is a nonce and $||$ is concatenation operation (where the length of $K||M||N$ is fix and is less than or equal to block size of the hash $H$)?


texts: Getting unlimited amount of signatures - Risk?

texts:
Lets suppose we have a communication protocol given where messages $(1)$ and $(2)$ are send over an unsecure network.

There are some prerequisites like distributed certificates etc., but they should not matter for this question).

Message (1) is send as plaintext from $A$ to $B$ and does contain the identity of $A$. Party $B$ responds with a signature over the received identity and some other data (e.g. a public DH key) and sends it over to $A$.

A protocol that starts like this design allows an attacker to get a lot of signatures (as much as needed) and the input is even something under his control (the identity of $A$).

In my opinion this may open door to a lot of attacks the attacker can use. I don't know any but I can imagine that have been some and this kind of design should always be avoided.

I am open for any kind of comment on this. Especially if there were some relevant attacks in the past.


texts: IETF Recommendations for preparation for PQC- clarify in what way they are referring to bits

texts:
Which bits are being referred to when it is said by the IETF, "Continue to avoid baking-in algorithms, either explicitly or implicitly (e.g. via maximum field sizes)" ?

Does that mean leave enough bits of RAM (bit usage within memory for the functions to run), or sufficient key sizes as in, don't just focus on NIST level 1, 128-bit encryption but allocate for the possibility of having to use a 256 bit encryption, which requires lots more bits?

Obviously, increasing NIST levels uses more bits, but I want to be clear on what is meant, exactly, because there is a large variation between bits used among the Level 1, 128-bit lattice-based asymmetric keys proposed solutions in round 2, and an even bigger difference in bits used in 256-bit keys proposed.

I am comparing how many resources to consider allocating on different types of systems with different proposed round 2 schemes, for resource-deprived systems, so need to go by bits reserved for the new quantum resistant schemes vs the current ones. Therefore it makes a big difference and want to make sure I understand which "bits" are being referred to.

IETF mtg in 2017 @ time 59:29, and in the NSA recommendations it says to leave large enough bit sizes


texts:
What happens when a root CA has its private key compromised? Then all children in the tree are compromised too? And then all certificates are compromised? What needs to happen then?

Related:
- How can we get CA's public key?
- I've got my private key compromised. How does CRL work?
- What happens when a root CA has its private key compromised?


texts:
In  “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies" by DeFeo, Jao and Plut, a reduction from the Decisional Supersingular Product (DSSP) problem to Decisional Supersingular Isogeny (DSSI) problem is mentioned.
However, I could not find such a reduction anywhere, or even some kind of idea how to compute such a reduction.

Question: How to reduce DSSP to DSSI?

Alternativly some source for post-quantum cryptography reductions featuring the given problem?


texts: Deduplication: Encrypting the SHA-256 hash of a file chunk

texts:
I'm designing a data storage system that should be both able to deduplicate data that share the same encryption key, and be reasonably secure.

I know that this kind of encryption quality can be achieved by using AES in CTR mode with a synthetic IV derived from the HMAC of the file chunk - so that the contents are deterministic and still not leak information about the similarity of chunks.

While thinking about this problem, however, it seems to me that a good way to allow data deduplication is to encrypt the SHA-256 of the unencrypted file, and use that as a key to determine if the contents are the same.

This seems simpler for a variety of reasons - the first being that it's cheaper to check if a file chunk already exists on the server; The other is that while the encryption of the SHA-256 hash should still be deterministic, the actual chunk contents' encryption don't have to be. This also allows me to perform other non-deterministic filters - like compressing the file contents before sending it.

Are there any down sides or known attacks for this cryptographic approach?

==== EDIT: More info ====

A file will be divided into chunks; Each chunk will have its plain-text SHA-256 hash calculated (this may be lowered to SHA-1 though for storage space reasons); This hash will be encrypted with a deterministic encryption - probably AES-256 (but suggestions are very welcome). This encrypted hash will represent the file chunk into the abstract file storage system.
At this point, the encrypted hash will be checked against the storage system, and checked if it exists already. If it doesn't, the chunk will be compressed, encrypted (I still haven't decided what encryption will be used for this), and sent to the storage. The file storage system will be "dumb" - meaning that it won't make any check.

The chunk is not of fixed size - instead, it should implement a bup-like hashplitting, so deduplication can work better. I'm studying the possibility of having bigger chunks, but right now in bup's implementation, each chunk has about 8k of data.


texts: Is this problem with anti-circulant matrices hard?

texts:
If there is an obvious way to solve this problem, please give it a chance before downvoting, I beg you. Also, some insight into the resultant asymmetric cryptosystem will be welcomed (described in the link at the end of this question).
We will work with 4x4 anti-circulant matrices of the form:
$$\left (\begin{matrix}
a_0 & a_1 & a_2 & a_3 \\
a_1 & a_2 & a_3 & a_0 \\
a_2 & a_3 & a_0 & a_1 \\
a_3 & a_0 & a_1 & a_2
\end{matrix}\right )$$
With $a_i \in \mathbb{Z}_p$ and with $p$ a large enough prime, say 32-bit. Let's call the invertible subset of such matrices $S$.
Since the product of two anti-circulant matrices is a circulant matrix, we define a matrix that turns a circulant matrix into its anti-circulant equivalent.
$$M=\left (\begin{matrix}
1 & 0 & 0 & 0 \\
0 & 0 & 0 & 1 \\
0 & 0 & 1 & 0 \\
0 & 1 & 0 & 0 \\
\end{matrix}\right )$$
Next, we define a function $f$, which is the product of two matrices turning the result in its anti-circulant equivalent:
$f(A,B)=M A B$
As an anticirculant matrix is defined by its first column, we can alternatively write $f$ just as a function of vectors:
$$
f\left(
\left(\begin{matrix} a_0\\a_1\\a_2\\a_3\end{matrix}\right),
\left(\begin{matrix} b_0\\b_1\\b_2\\b_3\end{matrix}\right)
\right)=
\left(\begin{matrix}
a_0 b_0+a_1 b_1+a_2 b_2+a_3 b_3\\
a_0 b_1+a_1 b_2+a_2 b_3+a_3 b_0\\
a_0 b_2+a_1 b_3+a_2 b_0+a_3 b_1\\
a_0 b_3+a_1 b_0+a_2 b_1+a_3 b_2\\
\end{matrix}\right)
$$
This function is not associative and not commutative.
Next let's define a series using the function just defined:
$k_1,k_2 \in S, s_0=k_1, s_1=k_2, s_i=f(s_{i-2},s_{i-1})$
next we define two result elements for a given $i$:
$r_1=f(s_{i-1},k_1)$, $r_2=f(s_i,k_2)$
Then, for a large enough $i$, the hard problem is:
find the value of $k_1$ and $k_2$ knowing $r_1$ and $r_2$.
If the problem is really hard, it can lead to the cryptosystem described here.
It is also described more simply here.


texts: Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

texts:
Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. However, it is unclear to me how much this fills all the gaps for symmetric cryptography. Could we for instance define and implement a TLS 1.3 cipher suite to use just constructions solely based on the Keccak-sponge/duplex as primitive? Simple bit operations and loops are of course permitted to tie everything together.
So besides KMAC we'd likely need to have a well defined and preferably standardized KDF and a secure random number generator (preferably one that can be reseeded). Additional points go to the answer that also manages to indicate a method of authentication (hash-based signatures?) and, possibly more tricky, a key agreement scheme to replace (EC)DH.


texts: Can big numbers multiplication be a valid form of encryption?

texts:
I have a vector of int called $Xreg = [x1, x2, ..., xn]$ that I need to send from a client to a server for storage in a database.

If an attacker gains access to the database or the server he shouldn't be able to recover the original vector $Xreg$.

To do so, I had the idea to multiply each component of $Xreg$ with two big numbers ($S0$ and $S1$) of 512 bits each.

Therefore the client will send $S0.S1.Xreg$ = $[S0.S1.x1, S0.S1.x2, ..., S0.S1.xn]$.

The client will keep the record of $S0$ and creates a new $Si$ each time he wants to connect to the server.
Therefore the second time, client will send $S0.S2.Xreg$ and server will replace it in the database.

My question is, if a malicious or semi-honest adversaries gains access to the server or the database will he be able to recover the original $Xreg$ ? Let's suppose that if the server is compromised, the communications will stop so the attacker could possibly get only one record of $S0.Si.Xreg$ and possibly $S0.S_{i-1}.Xreg$ and $S_i/S_{i-1}$

Thanks in advance.


texts: How was this Mersenne Twister seed for a 20-character string known a priori found?

texts:
Someone generated a seed for the Mersenne Twister, with the intent of that seed producing this string:

"9!dlroW ,olleH"ck,@

Which is 20 characters long. Why he did it is explained below, but I don't know how he hacked it.

Why he did it:

The user feersum on Code Golf did this to generate a Hello, World! program in the Seed programming language. Obviously he didn't merely brute force his way to this seed, which is 4200 digits in length. How did he do this? Furthermore, this user has other answers in which he uses what is presumably the same trick, see: this answer.

What we know: The seeds tend to be quite large (much larger than if they were brute forced by addition-and-generation). Furthermore, every seed he finds must generate 624 integers with the seed before twisting the next 20 to produce the above string's numerical data. The complexity to brute force a string of n length is O(96^n), very complex indeed.

What I suspect: He filters what seeds he generates in such a way as to reduce the complexity for n length to about O(log(96^n)), which simplifies to O(1). I don't think that "he has access to a supercomputer" is a viable answer.

An acceptable answer: Anything which explains how he might have done this, even if he actually did it differently. It might take a long time for the answer to this to be known.

Interesting Mersenne Twister trivia: You can generate the state of the Mersenne twister with as little as 624 outputs, then predicting future output from it.

Note: Several bounties were pledged on the Hello, World! question for him if he were to explain how he did it. Years have passed, and he is not budging. Maybe those bounties will be passed on to you for having explained this.


texts: How can I find the order of the group that an elliptic curve is defined over?

texts:
I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p $)

How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] command and WolframAlpha will do it for me, but how can I do it myself, mathematically?

The modulus, $p$, will be a large prime number, say 256 bits or more.


texts:
Suppose I have a 2048 bit RSA public key, and want to brute force the corresponding private key. I guess there are 2048^16 possible combinations?

How long would this take me to brute force with an i7, with a GPU, and with Amazon Cloud?

Is there any benchmarking data, that can be used to calculate similar for a 16 bit key, or a 1024 bit key?

Thanks


texts: How can AES-CCM behave as an AEAD stream cipher?

texts:
AESCCM-  Couter with Cipher Block Chaining Message.
As it uses cmac for generation for tag , which is internally aes-cbc (block cipher, need block size, may require padding) And Encryption is done with AES-CTR (can be used as stream cipher)
How AES-CCM can behave as a AEAD stream cipher , as it uses aes-cbc ?
Whereas in case of AES-GCM for tag generation uses GMAC and for encryption CTR is used , which are not dependent on block sizes. So this can be used as a stream cipher.


texts:
What is “Implicit Authentication” in the context of authentication methods?

I searched the Web but could not find any article that describes this.
If anyone can describe it, that would be a great help.


texts: Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

texts:
I read on stack overflow  that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA.

In other words, OpenSSL performs the following steps when for an Elliptic curve key -sign is called:

Calculate $H = Hash(M)$
Encode $H$ into ASN1 standard $H’$
Sign $H’$

If the above is true then in order to avoid applying step 1. it's necessary to first calculate the digest, and then sign the digest using raw signing -pkeyutl for elliptic curver keys.

However when I run BOTH -sign and -dgst + -pkeyutl I am able to verify the signature using -verify in both cases. This implies that ASN1 encoding is NOT being applied to the hash.

Can anyone throw some light on this topic? I was not able to find information in the OpenSSL documentation.


texts:
For an authentication problem imagine the following scenario with two devices:

1 server
1 client.

The client starts a conversation with the server and sends him his public key. All public keys in this scenario are signed by a CA.
The server validates the public key and sends his signed public key to the client together with a random nonce, which is encrypted with the public key of the client.
The client decrypts the nonce message with its private key, re-encrypts the nonce with the public key of the server and sends this message back to the server.
The server decrypts the nonce with his private key and checks if the nonce is the same as before.
The server then knows that he indeed communicated with the correct client (the one with the proper private key) and can authenticate the client.
My question here: Is this a valid and secure authentication protocol? If not, how could one improve it?
I googled a bit, but "authentication using nonce" or "asymetric nonce authentication" could not bring up proper answers for me.
I have the feeling that this protocol is flawed.
And I see the problem of a replay attack, because of the probability that the server generates the same nonce twice.
But if the nonce is random number between a large enough interval, this probability can be decreased. In addition to this, the encrypted nonce message is only identical if the same nonce was send to the same client twice (which makes this even more unlikely to happen).


texts: Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $

texts: Is there a map between the group of $\mathbb{Z}_{N^2}^*$ where $N$ is a composite number , a product of two equal size secure prime numbers $p$ and $q$ and a finite field $\mathbb{F}$, such that for all $x \in \mathbb{Z}_{N^2}^*$ there is a polynomial representation of $x \in \mathbb{F}$ ?


texts: Crypto lib that use files instead of passphrase

texts:
I would like to program an application to allow people to encrypt files without using a password or pass-phrase but an arbitrary long file.

I'm searching for a library that allows me to safely create a front-end.

Example: user 1 on PC1 encrypt the picture selfie.png (size 2 MB) using the key-file ketfile.foo (size 2 MB), then send  this file to user2 on PC2 that use keyfile.foo to decrypt selfie.png.
Of course I assume that the keyfile.foo was "securely" sent.

This idea come from the Vernam Cipher "Unbreakable" cipher.


texts: What's the simplest way to encrypt multiple bits with LWE public key cryptosystem?  Some paper say use a different secret key for each bit of the message.  Does that mean the length of the message need to be agreed upon before transmission?


texts:
I was reading an example from my textbook about verifying a certificate from a client using a certificate network. The example in the book is as follows:

  A issues a certificate to B.
      A issues a certificate to C.
      A issues a certificate to D.
      B issues a certificate to D.
      C issues a certificate to A.
      C issues a certificate to Alice.
      B issues a certificate to Bob.

  Bob wants to verify Alice's key. What is the path in the certificate network to do so?

I've drawn out the diagram but I don't see anyway such a verification possible as Bob's certificate provider is B, which has a one directional relationship with A, such that A "trusts" B, but not the other way around. Is there even a path that would solve the problem?


texts: What's the difference between confusion/diffusion and mode of operation?

texts:
I understand the concepts of confusion (substitution) and diffusion (permutation).

My understanding of what a mode is that it's an algorithm that lets us encrypt arbitrary message size. i.e. AES is a mode of operation, and confusion/diffusion are what we use to achieve a certain mode.

But that doesn't sound right.


texts:
i want to encrypt transparently using Rijndael. So this is, what I thought of and I would like to have an opinion from "Experts" whether this will harm encryption strenght.
I am using chunks of 1MB and give them a GUID as filename.
edit: The 1MB chunks are just out of performance reasons. Imagine a file of 500MB to decrypt, deflate change some bytes, compress again and encrypt again. Is it really that bad a security vulnerability?
These chunks are then first compresses using DEFLATE to minimize attacks based on known Content.
These chunks are then encrypted using Rijndael and a given Cipherkey. The IV will be created as an XOR of my Filename (the guid) and the Key behind the scenes.
edit: The IV is never stored, but always created anew from the GUID and the Key. As far as I understand, this is the IV only for the first cipher block in CBC. (GUID XOR Key) XOR Plaintext -> ciphering -> new IV for next block.
Is it possible to deduce the IV from ciphered data, without knowing the key? If so, this IS a bad idea. Otherwise I dont see the the disadvantage.
Would this be viewed more secure? Cipher the GUID with the key and an IV of Zeros and use this as the IV for my ciphering.
All chunks are then collected in an XML File, which is saved the same way but named as the original file name.
Will the creation of the IV harm the security in any way?
Am I doing something else terribly wrong?
Are there are other obvious weak spots that I am missing?

Thanks a lot!
Andreas


texts: How should I incrementally sign a large set of documents?

texts:
Say I have a large set (i.e. unordered collection of unique elements) of documents, each of which is around 4KB in size.  I'd like to sign that set with a private key so that anyone can verify the signature with the corresponding public key.

Additionally, I'd like to be able to modify the set by adding or removing elements and generate a new signature incrementally (in the sense of Bellare, et al.) which may be verified incrementally.  This new signature should be the same as if I had signed the modified set from scratch instead of incrementally.

My first thought was to use a Merkle tree, but such a tree would need to be transmitted, stored, and updated along with the set itself, which is undesirable.  Edit: The overhead of this scheme isn't as severe as I thought, since the signer need not explicitly transmit the Merkle tree and its updates to the verifier(s).  Instead, they just need to agree about how to build and update the tree independently, and in a way that the (amortized) costs of incremental updates are low.

Later, I learned about incremental multiset hash functions and came up with the following scheme:

Compute the SHA256 hashes of each document in the set and combine the hashes using integer multiplication modulo a large prime q.  Call the result H.
Sign H with the private key.
Modify the original set by adding or removing an element, and calculate the new hash H' as H times the SHA256 of the added element (or the inverse of the SHA256 of the removed element) modulo q.
Sign H' with the private key.

Verification proceeds likewise, except that H and H' are verified with the public key in steps 2 and 4, respectively.

Is this scheme secure?  How large would q need to be?

Is there a better option available?


texts: Does a regularly reseeded PRNG provide backtracking resistance?

texts:
I'm currently discussing a security topic with some of my classmates.

A cryptographic PRNG typically provides backtracking resistance if an adversary that compromises the internal PRNG state cannot distinguish previously generated values from random values.

Let's assume I use an invertible PRF as PRNG (e.g. AES in CTR mode with a true random key). Then this in general does not provide backtracking resistance since, after obtaining the internal state, I can calculate the previous output using the inverted PRF.

Now let's assume that I regularly reseed my PRNG, like for example every second. Does it then provide backtracking resistance or not?

We have now two opinions:

The PRNG does not provide backtracking resistance since it is possible to recover previous values within the compromised reseed interval.
The PRNG provides backtracking resistance since values beyond the reseed interval can only be guessed with negligible probability

Can someone explain who is right and why?

Best regards,
Matt


texts: Encryption used in a commercial software product

texts:
I found (through some reverse-engineering) that the following encryption scheme is used in a commercial software that is quite widely used in Germany (Security by obscurity at its best).

I have the following two questions:

Is this encryption scheme known in the literature, or is it a variation of a known scheme?
Does anyone have any insights into how it might be implemented, other than using 20 different permutation tables?

The following plaintext/ciphertext (P/C) pairs should be sufficient to describe the encryption scheme (the scheme repeats itself every 10 bytes).

P: 00 00 00 00 00 00 00 00 00 00
C: B0 FA 92 F4 AB 54 3C 8A E3 A9

P: 01 01 01 01 01 01 01 01 01 01
C: B1 FB 93 F5 AA 55 3D 8B E2 A8

P: 02 02 02 02 02 02 02 02 02 02
C: B2 F8 90 F6 A9 56 3E 88 E1 AB

P: 03 03 03 03 03 03 03 03 03 03
C: B3 F9 91 F7 A8 57 3F 89 E0 AA

P: 04 04 04 04 04 04 04 04 04 04
C: B4 FE 96 F0 AF 50 38 8E E7 AD

P: 05 05 05 05 05 05 05 05 05 05
C: B5 FF 97 F1 AE 51 39 8F E6 AC

P: 06 06 06 06 06 06 06 06 06 06
C: B6 FC 94 F2 AD 52 3A 8C E5 AF

P: 07 07 07 07 07 07 07 07 07 07
C: B7 FD 95 F3 AC 53 3B 8D E4 AE

P: 08 08 08 08 08 08 08 08 08 08
C: B8 F2 9A FC A3 5C 34 82 EB A1

P: 09 09 09 09 09 09 09 09 09 09
C: B9 F3 9B FD A2 5D 35 83 EA A0

P: 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A
C: BA F0 98 FE A1 5E 36 80 E9 A3

P: 0B 0B 0B 0B 0B 0B 0B 0B 0B 0B
C: BB F1 99 FF A0 5F 37 81 E8 A2

P: 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C
C: BC F6 9E F8 A7 58 30 86 EF A5

P: 0D 0D 0D 0D 0D 0D 0D 0D 0D 0D
C: BD F7 9F F9 A6 59 31 87 EE A4

P: 0E 0E 0E 0E 0E 0E 0E 0E 0E 0E
C: BE F4 9C FA A5 5A 32 84 ED A7

P: 0F 0F 0F 0F 0F 0F 0F 0F 0F 0F
C: BF F5 9D FB A4 5B 33 85 EC A6

P: 10 10 10 10 10 10 10 10 10 10
C: A0 EA 82 E4 BB 44 2C 9A F3 B9

P: 20 20 20 20 20 20 20 20 20 20
C: 90 DA B2 D4 8B 74 1C AA C3 89

P: 30 30 30 30 30 30 30 30 30 30
C: 80 CA A2 C4 9B 64 0C BA D3 99

P: 40 40 40 40 40 40 40 40 40 40
C: F0 BA D2 B4 EB 14 7C CA A3 E9

P: 50 50 50 50 50 50 50 50 50 50
C: E0 AA C2 A4 FB 04 6C DA B3 F9

P: 60 60 60 60 60 60 60 60 60 60
C: D0 9A F2 94 CB 34 5C EA 83 C9

P: 70 70 70 70 70 70 70 70 70 70
C: C0 8A E2 84 DB 24 4C FA 93 D9

P: 80 80 80 80 80 80 80 80 80 80
C: 30 7A 12 74 2B D4 BC 0A 63 29

P: 90 90 90 09 90 90 90 90 90 90
C: 20 6A 02 FD 3B C4 AC 1A 73 39

P: A0 A0 A0 A0 A0 A0 A0 A0 A0 A0
C: 10 5A 32 54 0B F4 9C 2A 43 09

P: B0 B0 B0 B0 B0 B0 B0 B0 B0 B0
C: 00 4A 22 44 1B E4 8C 3A 53 19

P: C0 C0 C0 C0 C0 C0 C0 C0 C0 C0
C: 70 3A 52 34 6B 94 FC 4A 23 69

P: D0 D0 D0 D0 D0 D0 D0 D0 D0 D0
C: 60 2A 42 24 7B 84 EC 5A 33 79

P: E0 E0 E0 E0 E0 E0 E0 E0 E0 E0
C: 50 1A 72 14 4B B4 DC 6A 03 49

P: F0 F0 F0 F0 F0 F0 F0 F0 F0 F0
C: 40 0A 62 04 5B A4 CC 7A 13 59


texts: Is secp256r1 more secure than secp256k1?

texts:
Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography.

Googling for these shows most of the top results are Bitcoin related. I've heard the claim that…

  Satoshi picked non-standard crypto which conventional wisdom says will be cracked in 5-10 years.

There is this discussion on bitcointalk with various opinions to both sides of the argument (also check out this article). I would like to take it away from Bitcoin and into the general cryptographic question: is secp256r1 indeed more secure in some sense than secp256k1?


texts: Distinguishing two sets of pseudorandom values when their keys differ by one

texts:
Suppose we use a pseudorandom function $PRF$ and a random key $k$ to generate a set of pseudorandom values:

$\forall i, 1\leq i \leq n:  w_i=PRF(k,i)$

Now, consider instead of picking a fresh key, we increment the key by one:$k'=k+1$. Then, we compute a set of pseudorandom values:

$\forall i, 1\leq i \leq n:  q_i=PRF(k',i)$

Question: Are the set of $w_i$ values are computationally indistinguishable from the set of $q_i$ values?


texts: Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

texts:
I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the whole ISO/IEC 9796-2?

I've already had a look at the “Practical Cryptanalysis of ISO/IEC 9796-2 and EMV Signatures” paper… but there, only the encoding function was listed and I couldn't really understand how the signature is verified and recovered. Thanks!


texts:
source: http://www.cosic.esat.kuleuven.be/publications/thesis-152.pdf ,page 32

  Note that key recovery implies invertibility of the cryptographic
  primitive (because due to the Kerckhoffs’ principle, the corresponding
  decryption routine is available). The inverse is not always true.
  PR-CPA secure ⇒ KR-CPA secure.

What does “invertibility of the cryptographic primitive” mean?


texts: What is the definition of a Linear Cipher

texts: Is there a precise definition of what counts as a Linear Cipher? If so, what is it?


texts: How does PKCS 1.5 solve the insecureness of Textbook RSA?

texts:
As we know, Textbook RSA is not enough safe to use because of the following issues;

Guessable plaintext problem
Small $e$ issue

I want to know how PKCS 1.5 solved these problems.


texts: Private set supporting adding elements and proving elements exist

texts:
Is it possible to construct such a set that parties can

Add elements to the set without revealing the elements or knowing the elements presently in the set.
Proving to other parties that a certain element exists in the set in a way that doesn't reveal at which point it was added.

For example, I want Alice, Bob, Cindy and David to start with an empty set. I want Alice to be able to add 5 to the set without revealing 5, Bob to be able to add 6 to the set without knowing 5 is there or revealing 6, and then Cindy, who cooperates with Alice and has access to any necessary information from Alice, to prove to David that 5 is in the set without revealing whether it was Alice or Bob who put it there.

Is there any protocol that would enable such scenario?


texts: How to Understand Authenticated Key Exchange?

texts:
I am reading some articles about key exchange. I know classic key exchange, such as Diffie-Hellman key exchange. This type of algorithm is vulnerable to man-in-the-middle attack. However, when using a digital signature algorithm, this attack is invalid.

So, does authenticated key exchange consist of classic key exchange and a digital signature algorithm? Who can tell me?


texts: Is it safe to store AES encrypted string and the original string in plaintext next to each other?

texts:
I have a server app that stores encrypted payload ($textPayload) that users encrypted on their side (The server is just stores is and serves it).
Users can use multiple encryption keys for different payloads ($textPayload)- the server doesn't know.
I am thinking about how to implement editing.
One approach I came up with was generating a random string ($editTokenPlain) on the client, encrypting it ($editToken) with the same key and storing both $editTokenPlain and $editToken next to the sensitive encrypted payload ($textPayload).
Then user would receive the edit token($editTokenPlain), encrypt it and send it together with the edited payload and if the encrypted token matched the encrypted value on the server - then the payload would be updated.
My question is: If I have 2 encrypted texts($textPayload,$editToken) with the same encryption key (using AES) and 1 decrypted text $editTokenPlain - can someone derive the encryption key?


texts: Trial divisions before Miller-Rabin checks?

texts:
I'm trying to understand prime number generation (more correctly, the primality checking) as described in Handbook of Applied Cryptography.

The context is circa pages 145 - 150, and specifically Table 4.4 (p. 148). The table presents (k,t) pairs, where 'k' is the number of bits in the candidate and 't' is the number of Miller-Rabin iterations that keeps the error rate below $2^{-80}$. From the table (partial shown below):

  k  |  t
=====|=====
 100 |  27
 200 |  15
 400 |   7
 450 |   6
 550 |   5
 650 |   4
 850 |   3
1300 |   2
2050 |   2

However, the discussion surrounding the table notes that "one is usually willing to accept an error probability of $({1\over2})^{80}$ when using Algorithm 4.44". Algorithm 4.44 (p. 146) states to use trial division to rule out low hanging fruit (sic).

But according to Note 4.45 (p. 146), Algorithm 4.44 bounds the trial division based on B, where B is based on the time it takes to perform a modular exponentiation versus time required to rule out a small prime by trial division.

If the "proper" number of trial divisions are not performed (for some definition of "proper"), then error rate may not be as expected. I'm reading that from the discussion on page 165, where its suggested to select 't' such that its equal to ${1\over2}\cdot\lg(k)$. Using this formula, it appears a 1024-bit candidate needs 5 or 6 Miller-Rabins test, and not the 2 or 3 advertised in Table 4.4.

Question: how many trial divisions against a table of primes should be performed before moving to Miller-Rabin? In essence, I'm asking how large the prime table used in trial division should be.

Is it enough to test all primes up to (and including) 17863? 17863 happens to be the 2048th prime.

Related Question: is the acceptable error rate still $2^{-80}$?

(Sorry about the tag. It does not appear there are tags for random-numbers, primality-testing, trial-division or Miller-Rabin)

EDIT (JUN-17-2014): The reason I asked was OpenSSL and Crypto++ random number generation. I did not want ot taint answers with too much context.

OpenSSL uses a prime table up to 17863 and Miller-Rabin according to Table 4.4. Crypto++ uses a prime table up to 32719 and either 1 or 10 round Miller-Rabin.

The OpenSSL source files of interest are openssl/crypto/bn/bn.{h|c}, and the Crypto++ source files of interest are cryptopp/nbtheory.{h|cpp}.


texts: Why does symmetric encryption require padding? Is it to avoid the attacker to learn the size of the plaintext?


texts:
The third-party Apache plugin mod_auth_tkt uses a tragically-not-HMAC construction:

digest0 = hash(
    encode_ip_timestamp(ip, timestamp) + secret + userid + '\0'
    + tokens + '\0' + user_data).hexdigest()
digest = hash(digest0 + secret).hexdigest()

How bad is it? Clearly the performance is worse than HMAC.


texts:
In SEC 2: Recommended Elliptic Curve Domain Parameters curve secp112r1 has $0xDB7C2ABF62E35E668076BEAD208B$ as the order of the finite field and as the $a$ coefficient in the equation $y^2 =x^3 +ax +b$. Wouldn't that essentially make the $a$ coefficient $0$? If so then why not just say that that's what the coefficient is?

secp192k1 has $0$ as coefficients so it's not like there's not precedent for a coefficient of $0$.


texts:
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (SHA256withRSA) when attempting to verify that the ciphertext has not been changed?
+-------------+
| Cipher Text |
+-------------+
| MAC         |
+-------------+

VS
+-------------+
| Cipher Text |
+-------------+
| Signature   |
+-------------+


texts: Difference between Constructor and Destructor terms

texts:
I was thinking that in the formal model (or symbolic model?) the destructor terms were used to model processes that could abort generating some errors or something like that. But then, I realized that it doesn't make sense because Processes are different structures, they are not terms.

So, I found this slide that defines destructors and constructors terms on the page eight as follows:

Constructors are used to build terms
Destructors manipulate the terms

But it is still unclear to me. Any function manipulate terms and they may be used to build terms... Thus, are these two sets of terms not disjoint?

Well, could someone explain the difference between these two types of terms and say their right definitions ?


texts:
What is the difference between a PRF and a PRF+?  I am understanding them to mean the same thing, but I imagine that is because I don't understand their differences.

The IKE RFC defines a PRF as:

  This pseudorandom function (PRF) takes as input a secret, a seed, and
     an identifying label and produces an output of arbitrary length.

The TLS 1.2 RFC defines a PRF as:

  prf(key, msg) is the keyed pseudo-random function-- often a keyed
       hash function-- used to generate a deterministic output that
       appears pseudo-random.

The IKEv2 RFC defines a PRF as:

  The PRF is used for the construction of keying material for all of
     the cryptographic algorithms used in both the IKE SA and the Child
     SAs.

The IKEv2 RFC defines a PRF+ as:

  Since the amount of keying material needed
     may be greater than the size of the output of the PRF, the PRF is
     used iteratively.
  The term "prf+" describes a function that outputs a pseudorandom stream based on the inputs to a pseudorandom function called "prf".


texts: I have been reading Fast Secure Two-Party ECDSA Signing by Lindell, and I see that in key generating and signing (pages 9-10, especially visible from Figure 1), only the first party performs a commitment, whereas both parties perform a proof-of-knowledge. I have seen this paradigm also in different two party protocols. Though, I do not quite understand why both parties need to provide zero-knowledge proofs, but only the first party needs to provide a commitment? What's the reason for this?


texts:
I have an authentication service, a client and an application service.

The client needs to use the application, but they have to be authenticated first. I'm trying to create a simple scheme to do this and what I've come up with is:

The client contacts the authentication service, sends its metadata (e.g. license number)
The authentication service validates the client (i.e. checks the license against a database) and returns a token containing: some new metadata needed by the application, a timestamp telling when the token was created and a HMAC-SHA256 for the mentioned data.
The client uses this token to contact the application service and perform its tasks
The application service checks a client's token by validating the HMAC-SHA256 (thus confirming that the token was generated by the authentication server) and also checks the timestamp, confirming that the token is still valid. If the operations succeed, it will use the metadata from the token to perform the task required by the client.

All communications between the authentication service and the client, as well as between the client and the application service are done over HTTPS. The secret key shared between the authentication service and the application service will be something large (e.g. at least 64 bytes)

My question is if anyone sees any flaw in this scheme.

PS: I know OAuth 1/2 exist, but to be honest I'm horrified to look into those. What I need is something really simple, like that "JWT stateless session" everyone recommends against. Oh, and I don't want to use JWT or Paseto because I've done a benchmark and a simple HMAC is faster (than Paseto at least)


texts: I would like to know if there is a way to place a condition on $k$-out-of-$n$ secret sharing such that out of $k$ participants who can pool their shares to reconstruct a secret, one of them should always be a particular user say $P_1$. In other words, say we share a secret $S$ with $n$ users $P_1,P_2,\dots, P_n$. The participants will be able to re-construct the secret $S$  iff { $P_1$ + at least $(k-1)$ other users from $\{P_2,\dots,P_n\}$ } pool their shares. If $P_1$ is not there, the other $(n-1)$ users cannot reconstruct the secret.


texts: What is the likely cause the RSA algorithm gives back plain text in this case?

texts:
Text book question of Chapter 9 of "Crypto and Network Security" by William Stallings:

When using the RSA Algorithm — if a small number of repeated encodings give back the plain text, what is the likely cause this happens?


texts: AES alternate equation for the S-Box affine transformation

texts:
The Wikipedia article for the AES S-Box gives an alternate equation for the affine part of the S-Box transformation:

$$b_{out} = (b_{in} \times 31_d) \operatorname{mod} 257_d \oplus 99_d$$

It is not very clear in the article, but it turns out from the paper (as cited in the article) that the multiplication is to be carried out over a finite-field with polynomial $257 = 100000001_b$ for the modular reduction.

How could such an identity have been derived, since the AES specification makes no mention of the use of this other finite-field polynomial $100000001_b$? Is there any more information about where it comes from?


texts: Prime numbers of the form $(2^k)p+1$, for a given prime $p$

texts:
Let $p$ be a prime. (say 256 bit)

Does there a exist a prime $q$ such that $q = (2^k)p + 1$, for a large $k$ (something like 256), if it does exist, is there a way to find out for which all $k$ such a $q$ exist.

[I know it exists for k =1, I am looking for a large $k$]