texts: Choice between appending or prepending nonces to ciphertexts

texts:
I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant.

However, I am making another home-brew protocol (the bad thing that always happens from time to time), which led to the following scenario:

I chose XChaCha20Poly1305, the best AEAD primitive I could get my hands on, as the encryption primitive. I must give up the actual user control of the encryption key, and the nonce cannot be reliably stored persistently, so I chose to generate the nonce randomly. The resulting ciphertext will then be fed into another deterministic encrypter, say AES-CBC with a constant key (burnt into the chip and cannot be changed in the device's lifetime) and zero IV, over which I have completely no control. The final result will then be sent over the wire.

Does the sequence in which the ciphertext is formatted matter? I have no idea whether the device's RNG is broken or not, nor can I choose where to place the authentication tag in relation to the ciphertext.

If it is
$$ nonce || Enc(key, plaintext) || tag $$
then in case of a RNG failure, the security is undermined; and if the extra encrypter is broken, the system fails completely. But if it is
$$ Enc(key, plaintext) || tag || nonce $$
then the extra encrypter might provide a bit of security or even make most security claims hold, even in case of a RNG failure.

Many limitations are involved here, and this might be complicated question, but I hope someone can shed some light on this question for me.


texts: Exact mathematical definition of simulation based security?

texts:
I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how this can be rigorously defined in terms of mathematics. In other words, how do we get a definition that can be used in proving something?

For simplicity, let's take a two-party protocol between $A$ and $B$. This can essentially be modeled as a 2-ary function $f(x,y)=(f_A(x,y),f_B(x,y))$, where $x$ and $y$ are the local inputs and $f_A$ models $A$'s output and $f_B$ models $B$'s output.

Now the intuitive definition is that we can have our ideal protocol, where we have a trusted party $T$ and $A$, $B$ just hands over their local inputs to $T$, which replies with either $f_A(x,y)$ or $f_B(x,y)$. The protocols would then be considered secure, if given any adversary $\mathcal{A}$ for the real-world protocol, we can construct an adversary $\mathcal{S}$ for the ideal protocol that ''accomplished the same thing''. While this sounds like what we intuitively want, it provides no bases for really any proofs.

I've seen some alternative definitions where the ideal and real-world protocol output a ''transcript''. The protocol would then be considered secure if e.g. no PPT algorithm can distinguish the transcripts. However, I have no idea what the exact mathematical definition of a transcript is?

I would hope that someone could actually open up these definitions and explain how to make them rigorous. Hopefully also with a concrete example.


texts: uuidgen has consistent 13th digit and it's 4

texts:
I ran uuidgen 10k times and noticed that the 13th digit is always 4.
Why is that?


texts: Is it possible to find two sets such that their hash xor summation is the same?

texts: Consider two sets $A=\{a_1,a_2,\cdots,a_n\}, B=\{b_1,b_2,\cdots,b_m\}$; $m,n$ can be different. we can calculate the xor summation of each element's hash value: $XOR(A)=(hash(a_1)\oplus hash(a_2) \oplus \cdots \oplus hash(a_n))$ and $XOR(B)=(hash(b_1) \oplus hash(b_2) \oplus \cdots \oplus hash(b_m))$. Is it possible that set $A$ does not equal set $B$, yet $XOR(A)=XOR(B)$?


texts: Why rogued certificate from hash collision is harmful

texts:
I cannot understand why rogued certificate is thought harmful though It can be used to impersonate some website. The attacker can craft a rogued certificate with different identities and public key but the same signature through hash collision, such as md5 collision. But the attacker cannot aquire the private key corresponding to the public key in the rouged certificate. So in the handshake stage of SSL, the attacker can't decrypt the PreMasterKey encrypted by the public key, then the negotiation will be fail.
Can anyone tell me where I was wrong. Truly appreciated.


texts: Which of the following protocols is susceptible to replay attack?

texts:
I have a hard time understandin which of the following protocols is susceptible to replay attack:

A   ----->  B username, password
A   ----->  B username, h(timestamp,password)
A   -----> B username timestamp, h(password)
A   -----> B username, h(timestamp), h(password)

I think the answer is 1 and 3

I know 2) is secure because the password and time-stamp are hashed together,
I know 1) is definitely insecure. 3) is insecure if somehow the intruder gets to know the time-stamp he may replay it.
I am slightly confused about 4) while it is true that we can't get the time-stamp from hash.
I was wondering if it is possible to brute force a time stamp.
I think there wouldn't be a lot of time difference between when the packet was sent and the time intruder intercepted it. Is it possible and send all possible timestamps until B accepts it?


texts: How can I convert a mathematical formula into a logical formula?

texts:
I'm using cryptominisat2.9.6 to solve equation set (including more than 160 equations). There are 160 variables in total, which are as follows: $x_0,x_1,x_2,...,x_{78},x_{79},y_0,y_1,y_2,..,y_{78},y_{79}$.

For example, the first equation is as follows:
$$x_1+x_2+x_4+x_{10}+x_{31}+x_{43}+x_{56}+y_3 \times y_{25} \times y_{46}+y_3 \times y_{46} \times y_{64}+y_3 \times y_{46} \times x_{63}+y_{25} \times y_{46} \times x_{63}+y_{46} \times y_{64} \times x_{63}+y_3 \times y_{64}+y_{46} \times y_{64}+y_{64}*x_{63}+y_{25}+x_{63}=1$$
Every  equation is different.

In every equation, every variable is 0 or 1.  So I want to put all the equations into

cryptominisat to solve the 160 variables.  But cryptominisat requires a standard input format, either CNF or XOR format.  I have no idea how to change the equation into the format.


texts: How can i calculate prime of Elliptic Curve?

texts: In many articles i have found directly the calculation of prime elliptic curve. How can i calculate this prime $p$ ? For example if I consider NIST P-256, $ p = 2^{256}-2^{224}+2^{192}+2^{96}-1$. Why ? Is there a formula ? Thanks for your support.


texts: How to compute the inverse of a polynomial under $GF(2^8)$?

texts:
It's well known that AES cryptography algorithm uses Galois Field $GF(2^8)$ multiplication to process the step MixColumn, and each column of the 4x4 matrix on encrypting should multiply the polynomial $3X^3 + X^2 + X + 2$ which is usually notated as an array $\{\tt 0x03, 0x01, 0x01, 0x02\}$, while on decrypting, the matrix should multiply the inverse of the polynominal mentioned above, namely $\texttt{0x0B}X^3 + \texttt{0x0D}X^2 + \texttt{0x09}X + \texttt{0x0E}$ which can also notated as an array $\{\tt 0x0B, 0x0D, 0x09, 0x0E\}$.

Now I wonder If only one polynomial is known, e.g. $\{\tt 0x03, 0x01, 0x01, 0x02\}$, how can I compute its inverse mod $(X^4 + 1)$, namely $\{\tt 0x0B, 0x0D, 0x09, 0x0E\}$, and vice versa.


texts: Designing a protocol to record attendance to lectures

texts:
Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements:

It must record each student's attendance.
A student X should not be able to say that another student Y went to the lecture.
The teacher should not be able to know who attended the lessons and who didn't until the end of the term.
It must provide integrity and non-repudiation.
It must be simple and fast.

This is what I thought:

Suppose that there are N students enroled.

Each class:

The teacher generates N random numbers, stores them somewhere safe, and writes them down on a separate piece of paper.
He gives one of these to each of the students that attend a class. He asks them to sign the reverse of the paper.
The students sign, and give the piece of paper to the teacher.
The teacher can check whether a student invented a number.

At the end of the semester:

The teacher asks for ID of each of the enroled students (or any other document that contains the signature), so he can now know who attended each class and who didn't.

Are there any visible flaws?


texts: Does AES 256 really make sense in hybrid crypto systems when the PKI is the bottleneck?

texts:
AES 256 is used widely in hybrid crypto systems (e.g. SSL/TLS). According to keylength.com a 2048 bit public key corresponds to 112 bits of security.

Does it make sense to use AES 256 in this context?
If yes, how it improves security in comparison with AES 128?


texts:
I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory.

Couldn't you just hash something with bcrypt, then with scrypt? If it has a layer of scrypt to use resources, and a layer of bcrypt, shouldn't that give you the benefits of both with the drawbacks of neither?


texts: Is it safe to say that a XOR with an unknown input provides a random output?

texts:
I am wondering if you have an input $x_{1}$ and you XOR it with an unknown random second input $x_{2}$, is it safe to say that the resulting $x_{1}\oplus x_{2}$ will be random ?
The final idea would be to first fix all the $x_{i}$ for $i>0$ so that one cannot change its $x_{i}$ afterwards, then set $x_{0}$ to a random value.
Then, person 1 $p_{1}$ gets a value $a_{1}=x_{0}\oplus x_{1}$, $p_{2}$ gets $a_{2}=x_{2}\oplus a_{1}$...
In the end person $p_{i}$ gets the value $a_{i}=x_{i}\oplus a_{i-1}$ $\forall i$
The point of this is to choose someone at random among them so we could pick $p_{min}$ where $a_{min} = min_{i}(a_{i})$.
Do you think it would be safe to choose someone at random in this way ? We probably need to make sure that two different people won't have the same $x_{i}$ otherwise there could be two people with the same $a_{i}$ value but apart from that I don't see any weakness where one could improve its chances at being the chosen one, do you see one?
Edit: I have to add that all of the $x_{i}$ will also be picked at random otherwise there would be a clear link between one $x_{i}$ and the previous $a_{i-1}$.


texts: Is PBKDF2 with 1 iteration acceptable for a simple random key expansion?

texts:
I have a 128 bit randomly generated key. I need to expand this key to 512 bits to use with an existing encryption library that does AES-256 encryption in CBC mode with HMAC-SHA256 authentication.
The encryption library I am using also has PBKDF2-SHA512 available. Is it acceptable to use PBKDF2 with just 1 iteration to do the simple key expansion that I need? I would also need a salt, for which I suppose I could just use a hardcoded value for.
Example:
generated_key = crypto_safe_rand(128)
derived_key = pbkdf2(password: generated_key, salt: 'hardcoded_salt',
                     iterations: 1, algorithm: 'SHA-512')

My thought is that the iteration count isn't really a factor since the original "password" is randomly generated and 128 bits long.
Or would it be better to use something like HKDF?


texts: How is PKCS a syntax to digitally sign, digest, authenticate, or encrypt arbitrary message content

texts:
I am really confused over PKCS. I saw this question but I do not have enough reputation to leave a comment so I am asking a new question to clarify.

I am trying to understand what exactly PKCS and in extension what CMS is. I have stumbled on the line from the RFC mentioned in the aforementioned question.

  This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content.

How can a syntax be used to digitally sign stuff?!! I can understand if it states it is a syntax used to describe digitally signed stuff...but signing? how can a syntax be used to sign?

This all tie into my confusion with PKCS/CMS and x509. I understand that x509 is a standard that describes what should make up a certificate, how is this different from PKCS/CMS?

Edit

The Wikipedia entry for CMS does not also help. For example it says:

  It [CMS] can be used by cryptographic schemes and protocols to
  digitally sign, digest, authenticate or encrypt any form of digital
  data.

Okay is CMS an encryption algorithm like RSA? No!! so why then say it is a protocol used to digitally sign or encrypt stuff?


texts: Sending the nonce in ChachaPoly1305 with the ciphertext

texts:
I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc.

Is it secure to send the nonce over the network along with the ciphertext? If not then why?


texts: Does a playlist of songs or movies mixed together contain enough random enough for OTP key material?

texts:
Ok hypothetical scenario. Lets say I want to generate a lot of key material quickly for a one-time pad. This key material will be divided up and used for many different messages in the future.

I select 50-100+ songs out of a custom playlist of all my music. The music has been converted to basic Waveform Audio File Format (.wav). The music could be a mix of rock, pop, classical, techno etc just whatever I selected.
I extract every song's raw music data out into one big file and remove null bytes. Now I have a single big file with all of the song data in it.
I randomize all of the song data so all the song data is blended together into an unintelligible sequence of bits. The user can provide some input using their mouse/keyboard which will provide some entropy into the randomizing function.
I loop through all the data in the file, taking every ~7th byte (or bit) and put it into another file which is now my new key material. This step could be altered so the user can provide a variable sample rate, e.g. they can change it to every 10th byte or 100th byte.

Now... is that file of key material sufficiently random for one-time pad use?

What about if I changed out music songs and use 10+ full length movies or TV shows instead?


texts: Are block ciphers more prone to implementation flaws?

texts:
I came across a Chrome extension: Minilock

It's blog contains a post: "No, the NSA Isn't Breaking AES". Small excerpt is below:

  A block cipher key is pretty much an initial seed for a
  pseudo-randomness permutation more than anything, and that’s why newer
  ciphers have focused on adding features (such as AEAD) instead of
  making ciphers “harder to break”. The most likely source of design
  weaknesses in block ciphers are likely to be not in the block cipher
  itself, but in its mode of operation (ECB spot-the-penguin, CBC
  bit-flipping, CTR nonce-reuse, to name a few). This is why block
  ciphers are now discouraged, and most new ciphers are moving to the
  stream cipher model.

Recently few ransomware started using stream ciphers like Salsa20 (probably because of speed).

I want to know whether there is more chance of implementation flaw in block ciphers as compared to stream ciphers like Salsa20?

If we are not confident with AES implementation, a stream cipher should be used?


texts: Clarification on Key exchange approaches in TLS/SSL

texts:
When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key which is used for symmetric encryption.

When Diffie-Helman (DH) is used on the other hand, -- are the DH public values exchanged unecnrypted? I ask this because while the client can use the server's public key to encrypt DH values to be sent to the client, the server has no such key to encrypt data being sent to the client (since typically the client has no public keys of its own).


texts: Are there any quantum-resistant symmetric encryption schemes?

texts: It seems that quite a few currently available encryption schemes will possibly be broken by quantum computing. Are there any symmetric encryption schemes that will remain unbroken (either because of their design or by increasing the key size)? In particular are there any such schemes that may be used with a single key in a non-deterministic manner?


texts: I need two types of easily crackable asymmetric and symmetric encryption

texts:
I have a school project in which I'm comparing asymmetric and symmetric encryption. I need two different types of easily crackable encryption, one symmetric and one asymmetric. I am planning on encrypting a string of text and then cracking that encryption.

I would like the encryption (and cracking if possible) to be done in Python, but if that isn't possible it's fine. I would also prefer it to take under 24 hours to crack. I have a server with an NVIDIA Tesla M60 GPU and an Intel Xeon E5-2690 at 2.60Ghz.

Thanks!


texts: How would low-precision Gaussian sampling impact the security of BLISS?

texts:
For digital signature, I implemented BLISS in my cryptographic suite, and wrote the Gaussian sampler based on Lattice Signatures and Bimodal Gaussians. But unlike the reference implementation and StrongSwan, I used 32-bit floating-point pre-computed constants instead of integer arrays, which I assume will be available on my targeted platforms.
And the picture shows 16384 iterations of accumulative sampling distribution image of my BLISS-I sampler preset.

In essence, my questions are:

How will low-precision Gaussian sampling impact security or anything?
And is using 32-bit floating-point a bad idea in cryptographic sampling?

Note the peak singularity in the picture is due to horizontally scaling before shifting and arithmetic performed rounding towards zero, not an error in the implementation. (And the image generation algorithm has been modified)


texts: Why do we use multiple rounds of encryption?

texts:
I understand that DES and AES use multiple rounds of encryption to secure the cipher text output, what is the real reason this is carried out?

Is there a certain point performing multiple rounds becomes pointless not relating to security; as of course performance becomes an issue at some point?

Do all encryption algorithms require multiple rounds in order to make them secure?


texts:
Consider the following scenario:

Sender S sends a message to receiver R. He uses a hybrid encryption scheme with RSA as key-encapsulation algorithm and AES-256-CTR (4byte-counter) and SHA256-HMAC. These algorithms are specified and already known by the receiver → the receiver knows the encrypted key length:
32byte AES-key + 12byte AES-nonce + 64byte HMAC-key = 108byte

Why don't use RSA(SECURE_RANDOM(404) || key-block) as padding-scheme?

The length is already known by the receiver, so there is no reason to indicate it.
If the key-capsule is altered it will be detected because the decrypted keys will be wrong and the HMAC-verification will fail.
It shouldn't be susceptible against padding-oracle-attacks because the application cannot distinguish between correct decryption and defect padding (in contrast to PKCSv1.5 and OAEP after standard).

There probably is a very good reason not to do this, but I'm not seeing it.


texts: Key management for military GPS receivers

texts:
I wonder what encryption scheme is used in high-precision encrypted GPS streams (the so-called “P(Y) code”). If there's a master key needed, then it has to be in every device. Yet the master key doesn't seem to have ever leaked (unlike like game consoles or Apple devices).

So what could explain why military-precision channel GPS receivers haven't been hacked yet? How does the protocol work?


texts: Why can't you hijack someone's public key

texts:
Sorry, this might be a stupid question but the more questions are here the easier you can use the Internet.
To sign your message in Bitcoin network, Alice uses his private key and message content. Bob verifies it with Alice's public key and message content.

Why can't a new user Fred just choose Alice's public key and generate his new private key? Then sign message with his new private key? So others who don't know Alice will think that Fred is Alice.


texts:
If server is sending its digital signature, in which message / where does the digitally signature is provided to the client.

Is it after the server_hello message because there the public key of the certificate is exchanged which is needed to decrypt the digital signature or  with the initial certificate containing public key.

If cipher suite is mutually confirmed after change_cipher_spec protocol which hash algorithm is used to hash the digital signature ?


texts: Is this definition of an RSA modulus safe?

texts:
Suggested definition

A positive integer is a safe RSA modulus if, after removing all its prime factors less than 512 bits, it is composite and has size at least 2048 bits.

Discussion

I want to build the smallest-possible safe RSA modulus without a trusted party. (The use case is for an RSA-based verifiable delay function to be used on a blockchain.) The strategy is to randomly sample several random numbers $N_1, ..., N_k$ and multiply them together. Each $N_i$ has some probability $p$ of being a safe RSA modulus so the product $N_1...N_k$ has probability $1 - (1-p)^k$ of being safe.

The above strategy of multiplying randomly chosen integers was pioneered by Thomas Sanders in the context of RSA accumulators. He used a stricter definition of a safe RSA modulus which only looked at having at least two primes above a minimum bit size. The reasoning behind suggesting this less strict definition of a safe RSA modulus is to maximise the probability $p$ so as to minimise the size of the final RSA modulus.

The "512 bits" parameter was chosen (conservatively) to protect against the ECM which has found primes of size up to 273 bits. The "2048 bits" parameter was chosen (conservatively) to protect against the GNSF which factored numbers up to 768 bits.

Is the above definition of a safe RSA modulus actually safe to use in production?


texts: DES Bruteforce attack and false positive keys

texts:
I have read that a bruteforce attack (regardless on which block cipher is used) can lead to a false positive if key space is greater than blocks space.
It is pretty clear to me that is due the pigeons hole principle (if I have more keys than available blocks, sooner or later I will use two different keys for the same mapping).

My question is, how can DES exhibit such behavior if the key space is about $2^{56}$ and block space is $2^{64}$.

What I am expecting from those premises is that given a plaintext and all possible keys, not all possible ciphertexts will be addressed.


texts:
1) a = b ⊕ s1

2) b = a ⊕ s1

3) b ⊕ s2 = c

Is there a way to find s1 and s2 if we know many different values of a and c?

4) a1 = b1 ⊕ s1

5) a1 ⊕ s1 ⊕ s2 = c1

I think it is possible if we analysis the result, but I am not sure how. Or is it impossible?

Edit: Sorry , a and c should be known but not b.

Alice sends 'a' to Bob. 2) Bob computes a xor s1 = b then 3) b xor s2 = c. Bob then sends c to Alice and verify if b =c .


texts: What consequences do the plaintext space size has on the performances in the BGV scheme?

texts:
In the BGV paper [1], the authors say in §5.4 that you can have $\mathbb{Z}_p$ as plaintext size with a large $p$.

What is the impact of the size of $p$ on the ciphertext size and computational work of the cipher's algorithms?

I would need this to decide how big my plaintext space can be before it becomes impractical.

References

[1] Brakerski, Zvika, Craig Gentry, and Vinod Vaikuntanathan. “(Leveled) Fully Homomorphic Encryption Without Bootstrapping.” In Proceedings of the 3rd Innovations in Theoretical Computer Science Conference, 309–25. ITCS ’12. New York, NY, USA: ACM, 2012. doi:10.1145/2090236.2090262.
http://eprint.iacr.org/2011/277


texts: Why standard deviation of BLISS is so high?

texts: In lattice based digital signature scheme BLISS why the standard deviation is so high (215) compared to the encryption schemes?


texts: What is the expected number of different sequences of bits in the collection that contains $2^{800}$ elements?

texts:
Let $F$ denote a function that returns the first $800$ bits of the input.

Let $G(N)$ denote a function that returns the last $800$ bits of the binary encoding of the given number $N$. For example,

$$\begin{array}{l}
G(0) = 00\underbrace  \ldots _{{\rm{796\;zeroes}}}00,\\
G(1) = 00\underbrace  \ldots _{{\rm{796\;zeroes}}}01,\\
G({2^{800}} - 2) = 11\underbrace  \ldots _{{\rm{796\;ones}}}10,\\
G({2^{800}} - 1) = 11\underbrace  \ldots _{{\rm{796\;ones}}}11
\end{array}$$

etc (we are only interested in the interval $0 \le N \lt {2^{800}}$ ).

Let $P$ denote Keccak permutation function that operates on $1600$-bit blocks.

Choose (arbitrarily or randomly) any 800-bit sequence. Denote it by $S$.

Consider the following collection (set) of bitsequences:

$$\begin{array}{l}
{C} = \{ &F(P(G(0)|| S)),\\&F (P(G(1) || S)),\\&F(P(G(2) || S)),\\&\ldots ,\\&F(P(G({2^{800}} - 2) || S)),\\&F(P(G({2^{800}} - 1) || S))\;\;\}
\end{array}$$

(it contains $2^{800}$ elements, and each element is a $800$-bit sequence).

Let $Y$ denote the number of different (unique) elements in $C$.

Question: what is the expected value of $Y$? And why?

Edit: I have read Expected number of different birthdays, and found the following formula:

$$\begin{array}{l}\\&
D = 2^{1600},\\&
n = 2^{800},\\&
\varphi = (D-1)/D,\\&
Y = D\times (1-\varphi^n)
\end{array}$$

Is this the correct formula for $Y$?


texts: Unwrapping secrete key without exposing original key?

texts:
I am trying to unwrap a secret key (AES/DES) using Java APIs and SunPKCS11. Problem is that it reveals the value of an unwrapped key (out of HSM) in the key object. Here is the code:

Key privateKey = keyStore.getKey("MyKeyId", keyStorePassword);

Cipher cipher = Cipher.getInstance("RSA", "SunPKCS11-Safenet");
cipher.init(Cipher.UNWRAP_MODE, privateKey);
// The unwrapped key is visible in below line in unwrappedKey object
Key unwrappedKey = cipher.unwrap(wrappedKey, "AES", Cipher.SECRET_KEY);

How can I tell the code to not to reveal the unwrapped key?

Do I have to add something in PKCS11 cfg file? I tried below in cfg file but doesn't help:

attributes(*,CKO_SECRET_KEY,*) = {
CKA_SENSITIVE=true
}

Also asked the same question here https://stackoverflow.com/questions/52220368/unwrap-secrete-key-reveals-actual-key but I have got no response.


texts:
I've had a thought and I'm wondering if this would be a useful way to devise and distribute a one-time pad. It relies on a digital dead drop and a hash function.

The digital dead drop could take a variety of forms.

For wide distribution it might be a Twitter, Facebook, or Instagram feed, a cloud storage container (Dropbox, Pastebin, etc.) or similar method.
For local distribution it could be a wireless server set up in a public area using Raspberry Pi, Beaglebone, or similar hardware. It could even be a physical dead drop using thumb drives. Such repositories could be password protected if desired.

The "payload" for the dead drop would be delivered and retrieved using VPN access from a public computer, and could be any set of 5 files. These could be anything: photos from the NOAA weather satellite, text files from Shakespeare, videos pulled at random off Youtube, whatever. Each group of 5 files would be in a labeled folder and numbered 1 to 5.

To generate the key, an user would run SHA-3-512 on each file, generating five hashed outputs. Each user would have a unique ID number, such as 12345, 24315, etc., and would arrange the five keys in that order to generate his or her unique one-time pad key, with a total length of 2560 bits.

The ciphertext would contain some indicator of the user's ID and the label from the repository folder, to allow the recipient to generate the proper key.

I've identified some security problems with this method already. The most obvious is the nature of the input files. The input relies on security through obscurity, with the input files "hidden in plain sight" either as innocuous Twitter posts or files on an obscure server available only within a small public area. But granting that this is a significant problem of operational security, is this method otherwise usable?

EDIT TO ADD: Based on some of the feedback (thanks to all who have written), I've thought of a variation that could resolve some of the problems with the dead drop while maintaining the basic principle of obscurity and utility. It's a variation on a book code.

Each user is issued a digital book, in PDF format, Word format, or text (text explicitly divided into pages). Each user has a unique book, but they can be any sort of innocuous writing: A complete Shakespeare, a Handbook of Chemistry and Physics, a complete edition of the Talmud -- any long book will work.

User generates the OTP key by copying single pages of the book into individual files, and hashing those files.


texts: Padding oracle attacks are a huge nuisance when using CBC mode encryption without authentication. Wouldn't all those padding oracle attacks be avoided if we'd just use bit padding instead? Or is does bit padding also leak information during decryption?


texts: Is it something wrong in proof of Preservation of Collision Resistance for Merkle-Damgard?

texts:
I wonder about this proof. Can someone help me?
I try to prove for Presevation of Collision Resistance for Merkle-Damgard as guide in end of this paper (Security Reductions of the Second Round SHA-3
Candidates).
Assume H is Merkle-Damgard hash function, f is an compression, f' = chop_s(f). I try to prove:
〖Adv〗_H^col (q)≤ 〖Adv〗_f'^col (q)
However, I think it may be is
〖Adv〗_H^col (q)≤ 〖Adv〗_f'^col (q)+〖Adv〗_f^col (q) + ..
Because collision with not only in one position (i) of f, it may be collision in f', and some position f.
Can someone explain for me why?


texts: Is it more, or less, secure to use a different $F$ and $G$ for a Lamport signature?

texts:
A Lamport signature is made as follows:

Alice stores $k_1, \cdots, k_{n'} \leftarrow K $ as her "private key", with one-way function $F: K\to V$, $n'>n$, and (easily enough) all $F(k_i)\neq F(k_j)$.

Alice publishes $F$, $G$, and $\alpha = \left(F(k_1), \cdots, F(k_{n'})\right)$ as her "public key", with one-way function $G:M\to \binom{\{1, \cdots, n'\}}{n}$ [notation].

Alice later publishes $\sigma_\alpha(m)=(k_{i_1}, \cdots, k_{i_n})$ as her "signature" on $m$, with $(i_1, \cdots, i_n) = G(m)$.

Alice then destroys all stored $k_i|i\notin G(m)$ to prevent any subsequent $\sigma_\alpha(m')$ from being created, which would leak additional values of $k_i$ and rapidly destroy the scheme's security.

To verify $\sigma_\alpha(m)$, Bob simply checks that $F(\sigma_\alpha(m)_j)=\alpha_i$ forall $i\in G(m)$ and $G(m)_j=i$.

Now, Wikipedia provides a reference implementation:

$n=256$, $n'=2n$
(the original paper only bothered specifying $n=20$ and $n'=2n$, to allow an apples-to-apples comparison with Rabin's scheme which Lamport intended to obsolete by his own.)

$F=\phi=\text{SHA}_n: \{0,1\}^*\to\{0,1\}^n$
(the original paper did not even bother specifying any $K$, $V$, or $\phi$.)

$G(m)=R\circ\phi(m)=(1 + \phi(m)_1, \cdots, 2n - 1 + \phi(m)_n)$
(Wikipedia's construction of $R$, despite not being surjective and effectively constraining $n':=2n$, is nevertheless a clear improvement over the original paper's construction, which was a partial function thus might, “undesirabl[y]”, require the sender to brute-force a valid value via a nonce on $m$.)

Clearly, in this instance, $F$ and $G$ are "pretty much the same function"; each is a "thin wrapper" around $\phi$, i.e. with a trivial left-inverse.
So I'm wondering: does it harm, or help, the security of this scheme to have $F$ and $G$ be "the same function" like this? (And is it any particular risk for $G$ not to be surjective?)
Dr. Lamport seems to have mostly proposed similar constructions to Wikipedia's in his paper and raised no similar concerns on them, so I assume this is probably OK, but I don't know what all (if anything) modern cryptography or cryptanalysis has to say about either point.

The reason I'm asking is: I'm writing a reference software implementation that includes PKCS#8 serialization and deserialization, and I'm wondering if I should create separate parameters for $F$ and $G$ or have them "hard-coded" to be the same (and/or if I should hard-code in the behavior of $R$ despite the lack of a trivially correct choice for it).


texts: How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework？

texts:
everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem （Discrete logarithm problem of elliptic curve or ECDSA）is Pollard’s rho method, and takes about the square root of πp/2, where p is the modulus. My questions are:
(1) Elliptical encryption (done by designer and sender) also takes time. Can this time also be expressed by modulus p?
(2) After the other party receives the information, it needs to be verified. This verification (done by receiver of information) also takes time. Can the time for verification also be expressed by modulus?
That is to say, can the above three kinds of time be put into a frame for comparison, and they are all compared with the parameters of elliptic curve (it is best to use modulus or order of Base point). My intention is to know which of these three times is the slowest and which is the fastest. But there is no doubt that the time to crack is definitely the slowest, and the time for encryption and verification is definitely much shorter. But how to quantify them? Is there any literature recommendation that compares them? It would be best to give a simple example. Thank you very much!


texts:
I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much information can they learn about the key (and how easily). Or I guess worse than that is if they have multiple such pairs of blocks produced with the same key.

Additionally, suppose an attacker knows all 8 bytes of plaintext, but only X bytes of ciphertext (including their position in the block). Then what kind of information can they determine about the key? (this has applications when other modes, like CTR, are used and a crib occurs in the first block).


texts: Elliptic Curves - Proving that the group is not cyclic

texts:
I have a question from Stinson: 7.14. The question states:

  Suppose that $p > 3$ is an odd prime, and $a,b$ is an element of $\mathbb Z_p$. Further, suppose that the equation $x^3 + ax + b$ is congruent to $0$ ($\mod p$) has 3 distinct roots in $\mathbb Z_p$. Prove that the corresponding elliptic curve group $(E, +)$ is not cyclic. Hint: Show that the points of order two generate a subgroup of $(E, +)$ that is isomorphic to $\mathbb Z_2 \times\mathbb Z_2$.

I've read through the elliptic curve material in the chapter preceding this question but I'm still a little hopeless. Can anyone explain or push me in the right direction on how to show/answer this?

I understand that points of order two (from the hint) follow the formula: $[2]P = \mathcal{O}$ but I'm not sure how this relates.


texts: What are the security effects of reusing a public RSA key to encrypt large data by blocks?

texts:
I'm trying to figure out a way to do public key encryption on a very large piece of data.

For this, I of course want one side to do the encrypting but is unable to decrypt the data, and the other side to be able to decrypt data.

But for RSA encryption, there's a limit to the reasonable size-performance on how big it can encrypt.

I haven't really figured out a good solution to this problem, but the simplest one that comes to mind is to just reuse the public key to encrypt the data in blocks. Of course, this would create some sort of security problems, but as of right now I still don't exactly know what kind of security problems it would cause.

Could someone explain to me what problems this simple method would cause and perhaps also tell me of a way to achieve my goal of being able to do public key encryption on a large piece of data?


texts: Is creating a own protocol safe or should TLS always be used?

texts:
The more I start to learn about cryptography the more I hear it is unsafe to 'create' your own cryptographic protocol. With this I mean combining cryptographic primitives like HMAC, AES and RSA

However the only protocol, which is also suited for small embedded devices, I know of is TLS. are there any other protocols similar to TLS which can provide: privacy, authentication and verification (identification and trust are not hard requirements). I use these terms as they are described in this explanation of cryptography (i found this to be the best explanation if I want people to know what I'm talking about)

currently I'm just thinking about combining primitives like mentioned above (AES, HMAC, etc) to create a secured communication for my embedded devices but can this be done or should one really try to avoid this? If this should be avoided are there other protocols like TLS which could do what I want?

EXTRA information:
The embedded devices are (often) placed in secure environments, the communication however, is not going through a secure environment.
specs are: 100mhz mcu and about 20 kb ROM/RAM


texts:
I am given that $S_1=(S_1,P_1)$ and $S_2=(S_2,P_2)$ are sources, where $S_1=\{s_1,...,s_n\}$, $P_1(x_i)=p_i$ and $S_2=\{y_1,...,s_m\}$, $P_2(y_j)=q_j$.

I have to find the entropy of $S_{\lambda}=(S_i \cup S_2, P)$, where $0 \le \lambda \le 1$, $P(x_i)=\lambda p_i$, and $P(y_j)=(1-\lambda) q_j$.

I was unable to find something that I could understand on the process for finding the entropy of the union of two sources.

I am thinking that it is $H(S_{\lambda})=H(S_1 \cup S_2+S_2 \cup S_2)=H(S_1 + S_2+S_2 + S_2)=\sum_{i=1}^n p_i log(\frac{1}{p_i})+3\sum_{j=1}^mq_jlog(\frac{1}{q_j})$

But I haven't seen this before and wanted to make sure.
Also any hint on how to proceed would be greatly appreciated, thank you.


texts: Do I need to send the RSA public exponent with the public key?

texts:
I used RSA to provide confidentiality for a protocol. As I know the public key of RSA has two values: $e$ and $n$. Of these two, $e$ usually has value 65537.

When the public key is sent, does the sender need to send $e$ and $n$ or just $n$?


texts: Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions of N bits. Can the attacker knows a pattern here assuming the same  key is used each time i want to send the bits? Assume the legitimate receiver use the same key to know the positions of the hidden bits from RNG.


texts: Changing an Encryption scheme from AES to ChaCha20

texts:
I am using the AES cipher for my OTT platform. Almost all Chip vendors (ARM, Intel, etc) have built-in AES for faster and secure processing.

Now, how feasible it is to move from AES to ChaCha20?  What are the pros and cons of this?
Will ChaCha20 be faster than in-built hardware support for AES?
Can ChaCha20 provide better security over AES over the years?
Do we have any comparison document where it shows performance(cipher speed) over various resolutions starting from 576i to 4K over various bitrate from 2 Mbps to 20 Mbps?


texts: Size of messages in timing attack on RSA Montgomery

texts:
I'm codin' timing attack on RSA Montgomery which compares two sets ( the first one includes those which need a reduction in contrary to the second one ). But I got troubles with the Montgomery multiplication, I used sets of 15000 random Messages ( size: 120 bits ) and there is no reduction for a complete key of 128 bits! ( Modul N is 128 bits size).

Question what is the recommended size for random messages?


texts: While encrypting what can happen between words

texts:
From some time I am working with "pen and paper" encrypted text.
Keys are not known, algorithm is not known.

I managed to find simple algorithm and key that seems to be nearly perfect.
Nearly perfect means that using this algorithm and key I can decrypt part of the encryption into meaningful text (~10 consecutive letters that create words). The composition of the algorithm, the length of the decrypted text and the text itself are definitely not coincidence. It seems that something changes beetween sentence/list of words because the rest of the text cannot be decrypted using simply the same method/key.

What is used in cryptography that could make such outcome?

e.g. If I use simple cipher: Add A letter to decrypted text I would get

DECRYPTEDTEXT
AAAAAAAAAAAAA
EFDSZQUFEUFYU

but in order to make it harder I could add consecutive letters to consecutive words

DECRYPTEDTEXT
AAAAAAAAABBBB
EFDSZQUFEVGZV

another example would be encryption using Caesar:

DECRYPTEDTEXT
CAESARCAESARC
.............

but in order to make it more difficult I could add X as space, encrypt and then remove encrypted letter that corresponds to X from encryption string:

DECRYPTEDXTEXT
CAESARCAESARCA
it would then be changed to:
DECRYPTEDTEXT <- X removed
CAESARCAEARCA <- S removed - corresponds to X

Are there any known and used methods that happen every word or every sentence?


texts: Implementing RSA with small integers in CUDA

texts:
I have found some researches dedicated for speeding-up RSA calculations using CUDA. But I am wondering how they do that, given that the biggest unsigned int that could be declared in CUDA is 64 bit.

Could anyone clarify this ambiguity for me?


texts: Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely require?


texts: how does OpenSSH use bcrypt to set IV's?

texts:
I generated an encrypted OpenSSH private key for test purposes:

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABCX18gzzE
urqzviTpYwDuLjAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIL3fL8j3ilzDkr/O
7rBBCIYaH/pE1VvU3r2IEy7M2vBaAAAAoAHqj8gYr4dNtxmQyoC+md10ZwY+GOuWIYmOxl
vDYQkGZWYAU4zeiu+GnWhJr935cR1IrJUdsPWkjtdYRh4HksY5DjFngSHxEYr5/HyfJN52
tCN4zoxVe9bHyWVAs/XdnfHAMSUL7f+tXXhSIOitwggn1/bUDqX3bYMk8qtEYbDweE0lS4
Q5TcIJEn3A255WyCJ+WKXTglTaKpDNXCucV9E=
-----END OPENSSH PRIVATE KEY-----

(key type is ed25519; password is "key")

PROTOCOL.key describes the format of the key. In decoding it they're using bcrypt with 160 rounds.

Quoting PROTOCOL.key,

  The KDF is used to derive a key, IV (and other values required by the cipher) from the passphrase. These values are then used to encrypt the unencrypted list of private keys.

That's kinda vague. How do the IV / key get generated? Are they the same?


texts: Is there an algorithm that allows to distribute elements securely between parties?

texts:
Let's say we have a set of numbers $n = \{ 1, 2, 3, 4, 5, \ldots \}$ and $m$ players ($m < \operatorname{sizeof}(n)$, of course).

I want to know if there's a way for all $m$'s to pick different numbers from $n$ in a way that it doesn't reveal which one did they pick or which ones were picked by the others.


texts: Indistinguishability vs fixed bit-length

texts:
Suppose there is a cyclic group $\mathbb{G}$ of prime order $q$ of elements in $Z^{∗}_p$ with a generator $g$ and values $a,b,c,d \in Z_q$.

There is also an equation $g^{ab} = g^{cd}$, where $a,b,c$ are known, so we can compute $d$. Also we know, that $a$ and $c$ are $x$-bits and $b$ is $y$-bits (or alternatively less than some value $v$).

Can it be claimed that $d$ is indistinguishable form $b$ if both $a,c$ are outputs of some secure $PRF$? By indistinguishable, I mean you can't say whether $b$ or $d$ were computed in this equation based on values $(a,b,c,d)$.

I've thought sure it's indistinguishable but on second thoughts $b$ has the fixed bit-length. A smaller $d$ can be padded, but what to do with a bigger one? So I'm lost. I would really appreciate any ideas or hints.

UPDATE: I found this answer and tried to mimic the logic. If we apply this bit-size definition for primes to values $a,b,c$, then we have $2^{x-1} \leq a < 2^x$, also $2^{x-1} \leq c < 2^x$ and $2^{y-1} \leq b < 2^y$. Thus, $ 2^{x-1 + y-1 - (x-1)} \leq \frac{ab}{c} < 2^{x + y - x}$, which means $2^{y-1} \leq d < 2^y$. So $d$ is also $y$-bits number. However, a) I'm not sure the def is appliacble here and b) $d$ destribution doesn't reveal that it has been computed and not selected.


texts: Can we have Rijndael s-boxes constructed using reducible polynomials?

texts: Is it necessary for the Rijnael polynomial to be irreducible? Can we have s-boxes constructed using reducible polynomials? If not what is the mathematical property that is obstructing to do so?


texts: What is the relevance of "physical layer security" to cryptography?

texts:
I found that there are quite some active research activities in a field named "physical layer security", with in particular some types of codes that apparently are different from those commonly treated in the conventional textbooks on coding theory.

Could someone kindly explain the relevance, if any, of that field to cryptography, i.e. to issues of interest to our community (and eventually give a little bit of introduction to that field)?

edit:

Though having no prior knowledge in that field, I did attempt to read a bit of the corresponding literatures but found it too hard to really proceed with my humble knowledge (among other causes: lots of math). A perhaps understandable "reaction" of mine was that I asked myself:

"The physical layer needs 'merely' to transmit the bytes from the sender to the receiver error-free and that's obviously a type of task already successfully achieved via the (conventional) error-correcting codes etc. long before that new field came up. Now, since modern cryptography (as we commonly understand the term) has already provided lots of sufficiently fine techniques for achieving good security for the users, why does one need (at all) any additional theory to be applied, as well as additional work to be done, elsewhere (i.e. in the physical layer) in the entire processing of the messages of the users?"

In other words, I thought that the status-quo of cryptography is good enough and hence the raison-d'etre of the said field would possibly be questionable.

However, it is on the other hand entirely obvious to me that this kind of "personal" (emotional) thinking of mine can be no scientific argumention at all to "devaluate" that apparently fairly active new scientific research field, with lots of papers to be easily found via Google and even some published books written by univeristy professors.

I found subsequently in our library two books:

M. Bloch and J. Barros, Physical-Layer Security (sub-title: From Information Theory to Security Engineering), Cambridge, 2011,
X. Zhou et al. (Ed.), Physical Layer Security in Wireless Communications, CRC Press, 2014.

So currently I believe the real situation is as follows: Both (a) the (conventional) cryptography as treated e.g. in HAC of Menezes et al. and underlying the discussions of our community up till now and (b) the said new field of research are at the foundation based on (the same) Shannon's theory and they have merely different realms of applications in practice. This means that, for the benefit of the general readers of our community, it would be highly desirable that an expert who has good knowledge of that new field and who happens to be also in our community kindly volunteer to spend some of his time to post a short but helpful review of the research results of the new field that are presumably yet unknown to the majority of us.


texts: Regex searchable word list for space-less monoalphabetic substitution

texts:
I am working on teaching myself basic cryptography. In the process I created a simple substitution cipher based on a single alphabet, and a statically defined offset (no key for now). Now that everything is working, I want to start on another application to "crack" the offset. The key here is my cipher removes all spaces, so I can't judge the length of the individual words.

To solve this issue I would like to use regular expressions. I would then take parts of the (possibly) deciphered message and query a word list to determine where the words start and end.

Is this a good way to do this?

I know there are only 26 possibilities for the offset in my simple cipher. However, I would like to find the answer programmatically.


texts: how to truncate a PRF on n bits to PRF on t bits where t < n?

texts:
Dan Boneh's courersa lecture on format preserving encryption  at 5.50 mins , talks about truncating a PRF on $n$ bits to PRF on $t$ bits.

The approach is by appending $(n-t)$ zeros to input $t$ bits then applying AES on $n$ bits and truncating it back to $t$ bits . He says there are better ways to do it but does not mention how . anybody has idea on better ways to truncating PRF on $t$ bits when $t \ll n$ .


texts: Can anyone give an example where (asymmetric) crypto can go wrong due to selection of wrong groups?

texts:
Basically the title says it all. It would be great if someone could tell give an example using provable security. More information about groups can be found at:

https://en.wikipedia.org/wiki/Group_(mathematics)

https://en.wikipedia.org/wiki/Group-based_cryptography


texts: In what countries am I now allowed to talk about technical details of cryptography?

texts:
I hope this is the correct place to post this, otherwise I'm sorry.

The OpenSSL Legality section states:

  OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY
  SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD

I am wondering in which parts of the world you not allowed to talk about the technical details?


texts: When do I need to use hybrid cryptography?

texts: I need to provide confidentiality for a protocol. The protocol message size is between 100 bytes to 500 bytes. Do I need to use asymmetric encryption or hybrid cryptography?


texts:
So I recently read an article about the Argon2 hash function.
Now some Questions:

I heard that it was developed in 2015 so why is it not implemented yet?

If so where is it implemented? ( I think I saw it in KeePass2 )
How strong is it in comparison aginst bcrypt or sha512 or whirlpool?

Is it really that strong against gpu clusters?


texts:
Section 3.4.3 "The MixColumns Step"(page 39) of "The Design of Rijndael", it states

  The columns of the state are considered as polynomials over
  $\operatorname{GF}(2^8)$ and multiplied modulo $x^4 + 1$ with a fixed polynomial $c(x)$.

  The polynomial $c(x)$ is given by
  $c(x) = \mathtt{03} \cdot x^3 + \mathtt{01} \cdot x^2 + \mathtt{01} \cdot x + \mathtt{02}$

  Let $b(x) \equiv c(x) \cdot a(x) \pmod{x^4 + 1}$. Then

How this polynomial multiplication modulo $x^4+1$ is converted to Matrix Multiplication?


texts: Diffie-Hellman using a different modulus on both sides

texts:
For Diffie-Hellman Key Exchange, the used modulus is the same throughout the process. Is it possible to use 2 different for both sides? For example,

$A \gets M^{d_1} \pmod{n_1} $
$B\gets M^{d_2} \pmod{n_2} $
$m \gets B^{d_1} \pmod{n_1} $
$m' \gets A^{d_2} \pmod{n_2} $ <-- I wonder if $m'$ is equal to $m$ as well?

Put 1 into 4; put 2 into 3, then

$$(M^{d_1} \;(\bmod{n_1}))^{d_2} \pmod{n_2} \equiv (M^{d_2} \;(\bmod{n_2}))^{d_1} \pmod{n_1} $$

Please kindly help if my concept is correct? Thanks!


texts:
I found this explanation of Enigma rotor movement on this website, but can't quite understand the methodology: Enigma rotation example

A ⤑ B → D ⤑ C (rotor III in position B)
C ⤑ C → D ⤑ D (rotor II in position A)
D ⤑ D → F ⤑ F (rotor I in position A)
F ↔ S (reflector B)
S ⤑ S → S ⤑ S (rotor I in position A, reverse)
S ⤑ S → E ⤑ E (rotor II in position A, reverse)
E ⤑ F → C ⤑ B (rotor III in position B, reverse)

I follow steps 2 to 6 inclusive OK, but unsure about steps 1 & 7:
I understand that the rotor moves before encryption, so I get the A>B>D, but why the final D>C? and similarly the end of step 7.  I can't understand where that final step comes from.
I guess there is a similar bit of complexity when the the rotors cause the next one to step ahead when the notches engage?
I'm only doing this for interest, as I used to use AES a lot in my job (now retired), encrypting electronic messages, so thought I'd get my head round Enigma to keep the brain ticking over.
Think I understand now (correct me if I'm wrong)!:
Because the rotor has advanced, pressing A goes into rotor III at letter B, which encodes to D, but "comes out" in "position" C because the rotor has advanced.


texts:
In Elliptic Curve Cryptography, using the projective space is often mentioned to accelerate the computations and to represent the point at infinity.
But What is the Projective space exactly ? How can we represent the curve in such space ?


texts: How to solve a simple case of a RLWE problem

texts:
I've been reading up on the Ring Learning with Errors problem and the proposed attacks, in relation to homomorphic encryption. Some of the literature has been quite difficult to understand - what I want to know is if it is possible to solve this problem? And if so, what is a general outline of a possible attack? I'm quite new to this so any basic explanations would be very helpful!

Edit (thanks to user fgrieu): What are known methods to solve small instances of RLWE problems, as used or proposed in cryptography with larger parametrization?


texts: How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

texts:
To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$.

$c = mg_1^r$ mod p

If an attacker want to derive $r$ he can use e.g. the Baby-step giant-step algorithm. He can solve this in $\mathcal{O}(\sqrt{p})$.
I'm looking for a way to make it harder to reduce the size of $p$ and still be safe.

Are there any records about solving something like this:

$c = mg_1^r + g_2\frac{g_1(g_1^r-1)}{g_1-1} \mod p$

Or do you know any? Would it (significantly) increase the solve time $\mathcal{O}(\sqrt{p})$?

The potential attacker has the source code and so he knows $g_1, g_2$ and $p$. So if he picks a known $m$ and $r$ he can also compute $c$. In my usage scenario each computed $c$ can be used as $m$ to compute the next $c$. So the main aspect is not to encode a message. I'm looking for a way to make the computation of r as hard as possible for a given $m$ and $c$. That means the attacker has by default a given $m$ and some $c$'s. He should not be able to compute the respective $r$'s which allows him to compute those $c$'s out of the $m$. And if he somehow managed to compute $r$ for a $m$ to get $c$ it should not be easier if $m$ or $c$ changes.

Derivation of formula:

If you use $+$ instead of $*$ operator you can encode like:

$c_1 = m+g_2 \mod p$

$c_2 = m+g_2+g_2\mod p$

so for $c_r$ you can shorten it with multiplication by r

$c_r = m+rg_2\mod p$

But this can easy be solved with computing $g_2^{-1}$ with e.g. eucl. algorithm.

But how about a combination with $*$ operator?

$c_1 = (m+g_2)*g_1\mod p$

$c_2 = ((m+g_2)*g_1+g_2)*g_1 = mg_1^2+g_2g_1^2+g_2g_1\mod p$

$c_3 = mg_1^3+g_2g_1^3+g_2g_1^2+g_2g_1\mod p$

so for $c_r$

$c_r = m*g_1^r + g_2*\sum_{i=1}^r g_1^i \mod p$

$c_R = mg_1^r + g_2\frac{g_1(g_1^r-1)}{g_1-1} \mod p$


texts: Should data encrypted in a database have a MAC?

texts:
I need to store sensitive data in a particular column in my database (Postgres). I'm hosting with AWS, so I'm planning on using KMS to use envelope encryption. For example:

To encrypt a secret:

Generate a 256-bit plaintext data key.
Generate a 256-bit random IV.
Encrypt the secret with AES-256-CBC using the plaintext data key, and the IV.
Using KMS, encrypt the data key.
Throw away the plaintext data key.
Encode the IV, the ciphertext secret, and the ciphertext data key in the column.

To decrypt a payload from the column:

Decode the IV, ciphertext secret, and the ciphertext data key from the column.
Using KMS, decrypt the ciphertext data key.
Decrypt the ciphertext secret with AES-256-CBC using the plaintext data key, and the IV.

With this in place, should I encrypt-then-MAC the message? I found this answer about using a MAC with a HSM, but I'm not sure if it still applies in the case of data stored in a database:

For checking data integrity, isn't this already covered by our database?
For checking authenticity, we are the only ones who consume the ciphertext. For example, we do not exchange the ciphertext with a client where it could be modified.

Is applying a MAC to the encrypted data unnecessary overhead?


texts: AES Cipher Block Chaining 128 bit message

texts:
I understand that for AES CBC you need to split the plaintext up into blocks and perform XOR'ing using the previous blocks calculations etc.

However, if your message is exactly 128 bits long, do you only perform the XOR with the IV and the encryption with the key once? Or is there a way to split up a 128 bit message so that you can perform the cipher block chaining method as intended.

Thanks.


texts: Given the block cipher compute max PRF advantage

texts: Hey all I'm having a bit of problem with this question. Not sure how to approach it. Any help will be appreciated :)


texts:
(I asked in stackoverflow and I should ask my question here not there, sorry about that)

The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,c4 How is the decryption for this graph? I hope that someone can explain it to me with a graph because I checked the explanation in wikipedia and it was confusing to me.


texts: Does this approach on MEDP take into account the multiple differential trails?

texts:
I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES:

I cannot fully understand what he is doing but it seems like it iterating over all possible intermediate differentials that lead to (a,b).
Is that really the case?


texts: Performance bottlenecks in Paillier encryption

texts:
I'm implementing Paillier encryption and I'd like some recommendations about improving its performance.

Firstly, I have to note the following:

I have already set g=1+n to get rid of one exponentiation.
I've been using the CRT to improve decryption.

Nevertheless, the computation of r^n mod n^2 is rather intensive, do you have any other trick to improve the performance?

Note: I don't want to use the Catalano et al. improvement with e as I want to keep its homomorphic property intact.


texts: How does the HOTP dynamic truncation function generalize to longer hashes?

texts:
HOTP, the HMAC-based One-Time Password algorithm from RFC 4226, uses a "dynamic truncation" function to turn the 20 byte HMAC-SHA-1 value into a 31 bit string. The dynamic truncation (from Section 5.3) works like this (and is probably useless):

 DT(String) // String = String[0]...String[19]
 Let OffsetBits be the low-order 4 bits of String[19]
 Offset = StToNum(OffsetBits) // 0 <= OffSet <= 15
 Let P = String[OffSet]...String[OffSet+3]
 Return the Last 31 bits of P

TOTP (RFC 6238) allows using SHA-256 and SHA-512 as the HMAC hash in HOTP, but doesn't seem to define a new dynamic truncation function for use with them:

  TOTP implementations MAY use HMAC-SHA-256 or HMAC-SHA-512 functions,
    based on SHA-256 or SHA-512 [SHA2] hash functions, instead of the
    HMAC-SHA-1 function that has been specified for the HOTP computation
    in [RFC4226].

Should I use low 4 bits of String[19] as offset, low 4 bits of String[length-1], or perhaps some other number of bits or a completely different truncation algorithm?


texts:
This is possibly a dumb question. I'm trying to input SECP256K1 curve parameters to a system that expects any custom curve. The form is asking for "curve type". It offers three options:

Short Weierstrass
Twisted Edwards
Montgomery

What should I use for SECP256K1? I verified here and here, but they tell that SECP256K1 is a "Koblitz" curve. Is that compatible with any of the expected curve types above?


texts: Are there any existing ASN.1 structures for transferring symmetric keys?

texts:
Is there any reasonable ASN.1 standard to encode symmetric keys?

I found PSKC, but it seems extremely heavy, and I can't quite find any library (e.g. bouncycastle) that would simplify using it.

If all I need is to encode a symmetric key, would it be sufficient to just include:

algorithm ID
block size
key size
key bits


texts:
I'm trying to understand PPT and in particular what the differences are in uniform and non-uniform PPT's. First, this is how I see it:

A probabilistic polynomial-time (PPT) algorithm $A$ is an algorithm that runs in polynomial time but also has access to some oracle which provides true random bits. So if we input $x$ into $A$, instead of getting an output $y = A(x)$ that is a deterministic value, we get a random variable $Y$ which has a certain probability of being a set of different values.

A non-uniform PPT $A$ is PPT whose description size (i.e., $|A|$) is not constant, but polynomially increasing with its input. I've seen definitions like $A = \{A_1, A_2, \dots\}$ where every $A_i$ is a PPT.

Are my observations/conclusions wrong? And if so, please correct me.
Some definitions I have seen for a non-uniform PPT is that we insert some "advice string" along with the input to $A$. But what exactly is that advice string?

Best regards


texts:
My question is: Are ephemeral keys symmetric or asymmetric?

If symmetric, can ephemeral keys be created based on a (UserID || nonce)?


texts: Why use IV like this in TLS 1.2 record layer AES-SHA block cipher?

texts:
struct {
    opaque IV[SecurityParameters.record_iv_length];
    block-ciphered struct {
        opaque content[TLSCompressed.length];
        opaque MAC[SecurityParameters.mac_length];
        uint8 padding[GenericBlockCipher.padding_length];
        uint8 padding_length;
    };
} GenericBlockCipher;

I quoted above from RFC5246.
I am curious why do we use IV like that.
Why not derive IV in the key expansion and use it again again?

If we use it like above, the IV will be public to anybody.
Is it right that the recipient should use the IV to decode block-ciphered struct? So IV is not encoded and only block ciphered struct is encoded.


texts: Do people not care about side channel resistance?

texts:
Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/cache) resistance or with casual mistakes. Where I come from, side channels in cryptographic code are a big no-no, and I instinctively stay away from using these kinds of libraries.

Although Shamir secret sharing is pretty obscure, people actually use these implementations. We know (thanks Ilmari Karonen)
 that side channels matter, so why do the main (most popular) libraries not protect against them? Are the developers sloppy or uneducated?

Edit: I removed the question whether side channels were relevant, because this question already has an answer.

Edit: Related question: Why do crypto libs use table lookups when they're vulnerable to timing attacks?


texts: Recommended minimum entropy for online passwords in 2018

texts:
Assume a simple case, that an attacker knows the password creation scheme, and that we're not dealing with state actors, nor with sites which keep passwords in plain text. We're trying to defend against offline brute force attacks on a compromised database of password hashes. And we want the vast majority of our passwords to resist an attack over ten years.

From anecdotal evidence it seems like even sites that should know better keep passwords hashed only once. (And others in plaintext, but there's nothing to do about those.)

So it seems like the answer will depend on the following:

Are single-iteration-hash databases really common? If not, what
method is the least secure and most common? (Including iteration
counts, hash types, etc.)
And how long does it take to crack these methods. (Including common
hash cracking hardware, do these databases become public and are then
cracked by the best hardware out there (think ASICs),...)
How much time do attackers spend on a password before giving up on
it (Assuming unique salts)?
More parameters?

Just saying that we'll never have enough information for an informed decision is not enough. We need some idea. We all use passwords, and not everyone uses password managers. (I'm not saying it's not a good idea. It's just a fact.)

(I initially asked this on security.stackexchange, thinking that that would be more appropriate, but got no answer there. In fact, at first I got comments questioning the basics of password storage etc. (Which were later edited out by the mods.) So I'm asking this here instead, hoping that the crowd here will have already asked itself that question.)


texts:
I'm trying to understand how it works and how to implement the algorithm described in
this paper. The paper shows a methods to compute a modular multiplication where it is used multiplier with a resolution smaller than output resolution. For example if I want to do a modular multiplication with 2 1024 bits numbers I can use 16 bits adders.

I've extracted the algorithm for simplicity :

$
S = 0\\
for\ i=0\  to\ (m-1)\ loop\\
\ \ \ \ (C,S^{(0)}) := x_i\cdot Y^{(0)}+S^{(0)}\\
\ \ \ \ if\ S^{(0)}_{0} = 1\ then\\
\ \ \ \ \ \ \ \ (C,S^{(0)}) := (C,S^{(0)}) + M^{(0)}\\
\ \ \ \ \ \ \ \ for\ j = 1\ to\ e-1\ loop\\
\ \ \ \ \ \ \ \ \ \ \ \ (C,S^{(j)}) := C+ x_i \cdot Y^{(j)} + M^{(j)} + S^{(j)}\\
\ \ \ \ \ \ \ \ \ \ \ \ S^{(j-1)} := (S_0^{(j)},S^{(j-1)}_{w-1..1}) \\
\ \ \ \ \ \ \ \ end\ loop\\
\ \ \ \ \ \ \ \ S^{(e-1)} := (C,S^{(e-1)}_{w-1..1})\\
\ \ \ \ else\\
\ \ \ \ \ \ \ \ for\ j = 1\ to\ e-1\ loop\\
\ \ \ \ \ \ \ \ \ \ \ \ (C,S^{(j)}) := C+ x_i \cdot Y^{(j)} +  S^{(j)}\\
\ \ \ \ \ \ \ \ \ \ \ \ S^{(j-1)} := (S_0^{(j)},S^{(j-1)}_{w-1..1}) \\
\ \ \ \ \ \ \ \ end\ loop\\
\ \ \ \ \ \ \ \ S^{(e-1)} := (C,S^{(e-1)}_{w-1..1})\\
\ \ \ \ end\ if\\
end\ loop\\
$

where I have :

$\\S$ is the result
$M$ is the module
$Y$ is the multiplicand
$X$ is the multiplier and $x_i$ is the single bit (e.g. $X = (x_n,...,x_1,x_0)$.
The superscript are the words vectors ( e.g. $M = (0,M^{e-1},...,M^1,M^0)$
$(A,B)$ is the concatenation of two bit vector.
$m$ is the operands width
$w$ is the width of chosen words
$e$ is the number of $w$ bits required to complete the vectors ( $e = \lceil(m+1)/w\rceil$

I don't understand what the authors mean with the variable $C$. It should be the carry, but the problem is that I don't understand what carry they are using, Is the carry of the previous addiction ?

P.S.
In the paper it's written that $C$ is in the range $[0,2]$ . Thus, $C$ is represented by 2 bits. The problem is that in the algorithm there is this step :

$S^{e-1} := (C,S^{e-1}_{w-1..1})$

It represents the concatenation of :

$C$ : $2$ bits.
$S^{e-1}_{w-1..1}$ : $w - 1$ bits.

So the concatenation is $w + 1$ bits and it shouldn't be possible. Where is my mistake ?


texts: Reveal a plaintext with 3 encryptions of Textbook RSA

texts:
Assume we using Textbook RSA encryption with the public key $(N,3)$.
How can I learn message $m$ if I have the encryptions of $m,m+1,m+2$ in an efficient way?
I'm studying for a test and it's a question from one of the tests of the past


texts: Indistinguishable encryptions and CPA-secure example

texts:
Let $ F $ be a PRF and $  G$ be a PRG with expansion factor $n \to n +1  $ For the following encryption scheme, decide whether it has indistinguishable encryptions and whether it is CPA-secure.

Given $k \in \{0,1\}^n  $, to encrypt $m \in \{0,1\}^{2n}  $, parse $ m $ as $ m_1\|m_2 $ with $|m_1| = |m_2| = n  $ then choose uniform $  r \in \{0,1\}^n$ and output the ciphertext $\langle r, m_1 \oplus F_k(r), m_2 \oplus F_k(r+1) \rangle  $

I would need help to give a proof about if this ES is CPA secure or not, or at least some tips/ideas to try by myself first.


texts: Why are bitwise rotations used in cryptography?

texts: Any understanding I have of cryptography stops right around the cipher level. As such, I'm just curious as to why bit shifts and moreover circular bit shift are so prevalent in cryptography.


texts: In a Feistel cipher structure, what exactly does the "round function $F$" do?

texts: In a Feistel cipher structure, what exactly does the "round function $F$" do to the right half of the data, before taking XOR of the output with the left half of the data?


texts: Attacks from releasing decrypted CCM payload before verifying tag

texts:
CCM specifies (Section 1.7) that no plaintext data should be released before the MAC is verified.

Why is this recommendation given and what attacks are possible against CCM if data is treated like a streaming operation and decrypted data is released before the MAC is verified?

Is this recommendation given because of user temptation to use unverified data without checking the MAC?  Or are there deeper ramifications?


texts: Is a chosen ciphertext attack on PGP still possible?

texts:
In a paper from 2002 (pdf), Jallad et al describe a chosen ciphertext attack on PGP by taking advantage of the CFB mode that the block ciphers use under PGP. It's quite a devastating attack.

Is this attack still viable in 2016 or has PGP made changes?


texts:
Assume a cyclic group $G=\langle g\rangle$ of order $q$ and $g_1,g_2$ are two generators of $G$. Alice computes and sends to Bob

$m_1=g_1^{a_1}g_2^{x_1}, a\gets R $ is a uniformly random element

$m_2=g_1^bg_2^{a_2x_2}, a,b\gets R $  are uniformly random elements

A malicious Alice selects $a_1 \ne a_2$ and $x_1 \ne x_2$ while a benign one chooses $x_1=x_2$ and $a_1=a_2$.

Is there a way to prove to  Bob that in $m_1,m_2$: $x_1=x_2$ and $a_1=a_2$ in a zero knowledge manner? Recal that $a_1,a_2,b,x_1,x_2$ should be kept secret to Bob the verifier.


texts: Creating Random Pad from XORed Sections of Pi

texts: If two strings of equal length from random offsets in Pi were XORed together, would this result in a cryptographically secure random number suitable for use in a one-time pad? If so, would this mean that using a secure low-bandwidth channel, you could bass three digits (two offsets and a length) to provide an arbitrarily long pad?


texts: In a AES-CBC + HMAC architecture, Is it secure to send a second IV in a message to a device incapable of producing satisfactory random numbers?

texts:
There are many threads here explaining the need of a random and unpredictable IV for the AES-CBC.

I am building a home automation system with security for a school project where a Raspberry Pi creates a separated WPA2 network to communicate with many ESP8266 Wi-fi modules via HTTP requests. Each new message from the central node is encrypted with a key and a newly generated(using "/dev/urandom") IV.

The message payload structure is:

plain-text IV || cipher-text || HMAC-SHA256

However, the answer of a GET request needs to be encrypted  too. From what I read, encrypting the answer with the same IV from the received request may not be the ideal.

So is it okay for the central node to send another IV, which the esp8266 is going to use for encrypting the answer?

And what is the best way to send this IV?

Inside the encrypted message(cipher), or
As plaintext, making the payload:

IV2 || IV1 || cipher || HMAC(hash of IV2 || IV1 || cipher)


texts: Sender and receiver having different moduli conflicts with encryption and signing in RSA

texts:
I should implement a security protocol as a part of which I need to:

Encrypt the message with receiver public key.
Sign it with my private key.
Send it to receiver.

Suppose that the system uses a modulus with at least 1024 bits and data is in blocks of 512 bits.

The problem is that when the receiver's n (modulus) is bigger than  my n then the output of step 1 is probably bigger than my n and so step 2 will fail.


texts: How many primitive cryptography operations are there?

texts: Every cipher I've encountered seems to be built from slight variations of only three basic operations: the S-box, the P-box, and the XOR.  I’m just wondering, are there any others?  And if there aren't (keep in mind I'm not counting XNOR here, since it's semantically the same as XOR), is there any way to prove that those three operations are the only ones that have the desired entropy properties needed for cryptography?


texts: Isn't the security of EC curve 25519 126 bits?

texts: The security of the EC25519 is given as 128 bits, but since the order of the group is 252 bits shouldn't the security be 126 bits? Given as half the magnitude of the underlying field, since DLP algorithms such as Baby-Step-Giant-Step and Pollard-Rho generally have a complexity of O(sqrt(n)), n being the order of group. At least in theoretical terms. What am I missing?


texts: How to prove hardness of approximate-GCD problem?

texts: I am trying to prove the security of my system using the hardness assumption of the approximate-GCD problem using contradiction, i.e. If the attacker is able to break in our scheme, then attacker would be able to solve the approximate-GCD problem. I am stuck at the point where I proved that the complexity is O(2^rho) using brute-force approach. How shall I proceed? Is there any concrete complexity measure which can be used as to prove the contradiction?


texts: The probability of finding a limited set of collisions for HMACSHA256

texts:
I need some input on the use of HMAC-SHA256 in an open source project, any help appreciated.

The problem I'm solving is session fixation. We have a username, for that username we'd like to generate a session ID that would only be valid for that particular username so that it cannot be reused across users.

The session ID is calculated in the following manner:

|| denotes concatenation
key = 256 random bits from a cryptographically strong RNG
randomID = 128 random bits from a cryptographically strong RNG
username = some UTF-8 encoded string
sessionID = Base64Encode(randomID || HMACSHA256(key, username || randomID))

A few questions:

Will there be no collisions as long as the username <= 128 bits, i.e. the total input is never longer than 256 bits?
When usernames are longer than 256 bits, I assume the birthday paradox applies and you could expect a collision after 2128 distinct inputs (that's when probability reaches ~0.5)?
If we assume 231 valid usernames, what would the probability be that the attackers session ID would also be valid for another user and hence could be used in a session fixation attack? (A collision that does not map to another user would be useless to the attacker)

If there's anything else I should be worried about, I'd appreciate a comment on that.

If anyone's interested in the whole background on this, I'll include a pointer to the draft documentation.


texts: Are there any classical proven secure cryptographic algorithms other than OTP?

texts:
Boiled down to the core as I understand it:

  A cryptographic algorithm has provable security if it's unbreakable, even if an adversary has unlimited computational power / time.

If my understanding is correct then cryptographic algorithms like RSA / Diffie-Hellman are not considered to be provable secure since they would be broken to an adversary with unlimited computational power / time.

The only classical algorithm I know of that behaves in this manner is the OTP. I'm specifically asking about classical algorithms because I know that there exist quantum cryptographic algorithms that are provable secure, i.e. QKD.

My questions are:

Is my understanding of provable security correct?
And if so, are there any other classical algorithms that are provable secure?


texts: How to retrieve the plaintext of a substitution ciphertext?

texts:
So the other day, I was piqued by a ciphertext that was trivially encoded through substitution. Solvable only because we can use our eyes to determine word boundary word detection, etc. Trawling the net, there didn't seem to be any automated way of doing this, other than of course to generate a key the size of the alphabets.

How would one go about programmatically decrypting a substitution cipher given that all spaces have been removed?

It seems like there would be multiple runs of frequency analysis on single letters, then double letters, then finding out word boundaries. How would one go about solving this without resorting to a 26-factorial brute-force method?


texts: Deterministic Counter Mode with a PRF. What does evaluate at a point mean?

texts:
This is from Dan Boneh's Lecture where he talks about operating a PRF (AES, DES) in Deterministic Counter Mode.

Dan Boneh says

What we could do is we could use what's called a deterministic counter mode. So in a deterministic counter mode, basically we build a stream cipher out of the block cipher. So suppose we have a PRF, F. So again you should think of AES when I say that. So AES is also a secure PRF. And what we'll do is, basically, we'll evaluate AES at the point zero, at the point one, at the point two, up to the point L. This will generate a pseudo random pad. And I will XOR that with all the message  blocks and recover the ciphertext as a result. Okay, so really this is just a stream cipher that's built out of a PRF, like AES and triple DES, and it's a simple way to do encryption.

What exactly does he mean by "Evaluating at point 0, point 1" etc?
Does he mean encrypting the numbers 0, 1, 2, etc using AES?
i.e. something like
for (i = 0; i < messagelen; ++i)
    plaintext = PadToBlockLength(i);
    Output(AES-PRF(key, plaintext));

where the Output function generates one unit of the PRG with each call.


texts:
I am trying to figure out this quiz question on a course I am doing but keep getting it wrong.

  Consider the Vigenere cipher over the lowercase English alphabet,
  where the key can have length 1 or length 2, each with 50%
  probability. Say the distribution over plaintexts is Pr[M='aa'] = 0.4
  and Pr[M='ab'] = 0.6. What is Pr[C='bb']? Express your answer to 4
  decimal places with a leading 0, i.e., if your answer was 1/2 then you
  would enter 0.5000 (without a trailing period).

The way I reasoned was as follows:
Probability P1 where m=aa and key is of size 1 = 1/26 * 0.4
Probability P2 where m=aa and key is of size 2 = 1/26*1/26*0.4
Probability P3 where m=ab and key is of size 1 = 0
Probability P4 where m=ab and key is of size 2 = 1/26*1/26*0.6

The answer (I thought) was P1 + P2 + P3 + P4 = 0.0169

This is apparently wrong. Can anyone guide me, please?


texts: Why do the non-leaf Nodes of Merkle tree need to be hashed?

texts: Given the standard Merkle Tree as shown Wikipedia. I am having a hard time understanding why Hash(Hash(Leaf A)|| Hash(Leaf B)) at the parent of A and B is advantageous over just Hash(Leaf A) || Hash(Leaf B). I understand that a hash can't be any more collision resistant than it's input, so why can't we just return the concatenation as opposed to double hashing again? Is it just to make the result a fixed size again?


texts:
There's no doubt that third party cryptanalysis is an essential part of the crypto ecosystem.  It's how we know that there's some degree of practical "goodness" to a new algorithm or protocol.

Unlike a number of other information products, a robust third party testing, analysis and validation industry doesn't seem to have evolved for crypto.  For example, NIST's CAVP and CMVP are very specific and focused in scope while the Common Criteria PP's are focused on modules and implementations rather than the constituent algorithms.

Are there trusted third parties - labs, academic institutions, government agencies, to whom new algorithms and concepts can be submitted for cryptanalysis?  If so, who are they and how can one contact them?

Many thanks,

Adam


texts: Hash function that is efficient on GPU and poorly suited to ASIC

texts:
I have such requirements to the hash function in my project:

operating on 32-bit data,
not mathematically breakable (built on existing hashes known to be secure),
free of branching,
as much as possible, free of repetitive rounds and rotations,
long enough to require a huge number of gates on the ASIC.

The idea is to make efficient hash focused on GPU units, and not prospective for ASICs implementation.

(Skein-256 almost seems to fit these requirements?)


texts: Is it cryptographically insecure to use fixed-length AES-GCM messages?

texts: Is there any weaknesses to encrypting fixed-length messages? Should a random amount of padding be added to the message to decrease the odds of some sort of attack?


texts:
Suppose a message $M$ was encrypted with a one-time pad. If we learned the first half of the original text is some substring $s$, would we have a better chance of cracking the rest of the message?

Is this true or false? I know that OTP is unbreakable in theory but with the knowledge of the first portion of the string, would this help us?


texts: I am using AES/CBC to encrypt my http cookie. I never encrypt the same cookie value twice so my understanding is I don't need to use a random initial vector - using a fixed initial vector is fine for this case. A random initial vector is needed if we may encrypt the same message more than one. Is my understanding correct for my case?


texts: Using machine-learning techniques for data-dependent operations in ciphers

texts:
From 'Methods of Symmetric Cryptanalysis' by Dmitry Khovratovich,

  The data-dependent operations are one of the most controversial design concepts. We say that an operation is data-dependent, if it is expressed as a family of functions indexed by input data. The examples are key-dependent S-boxes, key- and message-dependent rotations and
  permutations. The advantage of data-dependent operations is that its statistical and diffusion properties are largely unknown to the attacker, so that she can not predict the behaviour of the primitive on a large set of data.
  On the other hand, the advantage quite often converts to the disadvantage. Indeed,
  if the statistical property is key-dependent, then by statistical parameters of a sample yield
  information about the key. The main difficulty of the analysis is hence the extraction of those
  properties and relating them to a particular key group...

Can we use maching learning techniques for cryptanalysis of these operations?


texts: Is it safe to encrypt data by simply randomizing chunks based on a permutation?

texts:
Say I want to encrypt the following text: "Today is March the 22nd, 2015". And say want to encrypt 8-byte blocks of data using the following permutation [6,3,0,1,5,7,2,4] to swap characters at those indexes.

[T|o|d|a|y| |i|s| |M| a| r| c| h|  | t| h| e|  | 2| 2| n| d| ,|  | 2| 0| 1| 5]
 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Using the encryption key [6,3,0,1,5,7,2,4], encrypting the first block goes like this:

First index is 6, so move the character at index 6 in the plain text to the first position of the ciphertext.

[i]

Second one is 3, so add the character at index 3 to the ciphertext:

[i|a]

When we finish the first block it looks like this (without the "|"):

[i|a|T|o| |s|d|y]

Then continue to do the same for the other blocks.

If the length if the text is not a multiple of the block size, just pad with some character and remove it after decryption.

I can't think of any type of attack except for brute force. This would basically mean generating all permutations of size n (where n is the block size). For block sizes larger than 1KB, it's basically computationally infeasible to break it.

Can anyone think of any other type of attack?


texts: What is the significance of IV in stream ciphers like Trivium?

texts:
In Trivium cipher, an 80-bit key and 80-bit IV (initialization vector) are used initially to set up the initial state. I would like to know,

Role of IV in stream cipher?
Can we make IV a secret parameter? and
How IV values are chosen/updated in Trivium?


texts: Differential and Linear trail propagation in Noekeon

texts:
In the Noekeon Cipher Specification they write the following :

  The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a
  step. Because of the linearity of Lambda it is fully deterministic:
  both for LC and DC patterns, we have: $A = \operatorname{Lambda}(a)$. The fact that the
  relation is the same for LC and DC is thanks to the fact that the
  Lambda is an orthogonal function. If represented in a matrix, its
  inverse is its transpose.

I'm having a hard time understanding why the orthogonality of Lambda affects the relation with regards to selection patterns (LC).

Why does the orthogonality of Lambda make it so that the relationship is the same as for DC ? How would the selection pattern propagate through the linear layer if Lambda was not orthogonal ?


texts: How to find the value of a vector modulo a basis in lattice-based cryptography

texts:
In Gentry's paper on fully homomorphic encryption using ideal lattices, he finds the values of vectors modulo a certain basis. For instance:

$\psi \leftarrow \psi' \mod B$

Taken from page 69 of Gentry's thesis.

What does it mean to evaluate a vector modulo a basis?


texts: Efficient algorithm for remainder calculation over prime field for ECC implementation?

texts: I am working on 224-bit elliptic curve cryptography. In this 224-bit * 224-bit multiplication results 448-bit output. I am reducing 448-bit into prime field range( prime number $2^{224}-2^{96}+1$) using modulus operation. Can any tell me efficient modulus operation for remainder calculation? I am working on VHDL.


texts:
Suppose I want to use the following simple hash function.
For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation).

This hash function is secure because the discrete log problem is hard, but only if $p-1$ has a large prime factor (to avoid being broken by index calculus). However, I figure if everyone's going to use the same $p$, I might as well choose $p$ so it's largest factor is as large as possible, in other words choose $p$ to be a Safe prime (meaning $\frac{(p-1)}{2}$ is also prime).

So how can I choose p to be a Safe prime, but also make it a Nothing-Up-My-Sleeve number for the purpose of constructing a good cryptographic hash protocol.

Then I'll choose $a$ to be the smallest generator $\bmod p$ (that's easy to check for Safe primes because all I need to do is find the smallest $a$ for which $legendre(a,p)=-1$).


texts: Difference between strongly universal and $\delta$ univeral hash functions

texts:
Define a family of strongly universal hash functions as:

$$\forall x_1, x_2 \in \{0,1\}^n, \forall y_1, y_2 \in \{0,1\}^m, ~ x_1\ne x_2: ~~ \Pr_{h\in H} [h(x_1) = y_1 ~\text{and}~ h(x_2) = y_2] \le \frac{1}{2^{2m}}$$

if $h: \{0,1\}^n \rightarrow \{0,1\}^m$
and a family of $\delta$ universal hash functions:
$\forall x_1, x_2 \in \{0,1\}^n$ where $x_1 \neq x_2$:
$$Pr_{h \in H} [h(x_1) = h(x_2)] \leq \delta$$

(Definitions according to Moni Naor slides.

Then I see why strongly universal implies $2^{-k}$ universal (simply pick $y_2 = y_1 = h(x_1)$), but according to Moni Naor slides, $\delta$ universal does not imply strongly-universal.

Since I don't fully understand the counterexample on the slides ($h(x) = x$) I am searching for a counterexample and an intuitive description of the differences between the two definitions?


texts: XOR Encryption with bcrypt password de-biasing

texts:
Objective:  To have a very simple to verify, but very secure small message encryption.

Idea:  Message ⊕ bcrypt( Password).  We remove password biases with bcrypt and then XOR resulting key with the Message.

Implementation.

Limitation: Only messages up to 320 characters long are supported.

10 bcrypt salt values are hard coded:

Salt1 =  $2a$12$geKv/Jdb2zSGEtnn3AuXXe
Salt2 =  $2a$12$h1V42zCLf/F5F7RbueVuZe
Salt3 =  $2a$12$UTX8OMvg1CI3/pnbT0F5Mu
. . . . . . .
Salt10 =  $2a$12$Yq9Vo0yefk6zJlEvJmBf6O

Suppose we have

Message=My safe code is 29540323, my bank card pin is 6926

Password= 32GateKeepers

The message is 50 characters long. bcrypt produces keys 32 characters long. So we need 2 keys to match message length:

Key1 = bcrypt(Password, Salt1) = e8.4zyJT9m9R/KX./Kd2juSHn25IqGUO

Key2 = bcrypt(Password, Salt2) = emTDJsUVCLFE3Jm8Cjx2S2/WmXEVrrU.

Key (50 characters) = e8.4zyJT9m9R/KX./Kd2juSHn25IqGUOemTDJsUVCLFE3Jm8Cj

Code = Message ⊕ Key = 40,65,14,71,27,31,47,116,90,2,93,55,15,34,43,14,29,114,81,6,90,70,97,123,66,18,88,48,81,37,52,33,14,77,55,37,56,23,117,38,42,34,102,44,64,106,91,1,113,92

Question: Is bcrypt de-biasing good enough to use in XOR encryption?

Specific Problem: Attacker knows that the same password was hashed with ten known salts for longer messages.

Specific Question: If the attacker has 10 hashes of the same password with 10 known salts. Given the nature of hashes, does this weaken the password?


texts: Has the distributed project "Number Fields @ Home" project benefited cryptography in any meaningful way?

texts:
Is there any new understanding, property, or knowledge that has come from the Number Fields @Home distributed computing project?  Has any outcome advanced the study of cryptography, or altered previous recommendations?

If nothing in particular has come from the project as of yet, are there some outcomes a cryptographer would find intriguing? If so, what are they, and in what way?


texts: Why does second pre-image resistance imply pre-image resistance?

texts:
Definitions here:

Pre-image resistance

Given a hash value h it should be difficult to find any message m such that h = hash(m).
Second pre-image resistance

Given an input m1 it should be difficult to find different input m2 such that hash(m1) = hash(m2).

Wikipedia says:

  These properties form a hierarchy, in that collision resistance implies second pre-image resistance, which in turns implies pre-image resistance, while the converse is not true in general.

Assuming pre-image resistance is broken, we have a function pre(h) which can easily find m such that h = hash(m). How is it helpful in finding a different m2 such that hash(m1) = hash(m2)? What if pre(m1) always returns m1?

Edit. The definition on Wikipedia is not quite formal. A better explanation is here.


texts: Birthday attack on AES-CCM with 32-bit Authentication Tag

texts:
I would like to use AES-CCM with a very small Authentication Tag length of 32 bits. Thus, I have a question about the vulnerability to birthday attacks.

How vulnerable is CCM to birthday attacks?
Jonsson explains that the adversary does not gain more than negligibly from making multiple forgery attempts if the tag length is considerably larger than $\frac{k_b}{2}$.

Theorem: $\mathcal{Adv} \leq \frac{q_{dec}}{2^{\tau}} + \frac{\sigma^2}{2^n}$, where $q_{dec}$ bounds the total number of decryption queries that the adversary asks and $\sigma$ bounds the total number of blockcipher calls that the mode would make on the adversary’s sequence of queries, both to encrypt all the encryption queries and to decrypt all the decryption ones [explanation from Rogaway].

Since AES is used, $k_b$ should be 128 and the theorem wouldn't hold on a 32-bit authentication tag size. Does that mean that a birthday attack would work after $2^{16}$ attempts? Does this apply to blocks or messages (since blocks are mentioned here)? It would make quite a difference if it's the amount of blocks the function is called or the amount of messages:
$2^{16} \times 128\text{-bit block} = 1\text{MB}$
Thus, there'd be a collision after 1MB of data?

Or do I misunderstand Jonsson's theorem? On the other side, Rogaway applies Jonsson's theorem on 32-bit tags and explains that if a forgery that can perform 10,000 attempts until the key will be retired and the total amount of plaintext or ciphertext that the adversary attempts to encrypt or decrypt corresponds to $2^{50}$ blocks, then the adversary’s probability of forging will be at most $\frac{10000}{2^{32}} + 2^{-28} \approx \frac{10000}{2^{32}} < 0.000003$
Again, he works with $2^{50}$ blocks. Does that mean that the birthday bound describes the amount of messages instead of the blocks?

In short: How many messages can I securely send in CCM with a 32-bit authentication tag and after how many INVALIDs should the key be retired? Is Jonsson's Theorem applicable on 32-bit tags?


texts:
Is there any library/tool available which can allow me to search over encrypted data?
I would like to encrypt data on client side, send it to cloud and perform search in cloud.

I've been reading about homomorphic encryption and though there is CryptDb available which makes it possible to run encrypted DB in cloud, but my use case is slightly different- in my case I want to let users send me encrypted data and I want to be able to do a keyword search (as opposed to user performing search).


texts: What is the difference between pseudorandom permutation/pseudorandom function/block cipher?

texts:
What is the difference between;

pseudorandom permutation
pseudorandom function
block cipher?

Very confused with the 3 terms and I am not good at advanced math. Can someone explain in plain word?


texts: Collisions in Diffie-Hellman private keys

texts: Given a generator $g$, a large, safe prime $P$ and a result of the DH key exchange $g^{xy} \mod P$, how would I come up with two different $x', y'$ s.t. $g^{x'y'} = g^{xy} \mod P$


texts: Why do they use elliptic curve instead of circle or other simpler curves?

texts:
I am curious why people use elliptic curve in cryptography. I know the main requirement is DLP, but elliptic curve is not the only curve with such property. Some of curves seem to be even simpler.

As an example, we can consider a circle given by the equation:

$$ x^2 + y^2 = 1 (mod p) $$

where $ x, y $ in $ Z_{p} $, $ p $ is prime. And the rule for addition is:

$$ (x_1, y_1) + (x_2, y_2) = (x_1 x_2 - y_1 y_2, x_1 y_2 + x_2 y_1) $$

that can be also written as:

$$ P_1 = (x_1, y_1) $$
$$ P_2 = (x_2, y_2) $$
$$ P_{1+2} = P_1 + P_2 = (x_{1+2}, y_{1+2}) $$
$$ x_{1+2} = x_1 x_2 - y_1 y_2 $$
$$ y_{1+2} = x_1 y_2 + x_2 y_1 $$

I think the circle has some benefits towards elliptic curve:

Easier to understand and to interpret.
Better performance, because we have fewer operations in the addition rule.
Easier to research for "good" primes $ p $ in cryptography tasks, because the number of points on the circle can be calculated much easier than using Schoof's algorithm.

As far as I know, the presence of DLP is an unprovable fact. So we can only prove that there is no DLP, and if we haven't found this prove we can think that there is DLP. I have made a research and haven't found that there is no DLP for the circle, that makes me think it is a good curve to use in cryptography.

On the other hand, it is obvious that circle looks simpler than elliptic curve, that makes me think people tried to use circle in cryptography but left this idea because of something. Does anybody have some thoughts about why people don't use circle? Or perhaps, is there some literature about it?


texts: Hash function that allows to decide if A > B if you only have hash(A) and hash(B)?

texts:
Is it possible to construct a hash function with the following property?

If you have hash(A) and hash(B) with A and B being integers, you can tell if A is greater than B -- without however knowing the actual values of A and B.

Even better: If you have hash(A) and hash(B) with A and B being ordered sets of strings, you can tell which elements of A overlap with B (e.g. those at position 1 and 3 in the ordered set) -- without however knowing the actual contents of A and B.


texts: Some confusions about Repeated Doubling Algorithm?

texts:
The following repeated point doubling algorithm is taken from the book Guide to Elliptic Curve Cryptography by D. Hankerson, A. Menezes, and S. Vanstone on page#93.

Clearly, this algorithm is better than calling the point doubling procedure $m$ times. But I am having a hard time to understand the correctness of this algorithm. So, I have two questions about the use of $2Y$ instead of $Y$ coordinate after the first iteration in the body of the loop

1) How to prove that it computes the correct value of all the coordinates at the end?

2) How to prove that it computes $2Y$ for $4P$ and so on?