texts: Password-based cipher with fast encryption

texts:
Define a password-based cipher as a cipher which decryption key is a humanly memorable password, thus optimistically at most 28 to 44 bits of entropy (per the obligatory XKCD).

For a password-based cipher to have any practical security, decryption is bound to be slow (and encryption adjusted to keep decryption slow as technical progress makes password search faster). The traditional way to do this is using an appropriately parametrized entropy-stretching password-based key derivation function (such as PBKDF2, bcrypt, scrypt, or Argon2) to transform the password (and perhaps a random salt) into the key of a normal cipher. That's done for both encryption and decryption, making the two about as slow.

What are recommendable (and preferably common or/and standardized) password-based ciphers with fast encryption ?

One option would be a $(\text{password},\text{plaintext})\mapsto\text{ciphertext}$ that is fast, while $(\text{password},\text{ciphertext})\mapsto\text{plaintext}$ remains about as difficult as in traditional password-based cipher for a comparable level of security. There are other options, and I do not want to be too directive, to see what good ideas emerge.


texts: Can we place the WOTS scheme into a Merkle tree structure?

texts:
In post-quantum signature schemes that are (to put it simply) built out of merkle trees, they usually employ some sort of OTS scheme on the very bottom leaves.  I.e WOTS Winternitz scheme.
A relatively simple scheme such as Merkle is making a bunch of Lamport/WOTS keys and putting them on a merkle tree.
Is it possible to instead put the WOTS scheme itself on a tree, where each leaf represents a byte value, and where each leaf is a simple chain of 1 hash?
By tripling the computation required to make a single use WOTS key, it becomes a potentially finite use key, and you don't have the problem of being able hash forward that is usually resolved with checksums.
Are there some obvious security downsides to doing this?


texts: Is regular CTR mode vulnerable to any attacks?

texts:
Regular plain CTR mode, is it vulnerable to any attack?

I plan to write a program to encrypt a drive with ctr mode. Would this be wise? Would AES be better?

When I look at this diagram, it looks pretty solid to me.

If the question is "too broad", allow me to rephrase:

Which is better, AES 256 or CTR mode like the picture above to encrypt a drive?


texts: Block cipher information leakage using same key

texts:
This is from a previous exam question and I'm not really sure how to approach this properly

  We're using a block-cipher mode that encrypts

  $C_i$ = $E_k$ ($P_i$ $\oplus$ $C_{i-1}$ $\oplus$ $P_{i-1}$) with $C_0$
  = IV and $P_0$ = 0.

  Indicate whether information leaks on the plaintext if too many
  plaintext blocks are encrypted under the same key (use as example
  DES).

Now I'm not really sure how to indicate this. But I assumed that if the IV is truly random that no leakage should happen.

My opinion even if you do a chosen-plaintext attack where $P_1$ = 0

$C_1$ = $E_k$ ($P_1$ $\oplus$ $IV$ $\oplus$ $P_0$) = $E_k$ ($0$ $\oplus$ $IV$ $\oplus$ $0$) which would give $C_1$ = $E_k$ ($IV$)

$C_2$ = $E_k$ ($P_2$ $\oplus$ $C_1$ $\oplus$ $P_1$) = $E_k$ ($P_2$ $\oplus$ $E_k$ ($IV$) $\oplus$ $0$)

$...$

I don't see how it would leak any information on the plaintext. I might be assessing the question wrong though.


texts: What's is the simplest possible example of using cryptography to sign a message?

texts:
I am interested in explaining to a total layman the basics of how a network can know that you are authorized without having to compromise your private key.

Using an example consisting of simple primes that anyone could understand, what is the best way to illustrate this?


texts: Difference between Zero Knowledge Proofs and Multi Party Computation

texts:
I am struggling with understanding the difference between the two. From what I am putting together, they have different adversarial models, MPC adds the condition of collusion between parties i.e. election voting.

I would appreciate if it anyone could provide both a simple and expanded explanation for this.


texts: What is the one-time signature scheme with shortest signature size known?

texts: There are several one-time signature schemes. The original one - Lamport - has very big signature sizes (several kbs). Is there an one-time signature scheme on which relies only on simple assumptions (one-way functions and random oracle), and on which signatures are no larger than a few bytes?


texts: Should I use md5 for my new application?

texts:
MD5 is a very fast hash and its output is short and easy to store. Should I use it for my non-security-sensitive application?

I don't think so, but I can't seem to convince anyone else that this is true.


texts: Can we give access to controlled functionality in Fully homomorphic encryption schemes?

texts:
Homomorphic encryption schemes are PKE schemes with an additional special method Evaluate. Evaluate method takes input any function (as boolean circuit) and encrypted inputs of the function and evaluates the circuit. The results of such function are still encrypted under the public key PK.

Sometimes, it would be too wide of a scope to allow execution of any arbitrary function.

How can one limit FHE schemes to allow only fewer circuits?


texts: When does a feedback shift register count as non-linear?

texts: It seems that a feedback shift register is counted as a linear feedback shift register whenever it only includes XOR operations. This leads me to believe that a non-linear feedback shift register is any feedback shift register that does not just use XOR operations and would include the use of S-boxes, AND operations, permutations, and so forth. Am I correct?


texts: Proving property of Modified Rabin Signature

texts:
I'm trying to prove one of the properties of the “Modified Rabin Signature Scheme”:

  If $\gcd(x, n) = 1$, then $x^{\frac{(p−1)(q−1)}{2}} \equiv 1 \pmod n$

This is what I’ve got so far…

Proof

Let $p$ and $q$ be primes such that $p \equiv 3 \pmod 4$ and $q \equiv 3 \pmod 4$

$$p = 4 t_1 + 3 , \, q = 4 t_2 + 3 \,\,\,\,\,\,\,\,\,\,-(I)$$

Then ($s$ = odd)

$$\frac{\phi(n)}{2} = 2 s\\$$

From the “Euler theorem” we know that

$$x^{\phi(n)} \equiv 1 \pmod n$$

Taking square root both sides

$$x^{\frac{\phi(n)}{2}} \equiv \sqrt{1} \pmod n$$

assuming

$$x^{\frac{\phi(n)}{2}} \equiv -1  \pmod n \,  \text{ i.e. } \, x^{2s} \equiv -1  \pmod n\\
\implies x^{2s} -1 = nk$$

subsituting values of $p, q$ from $(I)$ we get

$$x^{\text{even}} = (\text{odd})k + 1$$

Now, I want to show that

$$x^{\text{even}} \neq (\text{odd})k + 1$$

… but I'm kind of stuck here.

Can anybody help me complete this proof of one of the properties of Modified Rabin Signature?


texts: Why should I export my private key instead of well known asymmetric crypto mechanism on openkeychain?

texts:
I'm trying to use password-store as password manager under linux. I created a private github repo with my gpg files in order to use it with other devices. I installed android-password-store app for this end, which uses openkeychain as a openpgp client.(openkeychain paper).
My concern is that isn't using an private-public model (asymmetric crypto), you have to export your private key of your gnupg keyring and import it into your openkeychain keyring. I don't feel very safe exporting my private key when the public key exchange is a very good solution. What do you think about?
Thanks in advance.


texts:
Here is a typical cryptographic situation:
A secret key exists that is only known to a sender and a receiver of messages. As it is hard to replace that key, since you either need a secure channel for transmission or a way how the receiver can send something to the sender to perform a key exchange and both may not exist, a lot of different messages will be encrypted all with the same key. Note, however, that the messages exchanged will all be different. It's not impossible that two messages could start with the same couple of bytes or contain the same byte sequences somewhere within the messages but that would be pure coincident and is not generally expected to happen frequently.

Now when using CBC encryption, there is an IV and that IV is randomly chosen for every message exchanged. With a 128 bit block cipher, like AES, the IV has 128 bits as well, so the chances that two messages are encrypted with the same IV is only 1 to 2^128, which is rather tiny. And even if the same IV would have been used for two messages, does it really matter if the messages are entirely different in the beginning? After all the IV is XORed with the first 128 bit of the message first, so even for the same IV that operation has a different result if the first 16 byte of the message are different than the last message that had the same IV.

However, CBC is considered outdated by most people today, pretty much every paper about block cipher chaining recommends to only use CTR for new development, praising all it's advantages. Sure, CTR has a couple of nice features but is it really equally secure to CBC in a situation initially described?

CTR also uses an IV, yet that IV is split into two parts: A nonce and a counter. As the counter values are for sure repeating for different messages, since all counters start at zero for the first block of every new message, the only randomness comes from the nonce. Yet the nonce will be less than 128 bit because there must be room for the counter. All papers say, you must never use the same IV with the same key to encrypt two different data blocks but the nonce space of CTR is always for sure smaller than the IV space of CBC, so the chances for a collision are much higher, aren't they?

I've seen CTR implementation that split the IV in half, so there are 64 bit nonce and 64 bit counter. In that case the chances for a nonce collision are just 1 to 2^64 compared to 1 to 2^128 for the CBC case. While 2^64 is still a big number, it's a whole lot smaller than 2^128.

Thus won't using CTR force you to replace the key much more frequently, unless you want to risk the security of your encrypted data exchange? Is CTR really a suitable replacement for CBC in a situation as described above?

Aside from that, CTR doesn't seem compatible to itself. Every CBC implementation can decrypt data correctly that any CBC implementation has encrypted. That's because there are no open question on how CBC works, everything is standardized. The same cannot be said for CTR as different CTR implementation can use different ways to split the IV into nonce and counter. When I know that my messages will never have more than 2^20 blocks, I could use only a 20 bit counter and thus get a 108 bit nonce, yet this won't work if the other side expects a nonce to be exactly 64 bit long.

To make things even more complicated, instead of splitting the IV into two parts, one can also create the IV by adding nonce and counter together or XORing nonce and counter together, which avoids the issue with the IV space reduction, yet I have no idea what such a behavior means in regards to security of CTR. Also it will make the implementation incompatible to most existing CTR implementations.


texts: Lagrange Coefficients & Polynomial in KP-ABE

texts:
My question is how these concepts relate in ABE.

I am assuming that the attributes are used to share the master secret key and only a user with the right attributes for a particular access tree is able to reconstruct the master secret key.

Could someone help with some details on how this work.


texts: How much original entropy is lost if a part of the hash is known?

texts:
You have an entropy source of n bits
You hash it with SHA-512 for example
k bits of the SHA-512 output are publicly revealed, but the SHA-512 hash is also a private key to be protected (k<=512)

The question is how many bits are lost in the original entropy source by revealing/losing k bits in the hash?

Especially: the original entropy source has less entropy than the hash output size. Because if it has more or the same as the hash output then it will be equivallent to 512-k, the question is… what if it's less?


texts:
in LWE instance $b=A^t  s  +e$, can we find an orthogonal basis of coefficient matrix A in polynomial time, let it be B.Multiply B to get $Bb=Be$ as term with s will vanish. Then solve for $e$. After getting $e$, subtract from $b$ and get the equation without error. Solve for $s$.

My doubt is, "Is finding orthogonal complement matrix difficult?" otherwise LWE may be broken?


texts: Is $E′(k,m)=E(0^n,m)$ semantically secure?

texts:
$(E,D)$ is a (one-time) semantically secure cipher where the message and ciphertext space is $\{0,1\}^n$. $E'(k,m)$ is defined as

$E′(k,m)=E(0^n,m)$

The question is whether $E'(k,m)$ is (one-time) semantically secure?

I thought that the random chosen key $k$ might be $0^n$, therefore the adversary cannot distinguish the messages $m0$ and $m1$ when encrypted with the key $0^n$. Therefore, the scheme is semantically secure. However, the answer states that

  To break semantic security, an attacker would ask for the encryption of $0^n$ and $1^n$ and can easily distinguish $EXP(0)$ from $EXP(1)$ because it knows the secret key, namely $0^n$.

Can you elaborate on the answer more? I don't understand how the key is known ("because it knows the secret key") and how we can find that the messages $0^n$ and $1^n$ should be used to break the semantic security (Can we try the whole message space?)?


texts: Is there a TLS extension for generating unique IVs for AES GCM?

texts: Since reusing IVs is death for AES GCM, it seems like using the fixed IV in the TLS connection state is a phenomenally bad idea. It wouldn't even seem to be a good idea to use the salt + counter method since an attacker could watch for the first ciphertext record exchange and keep track from there. Is there an extension to address this? The RFC is distinctly unhelpful.


texts:
I have a client-server application, which is transferring data between its components in a secure way. I currently use AES algorithm with CBC mode to transfer data and file. This is the scenario: Client ask for data(file or plaintext), server takes the request and encrypt data with a iv/key pair and sends encrypted data to the client. Client always stores data encrypted. Client is a per user application. So for this reason, client should open the files, should read data even in offline mode. (Server application is .Net based, Client is Delphi)

What I need is a secret key generation mechanism, that is secure and changeable between client and server, something that is related to the current user ('user1', 'user2' etc). I'm not experienced in cryptography, So I will be waiting for the experienced one's advices.

Thanks in advance

Edit: I will try to explain my problem in more details. We have a client application, that is opening some files in some format (say 3dsmax). Those files are downloaded from  a database in server and only authenticated user can download this files. But even if authenticated user download this one, files shouldn't be copied to other computers, disks. because those files contain strictly worked models (say 3d models) and need to be encrypted; and there is another case that when client sqlite database need to be updated, we send scripts to the client  in an encrypted way and client decrypts and executes, saves values encrypted.

We do all of this work. Perhaps I asked the question not in a proper way. By key generation I mean that, how do we create a mechanism to securely and consistently exchange the data? Preferably without key storage but some mechnaism that creates the key in runtime but in both sides by using userids, licence keys etc... we store user information both in client and server. I hope I could explain


texts: In this example, which is a premaster secret, and which is a master secret?

texts:
In the context of this data, as shown in the image below, which one is a pre-master-secret and which one is a master-secret. It looks to me as if the final value of 2, for Alice and Bob is a master-secret which can be then used for creating a symmetric key (AES). Am I right?

  Alice and Bob agree to use a prime number $p=23$ and base $g=5$.
  Alice chooses a secret integer $a=6$, then sends Bob $A=g^a\mod p$

  $A=5^6\mod 23$
  $A=15,625\mod 23$
  $A=8$

  Bob chooses a secret integer $b=15$, then sends Alice $B=g^b\mod p$

  $B=5^{15}\mod 23$
  $B=30,517,578,125\mod 23$
  $B=19$

  Alice computes $s=B^a\mod p$

  $s=19^6\mod 23$
  $s=47,045,881\mod 23$
  $s=2$

  Bob computes $s=A^b\mod p$

  $s=8^{15}\mod 23$
  $s=35,184,372,088,832\mod 23$
  $s=2$

  Alice and Bob now share a secret (the number $2$) because $6$ x $15$ is the same as $15$ x $6$.


texts:
Shamir's secret sharing protocol generates a polynomial over a prime field $F_p$.

Is it possible to generates it over $Z_n^*$ as well?

The reason is that I want to combine a secret shared value in another scheme. For example sign on it with an RSA signature (that is over $Z_n^*$.

Thanks.


texts: How can a recipient recognize which encrypted messages are intended for them?

texts:
Let's say there's a decentralized email service where parties' public keys are known. A sender sends a message to a recipient by encrypting via RSA with the recipient's public key and posting the ciphertext publicly somewhere where everybody can see, e.g. a public blockchain.
Senders don't want others to know which addressees they're communicating with, so they only publish the ciphertext. Then everyone needs to scan the blockchain for new events and try to decrypt each message with their private key (in the RSA-AES hybrid scheme, they will try to decrypt a one-time AES key the message is encrypted with). If they succeed (and let's say the prefix of the recovered message is their public key per protocol), it means the message is intended for them.
The above scheme requires every participant apply RSA decryption to every message, and the number of messages per time unit are expected to increase. Are there any cryptographic primitives/protocols allowing the sender to signal to the recipient faster that the message is intended for them, yet not reveal the true recipient to everyone else and allow them to quickly skip trying to decrypt the message?
One thing I came up with is, as the number of participants and messages passed grows exponentially, gradually increase the number of leading bits of the recipient's public key getting revealed with new messages. This way, each revealed bit splits the number of potential recipients in half (starting from everybody when 0 bits are revealed and halved with each bit), while still not allowing outside observers to determine the exact recipient, but it does allow everyone else to save computing cycles skipping exponentially larger amount of messages.
However, I'm interested to know whether there are even better approaches.


texts: Are digital signatures using preprocessed paper pads possible?

texts:
My idea was, given that a computer could produce some sort of lookup tables on paper, could then a human use those lookup tables to create a system for digital signatures?

This was really an idea for fictional writing. I was trying to figure out whether it could be possible in a society at sort of 1950s technology to create a more secure alternative to handwritten signatures.

E.g. that people could order paper pads produced by a computer as service and use those to sign contracts etc with a number rather than a handwritten signature. Another paper pad which was public should be used for verifying the authenticity of the paper.

Could anything like this be done. We assume that given that processing power availability in such a society is much worse than today, this system does not need to be nearly as secure (require as much computation) as today.


texts: Is there a system where multiple people can encrypt a message and then decrypt it in any order?

texts:
For example, A encrypts a message.

B encrypts that.

C encrypts that.

Then B decrypts, followed by A then C.

Are there systems that allow this? Does such a property have a name?


texts: How to fairly select a random number for a game without trusting a third party?

texts:
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)

Can this be done such that each player has the power to be reasonably sure that the random number was fairly selected, without having to trust anyone else?

This question stems from a discussion in comments to my answer on the Bitcoin SE. I came up with a protocol but someone else spotted a flaw. This site seems more appropriate.
Please feel free to make use of my answer to that question.


texts: Period of LFSR sequence with reducible polynomial

texts: I want to prove the following theorem: Let's assume a LFSR(Linear feedback shift register) sequence with a reducible characteristic polynomial of degree $n$ over the finite field $\mathbb{F}_q$. Under those assumptions, the minimal period of this sequence cannot be $q^n−1$ (which implies it must be smaller).


texts:
First of all, I've seen a question marked as off topic because OP doesn't cover any issue related to cryptographic work, but the legal aspects, but I'm unsure where to attend to ask the following questions.

I've never thought I was going to ask such a question, since I always thought that cryptography should be an open field, because the majority of information I know is on the public domain. But advices received from partners and relatives encouraged me to experiment with the idea. I know that some schemes were patented in their beginning: DH, RSA, DES, NTRU, some schemes on ECC.

Imagine that I own various schemes that are based on existing ideas, but the construction of these schemes are different from the original description, resulting in a different scheme that is believed to have better security or it is more efficient (optimized). I haven't studied any subject related to patents since I started my career so I'm not very familiarized with the scenarios that can arise:

Can you patent a cryptographic scheme and publish a paper opening your method entirely, which is descriptive enough, so its security can be analyzed by the cryptographic community? Could I provide an implementation of the scheme?

Can you patent a cryptographic scheme based on an scheme/idea that was previously patented but lacks of patent nowadays, considering that this scheme is a modification of the original one?

I just don't want to hit a barrier considering this option. I'd like everyone to read and study the presented schemes, so I can still contribute onward with the community I've always thought that patenting make your idea less interesting or restrictive because you can't disclose any technical secret related to it, but maybe I'm wrong because I'm lacking of information. Thanks in advance.


texts: Are there cryptographic hash functions which do not have any collisions?

texts: I've been studying digital signatures and hash functions recently, and I was wondering: Do hash functions exist which will never produce collisions?


texts: ECDSA: Why is SigningKey shorter than VerifyingKey

texts:
Total Crypto Noob here.

I was wondering why in ECDSA the Signing Key is so much (half of) shorter than the Verifying key?

Lets look at some python code:

import ecdsa
import binascii
signing_key = ecdsa.SigningKey.generate(curve=ecdsa.SECP256k1)
verifying_key = signing_key.get_verifying_key()
print(binascii.hexlify(signing_key.to_string())
print(binascii.hexlify(verifying_key.to_string())

b'662ab496304f2d99aca32d813dbcba3c3ae10ab2b3359fbe43b05ee40b458cec'
b'6632feae645469c16cb31d7e1364cae247bd4322040d7089476614399bcf59b2fccf5060686ab09ee64e1b768ba037184e9a87001a4897a745721f99000b44ee'

lets assume I send verifying keys over the network or store them someware, it would be nice if they were not so long. Is there a way to compress them?

I assume it would be really bad to use the keys vice versa, but I don't understand why.


texts: Why is it necessary that the mod in an elliptic curve is a prime?

texts: For the elliptic curve y^2 = x^3+2x+2 mod(23), why is it necessary that 23 is a prime. Why is the elliptic curve y^2 = x^3+2x+2 mod(24) not suitable for elliptic curve cryptography?


texts:
Given this encryption method:

$$f_{N,e} : Z^{*}_{N} \to QR(N)^{*};\quad f_{N,e}(x) = x ^{2e} \bmod N$$

I need to show that, for any $x_{0} \in Z^{*}_{N}$, there are four elements $x \in Z^{*}_{N}$ such that $f_{N,e}(x) = f_{N,e}(x_{0})$.

This seems like a cross between RSA ($x \mapsto x^{e} \bmod N$) and Rabin ($x \mapsto x^{2} \bmod N$)? I know that Rabin decryption has four possible messages and that it uses Chinese Remainder Theorem, but I don't know how to start going about it here? This is homework, so it would probably be better for me to be pointed in the right direction, rather than given a complete solution. Thanks for any help.

I also need to give an algorithm that, given the public key $(n, e)$, the private key $(p, d)$ and a ciphertext
$c$ such that $c = f_{N,e}(x_{0})$ for some $x_{0} \in Z^{*}_{N}$, returns the set of elements $x \in Z^{*}_{N}$ such that $f_{N,e}(x) = c$. I also need to say why this algorithm is polynomial time in $k$ (= size in bits of primes $p$ and $q$). Any pointers here would also be appreciated. (Is it just asking for the decryption algorithm?)


texts: Protocol Design for IoT devices having PSK using AES-GCM

texts:
Handshake:

  1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv"

  2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag

  Client_key_256bit = Client_random_128bit + Server_random_128bit

  Server_key_256bit = Server_random_128bit + Client_random_128bit

Communication:

$c_{iv}=1, \space s_{iv}=1$

  Client_Encrypted_Message = AES-GCM(Message,$c_{iv} \space$,Client_key_256bit),$c_{iv} \space$,tag;

  Server_Encrypted_Message = AES-GCM(Message,$s_{iv} \space$,Server_key_256bit),$s_{iv} \space $,tag;

For every Subsequent Message $c_{iv}$ and $s_{iv}$ is incremented by $1$ by client and server respectively.

Client and Server makes sure every new massage's $c_{iv}$ or $s_{iv}$ is greater than the previous massage's else the session is terminated. (tcp protocol)

This is because I don't know any other way to make sure the massage/command is executed only once or to prevent replay attack.

Is there better way to do this considering the device can't keep track of time?

Would it be OK if the $iv$ used in handshake gets repeated considering the plain text is a random number?

Is this secure enough?

Here client is referred to iot_device and device_id as client_id.

psk is referred to pre_shared_key configured in the device at company and known to server.


texts: How is the Swiss post e-voting system supposed to work, and how was it wrong?

texts:
I read that the Swiss post had an e-voting solution developed, made it possible to obtain the source code for review, and that vulnerabilities were found.

Apparently we are not talking about the inherent and well-known issues of e-voting: it can't prevent purchasing of vote, and penetration of the voter's device can allow turning a vote around. Nor are we talking about the (reportedly laughable) code quality for the IT infrastructure, or its vulnerability to Denial of Service attack.

No. It was found a cryptographic flaw of some kind, by three independent teams:

Sarah Jamie Lewis, Olivier Pereira and Vanessa Teague: Ceci n’est pas une preuve, The use of trapdoor commitments in Bayer-Groth proofs and the implications for the verifiabilty of the Scytl-SwissPost Internet voting system (see introduction)
Rolf Haenni: Swiss Post Public Intrusion Test: Undetectable Attack Against Vote Integrity and Secrecy (referring page).
Thomas Edmund Haines (NTNU).

How was the proposed system supposed to work, and what was wrong with it or its implementation ?

We can stand reassured by the officials: the deployed e-voting systems can't have this flaw.


texts:
This answer points out that certain key and block lengths were a requirement for the AES submissions:

  The candidate algorithm shall be capable of supporting key-block combinations with sizes of 128-128, 192-128, and 256-128 bits.

My question is this; how can having a key length that is greater than the block size enhance security?

If we look at ECB mode for simplicity, when the key length is equal to the block length we have a permutation relationship between the set of all plaintexts and the set of all ciphertexts.

Once you increase the key length beyond that, you start to introduce collisions. In fact, you only introduce collisions from then on don't you? Collisions in the sense that a key will create the same ciphertext-plantext relationship as another key.

This would lead me to believe that only part of the key-space is unique, and only that part of key-space needs to be brute-forced?

I know that I am clearly incorrect, I just don't understand why.


texts: Few questions about setting up SuperCop primitives

texts:
Have a couple of questions about the supercop library.
I've refrained from asking this question for a considerable amount of
time because every time I thought about asking it, it sounded stupid
in my head and I felt it wasn't worthy of anyone's expertise & time in
this stackexchange (I respect the goal this SE has of preserving
high-level discourse here).
But I have to ask this question.

Can the Primitives that Accompany SuperCop Be Used Freely?
By 'freely', I mean, is someone able to use these primitives on the command line in the same way one can use 'sha256' or other cryptographic primitives that are built into most OSes these days? (i.e., Linux)
I ask for a few reasons:

All of the 'c' files and header files for each of the cryptographic primitives included are in the repo / package.

If one is able to run a test using these cryptographic primitives, then there's no reason why one shouldn't be able to iterate these primitives over other data as well.

I'm curious about this because I'm looking to toy with some of the more unique primitives using some other tools that I have. Nothing will be used in production, so no warnings needed. Looking to utilize this as a learning experience.
Tips on Building the Library?
Building the library has proven to be way more difficult than your average package written in 'C'. The instructions regarding which compiler should be used are hazy at best (Bernstein makes a couple suggestions but the gist is that it depends on your specific architecture, the version of the compiler you use + the method you use to compile the different files).
I've ran into countless issues trying to compile it.
Thanks!


texts: How to calculate the probability to get two random numbers equal from the same generator

texts: I have deterministic random bit generator (DRBG) to generate a random numbers in which it is 10 byte value and I want to turn this algorithm twice, what is the probability to get the two random equal and what is the maximum time to try to get this result ?


texts: What is the definition of "security beyond the birthday paradox"?

texts:
I'm reading a paper about MACs and I would like to be sure about the meaning of a security beyond the birthday paradox.

Is there a definition?


texts: Computing youngest person among 3 while keeping ages private

texts: I already found a protocol to find out who is richer (older) between two parties, but Is there any protocol to find the youngest person among 3 parties, without revealing actual ages?


texts: How do I express each element in a field F as a power of a primitive element?

texts:
I have a field $\mathbb F_{2^4}$, and it is represented as a residue ring of the

polynomials over $\mathbb F_2$ modulo the polynomial $\beta^4 + \beta^3 + \beta^2 + \beta + 1$.

I want to express each element in this field as a power of a primitive element $β+1$.

My questions are:

What are the elements of the fields?
How do I express them as powers of the given primitive element?

Any hints will be very helpful.


texts: Is there a way to bruteforce the private key of this cryptocurrency altcoin?

texts:
In the end of 2013 or the beginning of 2014, I bought 80 000 Applecoins (APC) for 0.1 Bitcoins and got another ten by an airdrop, so I had a total of 80 010.  I never spent the coins, and when a coinswap to a new version of Applecoin (APW) happened, I was too late to take advantage of the exchange offer, as I wasn't monitoring the coin then.

Fast forward to today. I simply could not find any copy of my wallet, and I looked on all my backup drives, simply not there. I don't specifically remember backing up the wallet, but I always do so when I run a wallet for a new cryptocurrency for the first time.

Well, all I have now is my public address and the password for the Applecoin wallet. Now the question is: Is there a chance that I can restore my private keys and basically my wallet by somehow bruteforce it?

In the Ethereum stack somebody posted a script with which he could restore his private keys just with the address and password. Is there a chance for me? Because nowadays only the new Version, APW is listed as active, the old one, in which I have the my balance of those 80 010 coins, is inactive.


texts:
Given a public key for RSA, I have extracted the modulus which looks like this :

Public-Key: (2049 bit)
Modulus:
    01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
    00:00:00:00:00:00:00:02:19:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:fe:
    f8:45
Exponent: 65537 (0x10001)

If we remove the first 01 for the sign, we have a 2048 modulus and we can remove the zeros. So I guess the modulus will be :

219FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF845

My problem now is to factorize this 1036 bit modulus. I think that the FF pattern gives us a hint but I can't find it.

Could you please help?

Thank you


texts: Fast 128-bit MAC with second preimage resistance?

texts:
I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key cannot later generate another message with the same MAC value for that key.

"Second preimage resistance", or whatever you call it here, is not normally a required property of MACs and the only one with it that comes to mind is HMAC. However, I would like something faster (with many relatively short messages per key). AES hardware can be assumed, so if there is a block cipher based MAC that does not allow generating a colliding message, that could fit the bill.

Do such MACs exist?

Collision resistance is not required.


texts: How do I calculate the maximum plain text length allowable for a certain cipher text length?

texts:
I am encrypting and storing sensitive values in the database. I have a set max length in the database, but in order to provide useful user feedback, I'd like to know the max input I should allow for a given database length.

I can throw together a test that brute forces an answer, but I'd like to understand more generally how to go about calculating.

In my specific case, I'm using Twofish in CBC mode with PKCS7 padding. The result is stored as base64 encoded string. The database column is a VARCHAR(512) column.

I know base64 has an overhead of about 137% of input so, roughly, 512/1.37 = ~373.
But now where? is 373, which happens to be 23 blocks, the maximum size, or is there more to it?

Thank you very much for you patience. :)


texts: What are the actual anonymity features of ZCash?

texts:
I have looked at their FAQ but I didn't find the answer to this.

Having looked at their whitepaper, it seems to me that the main feature of ZCash is that you can't trace where the money came from, because of zero-knowledge proofs.

My question is, does ZCash also feature anonymity the other way – not being able to trace who the money was paid TO, after it has been paid?

In other words, someone lost X amount, someone gained X amount, and we can't prove who paid whom. But what about simply finding all the people in that block who either gained or lost X? Zcash says it "does not: ... protect against correlations made with public transaction" but what about internal transaction?


texts:
Considering that algorithmic methods for generating unpredictable streams are hard to come by, I've wondered if any of these potential sources are good for making keys, seeds, and the like:

stocks, bonds, and other economic indicators.
weather patterns, temperatures, humidity, stream video of the sky, and other environmental variables.
photos taken by anyone at all.
noise in a room.
traffic patterns.
seismic activity.

Are any of these methods used?


texts: How to adjust scrypt parameters for Moore's Law?

texts:
I have been examining the scrypt paper, and I noted the claims in table 1.

  For 10 random ASCII characters, the cost at that time for scrypt set to $(2^{14}, 8, 1)$ is estimated to be $175T/yr.

Can formulae for equivalent year cost be constructed to determine the parameters as functions of time since those tests were performed?


texts: Sextic twist optimization of BN pairing - cubic root extraction required?

texts:
I found the following paper really interesting:

http://www.researchgate.net/publication/220378229_A_family_of_implementation-friendly_BN_elliptic_curves/file/79e4150b3a773beecd.pdf

It allows construction of a subset of BN curves where it easy to find the sextic twist. For instance, one knows through the contruction that the sextic twist will be the D-type which means one doesn't have to count points on the elliptic curves to check their order. Also, it gives explicit parameters for the generators of the involved subgroups.

Anyway there's one thing I'm wondering which the paper doesn't go into. Having determined the sextic twist and its generator, how do I map points on the twist back to the "real" curve over $p^{12}$? Other papers specify an isomorphism like:

$(x,y) \to (i^{1/3} x, i^{1/2} y$)

for the D-type (where $i$ plays the role of the epsilon in the paper mentioned). But how do I find the cube-root of $i$? It has to be found when $i$ is interpreted as an element of the finite field of size $p^{12}$ (probably represented using tower polynomials which the paper also describes? I have no problems understanding how to do ordinary arithmetic in this field but I don't know how to do cubic root extraction.

Also, I'm wondering if I'm completely off track because one of the benefits on the construction mentioned in the paper should be that one doesn't have to do cubic root extraction!


texts: Is it secure to use order preserving encryption in practice?

texts: When I read papers, I often see the comments, "order-preserving encryption is deterministic and it is not IND-CPA secure", or in general "it is not secure enough to be implemented in practice". So I am wondering if these comments are correct especially from the practical implementation's point of view. I know a lot of works based on OPE. If it is not that secure in real world, can I think of these works as be more theoretical than practical?


texts: Set an initialization vector to HMAC/SHA different from default in Java

texts:
I know that for HMAC/SHA there are default IV values. But if I want to supply my own IV (different from a default), there doesn't seem to be a way to implement it in — for example — Java. (At least, so far I hadn't found a solution in javax/bouncy castle. Looks like MessageDigest class isn't providing us with such methods).

Why are default values for IV (HMAC/SHA) used? What is the reason not expose them to a user?


texts:
Why we need pixel data encryption (perceptual encryption), not the complete file encryption (conventional encryption)?

I am working on securing medical images, but I could not find the answer to this question. Is the complete encryption of the file (image pixel data+ metadata(header file)) better than encrypting only pixel data (distorted image) which preserve the header information (codec information) of the encrypted image?

In the literature, I found the following: Security mechanisms developed in the existing digital medical image systems are mostly based on the conventional encryption techniques such as DES, AES, IDEA, RSA. These mechanisms have been widely recognized as the standard multimedia encryption mechanisms. However, conventional mechanisms have obvious limitations on the multimedia data such as images shown in the following papers:

Socek D, Magliveras S, C’ulibrk D, Marques O, Kalva H, Furht B. Digital video encryption algorithms based on correlation-preserving permutations. EURASIP J Inform Security 2007.
Yoon, Ji Won, and Hyoungshick Kim. "An image encryption scheme with a pseudorandom permutation based on chaotic maps." Communications in Nonlinear Science and Numerical Simulation 15.12 (2010): 3998-4006.
Pareek, Narendra K., and Vinod Patidar. "Medical image protection using genetic algorithm operations." Soft Computing 20.2 (2016): 763-772.


texts: IEEE P1619/XTS, inconsistent reference implementation and test vectors

texts:
I'm testing IEEE's P1619, which is XTS mode. IEEE documents from 2007 provided both test vectors and a reference implementation. Documents from 2008 only provided the reference implementation. Here is the 2007 document with both.

The reference implementation stayed the same from 2007 and 2008. The problem is, the reference implementation does not arrive at the test vector result. I've got it tracked down to the handling of the 64-bit S parameter in XTS_EncryptSector. The test vectors call out, for example, S=0x9a78563412; but I believe it should be S=0x123456789a, which allows the reference implementation to arrive at the test vector result.

I believe one of three things is wrong but I am not sure which one:

The S parameter is incorrect and should be byte-reversed
XTS_EncryptSector, which parses S into the tweak, is incorrect
The test vector result is incorrect

Based on Section 5, p. 4, I believe the test vector or S parameter is incorrect because of this sentence, which seems to apply to the S parameter:

  When encrypting tweak value using AES, the tweak is first converted into a little-endian 4 byte array. For example, tweak value 123456789A16 corresponds to byte array 9a16,7816,5616,3416,1216.

For anyone who wishes to try the code, see test2.cxx on GitHub. It is a copy/paste of the algorithm "C.2 Encryption of a data unit with a size that is not a multiple of 16 bytes" with OpenSSL providing AES code.

My question is, where does the problem lie?

Here's the relevant code for the handling of S:

void XTS_EncryptSector
(
    const AES_Key k2,               // key used for tweaking
    const AES_Key k1,               // key used for "ECB" encryption
    u64b  S,                        // sector number (64 bits)
    uint  N,                        // sector size, in bytes
    const u08b *pt,                 //  plaintext sector  input data
    u08b *ct                        // ciphertext sector output data
)
{
    ...

    for (j=0;j<AES_BLK_BYTES;j++)
    {                               // convert sector number to tweak plaintext
        T[j] = (u08b) (S & 0xFF);
        S    = S >> 8;              // also note that T[] is padded with zeroes
    }
    ...
}

It takes a value like S=0x9a78563412, and converts it into a tweak 12 34 56 78 9a 00 00 00 00 00 00 00 00 00 00 00 00.


texts: blake2b length extension attack approach

texts:
I understand that a completion flag parameter with Boolean value of 1 is used by Blake2 when it’s compressing the final block of the digested message.

This ensures that one cannot load the state of a blake2 implementation with a blake2 digest and continue on (length extension attack).

However I was just thinking, given that blake2 is open source, couldn't one just create a variant of blake2 that doesn't contain the completion flag, run the original message through it to obtain a non 'completed' digest and then use this as the state to mount a length extension attack through the standard version of blake2?

Which seems so trivial, I'm surprised we consider it length extension proof.

Surely loading the state of SHA-256 is only slightly more hassle than forking blake2, modifying and loading the state.


texts:
I'm trying to come up with a new way to do oblivious transfer that is faster and requires less computation than existing methods. The basis of my method is shamir secret sharing. Below is an example of how the system would work.

Let $C$ be a matrix. The user would like to query the DB for a particular row of $C$ without revealing which row to the server. I can do shamir secret sharing to form a vector indicating which row of the DB to query for as follows.

I have the following systems:

$$F_1(x_1)=s+a_1x_1\\
F_2(x_1)=s′+a_2x_1\\
F_3(x_1)=s′+a_3x_1\\
F_4(x_1)=s′+a_4x_1\\
F_1(x_2)=s+a_1x_2\\
F_2(x_2)=s′+a_2x_2\\
F_3(x_2)=s′+a_3x_2\\
F_4(x_2)=s′+a_4x_2$$

Unknowns are: $a_1,x_1,x_2,a_2,a_3,a_4,s,s′$

If we have the vectors…

$\vec{A} =[F_1(x_1),F_2(x_1),F_3(x_1),F_4(x_1)]$ and $\vec{B} =[F_1(x_2),F_2(x_2),F_3(x_2),F_4(x_2)]$

each vector is a share of the vector $\vec{E} =[1,0,0,0]$ using Shamir secret sharing scheme. So $E$ indicates which row of the DB that the user wants (in this case, the first row).

We can send the vectors $\vec{A}$ and $\vec{B}$ to the server who computes $R_1=\vec{A}C$ and $R_2=\vec{B}C$, and returns $R_1$ and $R_2$ to the user. The user can use Lagrangian interpolation to recover the row of $C$ that was indicated by $\vec{E}$.

There is a problem with this method, however. The system of equations has 8 equations and 8 unknowns. So, by sending $\vec{A}$ and $\vec{B}$ to the server, the server would be able to reconstruct $\vec{E}$.

How can I add more unknowns to these equations, to prevent this data leakage from happening while still being able to recover the desired row of matrix $C$?


texts:
From Definition of CSPRNG, it has two characteristics

It satisfies the next-bit test.
It withstands 'state compromise extensions' - part of all of the state being compromised does not allow for reconstruction of the prior stream of random numbers.

I am looking for PRNGs which fail the 2nd Characteristic. Infact they are PRNG but not CSPRNG.


texts: In zkSNARKS, does R1CS require every step of the calculation, or just statements which confirm the calculation was performed correctly?

texts:
I was attempting to figure out a way to implement the modulo operation as a set of gates in an Rank-1 Constraint System, detailed by Vitalik Buterin here

However, it occurred to me that maybe we don't actually need to break down each step of the calculation into an R1CS gate, as long we sufficiently implement gates which verify the prover performed the calculation correctly.

So instead of a complicated series of gates, the following calculations can be performed "behind the scenes" (assuming unsigned ints):

m = x % y
d = x // y

And the gates in our R1CS only need to consist of:

x = d*y + m
m < y

(I am aware that m < y is a tad complicated, but not nearly as complicated as actually performing the modulo operation itself)

Am I correct that we should only include the bare minimum constraints?  Or are there some sort of security flaws when doing this and it is better to have a more complicated system of gates to validate every step of the calculation?


texts: Is it important to defend against key substitution attack in ECDSA?

texts:
When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack?
ISO/IEC 14888-3:2018 NOTE 5 states:

  The mechanisms of EC-DSA, EC-GDSA. EC-RDSA and EC-FSDSA may be
  vulnerable to a key substitution attack[10]. The attack is realized
  if an adversary can find two distinct public keys and one signature
  such that the signature is valid for both public keys. There are
  several approaches of avoiding this attack and its possible impact on
  the security of a cryptographic system. For example, the public key
  corresponding to the private signing key can be added into the message
  to be signed.

  [10] Bohli J.M., Rohrich S., Steinwandt R. Key substitution attacks revisited:
  taking into account malicious signers. Int. J. Inf. Secur. 2006, 5 pp. 30–36

"May be vulnerable" may be read as "may be not vulnerable". I also heard opinions such that practically that attack is not applicable. For example, when the key source is a trusted CA or it's in HSM device. Also, common tools (like openssl) generate raw ECDSA signatures without protection against such attacks.

So the question may be rephrased to—is it still sane to use raw ECDSA signature in 2019? And not to use some schemes like CAdES.


texts: Pailler and Gentry - homomorphic encryption

texts:
Paillier cryptosystem is a probabilistic asymmetric algorithm for public key cryptography. Doesn't homomorphic encryption schemes have regular effects on the plaintext, and does that mean Pailliers cryptosystem missing the nonce? What is that I am missing?

I am also trying to understand if there are a disadvantage of Gentry's fully homomorphic scheme in terms of security (e.g. besides that the scheme is homomorphic how would it stand next to AES for example). Note that I do not refer to its impractical use due to its many series of computations.

Can anyone shed some light on these things for me, or perhaps point me in a direction where I can find information about it (I have been looking around, and the actual paper Gentry wrote is quite difficult to grasp for me and Pailliers cryptosystem eludes me a bit in this aspect).


texts: Relative security of this polyalphabetic cipher system?

texts:
A friend described this cipher to me the other day, but if it has an official name, I'm unaware of it.
The same 26 cipher alphabets that are used in the Vigenère cipher are used here, but rather than using a code word to determine which alphabet is used for a given character, the previous characters of the plaintext are used. The numerical value of every letter which comes before a given letter (a=1, b=2 etc) is added - for example, if the first letter of plaintext is H, then the 8th alphabet is used to encrypt the second letter. If the first five letters of plaintext are HELLO, then the 26th alphabet is used to encrypt the sixth letter (8+5+12+12+15 = 52, 52-26 = 26). A randomly chosen alphabet, agreed upon by sender and receiver, is used to encrypt the first letter.
How secure is this? Just relative to other polyalphabetic ciphers, like Vigenère, not modern encryption methods, which I know are arbitrarily more secure.


texts: How to calculate the non-linearity of an s-box?

texts: I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I still don't really get it. If someone could show me an example I would appreciate it.


texts: Would it be better to use HKDF or SCrypt for deriving a child key?

texts:
Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure.

Mp: The master key pair, this includes a private key (denoted Mpri) and an extended public key (denoted Mpub, more on this in a second).

i: Some kind of input from the user, it may or may not be random / high entropy.

P: RIPEMD160 hash of i.

Now there's a CKD (child key derivation) function that will return 512 bits (either from HMAC-SHA512 or SCrypt). The first 256 bits will be the key while the latter 256 bits will be the chain code (denoted as C). The total 512 bits is the extended public key.

I could use HMAC-SHA512(Key = C, Data = P), or I could use SCrypt(Password = P, Salt = C, N = 2^16, p = 1, dLen = 512), or SCrypt(Password = P || c, Salt = null, N = 2^16, p = 1, dLen = 512) to derive the new key from the previous.

There might be multiple child keys for one parent (think multiple leaves per branch) so the value of C might not change while the value of i (and P) does.

Which is the most secure? Would providing other values of N and p make SCrypt a better choice than HMAC-SHA512; if so, what are those values and which SCrypt option is the better of the two? Does the possibility of SCrypt having a repeated salt / no salt make HMAC-SHA512 a better choice?


texts: How exactly does ASKE (Alpha Secure Key Establishment) in Zigbee work?

texts:
I am working on Zigbee security. For key establishment, some approaches are given in Zigbee. Some of them are:

ASKE (Alpha Secure Key Establishment),
ASAC (Alpha Secure Access Control), and
SKKE (Symmetric Key Key Establishment).

I tried to do my own research, but didn't get proper information on the web. I would like to know what these mechanisms are, and how do they establish a key between two devices?

At least, where can I get the information about these mechanisms?


texts: How to verify a trusted Issuer in U-Prove

texts:
I work with U-Prove. In U-Prove they talk about a trusted Issuer, but I never saw how the trust is verified. The trust is essential, because the Verifier wants to know if the token was created with a trusted Issuer or not.

The U-Prove Cryptographic Specification V1.1 describes how to verify the signature of the Issuer. But there is no direct link if the signature is from a trusted Issuer or mayby from the Prover itself. The Issuer-Parameter could not be used, they are variable and created everytime a Prover wants to get a token.

Does someone has an idea or link where the trust establishment is described?

Updated question 24.02.2017

Maybe my first question was a bit unclear. Lets imagine that the Prover wants to create a token by himself. He creates the IssuerParameters and runs the protocol (Figure 8) by its own (this means he simulates the Issuer). Now he is the holder of the Issuer private key $y_0$. The Prover presents the created token to the Verifier. Signature (Figure 4) for the presented token is correct. But the Verifier does not know if it was a trusted or untrusted Issuer, who created the token with the Prover. The Verifier just knows that the received token relates to the private key $y_0$.

What I understand out of the Issuance protocol (Figure 8) and saw in the SDK-Implementation is, that every time the Prover requests a token, the IssuerParameters (generators $g_i$, $i$ = # attributes) and the private key $y_0$ (as well as $g_0$) are generated new.


texts: Disk encryption using AES-CBC: is reliance on previous block data a downside?

texts:
I have seen drives that boast that they use AES with CBC mode, which doesn't really make sense in my opinion, sure it's more secure than ECB (but actually, leaving security aside, ECB is better suited for disk encryption than CBC, explaining later)

The Problem with CBC is that you have a serious chicken and egg problem, which doesn't get very bad when working with most files, but gets problematic in disk encryption because it relies on the ciphertext of the previous block, wouldn't this be a serious performance bottleneck?
Encryption parallelizing is one thing (although I think that encryption speed > HDD speed) but what happens if I change/remove for example block $1$? Won't the drive be unusable while re-encrypting ALL the remaining data?

ECB is junk security-wise, that one is true, but it doesn't rely on the previous data, which gives it an advantage, but then again CTR mode has the same advantage and XTS as well (aside from the last block which may rely on ciphertext stealing).


texts: What does the absence of Abelian group actions on supersingular isogenies implicate?

texts: There are no Abelian group actions on supersingular isogenies. Why does this make them secure? - motivated by De Feo's Paper on mathematics of IBS


texts: Encrypting conversation messages stored in database (symmetric encryption)

texts:
I have a chatting application like Slack/Discord.
In this chat application there chat groups and messages sent by users need to be encrypted in the database.
I do not need features like E2E encryption, I only need to encrypt these data for legal purposes & database issues like SQL injection.

I plan to use a simple symmetry key encryption on the backend server. When storing/querying messages, perform application-level encryption/decryption on the messages.

Question is how do I handle what secret key to use?

Method 1: Global secret key (can be stored in another microservice)

Method 2:secret key for each chat group (generated when the group is created, stored in db)

Method 3: Use some information like the chatgroup_id as a secret key

My main question is, is having multiple secret key more secure than having a global key? Any purpose of having multiple secret key in my use-case?


texts: Incorrect Test Vectors for AES' MixColumns?

texts:
I'm looking for test vectors for AES' MixColums and I found this: https://en.wikipedia.org/wiki/Rijndael_mix_columns#Test_vectors_for_MixColumn.28.29.3B_not_for_InvMixColumn

Here it says that the operation on the column 1, 1, 1, 1 doesn't do anything and returns 1, 1, 1, 1.

I don't understand this. From MixColumns here's what we're doing:

$$
\begin{bmatrix}
\mathtt{02} & \mathtt{03} & \mathtt{01} & \mathtt{01} \\
\mathtt{01} & \mathtt{02} & \mathtt{03} & \mathtt{01} \\
\mathtt{01} & \mathtt{01} & \mathtt{02} & \mathtt{03} \\
\mathtt{03} & \mathtt{01} & \mathtt{01} & \mathtt{02} \\
\end{bmatrix}
\begin{bmatrix}
\mathtt{01} \\
\mathtt{01} \\
\mathtt{01} \\
\mathtt{01} \\
\end{bmatrix}
\cdot
=
\begin{bmatrix}
\mathtt{a_0} \\
\mathtt{a_1} \\
\mathtt{a_2} \\
\mathtt{a_3} \\
\end{bmatrix}
$$

And so, $a_0 = a_1 = a_2 = a_3$ will be calculated as:

$$
(\mathtt{02} \cdot \mathtt{01}) + (\mathtt{03} \cdot \mathtt{01}) + (\mathtt{01} \cdot \mathtt{01}) + (\mathtt{01} \cdot \mathtt{01})
$$

with:

$02 * 01$ is $X * 1$ which is $02$
$03 * 01$ is $(X+1) * 1$ which is $03$
$01 * 01 = 01$

So the total should be $03 + 02 + 01 + 01 = 07$.


texts: Why are protocols often proven secure under the random oracle model instead of a hash assumption?

texts:
Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle?

I mean, is it possible to devise a protocol $P$ using a function $H$, and then prove a theorem saying that $P$ is secure in a model $M$ given that $H$ is a collision-resistant function? What I most often see is some thing like: given a random oracle $H$, $P$ is secure in the model $M$.

Is this because it's more difficult or even impossible to prove security without the random oracles?


texts: Can XEX or XTS modes be used with only one tweak? (part 2)

texts:
This question is similar to Can XEX or XTS modes be used with only one tweak? except I am interested to know if one can instead use
$X = E_{k}(0) \otimes \alpha^j \\
C = E_{k}(P \oplus X) \oplus X$
in order to simply do a finite field multiplication and an aes operation per block rather than two aes operations per block (unlike the original question) for large amount of data.


texts: Would a Rubik's cube be a trapdoor function?

texts: It's easy to scramble a Rubik's cube but it is hard to solve, unless you know the algorithms for solving it. This makes it a trapdoor function, correct?


texts: Is it possible to successfully encrypt/decrypt in DUKPT using different sized BDKs?

texts: We are having our P2PE Solution validated against the PCI P2PE standard.  We currently use a TDEA 2-key based BDK, and IPEK in both the encryption and decryption environments.  ANSI X9.24-1 (2009) states that the BDK can be either 2-key or 3-key and the QSA is insisting that the BDK must be TDEA 3-key as per Appendix C in the standard. Our encryption environment can't perform encryption using TDEA 3-key (hardware limitation).  The assessor has asserted that mixed sizes of BDKs can be used with DUKPT, based on his reading of ANSI X9.24-1 (2009). Is that true?  Can DUKPT encrypt plaintext with an IPEK derived from a 2-key BDK and successfully decrypt that data from that same IPEK in a decryption environment with a 3-key BDK?


texts: How many keys does the Playfair Cipher have?

texts: I was just studying the Playfair cipher and from what I've understood, it is just a slightly better version of a Caesar cipher, in that it isn't actually mono-alphabetic but rather the 'digrams' are mono-alphabetic. I believe that since it offers a larger combination i.e 26*26=676 digrams, it is better than a Caesar Cipher which would give us a maximum of twenty-six keys. So does this mean that the Playfair Cipher have 676 keys including the duplicate or is it larger than that ?


texts: Boneh/Franklin Identity based encryption with Tate pairing

texts:
Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 .

I know that this algorithm can also be implemented with a type 3 Tate pairing. But I could not find a paper or standard where this is clearly described.

Does anyone know a good reference? Ideally, this should be some kind of standard like IEEE, ISO, ANSI, etc.


texts: Cracking an RSA with no padding and very small e

texts: I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?


texts: Research Guidance on Elliptic Curve Cryptography

texts:
I am a freshman who want to research elliptic curve cryptography.
There are a few questions I have:
Firstly, I am not sure about how I should narrow down the topic. Where should I focus on? Can I examine a specific application of elliptic curve cryptography? Or should I basically compare Elliptic Curve Cryptography and RSA algorithms.
Secondly, which prerequisite knowledge do I need? Also, do you suggest any foundational books on the topic?
Thank you


texts: Is the linear and differential cryptanalysis only dependent on Sbox?

texts: While performing the linear and differential cryptanalysis a Linear Approximation Table(LAT) and a Different Distribution Table(DDT) is required which is created exploiting the S-box of the cipher which can be found in the tutorial of Howard heys. Now my question is if I take a random S-box for every other encryption and my cipher has a very good diffusion mechanism is my cipher still vulnerable to linear and differential attacks?


texts: Difference between group key agreement, group key sharing, group key distribution and group key establishement

texts:
I am currently doing a survey on group key, and throughout my readings, I stumbled on these different terms: Group Key agreement, Group key Sharing, Group key distribution, and Group key establishment.

My question is the following: is there a meaningful difference between those different terms? because what I know is at the end, all members in the group should have the same key.


texts:
I'm learning publick key infrastructure and certificate authority.

But I cannot understand below conecepts.

  Unlike KDC or public key authority, CA does not have to be online to
  provide keys to users

Why? I think KDC and public key authority are same as CA.


texts: What is the reason to separate domains in the internal hash algorithm of a merkle tree hash?

texts:
From rfc 6962 It is stated that:

  Note that the hash
     calculations for leaves and nodes differ.  This domain separation is
     required to give second preimage resistance.

That means that whenever the hash computes on leaves a distinct known element is preappend to the element $e$: $$H(0\mathbin\|e)$$ and whenever hash applied to parent nodes for leaves $h_0=H(0\mathbin\|e_0)$ $h_1=H(0\mathbin\|e_1)$ then $1$ is being put in the beggining:

$$h_2=H(1\mathbin\|h_0\mathbin\|h_1)$$

It is not clear what is the security implication if $0,1$ is not appended to the hash to separate the two domains. The authors state that this happens to prevent second-preimage attacks. But from Merkle tree hash we require from the hash function $H$ to be collision-resistant


texts: Special equivalent key in symmetric encryption

texts:
Let $k$ and $k'$ be two keys of symmetric encryption such that for some $m$ we have $ Enc_k(m)=Enc_{k'}(m)$. Is it possible to exist a plain text $m'$ such that $Enc_k(m') \neq Enc_{k'}(m')$.

In fact, is there exist a key which be equivalent only for special plain text?


texts: How to use `openssl asn1parse` or equivalent on output files from `ssh-keygen -t rsa -b 4096`?

texts:
I generate an ssh key:

~ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/kurtostfeld/.ssh/id_rsa): rsa_key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in rsa_key.
Your public key has been saved in rsa_key.pub.
The key fingerprint is: <snip>

If I use an empty passphrase, I can successfully parse the private key file like this:

~ openssl asn1parse -in rsa_key

If I use a non-empty passphrase. This doesn't work. How can I parse an RSA private key with a passphrase. What format is that?

Also I can't parse the public key at all. This doesn't work with or without a passphrase:

~ openssl asn1parse -in rsa_key.pub
Error: offset too large

How can I parse the RSA public key?


texts: Fixed-points in block ciphers; why don't they indicate a vulnerability?

texts:
I've seen a few questions here on fixed-points in ciphers, most asking about the possibility and existence. Most of the answers however pointed out that fixed points are not exactly a security threat. Googling about it didn't fetch me much. All I found was this book, which stated it well but does not go on and explain it why!

My thoughts (from an attacker's perspective)

If I find out that the block that I captured is a fixed-point, I know the pText as well as eText for this key. So it'd certainly help me crack it faster (both chosen-plaintext-attack and chosen-ciphertext-attack). Additionally, I know that the number of keys that result in such a fixed-point are very few. So maybe there is a way for me to get the possible keys given the fixed-point.

My assumption was that it'd be easy for the attacker to find out that the captured block is a fixed-point because it retains all of the original message's pattern. Also I assumed that the relation from fixed-point to key is quite obvious.

So it seems this attack is not considered a threat because my assumptions are wrong (one or both). What am I missing?


texts:
In ElGamal, how does knowing the secret number used for a signature reveal the signer's private key? How do two signatures using the same secret number reveal the signer's private key?
[Hint: p-1 is twice a prime. Even though not all numbers have inverses mod p-1, division
can still be performed if one is willing to accept two possible answers.
(We're neglecting the case where the divisor is (p-1)/2, since it is
extremely unlikely.)]


texts:
The cipher AES-256 is used among other places in SSL/TLS across the Internet. It's considered among the top ciphers.

In theory it's not crackable since the combinations of keys are massive.

Although NSA has categorized this in Suite B, they have also recommended using higher than 128-bit keys for encryption.

So how secure is this cipher really? Should you assume the worlds top cracker-institutions are near or have cracked it already?


texts: Is following MAC schemes formed by MAC schemes secure?

texts:
Given two MAC schemes $\prod_1 = (keyGen_1, S_1, V_1)$ and $\prod_2=(keyGen_2, S_2, V_2)$.

$\prod_3$ runs $keyGen$ from $\prod_1$ and $\prod_2$, respectively, to obtain $(k_1, k_2)$. $\prod_3$, where $S_3 = ((k_1,k_2), (m_1,m_2))$ then runs $S_1(k_1,m_1)\rightarrow t_1$ and  $S_2(k_2,m_2)\rightarrow t_2$. And obtain $t_3 := t_1||t_2$. Would $\prod_3$ be a secure MAC?

And the follow up is when $t_3:= t_1 \oplus t_2 $, would this also be a secure MAC?

My guess is that the concatenation is secure because attackers would have no way of knowing how $t_1$ and $t_2$ is generated. For the second one, my intuition tells me that adversary can somehow swap the messages and produce a valid (m,t) pair?


texts: How does gpg know what cipher algorithm is needed for decryption?

texts:
I am using gpg to make encrypt a tar.gz.

My first try uses --verbose --symmetric and then the decryption is done with --verbose --decrypt. The --verbose shows that encryption was done with CAST5 and then the decryption uses CAST5.

I check all the file contents as a sanity check

My second try uses --verbose --cipher-algo AES256 --symmetric. But I don't change the decrypt command... but somehow it knows to use AES256.

I check all the file contents as a sanity check

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5?

p.s. Does gpg embed what cipher algorithm was used, yes/no? wouldn't it be "better" to not tell anyone what encryption type was used?


texts: Reference books in security and privacy preservation

texts: I am looking for books or reference guides to learn and teach "cryptography, security and privacy preservation techniques"? I need some advice to good resources that I can use.


texts:
I am experimenting with the GLV method but cannot manage to get the right results according to the literature.

I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm interested in.

According to the literature:

  $$kP = k_1P + k_2\phi(P)$$

However, to get the right results, it seems to be needed to test if $k_1$ and $k_2$ are of the same sign, in which case a point addition should be applied.  In the case of $k_1$ and $k_2$ being of different sings, one possibly needs to apply a subtraction.

Relevant part of code applying this method as is such:

BigInteger[] ba=splitK(k);
Point QP=new Point(beta.multiply(Q.x).mod(FIELD),Q.y);
Point A=wNAFMultiply(Q, ba[0],(byte)4);
Point B=wNAFMultiply(QP,ba[1],(byte)4);
if (ba[0].signum()==ba[1].signum()) // Where is this explained ????
    return add(A,B);
else
    return subtract(A,B);

It also follows that algo. 3.77 of the book “Guide to elliptic curve cryptography” probably does not work.

Am I missing something obvious?


texts: Repeating something encrypted and non-encrypted?

texts:
If one wants to keep the receiver's name non encrypted, but it also appears in the encrypted message - will it leak information? (other than the receiver's name, of course.)

Let's assume a "bad" case - where there are many messages to the same person, and that the name in the encrypted message will always appear in the exact same place, and will be publicly known to be there.

Of course it doesn't matter whether it's a name, or any other information that will be present in both encrypted, and non-encrypted form.


texts: Can a quantum money system exist in which bank (who possesses a secret key $k$) can create quantum states $S$ that anyone (in possession of public key $P$) can verify was issued by the bank without interacting with the bank, but nobody can spend twice?


texts: What if AES-128 key / text length is more or less than 16 characters

texts: In this example ( https://kavaliro.com/wp-content/uploads/2014/03/AES.pdf ), the AES-128 key and text are 16 characters each, but how would this example be explained if the key or text was more/less than 16 characters? How would this change the procedure that creates the encrypted text?


texts: Maximum number of blocks that can be safely encrypted using a block cipher with a counter

texts:
Assume that we have a block cipher with a key size of $\ell_{K}$ bits, a tweak size of $\ell_{T}$ bits, and a block size of $\ell_{X}$ bits. Formally, the encryption of a given block of data is $$E(K, T, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{T}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$$ and the decryption of the same is $$D(K, T, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{T}} \times \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$$

The encryption and decryption schemes $\widetilde{E}$ and $\widetilde{D}$ operate on a stream of $s$ blocks $X$, where $$X = X_{0} \Vert X_{1} \Vert \ldots \Vert X_{s-2} \Vert X_{s-1}$$ If $Y$ denotes the output of either the encryption or decryption of $X$ with key $K$, then $Y_{i} = E(K, i, X_{i})$ or $Y_{i} = D(K, i, X_{i})$ and $$Y = Y_{0} \Vert Y_{1} \Vert \ldots \Vert Y_{s-2} \Vert Y_{s-1}$$

What is the maximum number of blocks that can be securely encrypted? Is it $2^{\ell_{X}}$? Is it $2^{0.5 \times \ell_{T}}$?

Is every use of a block cipher for encrypting data subject to the birthday bound? Or do optimal constructions exist?


texts: Minimum distance between polynomials in ring-LWE

texts:
Let $R_q=\mathbb{Z}_q[x]/\langle f(x)\rangle$ where $f(x)=x^n+1$, as in the ring-LWE problem.

Let $a(x)$ be chosen uniformly at random from $R_q$.

Question: Is there any theorem that lower bounds the distance between any two polynomials of the form $a(x)s_1(s)$ and $a(x)s_2(x)$?

In other words, what is the value of $d$ such that $$||a(x)s_1(x)-a(x)s_2(x)||\geq d$$ except with negligible probability, for any two polynomials $s_1(x),s_2(x)\in R_q$ and where $||\cdot||$ is the usual $L_2$ norm?


texts: Is DES slow in hardware or only in software?

texts: I have been reading that DES is slow.  Is it only slow in software or slow overall?  Also, as far as Triple DES being slow is concerned, is double AES with two 128 bit keys slower than single AES with a 256 bit key?


texts: Public key encryption without ciphertext expansion

texts:
Say I have a database column that is defined as VARCHAR(255) that stores names.

I can assume that names can be up to 255 chars.

I need a public key encryption so that I can replace names with their ciphertexts. However the DB structure cannot be changed. In other words I need a public key encryption method that ensures ciphertexts are the same range as plaintexts. (i.e., a permutation).

RSA permutation is no good as it expands ciphertexts to the key size.

surely something like this must exist in the literature. ("format preserving public key encryption" or something like that).


texts: Using ECDH for encryption and decryption

texts:
I'm playing with cryptography and its use with typescript on one side and PHP on the other side. Now I'm looking for routines that can encrypt and decrypt with ecdh's private and shared keys. Any recommendations? At the moment its in a testenvironment to figure out how it works basically. The keys (private and shared) are generated with elliptic.

Edit:
The plan is to use tweetnacl and tweetnacl-utilities for Typescript on the clientside and sodium from php 7.2 on the backend. The tweetnacl is well documented and it works to create two keypairs and two shared keys. I can encrypt a string for 'Alice' and decrypt it for 'Bob'. But on the backend I did not found the right corresponding functions...

Next steps after this is a save key exchange...


texts: Trial division + Miller-Rabin complexity

texts:
I was reading a paper that shows time complexity of Trial division + Miller-rabin test for creating prime number.

T = N(T_rnd + T_td + T_mr)

T_rnd denotes time for making rnd number, T_td denotes time for trial division, and T_mr denotes time for Miller-rabin test.

N denotes the number of r(n-bit random number) that algorithm make until r is a prime number. Which is nln2/2.

I can't calculate how nln2/2 comes out.

Anyone can help me to understand this?

and sry for my bad English.


texts: Corelating between the concept of Universal Hashing wrt Algorithms (hash-table use) & the use of Universal Hashing in a one-time MAC

texts:
Trying to understand the concept of a Universal Hashing function.
From Introduction of Algorithms by Cormen, Rivest et al

We now define the hash function $h_ab$ for any $a \in Z^*_p$ and any $b \in Z_p$ using a linear transformation followed by reductions modulo $p$ and then modulo $m$:

$h_{ab}(d) = ((ad + b) \mod p) \mod m)$

I understand the above from an algorithmic point of view for use in a hash-table. i.e. if you have some data, which you need to hash to get a bucket/index number, you pick a random a & b from the sets & evaluate the function $h_ab$ at d. There is only a single input to the function once you picked the a & b.
But instead if we are using for a getting a hash in cryptography (for e.g. for using in a one-time MAC like Carter-Wegman MAC), then we now have 2 inputs - a key (a cryptographic key rather than a key to be hashed for a hash table) & also the message to hashed. So how does it work here? For simplicity, if I assume a single block of message, then how do I use this universal function to evaluate the hash?
TL;DR - a Universal Hash function has only one input when used with Hash Tables, but 2 inputs when used in Cryptography for a one-time-MAC. What's the relation between these 2 kinds of hash functions. All places (Textbooks, Wikipedia etc) I look at, universal hashing is defined in terms of a single input functions, so how does it differ for functions taking 2 inputs)?


texts: Proof that user public key corresponds the curve equation (secp256r1)


texts: Is there an equivalent to an RSA UFO in lattice-based cryptography?

texts:
So there's this concept within the realm of RSA cryptography called an RSA UFO. It is an extremely important function in the context of cryptocurrency. When starting up a cryptocurrency the creator(s) need an initial cryptographic setup. Worst case scenario an untrustworthy initiator uses the startup information to wreak havoc on the cryptocurrency. Its better to have a number of people collectively create the startup information, but you still can't trust them. An RSA UFO allows the creation of the initial cryptography in such a way that even the creator doesn't know the initial values; trustless setup of a cryptocurrency.

Lately with all the fuss about quantum-safe cryptography, especially lattice-based cryptography, I was just wondering if a functional equivalent to an RSA UFO exists in the realm of lattice-based cryptography.


texts: How secure is a hash based signature scheme after signing assuming quantum computers?

texts:
Consider a hash based signature scheme that requires taking the $k$-bit hash of an arbitrary length message to be signed (e.g. Lamport one-time signature scheme). My understanding is, assuming that this step is the weakest point of the signature scheme and that the hash function used is collision resistant, this signature scheme offers $k$-bit security before signing and $k/2$-bit security after signing (since anyone trying to forge a signature will on average get half the bits for free when taking the hash of any message they are trying to sign).

My question, then, is what is the security of such a signature scheme if an adversary is trying to find a hash collision with a quantum computer using the best quantum algorithm currently known for finding hash collisions?

The answer to this question:

Hash-based signature scheme XMSS/LMS susceptible to preimage/second preimage attack?

provides helpful information and implies that this scheme would still offer $k/2$-bit security as

"Grover’s algorithm allows us to find preimages with a complexity of $Θ(2^{/2})$ in a quantum world, however the birthday paradox bounds the complexity of the collision-resistance in the classical world already. (And we don't know a better way to go around it in the quantum world..."

citing this paper:

[1] https://cr.yp.to/hash/collisioncost-20090517.pdf

which appears to debunk the claims of this paper:

[2] http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.55.5265&rep=rep1&type=pdf

that presents a quantum algorithm to find collisions more efficiently.

The argument presented by [1] seems to make sense (i.e. that the work presented in [2] makes the unrealistic assumption that communication is essentially free), but I am not knowledgeable enough in this area to analyze it more thoroughly. To those who are: is this argument valid? What is the general consensus of quantum cryptography researchers?

Finally, the author in [1] also states the following:

"In fact, time $2b/3$ had already been achieved by non-quantum machines of size just $2b/6$, and smaller time $2b/4$ had already been achieved by non-quantum machines of size $2b/4$. Anyone afraid of quantum hash-collision algorithms already has much more to fear from non-quantum hash-collision algorithms."

What algorithms is the author referring to here? Does this mean that the post-sigining security of signature schemes using a k-bit hash function is already less than $k/2$ bits even without quantum computers?


texts:
I was reading a paper, Practical and Provably-Secure Commitment Schemes from Collision-Free Hashing where there was a reference to message digests being 'regular'

Here, MD is a message digest. I've not been able to find anything online about the regular property of message digests/hash functions. Does anyone here know about it?


texts:
Can anyone explain to me what a trapdoor one-way permutation is?  Is RSA a trapdoor one-way permutation?

Context: I was reading about ring signatures.  On page 560, it describes steps to implementing a ring signature. I am confused by step 3, where $g()$ is a trap-door permutation.  The paper briefly says that $g()$ is an RSA trap-door permutation. I thought that RSA was a public-key encryption protocol.  Is RSA a trapdoor permutation?


texts: How simple can the PRP used in the Even-Mansour scheme be?

texts:
For example, in the question “Is there any reason not to use Single-Key EM with AES and a constant key?” it is proposed to use AES with a fixed key as the permutation in a xor-permute-xor construction. In the paper linked in the answer – “Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations” (PDF) – there is a proposal for a cipher that uses the full AES cipher with a fixed key(s).

Why is the full round AES required? How would the situation change if AES with only half the number of rounds was used? What about AES with only two rounds? If I recall correctly, two rounds of AES is the minimum required for complete diffusion of the input, so I wonder why 2 rounds wouldn't work just as well.

Why would one use an iterated construction, if the XOR-permute-XOR construction is providing all the security?

What requirements does the permutation need to fulfill, specifically? In the paper “Minimalism in Cryptography: The Even-Mansour Scheme Revisited” (PDF) they appear to just use the term "fixed random permutation" or "publicly known permutation".


texts: In a safe finite field elliptic curve, why is p not n?

texts:
From what I understand, in order for a curve to be safe, it would appear that $n$ being the order of the cyclic subgroup of the curve, is a prime. Also, it is the theoretical upper-bound on the number of private keys the curve can issue, thus it should be a good candidate for being the limit on the size of the field.

However in practice, it looks like we always choose a different $p$ than $n$. Why do we do this? Also, I'd understand that if $p$ is smaller than $n$, but why do we sometimes have a larger $p$ than $n$? It won't be possible to have up to $p$ private keys when the subgroup has order $n$ right? Lastly, I see some tutorials referring to $p$ as the characteristic of the curve, what does that mean?

I'd love to understand the above a bit further, and I guess in general my question is, given $n$, how would I choose $p$ for a safe curve?


texts: If multiple hashing algorithms are chained together, is the compound hash function more collision resistant?

texts:
The DASH cryptocurrency uses X11, which is a Proof of Work hashing algorithm composed of 11 separate hash functions which are run as a sequence.

Example: $Digest = H_{11}...(H_3(H_2(H_1(Input))))$

Questions:

1) Is this algorithm's collision resistance that of the weakest function in the sequence?

2) Can this algorithm tolerate a hashing collision found in one of the constituent parts and still produce output that is considered safe?


texts: Managing data access through asymmetric cryptography

texts:
I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography.

I'm concerned about how it is possible to share access of encrypted data with N entities, be able to revoke any of them at anytime, and do this securely.

I've thought about a cryptography function that I'm asking here some help to build.

Let's imagine I have a public data base encrypted with my public key.

I want:

to share some data from my encrypted DB (my email address for example) to 3 different entities (applications)
these 3 applications and only these to be able to read the data
to be able as a user to revoke their access to this data at any time.

I have a private/public key and these applications' owners too have a private/public key on the network.

I use a function to encrypt my email with my public key as:

Encrypt(Email, MyPublicKey)

At this point, only I with my private Key can read the data.

If I give access to a 3rd-party application to it, then I would re-encrypt my email with a new function, using my public key and the application's, so both my private key and the application private key are solution and can decrypt the data:

Encrypt(Email, (MyPublicKey, AppPublicKey))

So, now, only me and the application could read the data with our private key because each  of our private keys would be a solution of this encryption algorithm.

If I add a 2nd application access to this data, I would then re-encrypt the data through a new function:

Encrypt(Email, (MyPublicKey, AppPublicKey, 2ndAppPublicKey))

Now the 2nd application has the same access as me and the first application to this data.

Then if I want to revoke the 1st application's access, I would re-encrypt the data excluding the 1st application private key as solution of the function as:

Encrypt(Email, (MyPublicKey, 2ndAppPublicKey))

So, the 1st application cannot access to the data anymore as its private Key is not solution anymore of the encryption function.

Is it a known cryptographic scheme (like custom shared secret)? Does such mathematical function exist? What it would look like? Maybe there is a simpler solution I didn't see...


texts: What is the shortest ciphertext size output by FHE?

texts:
Assume we use batching and modulus switching techniques to reduce the size of ciphertext in fully homomorphic encryption (FHE).

Question: What is the shortest ciphertext bit-size output by the most efficient fully homomorphic encryption?

Remark: I'm aware that there're different FHE schemes. I'd like to see what is the shortest ciphertext we can get (even using the above techniques) from an efficient FHE that outputs the shortest ciphertext.


texts: Prepending random data to encrypted file

texts:
If random data is prepended to a file encrypted with GNUPG's symmetric encryption, how may an attacker find out if the input file is deliberately corrupted or the passphrase is wrong?

If it is not easily ascertainable from which offset the actual encrypted data starts, is there any added security in always prepending a few  kilobytes to an encrypted file in order to slow down an attacker?

In order to brute force the file, the attacker must start at offset 0 and  continue incrementally with all likely passphrases until he gets a match.

Here I am assuming perhaps incorrectly that there is no magic number easily identifying the file as encrypted with GNUPG or there is no validation of the contents without trying the passphrase.

But if this assumption does not hold for GNUPG, what about Truecrypt's file based containers?

So far I know Truecrypt file based containers are indistinguishable from random noise, but the size gives away that the file may be a Truecrypt container.

If my TC container's actual size is 5 GB, and I prepend it with 5 GB random data, will brute forcing by an attacker who doesn't know the real offset be too costly?

Is there any design reason why crypto software do not let the user select the start offset for decryption in addition to the passphrase?


texts: Is it safe to distribute different portions of the same data encrypted with different AES keys?

texts:
Assume I have a block of data consisting of three segments A, B and C. With "segments" I mean a particular section of a bit stream, so if the whole binary data was simply 00 01 02 ... FF, A might be 00 ... 5C, B could be 5D ... 72 and C would then be 73 ... FF.

K1 and K2 are 128 bit AES keys that were securely exchanged such that Alice has K1 and Bob has K2.

Alice gets data segments ABC encrypted with K1.
Bob gets only data segment B encrypted with K2.

My question is: if Bob got to know Alice's full cipher text for ABC (that was encrypted with K1), what could he deduce from the information he already has? Are there any circumstances under which Bob could decrypt segments A and/or C as well?

This is question is very similar to Vulnerabilities if encrypting the same data with 2 different keys, but not quite; I'm not asking about what Eve can deduce, but Bob.

I'm fairly new to encryption, and it was my understanding that AES is mostly XOR operations. For strict XOR operations, I think if you know any two a, b or c where a ^ b = c, you can calculate the third variable using XOR on the other two, as I think this was how parity bits for RAID systems work.

I keep finding hints as to AES is not just XOR, like How is XOR used for encryption? which in turn links to Why do block ciphers need a non-linear component (like an S-box)?. But I'm not sure I'm understanding the implications of the answers given there.

I think what the answers to those questions say is that for AES, K1 and K2 are just used to continuously generate a pseudo random bit stream, and only that is then XOR'ed with the data. So all Bob could deduce was the pseudo random bit stream section that has been used for Alice's B, but the generator function is such that this doesn't give Bob a clue about K1 or the bits generated earlier for A or later for C.

Is this universally true? Or, as I have seen often mentioned, are there limitations as to how many bits B may have to keep a 128 bit K1, A and C reasonably secret from Bob?


texts: Is there an existing authorative definition of the cryptographic term 'pepper'

texts:
I can attempt to define the term 'pepper' as:

  In cryptography, a pepper is a something that is added to another
  value (for example a password) prior to a the value being hashed using
  a cryptographic hash function. A pepper can be added to a password in
  addition to a salt value. A pepper performs a similar role to a salt,
  however whereas a salt is commonly stored alongside the value being
  hashed, for something to be defined as a pepper, it should meet one of
  the following criteria that define it a more carefully hidden 'secret'
  than the salt value:

  The pepper is held separately from the value to be hashed
  The pepper is randomly generated for each value to be hashed (within a limited
  set of values), and is never stored. When data is tested against a
  hashed value for a match, this is done by iterating through the set of
  values valid for the pepper, and each one in turn is added to the data
  to be tested (usually by suffixing it to the data), before the
  cryptographic hash function is run on the combined value.

Is there a resource that can verify this as an authorative meaning of the term or otherwise? The articles I'm seeing on Goole aren't very authorative on the meaning of the term and are mutually contradictory in cases, so I'm deriving the definition above based on what's seemingly common in the software development community's understanding of the term 'pepper'.


texts: Pollard's Rho - Constructing the Random Function

texts:
Suppose we are aiming to solve the discrete logarithm problem $\alpha^x=\beta$ in some cyclic group $G=<\alpha>$. Then we are looking for a (uniformly) random sequence of elements of the form $\alpha^{a_{i}}\beta^{b_{i}}$, $i=0,1,2,...$ so that we can invoke the 'Birthday Paradox'. Pollard suggested a function which apparently works fairly well but can be improved on.
My question concerns the concrete implementation of Pollard's Rho: if we generated sequences of integers $\{a_{i}\}$, $\{b_{i}\}$ with a random number generator (from any given programming language), would this yield an acceptable 'level of randomness'?
The reason I am asking this is because I stumbled upon articles on 'random walks' for Pollard's Rho, which all seemed rather extensive; this led me to believe that achieving an desired level of randomness is quite tricky, and that there is a flaw in my idea of generating random integers. However, I can't seem to find it.


texts: When is a cryptosystem or its algorithm (like RSA) considered efficient?

texts: When is a cryptosystem (like RSA) or its algorithm for keygeneration, encryption and decryption of messages considered efficient? Is there some bound in complexity which splits both efficient and not efficient cryptosystems or algorithms of cryptosystems?


texts: Can Shannon's proof be applied to all ciphers

texts: I have been studying Shannon's proof of Vernams (1917) unbreakable cipher. Can His proof be applied to positional ciphers?


texts: Proving the existence of a pseudorandom function

texts:
I've been reading the Introduction to Modern Cryptography book by Katz and Lindell as part of my own learning and have come across this exercise which I am not sure how to approach. The exercise is: (exercise 3.8)

Prove unconditionally the existence of an efficient pseudorandom function
$F:\{0,1\}^* \times \{0,1\}^* \mapsto \{0,1\}^*$ where the input-length is logarithmic
in the key-length (i.e., $F(k,x)$ is defined only when $|x| = log |k|$, in which
case $|F(k,x)| = |k|$).

There is also a hint which states that you should use the fact that any random function is also pseudorandom.

This is my initial train of thought:

We require the pseudorandom function to be indistinguishable from a function chosen uniformly at random from the set of functions that map $log|k|$ bit strings to $|k|$ bit strings (let's say this set is called $Func_{log\,|k|\, \mapsto |k|}$). I'm guessing that we need to work how many functions in this set in order to work out the probability of picking a random function, $f$, from this set.

I know that the set of functions $Func_{n \mapsto n}$ mapping $n$ bit strings to $n$ bit strings contains $2^{n*2^n}$ functions. However my first obstacle is calculating how many functions are in $Func_{log\,|k|\, \mapsto |k|}$ since the functions in this set are not bijective as they are in $Func_{n \mapsto n}$.

If I could calculate this value then I would approach the rest of the problem by calculating the amount of possible pseudorandom functions (clearly given by $|k|$ since $k$ is chosen uniformly at random). I was then hoping, if there was a similar number of functions in $Func_{log\,|k|\, \mapsto |k|}$ (although I speculate there is way more than $|k|$ functions in this set), then eventually try to show that it would be hard for any ppt distinguisher to tell between the pseudorandom function and the randomly chosen one.

I have no idea if this is along the right line and I also don't really know how to bring the hint in to play. All I can think is that it may turn out to be easier to prove that $F$ is indistinguishable from another pseudorandom function which also happens to have been chosen at random.

If anyone could provide a hint as to how to calculate the amount of functions in $Func_{log\,|k|\, \mapsto |k|}$ or pointers for how to approach this then that would be great. As I said, I am doing the exercises for my own good so I'm not massively keen on being given a full solution straight away.


texts: Alternative for RFC 6238/4226 - one time password via SMS (single-factor authentication)

texts:
Currently we have implemented One Time Passwords (OTP) as second  authentication which works well. We use TOTP - RFC 6238

Some clients would like to have a "sms only" login, so it's single factor authentication. In the some cases (dependent of the data) that is fine. We will send the token via SMS and it won't have to be OTP-app compatible (e.g. Google Authenticator)

To our opinion the RFC 6238 (TOTP) is too weak for single factor authentication as the time component gives issues:

If the password is 30 seconds long, two login attempts in the the 30 seconds period will give the same password
If we change the time to 1 sec, we have to check multiple "frames"
Also, alphanumeric characters in the password isn't compatible with the RFC?

We are also aware there is a counter based algorithm (HOTP - RFC 4226), but their could be security issues if we won't sync the counter correctly (between servers).

So we are looking for a RFC to generate one time passwords with the following requirements:

Generate passwords, time based, no counter
Generate passwords with alphanumeric and numeric characters

The flow will be:

Generate OTP
Store the password in (server-side) session (including expiration)
Check the token and clear the session.

We could use the following code to create a OTP

Generate random (secure) bytes
Convert to text

But that isn't compliant to a RFC, and RFC-compliance is preferred.

My questions:

Is there another RFC we could use that satisfies the requirements?
Are we RFC 6238 compliant if we: generate the TOTP with a short time (e.g. 1 sec), and store the result in session.