texts: Calculating Phi(M) and D for RSA decryption given p,q,e

texts: I've been given a message in 4 digit numbers but it doesn't seem to work when I use my calculated values for phi(m) and d. If I'm correct phi(m) = (p-1)(q-1) correct? And d is given by ed = 1mod(phi(m))? And from this, it can be calculated by the smallest number in which ed-1 can be divided by phi(m)?


texts:
Definition

${H_1}^{K_1}(X)$ means data  $X$ hashed by keyed hashing algorithm $H_1$ with key $K_1$.

Short question

Is $H_1^{K_1}(H_2^{K_2}(X))$ equal to $H_2^{K_2}(H_1^{K_1}(X))$?
Is $H_1^{K_1}(H_1^{K_2}(X))$ equal to $H_1^{K_2}(H_1^{K_1}(X))$?

Long question

My web application is storing a hashed password in a database. A web service requests for authentication that the user types a password, which is hashed with a random key and then sent to the server. The server thus only sees $H_1^{K_1}(X)$ where $X$ is the password, not the password itself.

I have to compare the client-side hash with the original password.
How can I do that?


texts: Is it possible to correct the exponent of an RSA public key if it has been altered?

texts: Is it possible to change the exponent of an RSA public key?


texts: How to XOR two hexa numbers by hand fast

texts: I have an upcoming exam where I can use a simple Calculator. On some sample questions they ask us to XOR two values (for AES round key) and I know how to write it out by hand but is there any other faster way as the exam is timed of course.


texts: Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if you can encrypt arbitrary plaintexts and look for matching blocks, but I'm not sure how this applies to CBC mode.


texts: Why are elliptic curves over a field of characteristic 2 or 3 insecure?

texts:
The following is a quotation from my cryptography course:

  Recent results on the discrete logarithm raise big concerns on the security of elliptic curves over a binary field.

What are these results? Also, is characteristic three safe?


texts: XORing with 1B in MixColumn transformations for AES encyption

texts:
In MixColumn transformations in AES encryption, do we have to Xor the shifted input with 1B only when the leftmost bit is high or is it like the number of times we shift it, and then when a one exceeds power 8 in polynomial form then we have to do it.
for eg. if i have to find the transformation 0B.45 i.e. (0000 1011).(0100 0101)
Although here the leftmost bit is not high but when i multiply it with 1011 then i have to shift 45 3 times which will make a high bit(here 2nd bit from the left) to exceed power 8. Do I have to XOR with 1B then also?


texts: Certificate Signature Algorithm differs from Signature Algorithm Negotiated for Connection

texts:
With the upcoming sunsetting of SHA-1 by browsers I was checking signature algorithms for sites I visit. I'm using Firefox 43.0.2 on Windows.

I noticed something interesting when I visited the site Origin Energy site: https://online.originenergy.com.au.

The site's (leaf) certificate uses the SHA-2/SHA-256 signature algorithm. See certificate details dialog screenshot.

Where as the connection cipher suite appears to use SHA-1. See page info dialog screenshot.

I have a few questions:

Q1. Are the Certificate Signature Algorithm and signature algorithm in the negotiated connection cipher suite used for different purposes?

If these signature algorithms are used for different purposes.

Q2. Does the upcoming sunset for SHA-1 relate to the Certificate Signature Algorithm and signature algorithm in the connection cipher suite?

and

Q3. The SSL Labs scan for the site shows the web service cipher suite lists supports SHA-2 and SHA-1 algorithms.

If I'm using the latest version of Firefox why does the server/client negotiation not use the preferred SHA-2 algorithm for the connection?


texts: Does changing the random number selected for each message increase security in Schnorr's scheme?

texts:
I was reading about Schnorr's scheme and in that for signing the signer generates a random

number and continues with his operation. I am trying to implement this in a scenario where

the signature length is small and the number of possible messages is also very small.

Is generating a random number and signing, for each message also a good option in this case?


texts: Possibility of Man-in-the-Middle on X3DH

texts: I'm reading about the security of the Signal protocol (used in WhatsApp) and in particular, the X3DH part used to establish authentication, all papers seem to gloss over Man in the Middle attacks.  Is it possible or not to MitM between users and the server?  Seems easy on the server.


texts: Creating your own encryption and decryption algorithm

texts:
I'm very uneducated when it comes to cryptography. I have tried to find an answer to my question, but what I've read doesn't quite cover what I'm asking.

I have thought up my own encryption algorithm (which I'm sure is nothing new) and I would like to know why this sort of algorithm is not used in terms of security, efficiency and any other reasons.

It stems from the Caesar Cipher. But, instead of shifting each letter by 13, you shift each character (using computer character values) by a certain value  each time.

So, let's say I had the sentence:

My dog's name is Rover.

And I have an array of numbers:

1, 4, 3, 2

I would shift M up by 1 character, y by 4, [space] by 3, d by 2 and then continue with the rest of the sentence, looping through the number array.
So, the sentence would be converted into N}#fpk*u!rdof$lu!Vrxfv1.

Let's call the array your "key". Only someone with the key could decipher the message, unless someone figures it out. The more items in your array (key), the safer you are from someone deciphering your message.

Apologies if my explanation is poor.
To summarize my question:

Why is this bad (or, not used)
Is it inefficient/insecure compared to other encryption methods
Is there anything else about this that should be considered

Thanks.


texts: Are there any public-key encryption schemes based on DLog?

texts:
There are public-key encryption schemes based on many different mathematical hardness assumptions, like the hardness of Decisional Diffie-Hellman problem, the hardness of the Factoring problem, the hardness of the RSA problem, etc.
But my question is, are there any public-key encryption schemes based on the hardness of the Discrete Log problem?  Does the hardness of the Discrete Log problem even imply the existence of secure public-key encryption?


texts: How HOTP values are validated according to RFC 4226

texts:
In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part,

  The HOTP client (hardware or software token) increments its counter
  and then calculates the next HOTP value HOTP client.  If the value
  received by the authentication server matches the value calculated by
  the client, then the HOTP value is validated.

I don't understand this. Doesn't the client send the value it calculated to the authentication server? Thus, wouldn't "the value received by the authentication server matches the value calculated by the client" always be true?

What I am misunderstanding here?


texts: Sharing secret content with multiple recipients

texts:
I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email.

I am no expert in crypto and need validation of this model. I intend to use crypto libraries and not cook anything myself, but there is enough leeway even when using libraries to shoot yourself in the foot, hence my question.

Here goes:

Each person will have an ECDSA key pair and an ECDH key pair generated at "account creation". The public keys are made available to the everyone by a trusted entity.

When the sender wants to publish secret content (plaintext) to the N receivers, the following will happen:

On the sending side:

The ECDSA private key is used to sign SHA256(plaintext), yielding a signature.
A random AES key K and IV are generated for that content.
The plaintext is encrypted with K+IV (AES-CTR-256) yielding the ciphertext.
For each recipient i<=N, the shared secret between the sender and the recipient is computed from the sender's ECDH private component and the recipient's ECDH public component. This shared secret is used as a key to encrypt K using a random iv IVi, yielding a "wrapped key" Ki

This process yields a "cryptobundle" set of { Ki, IVi} corresponding to recipient i.

Then the {ciphertext, IV, cryptobundle, signature} is sent through an unsecure channel to all N recipients.

This is what each recipient does:

Compute the shared secret from their own ECDH private component and the sender's ECDH public component.
Find their { Ki, IVi } pair in the crypto bundle (it will be keyed by their user id so they can easily find it)
Run AES-CTR-256 to derive K from { Ki, IVi } + the shared secret (which is used as key)
Use K + IV to AES-CTR-256 decrypt the cipher text back to plain text.
verify SHA256(plaintext) with ECDSA public component of the sender.

Directed questions:

Does this seem like a reasonable approach?
Should the shared secret computed from the ECDH keys be used "as is" as a wrapping key, or should it be fed to a key derivation function to yield the key that will be used to wrap the content key K?


texts: Which are the most Promising Post-quantum Public Crypto Primitives in the Face of a Quantum Apocalypse?

texts:
I'm fairly new to the fundamentals of post-quantum cryptography.  So, please forgive me for such a direct question.  Searching Google opened up a whole lot of amazing ideas that are thought to be quantum-safe, and there were many confident submissions made to NIST.  I've heard of SIDH, lattice-based cryptography, etc.
But all of these seem overwhelming and exciting for a beginner.
Can anyone please suggest to me some resources that start from scratch for learning about the underlying fundamentals of these primitives?
For me, our present-day crypto primitives like RSA, ECC, etc., were very easy to learn and are very intuitive because of a whole plethora of information available on the Internet.
Before we ever thought of the disastrous effect of quantum computers on our present-day public-key cryptosystems, we had a lot of confidence in our public key algorithms (I'm not referring to implementations). Even now (at the time of writing this) we are thought to be safe from quantum attacks. But considering the amount of investment and resources on quantum computing, I feel that these algorithms should be kept ready, in software, so that we are well-prepared for a "Quantum Apocalypse".  As far as symmetric ciphers are concerned, we will have to just increase the key size. The only known attack is Grover's search algorithm, which accelerates the brute force search of an encryption key. But the countermeasure to increase the key size from 128 bits to 256 bits is sufficient. But we are unable to find such an easy one for our present public-key crypto primitives.
So, again, which are the most promising post-quantum public crypto primitives that can be used with confidence in the face of a "Quantum Apocalypse"?


texts:
I have seen in the PKCS#11 spec that "parallel sessions" are not supported

"in Cryptoki Version 2.01 and up, no token supports parallel sessions"

but I can also see that a token may have multiple sessions open with the same token because ulMaxSessionCount is defined as (the)

"maximum number of sessions that can be opened with the token at one time by a single application"

What is meant by "parallel session" if not multiple sessions on the same token?


texts: Using same key and nonce for different field of the same document

texts:
I have some fields, similar to NAME, SURNAME, EMAIL, ADDRESS...
I'm using NaCl for symmetric encryption.
Is bad If I Encrypt every field with the same key and nonce?
They are encrypted and stored separately.
Thanks for help


texts:
Quoting from the Million Dollar Curve website:

By using publicly verifiable randomness produced in February 2016 by many national lotteries from all around the world, we propose to generate a cryptographically secure elliptic curve for the ECDH cryptosystem as an alternative to the NIST P-256 and the Curve25519 curves.
[...]
Today most of elliptic-curve cryptography relies on the same set of curves: ANSSI FRP256v1, NIST P-256, NIST P-384, Curve25519, secp256k1, brainpoolP256t1, Curve1174 and a few others.
However, most of these curves parameters generation processes contain unjustified choices, specific constants or specific hash algorithms. [...]

I understand the concerns over how NIST generated their curve parameters, and this does seem like a better approach.  However, I didn't think Curve25519 had any suspicious constants or design decisions.  What exactly is the benefit of using the "Million Dollar Curve" over Curve25519 (if there is a benefit)?


texts:
I am wondering if other ciphers like Serpent or Twofish or even Threefish have really an use in real life, because AES seems to be very efficient in most situations.

But for example TrueCrypt or VeraCrypt offer Serpent and Twofish to be the algorithm to encrypt your drive, so why would anyone choose those ciphers and not AES? (I know that Threefish is tweakable, therefore efficient in encrypting disks).

So to clarify my question:
Is there a real purpose to use Twofish, Serpent or Threefish instead of AES?


texts:
In Practical Threshold Signature it says that there is a requirement in which the RSA public exponent $e$ must be more than $l$. $l$ in this case is the number of players in the threshold group.
My question is: Why is there a constraint that the public exponent must be larger  than the number of players?
In my case, my public exponent must be 3 (due to limitation on another component), hence the number of player can only be 2.
Thanks.


texts: repeated use of HKDF-extract on the same PRK

texts:
Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand.

Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple invocations of HKDF-expand (with different info strings).

Other answers say this is not how HKDF should be used, and possibly not safe. However, using HKDF-expand to generate a longer key (say, 256 bits) and then splitting it would be ok. (See D.W.'s answer in Which risks are associated with deriving multiple keys from the same DH secret Z? for example).

When I originally read the RFC I got the impression that it is fine to generate multiple keys from the same PRK using different info strings, but re-reading it, I can't see this being substantiated anywhere, i.e., the RFC does not explicitly allow multiple HKDF-expands on the same PRK (and implicitly seems to not support it).

So:

can HKDF-expand be used multiple times on the same PRK/HKDF-extract result?
if not, is it safe to generate a longer key using expand and split it?


texts: How to supply the GCM authentication tag to the OpenSSL command line tools?

texts:
I'm using AES-256-GCM for authenticated encryption. In order to decrypt, the ruby OpenSSL library requires an auth_tag parameter (in addition to the key and iv). This, according to the ruby docs, is because authenticated encryption is only supported with associated data (AEAD).

How can I use this auth_tag to decrypt? The node.js crypto library doesn't have an option for it, so I'm trying to use the openssl command line tool. However, looking at the docs, even that doesn't have an option for supplying the authetication tag.


texts: Can someone give me an example of a Merkle–Damgård transformation?

texts:
I started reading "Bitcoin and Cryptocurrency Technologies - Princeton University" (coursera) and in the first chapter it talks about Merkle–Damgård transformations for SHA-256. I was trying to understand it by working out an example, but I keep getting problems.

Here is my work:

Take a compression function that takes inputs of 4-bits and outputs 2-bits
For our hash function we create an arbitrary input of 6-bits
Since input-output = # of blocks, the 6-bit input should be divided into two blocks, each with the 3-bits
Now from my understanding the initialization vector should be 1-bit because 3-bits+1-bit = 4-bits which is the input the compression function takes
Now the output of the first pass is 2-bits, which is a problem because if I add on the other 3-bits, the total is 5 and the compression function only takes in 4-bits. What am I doing wrong?

If someone can help explain where I am messing up or explain the idea in a different way, with an example, I will greatly appreciate it.


texts: Encode ASN.1 PKCS#8 Private Key with Public Key and attributes

texts:
I'm trying to encode an Ed25519 private key as a PEM file based on this document https://tools.ietf.org/html/rfc8410#page-7 .
I'm using an ASN.1 encoder written in Dart, and I can encode the private key without its public key and attributes as in this example:
-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
-----END PRIVATE KEY-----

But I can't make sense of the specification on how to encode the public key and attributes like this one:
-----BEGIN PRIVATE KEY-----
MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
Z9w7lshQhqowtrbLDFw4rXAxZuE=
-----END PRIVATE KEY------

Using the lapo.it ASN.1 decoder you can see the optional fields, but I can't recreate it. What does the 0 and 1 mean? And why it doesn't have the annotated type?


texts: SHA-1 – Why are text containers used for certificates?

texts:
Why are researchers using text files to prove the successful collisions?

In the case of the first MD5 collisions I believe it was PostScript-files. In the case of the recent SHA-1 collision it’s PDF files.  A PDF file is basically a container file that comprehends a lot of meta-data attached to the actual viewable data. I presume this complicated the things, not the user readable data itself (the “content” of the PDF the viewer cares about). PostScript sometimes is called the predecessor of PDF and is somewhat comparable.

Why are these kind of “containers” used?

Assumption: apparently there’s enough data next to the actual data we want to change, to do some bit flipping / tricks to generate a collision.

Is this true?


texts: Generalized Benaloh cryptosystem with $r=2$

texts:
Benaloh cryptosystem requires $\gcd(r, (q-1))=1$ which is impossible if $q>2$ (since it needs to be a large prime) and $r=2$. This confuses me, since Benaloh is referred to as an "extension" or "generalization" of Goldwasser-Micali cryptosystem, but even though they're extremely close, Benaloh doesn't seem to work at $r=2$ when Goldwasser-Micali specifically works at $r=2$. Is there a way to make changes to these cryptosystems so that we can "generalize" Goldwasser-Micali in a way it also works for $r=2$ (i.e. works for all prime numbers* $r$)?

[*] I said prime since Benaloh's original cryptosystem doesn't work for composite $r$s, as pointed out and fixed by Fousse et al. Prime $r$ is sufficient for my uses, but I'd like to generalize for all primes including $2$.


texts: Nth term for Linear Congruence Generators

texts:
We can get the N+1th term for a Linear Congruence Generator like this:
x[n+1] = A * x[n] (mod m)

by raising the A to the exponent of n like this:
x[n+1] = A**n * x[0] (mod m)

Assume A=48271 and m=2**31 - 1
Suppose the generator changes to this:
x[n+1] = x[0] XOR (A * x[n] (mod m))

If the generator changes to XOR the result at each step with the x[0] value, are there any tricks to get the N+1th term using only x[0] and not calculating x[1] through x[n]?
Update:
Thank you kelalaka for suggesting an answer, but that solution has a dependency on x[n] for calculating x[n+1]. The goal is to get to x[n+1] only using x[0] without needing to calculate x[1], x[2], ... x[n].
The n+1 value will be known ahead of time, so it is acceptable to require precomputed values such as A**n. The big idea being a fast way to get to very large n value x[n+1] without calculating intermediate x[n] values.


texts: More general - what is the hard problem of recovering r from r*p mod q?

texts:
I would like to know the cryptographic hard problem that is most closely tied to recovering integer $r$ from the modular product $r\times p\mod q$.  (This is a simplification of an earlier post that had some errors).  It really looks like integer factorization to me; if not, what else would it be?

More specifically, select two prime numbers $p$ and $q$, $q>p$, and a random positive integer $r$, large enough such that $q/p<r<q$.  Publish $q$, but keep $p$ and $r$ private.  Further, assume there are several instances of $r$ for a given pair of $\langle p, q\rangle$ to work with.  Assuming existence of a hardness problem X, such that a polynomial-time solution of X could be reduced to finding either $r$ or $p$ from the integer $$r\times p\mod q$$in polynomial time, what is this problem X?

I am relatively new to this.  I looked at a few hard problems; none of the residuosity or discrete logarithmic problems seem to apply, but I'm hesitant to say that it's integer factorization or RSA in case there is some problem with a stronger assumption that fits.  I want to get a good characterization of the construct so that I may describe it accurately.

Thanks for your help and patience!


texts: Does a different exponent and base but same key help to resolve discrete logarithm?

texts:
E.g.:

$k = N^a \mod P$

The attacker knows the prime $P$ and $N$, which is also a prime and

(1.) prime root of $P$ or
(2.) has a cycle size of $s$, so $1 = N^s \mod P$, (and for $\forall s'<s$, $1 < N^{s'} \mod P$

The attacker want to resolve variable $a$ with some discrete log. algorithm for a certain $k$.

About the $k$ he knows:

$k = M^b \mod P$

With $M \neq N$ but $M$ has same properties as case (1.) or case (2.) (same cycle size as $N$). For this equation he knows all variables $k,b,M,P$. Does the attacker help this knowledge about $k$ (in case (1.) or (2.)?

(3.) Somehow the attacker got knowledge of all variables ($a,b,N,M,P$) for one $k$. Does it help him to resolve $a'$ for other $k'$ (with same $N,M,P$), in case (1.)/(2.)?

.

side node:

The sets of generated $k$ values are equal for $N$,$M$ in case (2.):

$\{N^c, \forall c \in \mathbb{N}\}=\{M^d, \forall d \in \mathbb{N}\}=S$

with $|S|=s$. The numbers in it have just a different order. (In case (1.) $s=P-1$)

(4.)side question:

bottleneck of this would be the size of $s$, right? No matter how big $P$ is, it would not help security with same $s$.


texts: How to prove possession of a CL signature in zero-knowledge?

texts:
Assume that we have the following signature scheme CL Signature:

Choose two cyclic groups $G = \langle g \rangle$ and $G_T = \langle g_T \rangle$ of order $q$, that have a pairing $e$.
Uniformly and randomly choose two elements $x,y \in \mathbb{Z}_q$, and compute $X = g^x$ and $Y = g^y$.
The secret key is $sk = (x,y)$, while the public key is $pk = (q, G, G_T, g, g_T, e, X, Y)$.
On input a message $m \in \mathbb{Z}_q$, secret key $sk$ and public key $pk$, choose a random $a \in G$ and output the signature: $$\sigma = (a, a^y, a^{x + xym}) = (a,b,c).$$
To verify a signature $\sigma = (a, a^y, a^{x + xym}) = (a,b,c)$, check that $$e(a, Y) = e(g, b) \quad e(X, a) \cdot e(X,b)^m = e(g, c).$$

Now, say that I want to prove that I know a signature $\sigma$ on a message $m$ without revealing any the signature $\sigma$ or the message $m$.
The paper explains that the first step to perform such a proof is to "blind" the signature to form $\tilde{\sigma} = (a^{r'}, b^{r'}, c^{r'r}) = (\tilde{a}, \tilde{b}, \tilde{c}^r) = (\tilde{a}, \tilde{b}, \hat{c})$ and send this blinded signature to the verifier. This clearly satisfies that $$e(\tilde{a}, Y) = e(g, \tilde{b})$$ and it also satisfies the second verification equation with $\tilde{c}$, but not with the actual one $\hat{c}$.
My question is, which is the objective of sending $\hat{c}$ and not $\tilde{c}$ directly?


texts: Cryptographic hash function for 32-bit length input keys

texts:
Since I'm unfamiliar with cryptography area I haven't been able to find cryptographic hash functions for 32 bit integer keys. It seems all such functions (as I saw here) are designed to digest a stream having hundreds of bytes. What I need is a cryptographic hash function that receives a 32-bit length key, and – preferably with basic math operations (addition, shifting, negating, multiplication) – delivers a preferably 32-bit length hash of the key. Later on I will crop 1, 3, 7, 15, or 31 least-significant bits of the output and use it in my application. Can someone please introduce a suitable algorithm for this purpose?

One more thing to ask: can I rely on simple hash functions on integers introduced here for this purpose? Can I expect them to have quite same characteristics as cryptographic hash functions, such as avalanche effect, for 32 bit integers?

Edit:
The function I'm trying to find or come up with receives an input 32-bit integer number (I referred to it as key in the question description), and delivers a 32-bit length hashed output. What I'm looking for in the output is that by changing even a single bit of the input integer, output varies (preferably drastically in Least Significant Bits). There can be hundreds of millions of keys, so it's better that its output range has a good distribution. Low computation complexity with simple math operations is preferred.
The variation of LSBs in output is much preferred since I'm going to crop LSBs as I described in the question. For example, if I'm going to crop 1 LSB bit, a parity bit would suffice. Or if I want to crop 3 LSB bits, 3 LSB bits of checksum is enough. But if I'm going to crop 7, 15, or 31 LSB bits, checksum would waste 2, 10, and 26 bits respectively.


texts:
I ran and timed an implementation of the Weil pairing on three set of parameters. One with an order of 512 bits, one with 256 bits and the last with 161 bits.

I took the Miller's algorithm to compute the Weil pairing. The algorithm that I used for the multiplication of 2 points is the double-and-add. Both algorithms have a time complexity of $O(log (n))$ if I understood correctly.

The time I got was 10 seconds for 512 bits, 2,5 seconds for 256 bits and 1,1 seconds for 161 bits. When I see the time I got it seems more like a complexity of $O(n^2)$ or $O(n \cdot log (n))$.

Can someone tell me what the time complexity is based on my results?


texts: Does an encrypted random sequence conserve its "randomness"?

texts:
If you have a random uniform sequence of bits $A$ generated by a TRNG with good performance of randomness tests (eg Dieharder, NIST, Kolmogorov complexity, chi-square, etc) and perform an encryption (eg AES) with a known deterministic key $B$ so that it results in a new encrypted sequence $C$.

Is the encrypted sequence $C$ generated by a TRNG? Should it have the same good performance in the randomness tests as the unencrypted sequence $A$?


texts: How is the strength of password evaluated?

texts:
Recently I came across howsecureismypassword.net. The site evaluates how many year a computer would take to crack the given password  but they don't provide the criteria on which they evaluate no. of years

So the questions arises:

Is there any standard algorithm for such?
Ain't the number of depends on computing power available at hand?
Or is there any lower limit which is same for any computation power ?


texts: OpenPGP Public-Key Encrypted Session Key Packet Key ID generation

texts:
Im probably just not reading something again, but:

RFC 4880 says that a OpenPGP Public-Key Encrypted Session Key Packet (tag 1) is made up of

- A one-octet number giving the version number of the packet type.
The currently defined value for packet version is 3.
- An eight-octet number that gives the Key ID of the public key to
which the session key is encrypted. If the session key is
encrypted to a subkey, then the Key ID of this subkey is used
here instead of the Key ID of the primary key.
- A one-octet number giving the public-key algorithm used.
- A string of octets that is the encrypted session key. This
string takes up the remainder of the packet, and its contents are
dependent on the public-key algorithm used.

i encrypted (using a working pgp program) a string of 0123456789abcdef using a key whose KeyID is 30522545CF77DD86, but the pgp message packet that resulted had a KeyID of F940C4301A67779D in its tag 1 data. it is certainly not the KeyID from the public key i used.

what do i need to do to get that keyid? what am i not seeing?

key used to encrypt data:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: BCPG v1.39

mQGiBE5B0h8RBAD533Z5bK1IpBx02QyQL0QoJE4uFRIMGDiwXuwmZzVl+R7Vlurd
GRLsCCbE6vOOh7XQVZGzLEBy9WNzZ9m+EbCfSVAYkjS6FhLws6hG6irrnS+b3JBf
gFJ8vNGF9Z7bhx+7y7NBk0IMyWkGnUkcnav73t5FQUI2faEBN4c/yAGJZwCgjcB7
3akWk9XVWvTCsiMXxpyvkukEALXsvB6cOoFEtQq9cQHjP63fBlvD94dhhMiM0cH6
hW9JotxdK+cxFGG9ZIWgoN2PWbMJka/H4W5EL6tS+YiNAR7I1Ozkt6X16GjnQUzZ
MlSpleK+KiKVN2anRaPEoOIinHrE3ZXd6QlJ/4+OJn4IVWmSEaJpFf4QNgvEu4rh
xinyBAD2RNzREOA+wpnFZ4lDt9NZXmXdxQME/l0J9XcvWhpGsxA/MATQKImy7N49
7GT/M38F+TrpBobag1O3buE99fOLyws4Tbc+sZMdHxoiGZDAIRNQS2rv475E6ktj
7vd5CYvOkA6+8sX1+hPcNlkHtHB1OFkJRsYp6k0zkyC9adjBM7QTYWJjIDxtYWtj
bUBhYWEuY29tPohGBBMRAgAGBQJOQdIfAAoJEDBSJUXPd92GRSQAoItbtbToOg7a
/hcg2sA/aBEQNwuxAKCGR69vmSoCWoBP5waPk0UsjM3BSbjMBE5B0h8QAgCUlP7A
lfO4XuKGVCs4NvyBpd0KA0m0wjndOHRNSIz44x24vLfTO0GrueWjPMqRRLHO8zLJ
S/BXO/BHo6ypjN87Af0VPV1hcq20MEW2iujh3hBwthNwBWhtKdPXOndJGZaB7lsh
LJuWv9z6WyDNXj/SBEiV1gnPm0ELeg8Syhy5pCjMAf9QHehP2eCFqfEwTAnaOlA6
CU+rYHKPZaI9NUwCA7qD2d93/l08/+ZtFvejZW1RWrJ8qfLDRtlPgRzigoF/CXbR
iEYEGBECAAYFAk5B0h8ACgkQMFIlRc933YZRrACfUnWTjHHN+QsEEoJrwRvFmvzj
bR4An24pTpeeN+I6R59O/sdmYsAhjULX
=sStS
-----END PGP PUBLIC KEY BLOCK-----

encrypted data: 0123456789abdef

-----BEGIN PGP MESSAGE-----
Version: BCPG v1.39

hI4D+UDEMBpnd50QAf9bWG97E9FfnSKB/WpVcBtLJqk5f/Ih9YZTUDULDZpSE0TP
ObJnCs91okOv6/BtDRDZ84ChF5pOZezb5+aL3TW5AfwK3gJ7nPTlmZOm5Kf7qOfB
n307xpn0qRw395y1mfOm10TsMpaCkbSvwjhqPi8hRMM17y29OsqGLstZdeAaNTGt
0mwB7EiZti4jOUF3/SCNnn2vA9hVc6o6c0l0h5vQOF0L+eL1Pmhg8RcFT4kHRnI/
A+Ad4hsbOxD1vvzZHx2iETkt1JmNTHmOOY5Cw/n+sFlU9JzZpzAtqwUjjnyN8NjQ
6NbpwL6gebTJCVTNW2c=
=kI32
-----END PGP MESSAGE-----


texts: Quality test for an hardware source of randomness

texts:
Say that I developed an hardware source of randomness, which I would like to use to seed a cryptographically secure random number generator.

How would I go about testing it? Are there standardized tests that one can use to check wether or not his source of entropy is reliable enough to seed cryptographic random number generation?

For example, the guys at onerng.info claim to generate the entropy any user needs to protect his privacy and blablabla. How do they substantiate their claim? How can random number generators be verified?


texts: Can I generate OTP secrets by using a hash?

texts:
Since I learned about one time  pads in last security lecture, I'm quite fascinated how easy the concept is, but how it still is absolutely safe.

Learning from implementing a multi time pad  attack, an OTP is not safe if the key is reused. I understand why this is the case. Also encoding large messages requires a large secret, so I tried to think about, how to solve this.

This is what I came up with:

Consider we have a Hash Function $H:= A^k \rightarrow A^l$ were $A$ is an alphabet, and $k$ and $l$ are arbitrary lengths. For example  we can use md5 for my purpose.
Next we have an secret $s_0$ with a length that is not sufficient to encode our message $m$. What if when I run out of characters/bytes of my secret to encrypt my message, I'll take the next characters/bytes from $s_1 = H(s_0)$. I could then repeat that process until I have a sufficient length of the secret $s_0 + s_1 +  ...$.

Also a possible variant would be to generate $s_{i+1}$ by taking the concatenation of the hashed characters of $s_i$.

Example: $m = thistextistoolongforthesecret$ , $s_0=short$. I can encrypt t with s, h with h, and so on until I have no more characters left for the e. I would calculate $s_1=4f09daa9d95bcb166a302407a0e0babe$ (md5). Then I could use the 4 of $s1$ for encryption of the e.

What are the security implications of this? I have the feeling that this has some serious downside, that eventually will lead to a possible multi time pad attack, but I can't show any reason for that. My knowledge is only superficial, since I only heard about OTP 2 days ago.


texts: Key iteration count while using random keyfile larger than master key

texts:
If I were to have a 4096-bit file of random data (/dev/random) used as a keyfile for LUKS, would there be any benefit to having a key iteration count higher than 1?

My reasoning is that the attacker could choose to guess the contents of the 4096-bit file (very very hard), the 256-bit master key (still hard, but easier than the 4096-bit file), or the potentially key-stretched 256-bit key derived from the keyfile that would decrypt the master key (equivalent in difficulty to the master key).

Am I correct in believing that an iteration count of 1 is no less secure than a count of 100000 for the keyfile?


texts:
Suppose I want to use LTV scheme from this paper https://eprint.iacr.org/2013/094.pdf to compute homomorphically a function.
But the multiplication operation is more expensive than the additive one.
So, if multiplication is the counterpart of an AND gate and addition is the counterpart of an OR gate, why not implement an AND gate as a combination of OR and NOT gates and MAYBE the resulting operation will be faster. But how should I image a NOT gate for the LTV scheme ? Or maybe the problem I formulate is simpler : how to toggle a bit homomorphically for this scheme? How to toggle a bit homomorphically for othe schemes (like BGV) ?


texts: How is a Caesar (Shift) Cipher represented at Binary level?

texts: If I want to encrypt the letter H, represented by ASCII 01001000 in Binary, with a key of 1, represented by  00110001. We should get the letter I, represented by 01001001. (H+1 = I through a shift). What actually is the binary manipulation process to get I using the key of 1? How do we get to 01001001 using 00110001? Straight addition of the Binary values doesn't come to the answer.


texts: Given only RSA public key parameters, what security issues might I be able to detect?

texts:
I'm attempting to automate some checks against a large list of .NET assemblies, and want to include a test to see if the RSA parameters used to sign the assemblies are sensible. However, since I don't have access to their private keys, I'm wondering how far I can go.

At the moment I'm reporting if:

The modulus $n$ is smaller than 1024 bits (issue)
The exponent $e$ is not 65537 (informational)

The latter is reported due to it being unusual, rather than a flaw in the cryptography, as I've never come across a case where a signed .NET binary uses anything other than 65537.

Are there any other checks I can perform, given only this limited data?


texts: RSA modulus (N) from public key and calculating N from p, q not equal

texts:
I have a RSA public key in the form of public exponent and modulus as follows:

String exponent = "0000000000000003";
String modulus = "D8016FFDDFBA4B144B0AB13FF01968048B2FC9AA269311D11357DC8CEDCABA232BEC118D3B05AFA2406D27BFB6602B45B80E91D4F446E4A753C251EA6EB8AB8E3F304585DD202D8B04538EB4DD1F87D9A27E1E7B34A304396BBC38EE669E823BD03C1F43698B4B3128F3770C465CE415FD0F965F3170CED1470ED777751DE59D";

And also I have a private CRT key of the corresponding RSA key as follows:

String p = "F401F9E76A0E65D80AA8CF0D526D8D8747E53A3E1223B143AA73F675708ED966AB96965040907CCDF3D5C77904AA0906A6941E3A9C69AEC1F99E73E6EDB07191";
String q = "E29F25EC241F0FEDAD28B8DD1DCBABBD066F4F557467AE6A2CE4ED34F9D93257E2F8C8B6EE1F7A687E386BFEE9C20C3388385E82AFA498237FF801D283216D4D";
String dp = "A2ABFBEF9C09993AB1C5DF5E36F3B3AF85437C29616D20D7C6F7F9A3A05F3B99C7B9B98AD5B5A8894D392FA6031C06046F0D697C6846748151144D449E75A10B";
String dq = "9714C3F2C2BF5FF3C8C5D0936932727E044A34E3A2EFC99C1DEDF378A690CC3A975085CF496A519AFED047FF46815D77B02594571FC31017AAA5568C576B9E33";
String qinv = "075130A6D464E1541E92CCDF21BC4860D4E9E1BEF664CF5900A93774C67A507C13F1FAD2BEC2DCD0BEB4F2535C8175890ABA1BE851D0067B462C4876477E5DA7";

This kind of key was generated for testing purposes.

So I would like to check if it is correct and I have found out that mulitplying of p with q would give different modulus N, resp. N is different only at one half. I used the following calculation:

byte[] bp = hexToByteArray(p);
byte[] bq = hexToByteArray(q);
byte[] bdp = hexToByteArray(dp);
byte[] bdq = hexToByteArray(dq);
byte[] bqinv = hexToByteArray(qinv);

BigInteger pBI = new BigInteger(bp);
BigInteger qBI = new BigInteger(bq);
BigInteger modulusBI = pBI.multiply(qBI);

And the resulting modulus modulusBI has the following value in HEX:

0160502A518CD54E933929557FE02EC03CDB4016A007B2233BFEF8E28362AE649D5CB2860C55B86BCE5EF447C7F4160B89421517A8389DC1DA2BDC30FDE6CCB03F304585DD202D8B04538EB4DD1F87D9A27E1E7B34A304396BBC38EE669E823BD03C1F43698B4B3128F3770C465CE415FD0F965F3170CED1470ED777751DE59D

The value is not same as original modulus N from public key, but one half of it is correct, as you can see:

Computed N :0160502A518CD54E933929557FE02EC03CDB4016A007B2233BFEF8E28362AE649D5CB2860C55B86BCE5EF447C7F4160B89421517A8389DC1DA2BDC30FDE6CCB0 3F304585DD202D8B04538EB4DD1F87D9A27E1E7B34A304396BBC38EE669E823BD03C1F43698B4B3128F3770C465CE415FD0F965F3170CED1470ED777751DE59D
Original N :D8016FFDDFBA4B144B0AB13FF01968048B2FC9AA269311D11357DC8CEDCABA232BEC118D3B05AFA2406D27BFB6602B45B80E91D4F446E4A753C251EA6EB8AB8E 3F304585DD202D8B04538EB4DD1F87D9A27E1E7B34A304396BBC38EE669E823BD03C1F43698B4B3128F3770C465CE415FD0F965F3170CED1470ED777751DE59D

The second half of modulus is correct. Why is that? Am i doing some mistake in multiplying primes p and q?


texts: Possibility of Chosen Plaintext Attack (CPA) in real-world scenario?

texts: In CPA, it is said that the adversaries get ciphertext for the choice of plaintext of adversaries through an encryption oracle. Is this a realistic assumption in real-world, in which the adversaries get ciphertext for the choice of their plaintexts? If so, please provide me with some example scenarios illustrating how adversaries obtain ciphertexts for their plaintexts?


texts:
I am studying my Cryptology exam and one question I got stuck below;

  Recall the Diffie-Hellman key establishment protocol. Alice runs this protocol over
  the Internet to communicate with Bob. Assume that the agreed key after running
  the protocol is k = g^ab (mod p). Alice then computes SHA256(k) and uses this
  as the key to encrypt a message m using AES. The resulting ciphertext is then
  sent to Bob.
  a) Does this protocol guarantee the secrecy of m?

I know that perfect secrecy is if the ciphertext provides no information about the plain text. Can somebody explain the above question to me?


texts: IKE Protocol have 2 modes, that modes have different structure. Does IKEv2 protocol have two modes like IKE.


texts:
The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves,  https://safecurves.cr.yp.to/verify.html
According to the description, the script works simply as:
$ sage verify.sage curves/nistp256/, where curves/nistp256/ is a folder containing the following files:
p: the field prime, in decimal.
l: the prime order of the base point, in decimal.
x1: the x-coordinate of the base point.
y1: the y-coordinate of the base point.
x0: the x-coordinate of a point generating the entire curve.
y0: the y-coordinate of a point generating the entire curve.
shape: the curve shape, either shortw or montgomery or edwards.
a and b, if the curve shape is shortw: the coefficients in the short Weierstrass equation.
A and B, if the curve shape is montgomery: the coefficients in the Montgomery equation.
d, if the curve shape is edwards: the coefficient in the Edwards equation.
primes: all prime divisors of of p, the curve order p+1-t, the twist order p+1+t, and t^2-4p; and, recursively, all prime divisors of q-1 for each q in the list.

Unfortunately all these files are not provided and this is really a pity after so much work.
Questions:

Does anybody know where to find all such missing files? can anyone provide an example for one curve?
Why a base point (x1,y1) and a point generating the entire curve (x0,y0) must be specified?
How do I find a point (x0,y0) generating the entire curve for a given curve?
What is q?
What does it mean "for each q in the list", which list?

Thank you for any hints.


texts:
I m looking at this Example of Merkle–Damgård

I have a similar question about this topic.

  I have hash function maps 256b blocks into 128b blocks, how many rounds are
  required for hashing a 140KB file?

My idea is to transform this 140kb into byte (140000 bytes) and divided this number on 256 ... So I have 546,875.
So my hypothesis is that function use about 547 round, 546 are full of byte, and last round have some zeros inside?

I'm thinking good...or I'm too far?


texts: What block cipher is used for CBC-MAC? DES, AES, 3DES? Or it doesn't matter?


texts: How to generate a large random number from smaller ones?

texts:
I'm using a function randInt that takes as input two integers as upper and lower bounds (inclusive) and outputs a pseudorandom number in that interval. Unfortunately, the function's range can be an interval no greater than $10^{14} - 2$ (meaning the difference of the inputs can be no more than that value). As a workaround, I want this function to generate a number in the closed interval $[0, p-2]$ where $p$ is a large prime (for example: 246,494,430,254,053,509,990,478,163,925,484,154,219).

I can't simply break it into digit groups and generate each group randomly because then the generated number could be 246,494,430,... and then all nines. I also want to avoid looping until I get a number smaller than $p$. How can this be done?


texts: Why is the complexity of RSA-1024 80 bit and not 86 bit?

texts:
Why is the complexity of RSA-1024 80 bit and not 86.76611925028119 bit?

  Here is the complexity for the GNFS (pulled from the linked Wikipedia
  article):

  $$\exp\left( \left(\sqrt[3]{\frac{64}{9}} + o(1)\right)(\ln n)^{\frac{1}{3}}(\ln \ln n)^{\frac{2}{3}}\right)$$

  where $n$ is a number to factor. Evaluating the above expression at
  $2^b$ is a rough approximation of the the time needed to factor a
  $b$-bit integer. Here's a table showing the bit-length of the
  evaluation at $2^{1024},2^{2048},\dots$:

Strength  RSA modulus size   Complexity bit-length
  80        1024              86.76611925028119
 112        2048              116.8838132958159
 128        3072              138.7362808527251
 192        7680              203.01873594417665
 256       15360              269.38477262128384

Security strength of RSA in relation with the modulus size

PS: Why is there an 'o(1)' in the formula? And why does it say RSA modolus size? Shouldn't it be RSA key size instead?


texts: Method to verify a signed archive's X.509 CoT

texts:
I am trying to understand the key high level details behind verifying trust when downloading an archive.

This is my understanding of how it could be done:

On the Software Developer side:

Obtain a certificate from a public CA like verisign
Generate a hash of your archive and then encrypt this string using the private key from your certificate, this is the "signature"
Host the archive for download, along with a separate file which contains the public key from your certificate + the signature generated in step 2.

On the (user) client side:

Download and unpack the archive, download the signature + public key file
Decrypt the downloaded signature using the downloaded public key, save this value
Iterate through the public root certificates embedded within your operating system. For each root certificate, decrypt the signature value and compare the result to the result in step 2.
Once a match is found in 3, you have verified that the author's private key descends from the chain of trust of the CA which you found matched in step 3
Note: This all assumes that the software developer used a CA for which we have an embedded root certificate in our clients OS.

Questions:

Is the above method sound, or am I overlooking key details?
Given a blank slate client, if I wanted to combine the public key + signature + archive into a single file that I could make the client understand and parse, are there any widely supported formats to leverage for organizing this data?


texts: Can homomorphic operations on many different ciphertexts be multiplied by a same constant?

texts:
Assume Alice encrypts messages $m_1$,...,$m_n$ using secret keys $k_1$,...,$k_n$ on a homomorphic encryption scheme (BHHO), so she would get $c_1=Enc_{k_1}(m_1)$,...,$c_n=Enc_{k_n}(m_n)$. Then Alice sends a constant a , some random numbers $a_1$,...,$a_n$ and these ciphertexts to Bob. Can Bob do the following homomorphic operations? (The homomorphic encryption scheme requires that the ciphertext is multiplied by a random number)
$$d_1=Enc_{k_1}(m_1)*{a_1}*a=Enc_{k_1}(m_1*{a_1}*a)$$
...
$$d_n=Enc_{k_n}(m_n)*{a_n}*a=Enc_{k_n}(m_n*{a_n}*a)$$


texts: Is multi-byte mapping to one byte a viable encryption technique?

texts:
The idea is to randomly map byte values eg

\begin{equation}
  Sub(x)=\left\{
  \begin{array}{@{}ll@{}}
    (a, b), & \text{if}\ r=1 \\
    (c, d), & \text{r=0}
  \end{array}\right.
\end{equation}

Where $r$ is the random value that determines the output, $x$ is the input byte, and $a, b$ or $c, d$ is the output bytes.

A concrete example might be:

\begin{equation}
  Sub(97)=\left\{
  \begin{array}{@{}ll@{}}
    (12, 57), & \text{if}\ r=1 \\
    (34, 54), & \text{r=0}
  \end{array}\right.
\end{equation}

Each byte has a unique byte reference.

To encrypt choose random map and set

encrypt[97] = 12,57
encrypt[97] = 34,54

To decrypt find matching values

decrypt[12,57] = 97
decrypt[34,54] = 97

Is this kind of multi-byte mapping to one byte a viable encryption technique?


texts: How to find key length of a Vigenere chiper?

texts:
I am trying to decrypt a Vigenere chiper, I saw a lot of youtube videos but I still can get a good value for the key length.
In theory I have to get the repetions of letters shifting the text one place every iteration and then see how many steps there are between the biggest numbers, but it gives me no common path.


texts: How to explain just how secure AES is in layman terms?

texts:
I have a rather particular classmate who wholeheartedly believes that there isn't such a thing as reasonably secure cryptography and that most people can steal encrypted data. I have attempted to explain (with must frustration) the security of AES. I often attempt to make points about how certain implementations and stream ciphers can result in data leaks, but AES in practice with proper implementations is feasibly unbreakable.

I am trying to find a way to present that AES is secure when everything is done correctly by developers. Any help to explain this to someone who is not cryptographically inclined would be a great help.

I have attempted to explain the math and just how large the keyspace is; the amount of energy required to bruteforce a key; econmical impacts of cracking the cipher, and with no avail.


texts:
Is there such an algorithm that would allow to upgrade the encryption of an RSA-encrypted message without revealing the plaintext to the untrusted user?

Basically, such an algorithm would probably be split in two parts.

The algorithm would take the old private key and the new public key and generate a sort of intermediate key.
The key would then be distributed to untrusted parties who could upgrade their encrypted messages to the new keypair using the intermediate key and (maybe) the new public key.

Neither the old private key nor the new private key should not be easily recoverable (computationaly infeasible) from the intermediate key, so untrusted parties wouldn't be able to recover the plaintext.

Now I suppose that such a scheme does not exist, because I don't see a real use case for it, but it would be interesting to know if such a thing can be done.


texts: What is stopping someone from saving encrypted info, and decoding it later?

texts:
When I send encrypted data to a website, using public key encryption, what is stopping someone who is listening from storing my encrypted data, and decryption it in a few years after they have determined the private key?

From my understanding, private keys can be discovered after a few years using a fast computer.
Are there any time-sensitive safeguards used with public key encryption so that my info won't be useful in a few years?


texts: In RSA, what happens if the plaintext $m$ is not coprime to $n$?

texts:
Coming from the Wikipedia page on RSA, I think I understand the following:
RSA is based on generating an integer $n$ as the product of two large primes, $p$ and $q$, and encryption/decryption exponents $e$ and $d$ such that for any given plaintext $m$, $$(m^e)^d \equiv (m^d)^e \equiv m^{ed} \equiv m \mod n\,,$$
i.e. such that modular exponentiation with $e$ (encryption) composed in any order with exponentiation with $d$ (decryption) is the identity mapping on the plaintext.
This works because $e$ and $d$ are chosen such that $$ed \equiv 1 \mod{|m|}$$ for any plaintext $m$, where $|m|$ denotes the order of $m$ in $\mathbb{Z}/n\mathbb{Z}$. This is done by selecting a multiplicative inverse pair $e$, $d$ in the ring of integers mod $\lambda(n)$, where $\lambda$ is Carmichael's totient function; and if I understand correctly the latter is essentially the least common multiple of the orders of all positive integers less than $n$ that are coprime to $n$, so that if $ed \equiv 1 \mod \lambda(n)$ is true then $ed \equiv 1 \mod |m|$ is too for all $m$ coprime to $n$, since $|m| \mid \lambda(n)$.
But what happens if $m$ happens not to be coprime to $n$, i.e. if $m$ is either a multiple of $p$ or of $q$? What guarantees that in this case too the first identity shown above (the encryption-decryption identity) still holds?
I thought along the lines of using Fermat's Little Theorem, i.e. if I could prove that $ed$ was congruent to $p$ mod $\lambda(n)$, then $m^{ed} \equiv m \mod p$. But after some thought, this doesn't seem to lead anywhere.


texts: Security of this parallelizable two-pass authentication scheme

texts:
This is only the authentication half of a block cipher mode of operation that provides authenticated encryption. The part that provides encryption is left out (it can be CBC, PCBC, ECB, or whatever).

Suppose that:

$E(k,x)$ is the encryption of data block $x$ using key $k$.
$D(k,x)$ is the decryption of data block $x$ using key $k$.
$K$ is the key used for authentication.
$N$ is the nonce used for authentication.
$x_i$ is the $i$th zero-based data block.
$a_i$ is an authentication tag for the $i$th zero-based data block.
$A$ is the authentication tag for the entire data stream.
$n$ is the number of data blocks.
$F(x)=E(K, N) \boxplus (x \oplus (x \ggg 1))$.
$a_i=E(K, x_i \oplus F(i))$.
$A=E(K, a_0 \oplus a_1 \oplus \cdots \oplus a_{n-2} \oplus a_{n-1})$.

It is my hope that the XORing each data block's authentication tag is similar to the repeated multiplication in a Galois field as found in Galois/counter mode.


texts: Why can an elliptic curve private key be 1?

texts: I often see in papers (e.g. this one) that for an elliptic curve with generator point $G$ and order $n$ the private key $d$ can take on any integer value in the range $[1, n)$. When $d = 1$ the corresponding public key $Q = dG$ is of course then just the generator point $G$. Why is this allowed? I understand that the chances that $d = 1$ for a sufficient size curve are basically non-existant, but doesn't $d = 1$ break the hardness assumption that elliptic curve schemes are based on (i.e. if I see $Q = G$ I can immediately infer $d$ without having to compute a discrete log over an elliptic curve).


texts: 4 x E = D in Simplified AES how it's possible?

texts: Can anyone explain how it's possible through hexadecimal or Binary 4 x E= D


texts: Encryption algorithms that require more work to decrypt versus encrypt?

texts:
Are there any encryption algorithms that require significantly more work to decrypt, versus the amount of work required to encrypt?
I'm looking for a method of fast encryption, but which will require much more CPU time to decrypt later, as a method of spam prevention (prevent people from decrypting too many files in a short amount of time).
One thing I should mention, is that the encryption key itself will be public knowledge.
I'm not trying to lock anyone out, I just want to force them to work before they can acquire data.


texts: Why do we assume un-security of communication channel on every cryptography system

texts: While reading about a few cryptographic systems, I noticed that we always assume the communication channel is not secured. Why is this assumption made?  And, why the effort is being put into designing cryptographic systems rather than working on making these communication channels more secure? I know the question is basic, but really cannot find a complete answer.


texts: Which attacks are possible against raw/textbook elliptic curve?

texts:
A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages.

For EC the story is something else. For signatures we have ECDSA, for general encryption we have ECIES (hybrid) and ElGamal encryption. Or ECDH for key agreement

None of those schemes define any formatting, does that mean that there a no know attacks against the raw schemes? Just compute the output and incorporate the raw binary into our network protocol?


texts: Encrypting small values with RSA private key

texts: I'm looking for best practices when it comes to encrypting small (< 128 bytes) amounts of data with the RSA private key. Signing it would make the resulting payload too large.


texts: Text encryption algorithms that can be used and are secure

texts: what text encryption algorithms are being used nowadays that are secure? Obviously I am not interested in DES or 3-DES that google shows me and which can break...


texts: How practical is proxy re-encryption for AES?

texts:
In proxy re-encryption schemes, a proxy is given special information that allows it
to translate a ciphertext under one key into a ciphertext of the same message under a
different key.

How practical is PRE? Is it possible for achieving PRE for AES?


texts: Questions about updating the secret key of RSA?

texts:
I want to update the secret key of RSA.

I understand there exists a common modular attack on RSA. Precisely, if adversary knows $(e_1, m^{e_1})$ and $(e_2, m^{e_2})$, where $e_1$ and $e_2$ are the RSA exponents under the same module $N$. Then it can compute $\lambda_1, \lambda_2$ such that $\lambda_1e_1 + \lambda_2e_2 = {\sf gcd}(e_1, e_2)$, where ${\sf gcd}(\cdot)$ is the greatest common divisor. Thus the plain message can be recovered by computing $(m^{e_1})^{\lambda_1/{\sf gcd}(e_1, e_2)}\cdot (m^{e_2})^{\lambda_2/{\sf gcd}(e_1, e_2)}=m$ (if I am wrong, please correct me).

In my implementation, I want to use the RSA like a private-key encryption. Instead of publishing the public RSA exponent $e$, I keep it secret. Then, the secret key is $(e, d)$ where $ed = 1 \mod \phi(N)$ (I do not consider to update the prime $p$ and $q$). Initially, I compute the RSA ciphertext $m^{e_1}$ and store the secret key $(e_1, d_1)$. At some time, I update the secret key to $(e_2, d_2)$ and give $d_1e_2$ for re-encrypting the ciphertext from $m^{e_1}$ to $m^{e_2}$.

My question is, 1) In my implementation of using RSA like a private-key encryption, the key-update is still vulnerable to common modular attack (or is it secure)? In other words, if the adversary knows $m^{e_1}, m^{e_2}$ and $d_1e_2$, is it able to guess $m$? 2) If 1) is secure, the key-update is resistant against leaking old secret keys? In other words, if the adversary knows $m^{e_2}, d_1e_2$ and $(e_1, d_1)$, is it able to guess $m$?

Waiting for your answers. Thanks a lot.


texts:
At the moment I'm designing a crytosystem for a VPN server. One of the requirements is Perfect Forward Secrecy, but I'n not sure how to implement authentication on the ephemeral key exchange.

If both parties possess a signed public key (signed by a CA or common trusted party) and exchange this, they can verify the identity of each other through the CA's public key. To implement perfect forward secrecy, both parties have to generate an ephemeral keypair and send each other the public key. Since these keys are not signed, how can one authenticate the other to guarantee that the keys were not altered/switched? Even if the keys are exchanged over an verified channel (for example using the signed and trusted public keys) that doesn't automatically ensure the ephemeral keys were generated by the same party. Also calculating a MAC over the public ephemeral key does not lead to a secure cryptoscheme since the public key could have been created by an man-in-the-middle in the first place. Is there any way the ephemeral key exchange can be authenticated?


texts: Additive homomorphic encryption: strict equality - handling congruence

texts:
Is there an additive homomorphic encryption scheme which guarantees that if provided with

$E(v)$, $E(m_1)$ and $E(m_2)$

and $E(v)=E(m_1).E(m_2)$ then $v=m_1+m_2$

Please note this is not $v \equiv m_1+m_2 \pmod p$

To illustrate, assuming a group of order $p$, the additive version of ElGamal does not seem to match the criteria. Assuming $v=m_1+m_2$, there exists values $m'_1$ and $m'_2$ such that

$m'_1+m'_2 = m_1+m_2+k(p-1)$, $k \in Z^*$

which verifies $E(v)=E(m'_1)E(m'_2)$ due to Fermat's little theorem although $v$ is not equal to $m'_1+m'_2$

A simple numeric example is, assuming order $p=7$, a generator $g=2$, $v=4$, a shared secret $s$,

$m_1=1$ and $m_2=3$ obviously verifies that $E(1)E(3)=E(4) = 2^4.s \pmod 7 \equiv 2.s \pmod 7$

but so does $m_1=4$ and $m_2=6$ since $2^{10} \equiv 2 \pmod 7$


texts: Prove that if we redefine the key space, we can assume Gen chooses a key uniformly

texts:
I am working on problem 2.1 in Introduction to Modern Cryptography 2nd edition by Katz and Lindell.

  2.1) Prove that by redefining the key space, we may assume that the key generation algorithm $\textsf{Gen}$ chooses a key uniformly at random from the key space without changing $\Pr[C=c\mid M=m]$ for any $m,c$

We are told to define the key space to be the set of all possible random tapes for the generalized algorithm $\textsf{Gen}$.

I don't understand how we are supposed to prove that this algorithm $\textsf{Gen}$ chooses a key uniformly without knowing the algorithm itself. I am not really sure where to even start with this as I am new to proofs and crypto in general, and and all help will be useful!

What I do know:

$\textsf{Gen}$ is a probabilistic algorithm that outputs some key $k$ chosen according to some distribution. The finite key space $\kappa$ is the set of all possible keys that can be output by $\textsf{Gen}$


texts: Can private data be encrypted and stored safely in public?

texts: Given that AES-256 is reasonably strong encryption, can private data (for example Bitcoin private keys) be sufficiently encrypted and stored safely in public places (for example a public github repository)?


texts: How to customize a standard encryption algorithm?

texts: I want to modify and customize AES encryption algorithm and develop a variant of it. What factors should I consider so that it does not become weaker? What skill sets would be required to undertake this task? How complicated can it get?


texts: Asymmetric cipher with multiple public keys

texts:
Asymmetric cryptography is well known.
You generate a private key.
Using the private key you generate a public key.
Then you can sign a message with the private key and check signatures using the public key.

I have different process which is as follows

On the one side are a lot of people that create messages (senders).
Each sender has only one private key which used to sign his messages.
Each sender knows only his own private key.
Each sender makes many signed messages.
Each message contains public key which can be used to check signature of that message. Message can be verified only by the key that inside in the message.

On the other side are o lot of people that read messages (readers).
Each reader can read all messages of all senders.

Our goal - no one among readers should be able to conclude for any two messages whether they created by the same sender or by different senders.

So generally we need an asymmetric cipher which allow to generate many public keys for one private key.

Do you know such asymmetric ciphers? Maybe we can use combination of known ciphers to achieve this result?


texts:
could anyone give me a small example with actual numbers and variables over a finite field of how the XL algorithm is used to solve overdetermined systems? And the steps involved. I understand the algorithm but a simple example would make my life a lot easier. Also are there any implementations of the XL algorithm available?

Thanks.


texts:
In DES, different S-boxes were tested for cryptanalytic resistance and the most secure one was chosen for the algorithm itself.

How do different S-boxes offer different levels of security against cryptanalysis and how is this tested?


texts: Is there any simple interactive zero-knowledge proof?

texts: What is the simplest known scheme that allows one to, given an input x : {0,1}* for which F(x) == y where F : {0,1}* -> {0,1}*, elaborate a proof p : {0,1}* such that V(p, y, F) iff F(x) == y?


texts: How feasible is a preimage attack or speedups to brute force a substring of MD5?

texts:
Beyond the birthday problem analysis how feasible is a preimage attack or speed up brute force on a substring of MD5. For instance let's say from the 128 bits I decide to strip 24 bits, the first four and last 20 of a generated MD5.

How can you attack or fast generate a preimage that will collide on the same substring.

ps.It is known MD5 is broken, some hardware can compute billions of MD5 hashes per second. The intent of the question is theoretical understanding.


texts: How to find generator $g$ in a cyclic group?

texts: As generator $g$ is used in DH how do you find a combination of prime $p$ and $g$? eg: if we choose $p=23$ and its generator is $7$ (given in the book) how do we find the generator?


texts: Why is low-degree polynomial preferred on Ring-LWE based somewhat homomorphic encryption?

texts:
I'm wondering why Ring-LWE based homomorphic encryption (somewhat homomorphic encryption, not fully) requires low-degree polynomial in order to avoid decryption error.
For example, a plaintext $m$ is an element over some polynomial ring, i.e. $m\in \mathbb{Z}_t[X]/(X^N+1)$ where $t$ is a prime and $N$ is a power of two integer.

More redundantly, $m= m_0 + m_1 X + m_2 X^2 + \ldots + m_{N-1}X^{N-1}$.
A noise $e$ is also a polynomial sampled from discrete gaussian distribution.

I do not know why polynomial degree is considered.
Noise amount on each coefficient violates on each coefficient of the plaintext polynomial.
Is this correct?


texts:
There are a number of pages on web to tell how to sign apk file for Android. But none I've found telling how it works under-the-hood. The (e.g from here https://github.com/appium/sign) command is java -jar SignApk.jar testkey.x509.pem testkey.pk8 my.apk my.s.apk and it has two files with keys - .pem (certificate) and .pk8 (as far as I understood it contains private key).

Official Android docs page app-signing says "Android requires that all APKs be digitally signed with a certificate". But certificate contains public key...

Do they mean app should by signed (presumably hash with private key) + with certificate (which is plainly attached to apk file)? That would explain why command above needs two files...


texts: Is AES CBC + truncated SHA-256 MAC a good design for embedded sensor networks?

texts:
I'll start off by saying I'm a noob with respect to software security but I've been reading about security models for a while. Also, I'm afraid some people would just say "go and hire a security expert" which is probably the most correct way to do it but we're a tiny start up and I'm going to have to implement the security model for our embedded mesh network to the best of my abilities.

So, here's what the hardware/firmware looks like:

2 different ARM MCUs, with about 1KB of RAM remaining after the current stack, that support 128-bit AES CBC (and ECB, but I know that should never be used) and SHA-256.

Both MCUs have libraries that support 802.15.4 security but we'd need more RAM than available for supporting the number of devices that we want to allow in a single network. Also, devices with either MCU should be able to talk to devices with the other one and both of them have implemented different versions of the 802.15.4 security model. The PHY/MAC has already been tested for compatibility.

Key storage:

128 bit AES key is stored in secured flash (Can only be erased using JTAG but not read from). 64 bit key for SHA 256, also in secured flash. Both keys are pre-shared among all devices.

Packet description:

Each packet contains a header with length, version, type fields and a variable sized payload.

Each device has a 32 bit frame counter that is initialized on first boot to a 16 bit random number (allowing enough room before the overflow happens) and is incremented after sending a packet. For incoming packets, the frame counter has to be greater than the last frame counter for the sender. If it isn't, the packet is considered a replay and is dropped. The frame counter need not necessarily be prev_counter + 1 because of the possibly dropped packets and the way our mesh works.

Finally, the question:

So, given that we can only use 128-bit AES CBC and SHA256, what'd be the most secure way of implementing authenticated encryption?

Note that since this is a low bandwidth network, we'd like to keep the per packet overhead to a minimum. And that'd be 16 byte IV + AES padding, if necessary + 4 bytes of hash, imo.


texts: Deniability and Prekey Security in X3DH Key Agreement Protocol

texts:
Can someone please explain the below paragraphs from The X3DH Key Agreement Protocol?

1st paragraph: What is deniability and how does it work here?

  Deniability

  X3DH doesn't give either Alice or Bob a publishable cryptographic
  proof of the contents of their communication or the fact that they
  communicated.

  Like in the OTR protocol [6], in some cases a third party that has
  compromised legitimate private keys from Alice or Bob could be
  provided a communication transcript that appears to be between Alice
  and Bob and that can only have been created by some other party that
  also has access to legitimate private keys from Alice or Bob (i.e.
  Alice or Bob themselves, or someone else who has compromised their
  private keys).

  If either party is collaborating with a third party during protocol
  execution, they will be able to provide proof of their communication
  to such a third party. This limitation on "online" deniability appears
  to be intrinsic to the asynchronous setting.

2nd paragraph: How would this passive attack work?

  Compromise of prekey private keys may enable attacks that extend into
  the future, such as passive calculation of SK values, and
  impersonation of arbitrary other parties to the compromised party
  ("key-compromise impersonation"). These attacks are possible until the
  compromised party replaces his compromised prekeys on the server (in
  the case of passive attack); or deletes his compromised signed
  prekey's private key (in the case of key-compromise impersonation).


texts: What does TLS_ECDHE_ECDSA_with_AES_128_CCM means collectively. What is the signature algorithm and keys used here?

texts: Will the signature algorithm be ECDSA and key (i) ECC key or (ii) ECDHE and ECDSA keys?


texts: Discrete logarithm problem - Pohlig Hellman $GF(2^p)$

texts: I would like to ask how to modify Pohlig Hellman algorithm if I need to work with polynomials $GF(2^{60})$ I know how this algorithm works with numbers, but I am not able to imagine how to do some operations with polynomials. E.g. if I need to do $g^{\frac{p-1}{q^e}}$. How can I do this with polynomial?


texts: End to end encrypted web chat app with stored messages in database

texts:
I am working on a web app with an integrated chat. All chats can only occur between two users - not more, not less.
I am very concerned with security, so I would like to encrypt all chat messages with end to end encryption. My favored protocol so far is the Signal protocol.

However, the problem of web apps is that it's not possible (as far as I know) to reliably store the private key of a user. Also, you can't really save anything locally (i.e. in the local storage of the browser) because the web app can be accessed from everywhere and the user should be able to view all messages as soon as he logs in wherever he might be.

So my solution would be:

User X creates an account in his browser.
A key pair is created and the private key is encrypted symmetrically using the entered password.
The public and the encrypted private key are sent to the server where they are stored in the database.

Then, if a user Y wants to start a chat with X:

Y's message is encrypted in his browser two times:

Once with the public key of user X, stored in the database,
and then with the password of user Y.

Both encrypted version of the messages are transmitted via WebSocket to the server.
The server sends the first version of the message to user X if he is currently logged in. Also, it stores both versions of the message in the database.
The browser of user X decrypts the message(s) received from the server as soon as he is logged in and displays them to the user.

Each time user X logs in and views the chat:

The user logs in and receives the encrypted private key. Using the entered password, the private key is decrypted.
The already existing chat messages are requested from the server.
Locally, the messages are decrypted with the private key.

Is this safe at all?
I think that this would prevent some of the following disadvantages when researching other methods:

The server does not have to decrypt and re-encrypt all messages when a user changes their password.
The browser does not need to generate a new key pair each time a user logs in at a new location.
The messages can be stored long term for both users to be easily read.

One potential vulnerability I thought of would be:

Because there are two versions of the message stored in the database, a potential attacker could have an easier job of brute forcing the original content. Though, this might be prevented by signing both messages with some userspecific value, i.e. the username.


texts:
Consider the following challenge-response protocol for $A$ to convince $B$ that he is indeed $A$. Here we are assuming:

at the
start when the virtual circuit is being set up, $A$ has to convince $B$ that he is indeed $A$.
once a virtual circuit has been set up, the BG cannot alter messages in the middle.
$A$ and $B$ share a secret
value $S$.

$B$ sends $A$ a nonce $N$.

$A$ calculates $C$ to be the first 64 bits of $N$ XORed with the first 64 bits of $S$.

$A$
returns $C$ back to $B$.

$B$ checks whether $C$ = first 64 bits of $N$ XORed with the first 64 bits of $S$.

If it is, $B$ accepts
that $A$ is indeed $A$. is it good idea to use this kind of functionality?


texts: Who's talking to who encryption - does this concept work?

texts:
With all the NSA stuff in the news, I've been thinking about how to ensure the "who's talking to who" is just as private as the contents of the messages. I had an idea on the subject, about which I've got two questions: the first, does this concept work (i.e. meet its stated objectives); and if so, what services employ this technique.

The problem: how to ensure that the "who" is just as private as the "what" of communication

The idea:

There exists a voluntary network of nodes that all have public key
encryption systems, and published public keys.
The sender sends a message to the first intermediate node, encrypted with that
intermediate node's public key.
The first intermediate node decrypts the message, which contains the second intermediate node's address and a payload that's encrypted with the second intermediate node's public key. The first intermediate note sends the payload to the
second intermediate node.
The second intermediate node decrypts the message, which contains the
third intermediate node's address and a payload that's encrypted with
the third intermediate node's public key. The second intermediate
note sends the payload to the third intermediate node.
The third intermediate node decrypts the message, which contains the
final recipients node's address and a payload that's encrypted with
the final recipients's public key. The third intermediate note sends
the payload to the final recipient.
The final recipient decrypts the message.

Key points about this system:

the sender needs the public keys of all intermediate nodes (a published database would be needed of addresses and public keys)
I was originally thinking of this in respect of email, but it should work with any communication, e.g. snail mail, IP packets, etc
on a computer it should be fairly easy to automate the multiple layers of encryption
the number of nodes can be manually selected, or selected at random
the nodes themselves should be selected at random
the communication could contain multiple next-hop nodes with a priority order, in case nodes fail. The nodes could provide an acknowledgement message back to the node they received communication from
the messages could potentially be randomly padded to ensure that the reducing size of the message over time (as address headers are removed) does not give a clue to the communication direction
random communication could be added to the network to further confuse snoopers
to prove the source of the correspondence to the sender, the sender and recipient would  need to pre-agree a secret that the sender would include in the message. Alternatively, the entire system could be set up such that each node gives a unique secret to each other node encrypted using that node's public key. This would establish encrypted relationships by default, without the need for pre-agreeing, and wouldn't allow anyone to infer relationships from the establishment of the original secret

Challenges:

as the network scales, the database of addresses and public keys
becomes potentially too large
if the secret sharing mentioned in the
key points is employed, the number of secrets each node would need to
hold could get prohibitively large if the network gets large


texts: RSA: Multiple Private keys for single public key and N

texts: I'm working on a problem that gives me two private keys $d_1,d_2$ that work with the same $(N,e)$ pair. The problem gives me the two private keys and $N$. Is it possible to find $p$ and $q$? Or how would I find $p$ and $q$ or the sum $p+q$?


texts: If the input text is divided into a fixed block size for encryption and decryption, what could be the typical block size for RSA algorithm for different size of input like 8 MB, 16 MB, 126 MB and 256 MB?


texts: Randomness and increment of nonce in GCM

texts:
2 questions about nonce usage in GCM:

Is it safe to use non-random nonce in GCM? Say I use 0x1 for m1, 0x2 for m2, so on.
How much should a nonce increased for a file? Say I use 0x1000 as a nonce to encrypt a 1000x block size file (128,000bits). Then should the next safe nonce to use for the next file be simply 0x1001, or after addition of the number of blocks used, i.e. 0x2000?


texts: Does AES with whitening mode have the following property?

texts:
This mode is that each time a random number $K$ is generated, you XOR it with plaintext $M$ and then pass the result to AES.

Since AES is a pseudo random permutation, does AES have the following property?

$$AES(M \oplus K) = AES(M) \oplus AES(K)$$


texts: How to encrypt a text file in a portable manner based solely on a password?

texts:
I used to use openssl aes-256-cbc, but the problem I have with this is when I try to decrypt in a different version of the distro it fails, as if it depends also on some internal key or something, instead of depending solely on the password. So I have to keep a different encrypted file for each version of the distro, which is annoying and bad.
Any suggestions?


texts: Can I construct a feasible stream cipher out of HMAC and a secure hash algorithm?

texts:
I have constructed a stream cipher from a secure hash algorithm and a HMAC. Here is a brief description of the algorithm:

Let: (Actually Objective-C styled pseudo code)

[data SHA512Hash]: SHA-512 hash of data,
[data SHA512HMAC:key]: SHA-512 HMAC of data with key,
[data xor:another]: bitwise XOR of two data and another which have the same length,
[data bytesTo:index]: first index bytes of data,
[data removeFirstBytes:count]: remove first count bytes from data,
[data length]: length of data.
[data concat:other]: Concatenate other after data.
[Data new]: allocate an empty buffer.

Pseudocode: (Or actual Objective-C code?)

Data hkey = [key SHA512]; // Hash to make lengths match.
Data segKey = [IV SHA512];

Data dest = [Data new]; // This will be the output
Data last = (Some constant)

do {
    // Cut off hash-sized chunks of source data
    Data segment = [data bytesTo:[hkey length]];
    [data removeFirstBytes:[hkey length]];

    // Derive a new segment key
    segKey = [segKey SHA512HMAC:hkey]; // or [segKey SHA512HMAC:[hkey concat:last]]? If so, how to decrypt?

    // XOR
    last = [segment xor:[segKey bytesTo:[segment length]]] // Truncates to make length match
    dest = [dest concat:last];
} while ([data length] > 0)

From some other questions I am suggested that this is SHA-512 HMAC running in OFB mode but what about the change in the code comment?

This code seem to decipher itself when given the same key.


texts: Why do the subexponential algoriths for the DLP not work for the ECDLP?

texts: Elliptic curve cryptography is much more secure for the same parameters because attacks that work on the DLP do not work on the ECDLP.  Why do the attacks fail in the latter case?


texts:
I'm studying algorithms that solve the discrete logarithm problem over elliptic curve. Reading online, it seems that people use the bsgs algorithm when the order of the curve is "low" and P-rho when it's "high".

But nobody says how much is "low" and "high", where I can find some good estimation?
Is this true?


texts:
Let $n$ be an RSA modulus and assume one has the two following equations

\begin{align}
y_1 = (x+a_1)^{-1} \pmod{\varphi(n)}\\
y_2 = (x+a_2)^{-1} \pmod{\varphi(n)}
\end{align}
with known $y_1$, $y_2$, $a_1$ and $a_2$, and where $\varphi$ is Euler's totient function.

Is it possible to solve the system and recover $x$?


texts: Probability of a prime number of points on an elliptic curve over a prime field

texts:
Suppose we have some elliptic curve defined over $\mathbb F_p$, with $p$ a large prime. Let $n$ be the number of points on the curve. I am interested in what is currently known about the probability* that $n$ is prime (i.e. some reasonable lower bound on this probability).

$n$ is well-known to be within the "Hasse-Weil interval":
$$t := \left| n - (p + 1) \right| \le 2 \sqrt p$$

By PNT there are something like $\frac {4 \sqrt p} {\log p}$ primes in this interval, but obviously the probability distribution of $t$ in this interval is non-uniform, so this does not directly give us a good bound. Is there perhaps some known constant multiple of this that is a correct bound?

*Note: To clarify the meaning of "probability": Suppose that the curve was chosen at random (uniformly) from all the nonsingular elliptic curves of form $y^2 = x^3 + ax + b$ over $\mathbb F_p$.


texts: Security analysis for a extended ElGamal Signature against selective unforgeability

texts:
Let $H$ is a cryptography hash function and $\Pi=(\mathsf{G}, \mathsf{S}, \mathsf{V})$ is a digital signature, as follows:

$(h_1=g^x,h_2=g^y) \leftarrow \mathsf{G}(1^n)$,  where $x,y$ uniformly random from $\mathbb{Z}^*_q \ .$

$(r=g^k,s=(H(m)-x \cdot r)\cdot k^{-1},z= y^{-1} \cdot k ) \leftarrow \mathsf{s}_{x,y}(m)$, where $k$ uniformly random from $\mathbb{Z}^*_q \ .$

$b:=\mathsf{V}_{h_1,h_2}(m,(r,s,z))$, where $b :=
\begin{cases}
   1 & \text{if } (g^{H(m)} = h_1^r \cdot h_2^{z \cdot s}) \\
   0 & \text{otherwise}
 \end{cases}$
The above construction is similar to ElGamal signature (https://en.wikipedia.org/wiki/ElGamal_signature_scheme).

1- Where can I find proof of existential unforgeability ElGamal signature?

2- Does the above construction is a secure digital signature against existential unforgeability?


texts: Directional vector privacy-preserving techniques

texts: I'm new to cryptography, and I wonder if it's possible to temporarily track users by observing directional vectors in Mobile-Ad-Hoc-Networks, and if there are any methods, in case it is trackable, to preserve it. I haven't found any research about this topic and would be very thankful for hints as to literature or techniques.


texts:
As far as I understand, there is no general way to enumerate irreducible polynomials in a particular finite field, which are similar in nature to prime numbers over the integers.

The GCM mode finite field has order $2^{128}$, which matches the block size of AES, and uses the irreducible polynomial (see source page 8)

$$x^{128} + x^7 + x^2 + x + 1$$

Why does the source PDF not go into any detail regarding the choice and how was it found? It does not even give proof that the polynomial is irreducible.


texts: How to encrypt the truth table in garbled circuits?

texts:
I'm learning about garbled circuits, and I'm using the following tutorial: Yao's Protocol.

I have a questions regarding to construction (encryption) of truth table in garbled circuits.

Slide 14 says:

  For each wire x, y, z, specify two random values, corresponding
  to 0 and 1.

So I picked:

(k_x0, k_x1) = 1, 0
(k_y0, k_y1) = 0, 1
(k_z0, k_z1) = 1, 0

Then,

  We need to “associate” (k_z0, k_z1) with (k_x0, k_x1, k_y0, k_y1).

Here's my table according to the values in slide 16.

x | y | z | GCT
----------------
1 | 0 | 1 |  ?
1 | 1 | 1 |  ?
0 | 0 | 1 |  ?
0 | 1 | 0 |  ?

However, I can't figure out what should GCT values be?
How should those values be calculated?


texts: How to compute the attacker's probability to attack mixnet with 3 intermediate routers?

texts:
I have a question in mind regarding the mix network topology. I know that the mix network communication has several possible attacks such as tagging, n-1, compulsion, statistical disclosure, and epistemic attacks. In this case, suppose that I build the mix network with 3 cryptographic routers that each router only sends the messages after reaching k number of messages.
So, the adversary has a probability of 1/k in each router.
But what is the probability of the adversary to successfully link a user packet A to the user B with the 3 intermediate routers without taking control of any routers? Because it has 3 intermediate routers R1->R2->R3.
And what is the adversary's probability if he has controls of 1 router?


texts: Computational Assumption For the extended discrete logarithm

texts:
Choose randomly $P\in G_1, (s,a \in Z_q)$.

let the attackers know $a,P$ and keep $s$ as secret.
Also the following is given.
 $$sP,(a+s)^{-1}P$$

Individually,

From $sP$, trying to reveal ($s$) will be discrete logarithm problem.

However, I don't know (computational assumption) how to prove  $s$ value cannot be revealed from $(a+s)^{-1}P$.

Moreover, are there any computation assumption to prove the secrecy of  $s$ value from both $sP,(a+s)^{-1}P$ instead of individually.

As there is no pairing operation, BDH, xBDH, wBDH cannot be used here.


texts: Does unbalancing a feistel cipher always improve security? Does it improve security at all?

texts:
So according to Wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state:

  The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one side is a single bit. This has better provable security than a balanced Feistel cipher but requires more rounds.

Which is a summary of the paper "How to Encipher Messages on a Small Domain — Deterministic Encryption and the Thorp Shuffle".

Forgive the simplicity of the question I'm about to ask, but as an amateur, to me this  seems counter intuitive. If for each plaintext block we have:

$$L_{i+1} = R_i $$

and

$$R_{i+1} = L_i \oplus F(R_i, K_i)$$

Where F is the round function, then doesn't constraining either $L_i$ or $R_i$ to a single, or fewer bits (given whichever side is smaller, they will swap in the next round) mean that each xor is easier to reverse since only single bits are being altered at a time (and we know this reliably since algorithms aren't secret...)? Does that not make the cipher more susceptible to side channel attacks, essentially becoming more of a stream-like operation?

So, is this actually the case and if so why? Is there any particular implementation of an unbalanced feistel cipher one should avoid - for example, are there optimum sizes for the data size bigger than a single bit?


texts: Is it still safe to use sha1 as an hmac hash function in 2018

texts:
I'm curious if it's safe to use sha1 for an HMAC in 2018 in a platform product.

A popular vendor (Twilio) uses an HMAC with sha1 with a shared secret to validate that messages they send are indeed sent by them (see the Twilio docs on validating messages)..

In a recent audit, the use of sha1 was flagged as a potential problem.

As part of the explanation and justification for why it is OK to use hmac-with-sha1, Twilio pointed to this article about hmac with sha1, though I note that article is from 2009.

So, what say you crypto.stackexchange? Is it still safe in 2018 for an organization like Twilio to use sha1 in an HMAC?


texts: What is the difference between MAC and HMAC?

texts:
In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal information about plaintext in contrast to HMAC. Is my understanding right?

What are other security properties of MAC and HMAC?


texts: Scalar Multiplication for Elliptic Curve

texts:
Let $\mathbb{E}$ be the elliptic curve $y^2 = x^3 + 6x \text{ mod } 11$ and consider the point $P = (2, 3)$ on it. How do I compute $3P$?

I have been able to figure out what $2P$ is, $2P = (5,10)$. However I am unsure if even knowing $2P$ is helpful, or do I just compute $3P$ from knowing the original $P$?


texts: Curve25519's Y coordinate of Basepoint origin

texts:
The paper High-speed high-security signatures by Bernstein et al. introduces the Edwards curve Ed25519.

Concerning the base point $B$, it says that

  $B$ is the unique point $(x,4/5)∈E$ for which $x$ is positive

and $B$ corresponds to the basepoint used on the birationally equivalent curve Curve25519.

So I haven't found on any site information about how do they get that $4/5$ value of the $y$ coordinate in order to get a small basepoint generator.

Is there any reason or origin of that $4/5$? How they determined that $4/5$ was part of the group $2^{255} -19$?


texts: Layman's explanation of encryption backdoors

texts:
In the media, I sometimes read about "backdoors" in encryption algorithms. I'd like to understand what such a backdoor actually consists of. Is it:
a) a hidden weakness in the math formulas that can cause security to be broken by brute force in a reasonable amount of time rather than the universe's expected life span?
or b) a plain hole that makes it possible for a knowing person to extract information without any brute force attack at all; it's a way "straight in"!
I don't know if it's possible to answer this without going into complex math, but I hope the answer can be kept in layman's terms as much as possible.
Creating such a backdoor would involve the challenge of making it almost impossible to find. Moreover, if found, its creator could deny malicious intent and say it was just an honest mistake. Information about how this works and would play out in practice would be interesting as well!


texts: What kind of encryption function is also used for decryption?

texts:
Is there a name for the particular type of encryption algorithm or function which is the same algorithm or function used for decryption?

This is a vocabulary question, because I'm largely unfamiliar with the terminology of encryption. Expressed mathematically, if $f(x)$ is an encryption algorithm that encrypts $x$, and $f(f(x))=x$, is there a name for this particular type of encryption? An example would be a cipher that converts $A$ to $Z$, $B$ to $Y$, $C$ to $X$, ..., $X$ to $C$, $Y$ to $B$, $Z$ to $A$.


texts: Why does Fortuna (RNG) require entropy sources to specify accumulator pool?

texts:
Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG:

Why require an entropy source specify which pool a random event should go in?

(For code, see the add_random_event method in this python implementation).

The book discusses why you wouldn't want to just round-robin (or similar) all events, as a compromised source could force all good data into specific pools.  This makes sense.

If I'm following the discussion correctly, each entropy source spreading it's events evenly across all pools is the desired behavior.  This also makes sense.

What I don't quite get is why you couldn't attach a counter or similar to each entropy source and use that bit of Fortuna-managed data to route events.  Seems like that would make it harder for an evil entropy source to influence particular pools, and simplify the accumulator interface a little bit.  The cost is an additional bit of state per entropy source, which doesn't seem substantial.

Now since it seems obvious to me, I suspect there is a flaw in my reasoning.  So, why is pool choice delegated to the entropy source instead of managed by Fortuna?


texts: What is the relation between computational security and provable security?

texts:
I read the book "Introduction modern cryptography". It gives the notion of computational security of private-key encryption at first which comes from perfect security and statistical security.

  Let $(E,D)$ be an encryption scheme that uses $n$-bits keys to encrypt $l(n)$-length messages. $(E,D)$ is computationally secure if
  $$E_{U_{n}}(x_{0}) \approx E_{U_{n}}(x_1)$$

And then it introduces the secure game (e.g. CPA, CCA)? I think it is a part of provable security.

"Unconditional security" (or "information-theoretic security" or "perfectly secrecy") and "computational security" are two opposite classes of security.
But I do not think "computational security" and "provable security" are two independent classes of security. I know that computational security emphasizes the power of attacker is bounded (polynomial-time algorithm). And the provable emphasizes the mathematical assumptions or cryptography primitives. But it also related to the computational power.


texts: Simple way to extend AES to 256-bit block size

texts:
What is the best way to use standard AES with a 128-bit block size to act as a 256-bit block cipher?  I am aware of CMC and EME which seem to serve this purpose, but they seem to be more complicated than necessary for the 256-bit block case.  (I would like to avoid relying on the uniqueness of a nonce.)

Is the following variant of CBC secure?

Let $(P_1, P_2)$ be the two 128-bit blocks of the 256-bit plaintext $P$, and $I$ be the 128-bit (public) IV (which might not be unique).  The secret AES key is $k$.

To encrypt, set $C_0 = E_k(I)$, $C_1 = E_k(P_1 \oplus C_0)$, $C_2 = E_k(P_2 \oplus C_1)$, $C_3 = E_k(P_1 \oplus C_2)$.  The result is $(C_2, C_3)$.

To decrypt, set $C_0 = E_k(I)$, $P_1 = D_k(C_3) \oplus C_2$, $C_1 = E_k(P_1 \oplus C_0)$, $P_2 = D_k(C_2) \oplus C_1$.

Both encryption and decryption require just 4 AES block encryptions/decryptions (just 3 if $I$ can be used as $C_0$ directly).

The key question is whether this is secure even if $I$ may not be unique.  If both $P$ and $P'$ are encrypted using the same value of $I$, an attacker should not be able to determine anything about $P$ and $P'$ other than whether they are equal (in their entirety).  For regular CBC mode, this is not the case, since if $P_1 = P_1'$, then $C_1 = C_1'$.


texts: AES 5-round Square attack, how to choose plaintexts?

texts:
I know that we need to generate a delta-set (with 256 plaintexts).

During the attack, we guess 4 bytes of round 5 key and 1 bytes of round 4 key, which allows us the byte at one position of the state at the end of round 3. If that position is balanced, then the 4-byte prediction is valid, but there are a lot of false-positives.

My problem is that there are too many false positives. No matter what delta-set I generate, all remaining 4-byte combination result in a false-positives.

How can I generate the input plaintexts to eliminate these false positives? I can't find a single implementaion of AES Square attack online, so if anyone can show me, I'd be very grateful.

Thank you.

Edit: nevermind. On average 5 delta-sets or less is needed. I just had a data-type bug (char -> unsigned int) that make the program fail to eliminate delta-set


texts: How many bits are needed for an LFSR to generate a specific number of sequences?

texts:
I need to generate 64-bit data sequences 16 times pseudorandomly. How many bits should the linear-feedback shift register (LFSR) have in order to do so?

That is, what is the number of bits for the initial seed? How can I calculate this number? Can we minimize this number? Should it be a fixed number of bits?


texts: Finding a dataset to benchmark cryptographic algorithms

texts: I’m planning to compare cryptographic algorithms in terms of encryption/decryption time, memory used etc. and for that I’m in need of a standard dataset consisting of plaintexts of different bit sizes and character lengths. Can anyone suggest a source where I can obtain these data?


texts: Construct Schnorr Protocol can only verify by designated verifier

texts:
Currently I have a DLP as following, $y = g^x \bmod p$, I can easily construct a proof of knowledge by using Schnorr Protocol.

But I would like to put it a a system of 2 parties with public key and private key as following.

Prover has private key $x_p$ and public key $y_p = g^{x_p}$
Verifier has private key $x_v$ and public key $y_p = g^{x_v}$

Is it possible i can construct a proof of knowledge that prover knowing $x$ in $y = g^x \bmod p$ and only can be verified by designated verifier with public key $y_p$?


texts:
I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these KDF's as sub-part of an algorithm description (key agreement). Does somebody have a formal description of both KDF's that adheres to the standards?

The description should include additional information to derive a key such as OtherInfo field or label, or indicate their absence. Needless to say the other input parameters and the use of the internal counter would be needed for the full algorithm as well.

The standards can be found in IEEE Std 1363-2000, ANSI X9.42 (KDF1) and ISO 18033-2 (KDF2). That last standard defines OID's for them, KDF1 is 1.0.18033.2.5.1 and KDF2 is 1.0.18033.2.5.2 (unprotected links to oid-info.com).


texts:
In Pollard Rho's Algorithm, a function $f$ with pseudorandom properties is required. Through this property, the birthday paradox can be leveraged to find a collision. But not all functions are pseudorandom. I am trying to understand what makes a function a good pseudorandom function.
Consider the following sample functions
$f(x)=a x+b \bmod N, a, b \in \mathbb{Z}_{N}$
$f(x)=x^{2}-2 \bmod N$
$f(x)=x^{2} \bmod N$
How can i show that these functions are not good pseudorandom functions?