texts: Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse

texts:
Tony Arcieri makes an interesting point in his Imperfect Forward Secrecy article which basically boils down to:

large entities such as NSA are storing encrypted internet traffic, also what's to stop smaller entities such as proxy owners from doing the same
that data should be considered as good as clear text when quantum computers of sufficient strength hit the shelves and as that date grows near more people will start logging encrypted traffic
quantum computers are getting stronger with a good pace (82-qbit computer last year, 512-qbit computer this year) and a not-unreasonable estimate is that quantum computers will hit the shelves in 10-20 years
when this happens much (all?) stored encrypted data will be compromised

Problem existed before of course due to growing strength of computing technology and many protocols where discovered to be flawed by design, but the promise of a computer which breaks modern cryptography and knowledge of existence of giant datacenters which store data encrypted by obsolete standards make it worse.

It doesn't seem acceptable any more to just protect against today's cryptographic threats and know that all of the data you thought secure will be freely available to a patient individual in a not distant future (think of credit card numbers for example, password patterns that many people use etc)

So the question is, what kind of encryption/hashing one can use today to protect against long-term data storage?

Clarification

The "quantum cryptocalypse" simply exasparates a previously existing issue as more parties are likely to store encrypted data and wait for a good cryptoanalytical tool.

Problem lies in the general focus on making data secure "now" which is fine unless there's a sufficient number of entities storing encrypted data to break it later.

Quantum cryptocalipse, real or not, will make a lot of people store encrypted traffic on tapes. Idea behind this question is to find a list of algorithms which are "future proof" to the best of our knowledge and such algorithms should probably be quantum-proof too

Bottom line

OK, so what's the bottom line? Is there an asymmetric cryptography protocol that is not compromised by Shore's algorithm? Are there alternatives to using OTP for session key exchange?


texts:
$\DeclareMathOperator{concat}{\|}$
I'm trying to do the following assignment:

Let $F : \{0,1\}^k \times \{0,1\}^n \to \{0,1\}^n$ be a PRF. Define function family $G : \{0,1\}^k \times \{0,1\}^{n-1} \to \{0,1\}^{2n}$, for all $x \in \{0,1\}^{n-1}$, by $$G_K(x) = F_K(0 \concat x) \concat F_K(x \concat 1).$$ Show that $G$ is not a PRF.
[Remark: To do this, design an efficient PRF adversary $B$ that achieves an advantage close to 1. Remember the $B$ is an algorithm. As such it needs to specify precisely: What oracle queries does it make? What does it do with the answers it receives? How does it decide what guess to make?]

I provided an image of what I have attempted.
The symbol $\concat$ means concatenation. Can anyone can please provide some insight on how to solve this problem.


texts: ElGamal Homomorphic Encryption Formula Question

texts:
With Public Key $(G, q, g, h)$ where $G$ is a group, $q$ prime, $g$ a generator of $G$, Am I right in thinking that:
$$\mathrm{Enc}(m;r) := (g^r, h^r \cdot g^m)$$


texts: (Re) How to validate AES decryption was successful?

texts:
I'm developing a local file encryption/decryption software (AES-256 CBC),
which I want to validate decryption was successful or not.

so I decided to add an additional MD5 hash of plain data to end of plain data and encrypt it together,
and when decryption, calculate the MD5 hash of decryption data(except last additional MD5 hash) and
compare it with last additional MD5 hash.

I want to know if this idea is safe to use.

Is it a bad idea?


texts:
PKCS#1 is one of the most used (de-facto) standard for real-world use of RSA.

That's for good reasons: PKCS#1 is well thought, versatile, understandable, has been relatively stable for over two decades, and remains practically secure in its original form, contrary to some other standardized uses¹ of RSA. The major upgrade to PKCS#1, from v1 to v2, circa 1998, introduced OAEP encryption with stronger security argument, and improved protection against timing and padding oracle attacks of a decryption device. V2.1 introduced PSS signature and multi-prime RSA.

PKCS#1² was updated from v2.1³ to v2.2⁴ in October 2012, and published by February 2013. Changes include:

incorporation of erratas (last updated in 2005) to PKCS#1 v2.1 (last updated in 2002);
additional hashes of the SHA-2 family, including SHA-512/256, SHA-224, and SHA-512/224;
corresponding algorithm identifiers;
corresponding test hex constants;
availability only in PDF format with permission to copy disabled (but who automatically compares to test hex constants anyway?);
updated legalese on the text (which remains worthless if taken literally, as it is of the form "permission to copy is granted if" followed by a condition that is false independently of what the copier does);
in the ASN Module:

PKCS-1 was changed to PKCS-1v2-2 and pkcs-1(1) was changed to pkcs-1v2-2(2);
in the IMPORTS (..) FROM NIST-SHA2 section, modules(0) sha2(1) was changed to hashAlgs(2).

What's the meaning, purposes and consequences of these changes in the ASN Module?

Are there any other technical changes? Is yes, which, and what's their meaning, purposes and consequences?

¹ The ISO/IEC 9796[-1] signature scheme was withdrawn for lack of security under chosen-message attack. The first scheme in ISO/IEC 9796-2 lives with a mild weakness under such condition. That's fixed with scheme 2, which is essentially  PSS-R, and scheme 3 which is a variant functionally substitutable to the broken scheme 1.

² Archive page of the website for RSA Laboratories.

³ Copy as published by RSA Security Inc. Public-Key Cryptography Standards.

⁴ Copy as published by EMC Corporation Public-Key Cryptography Standards.


texts: Given a hash function how to find all/some inputs that hash to 0?

texts:
Say I have a simple hash function where $x$ is a sequence of integers:

$$h(x)=(a_1\cdot x_1+...+ a_n\cdot x_n) \bmod N=\sum_i a_i\cdot x_i \bmod N$$

where $a_1,a_2,a_3,...,a_n$ is the coefficient known.

n can be any number less than 256.

How to find 2 different inputs that hashes to 0 in particular?

I guess I understand how to make them hash to some random hash, but hash to a particular value, 0, seems like I need to solve linear equation?

and the complexity would be exponential in terms of the size of the ouput sequence?


texts:
I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a certificate from the TP?

Also, if I need a user “A” to prove to the verifier his current location (longitude, latitude) in a range without stating the exact location, can the zero knowledge range proof be helpful in that problem? Who should commit to that secret (in This case, user “A”'s current location) so it should be accurate? Can the TP be a trusted timestamped service or Google?


texts: AES-GCM: What can be done if 'H' is known by an attacker

texts:
What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM?

Could the attacker do anything? Add some data in the authentication chain?

Thanks


texts:
If f(n) is a negligible function, is -f(n) also negligible by definition?
Since
$$f(n) < \frac{1}{p(n)}$$ for all positive polynomials $p(n)$ and for some integer N such that $n > N$

Thus
$$-f(n) < \frac{1}{p(n)}$$

Thanks very much in advance.


texts: How can we say there is absolute collision in Baby-Step Giant-Step attack for RSA?

texts:
According to this paper, there is a Baby-Step Giant-Step attack for RSA encryption.
Consider the following Baby Step, Giant Step attack on RSA, with
public modulus $n$. Eve knows a plaintext $m$ and $a$ ciphertext $c$. She chooses $N^2 ≥ n$ and
makes two lists:
The first list is $c^j$
(mod n) for 0 ≤ j < N.
The second list is $m.c^{−Nk}$ (mod n) for $ 0 ≤ k < N $.
The mentioned paper solves this problem by the collision of these two lists.
But how can we say there's a absolute collision in these two lists?


texts: Message expansion in NTRU: why is it $\log_p(q)$-to-$1$?

texts:
Suppose that we are working with the original version of NTRU with parameters $(N,p,q,k,d_f,d_g,d_\phi)$.

In this case we are working with the original NTRU with the digital envelope and the parameter $k$ is described below.

Suppose that we encrypt a message $m$ that is in $\frac{\mathbb{Z}[X]}{\langle X^N-1 \rangle}$.

Recall that $m$ has coeffcients between $-\frac{1}{2}(p-1)$ and $-\frac{1}{2}(p-1)$ and has degree at most $n-k-1$.

The ciphertext is then $e=p\phi \circledast h + m$.

It is said that the message expansion is equal to $\frac{n}{n-k}\log_p(q)$-to-$1$.

Can someone help me explaining why do we have this equalty? I don't quite understand what is said to be "message expansion" in this context...

Thanks in advance.


texts: What is the use of SCRAM-SHA-256 (over SCRAM-SHA-1)?

texts:
The Salted Challenge Response Authentication Mechanism (SCRAM) specified in RFC 5802 can use arbitrary hash functions to operate. The base version from RFC 5802 uses SHA-1.

From my understanding, SCRAM solely relies on the one-way-ness of the function. It does not need collision resistance. It uses extensive salting and possibly many iterations, as well as a clever nonce-based mechanism to thwart replays.

In a discussion about which SCRAM version to recommend, somebody asked why SCRAM-SHA-256 (RFC 7677) should be used at all (even why it was even specified); aren’t the improved security properties of SHA-256 over SHA-1 irrelevant for the SCRAM use-case? Is this simply future-proofing?

RFC 7677 states in the Security Considerations:

  See [RFC4270] and [RFC6194] for reasons to move from SHA-1 to a
     strong security mechanism like SHA-256.

RFC 6194 has the following:

  3.  SHA-1 Security Considerations

  [collision resistance and pre-image considerations for SHA-1]

  3.3.  HMAC-SHA-1

  As of today, there is no indication that attacks on SHA-1 can be
     extended to HMAC-SHA-1.

Note that SCRAM uses the hash function mostly in an HMAC construct; the only exception is StoredKey := H(ClientKey), but StoredKey is never transmitted over the wire and only used as key in an HMAC round. However, StoredKey is stored on the server. I don’t think that a pre-image to StoredKey would be useful, because in the protocol one needs both StoredKey and ClientKey to form the ClientProof.

RFC 4270 is less specific about the hash functions and talks in more generality about how they are used in the IETF protocols and how the attacks affect those uses.

From what I can tell, we can consider two uses of the hash function in SCRAM-SHA-1: 1. The obfuscation of the password through PBKDF2 with HMAC-SHA-1 as pseudo-random function, 2. challenge/response mechanism using HMAC-SHA-1.

Both uses are not mentioned as problematic in RFC 4270, AFAICT.

So to summarize, from what I have gathered:

SCRAM-SHA-256 uses a more expensive algorithm, without apparent security benefits
migration from SCRAM-SHA-1 to SCRAM-SHA-256 is difficult (requires a password change -> user interaction)

So... From that, the only use for SCRAM-SHA-256 seems to be new deployments and future-proofing, is that right? Is there a conceivable weakness of SCRAM-SHA-1 which outweighs the loss of interoperability when moving to or deploying SCRAM-SHA-256?


texts: Is there a way to use a one-way hash function for both sides to "ratchet" an asymmetric keypair?

texts:
Is there any way to derive a series of asymmetric keys, such as using a one-way hashing function, where both sides can predict the next in the sequence?
Detailed Scenario:
Imagine a chat application where two people, Alice and Bob, are sending messages -- each with the agreement to delete any messages received 7 days after they are sent.  And let's assume that some attacker is recording all of the encrypted communications between them.  The goal is to prevent an attacker who compromises a phone from getting more than 7 days of messages, either from the phone, or using any copy of a key on the phone.  Protecting against this requires both Alice and Bob to do two things:

Encrypt each message with a different key
Delete each message after 7 days
Also delete the key used to decrypt the message after 7 days

If they don't delete the key, then when the attacker compromises the phone, they can decrypt any previous messages from their historical record of the encrypted communications.
Partial Solution:
One way this could be done is for each side to publish a new asymmetric public key every day, with the promise that "any message encrypted to this public key (for me to decrypt with its corresponding private key) will be deleted, along with the private key used to decrypt it, on YYYY-MM-DD".  So, each side would receive the updated key every day, and encrypt messages to that public key (or more likely, use that public key to encrypt and deliver an ephemeral symmetric key used for all messages in that 24 hour range).  So long as both sides deleted their message after 7 days, and the recipient deleted their copy of the private key for that day (along with any ephemeral key), then forward secrecy would be maintained: compromising a device would only reveal at most 7 days of messages.
Problem:
The problem with that solution is it requires both sides to be in constant communication, in order to receive a daily key update from the other side.  If Alice were to go offline for, say, a month, then Bob wouldn't know which of Alice's public keys to encrypt a new message with.
Solution / Question:
Which brings me to my question:
Is there any way to derive a series of asymmetric keys, such as using a one-way hashing function, where both sides can predict the next in the sequence?
This is easy with a symmetric key: if you have the key for N=1 in the sequence, both sides can apply the same hash function, and generate the key for N=2 in the sequence.  I'm wondering if there is any equivalent for asymmetric keys, where:

Alice applies a one-way hash function to Alice's private key for N=1, to generate a private key for N=2
Bob applies a one-way hash function to Alice's public key for N=1, to generate a public key for N=2

If so, then both Alice and Bob could anticipate what key will be used for any future date by both "advancing" their side of the asymmetric keypair, even if they lose contact with the other side for extended periods of time.
Thanks!
PS: I'm aware there are other ways to solve this, such as by having each side publish a pool of "pre-keys" that are allocated out as necessary.  I'm specifically asking about if there's any way to directly ratchet both the public and private key.


texts: As far as I know, in the development of ANSI X9.82, there was consideration of OFB_DRBG, a pseudorandom number generator based on block ciphers like CTR_DRBG, but it appears to have been rejected of left out of the final publication, much like MS_DRBG. Is CTR_DRBG safer than OFB_DRBG? If so, is this because OFB_DRBG would be susceptible to a known-plaintext attack?


texts: In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?


texts: How long will my encryption remain private?

texts:
This is a basic question in cryptography but I have not found a good, comprehensive answer.

It is explained that our keys should expire and we should get new, stronger ones with time, reflecting more powerful decryption computing. Does that mean that emails encrypted today will become easier (even trivial) to decrypt in future, so emails encrypted today will eventually lose today's privacy?

If so, what is the general opinion on how this affects notions of privacy by encryption?


texts: Why are ephemeral/session/temporary keys useful?

texts:
One reason that communication protocols use ephemeral keys is to help with implementing Perfect Forward Security.

They're also used in SSL to go from using RSA to using a faster symmetric encryption.

Why else are ephemeral keys used? In particular, if I don't care about Perfect Forward Security, and I already have two machines that have a shared symmetric key, is there any reason to use ephemeral keys?

In AES-GCM, is a 96-bit IV sufficient to not require temporary keys?


texts: Is there any security issue if an attacker recovers the key stream generated by a stream cipher?

texts:
I've learned that a stream cipher like ChaCha20 generates a key stream that gets XORed with the plaintext to get the ciphertext... If an attacker knows the plaintext, he could just simply XOR that with the ciphertext to get the corresponding keystream.
Is there any security issue with this? I realize that it is because of the XORing operation that this is easily possible. Is there an even better way to encrypt the plaintext using the keystream without using XOR, that would also facilitate message authentication?


texts: Why do we need extra hashing if we could use simpler scheme?

texts:
Lets say that we use init vector IV, key K and HMAC key H. Message is M.

Mode of operation is CBC !!!

We usually encrypt this way:

C = crypt(M,K,IV) #encrypted data
R = C + MAC(C)  # final result and + is for con cat

But we could just use:

R = len + crypt(M + H,K, IV)  # notice M + H

Is there something wrong with such a scheme? It looks much faster to me and requires like half the computation and complexity.


texts: Consequences of Flipping a bit in an RSA public key

texts:
I'm taking a cryptography class and one of the previous exam questions is "Alice requests Bob's public key which Bob sends her. She then encrypts the secret number $M$. Unfortunately, Malice flips the fourth least significant bit of Bob's key $e$ in transit which Alice then uses to form the ciphertext $C_1$. Bob can't decrypt so he sends his public key again. Malice leaves the key alone this time and Alice encrypts and sends $M$ in the form $C_2$.

Where $(e_\text{Bob}, n) = (17, 113291)$
 and
$C_1 = 68496, C_2 = 12465$.

I don't really know how to go about doing a problem like this in an exam situation (i.e. with just a calculator) so I'm wondering if there's some trick to doing it without just finding the factors of $n$.


texts: Difference in the Powers of Simulator and Environment in Universal Composability

texts:
I know that in UC model, environment controls the real world adversaries but there is still a simulator wrapped around these real-world adversaries in the ideal world (which we sometimes collectively call ideal adversaries). I wanted to know if all the interaction that happens between the real world adversary wrapped inside the simulator and the environment in the ideal world has to go through the simulator?
If this is true, then the simulator can look at all the messages between the adversary and the environment.
Can someone clarify the powers that simulators have in UC versus the powers that environment have in UC?
Can environment also interact with the honest parties? As far as I know, the environment can only interact with adversarial parties and then try to distinguish the real execution of the protocol from the ideal one.


texts: What information is revealed if we send our points in Projective Coordinates?

texts:
Elliptic Curve Cryptosystem has various coordinate systems; like the Affine, Projective, and Jacobian coordinate systems.
We prefer not to use the Affine coordinate system during the calculations since the operations require inversion and that is much costlier than multiplication.
Katz and Lindell, in their book, wrote this sentence on page #332 of the 2nd ed. (bolds mine);

Specifically, a point expressed in projective coordinates may reveal some information about how that point was obtained, which may depend on some secret information.
To address this — as well as for reasons of efficiency — affine coordinates should be used for transmitting and storing points, with projective coordinates used only as an intermediate representation during the course of a computation (with points converted to/from
projective coordinates at the beginning/end of the computation).

So, what information is revealed? e.g. if we execute ECDH or ECDSA.
Is there a good example that shows how the information leaked?


texts:
I've been reading about Zero Knowledge Proofs with some interest, but I'm still unclear if it can be used to solve my real-life problem.

I'm wondering if someone can help me understand a little better how they work - intuitively it seems possible.

Let's assume I have 3 bank accounts with different balances, 1 balance is known, as read-only credentials to access the account are made public, but the second and third accounts are private, with the credentials kept secret.

Would it be possible to use a Zero Knowledge Proof to conclusively prove that the balances of the second and third accounts are what I say they are?

Including a brief description of what a ZKP is (quoting the ZKP article at Wikipedia):

  In cryptography, a zero-knowledge proof or zero-knowledge protocol is a method by which one party (the prover) can prove to another party (the verifier) that a given statement is true, without conveying any information apart from the fact that the statement is indeed true.

So, extending this definition, the statement in my example would be: the balance of account A = X. Which the verifier would require the prover to prove is true.


texts: Why is the P-521 elliptic curve not in Suite B if AES-256 is?

texts:
In the NSA's document, "The Case for Elliptic Curve Cryptography" (archived), we have

+---------------+-------------------------+-----------------+
| Symmetric Key | RSA and Diffie-Hellman  | Elliptic Curve  |
| Size (bits)   |      Key Size (bits)    | Key Size (bits) |
+---------------+-------------------------+-----------------+
|       80      |            1024         |       160       |
|      112      |            2048         |       224       |
|      128      |            3072         |       256       |
|      192      |            7680         |       384       |
|      256      |           15360         |       521       |
+---------------+-------------------------+-----------------+
             Table 1: NIST Recommended Key Sizes

In NSA Suite B, we do have AES-256 (for TOP SECRET); however, the ECC is limited to P-384:

  AES with 128-bit keys provides adequate protection for classified information up to the SECRET level. Similarly, ECDH and ECDSA using the 256-bit prime modulus elliptic curve as specified in FIPS PUB 186-3 and SHA-256 provide adequate protection for classified information up to the SECRET level.

  AES with 256-bit keys, Elliptic Curve Public Key Cryptography using the 384-bit prime modulus elliptic curve as specified in FIPS PUB 186-3 and SHA-384 are required to protect classified information at the TOP SECRET level.

Despite P-521 being officially codified in NIST FIPS-186-4, an entropic choke point appears to have been introduced, as if we have a cryptographic "pipeline".

Example: If we're doing ECDH with P-384 keys and then use AES-256 to encrypt, we're effectively passing just 192 bits of keying entropy into the AES-256 engine.

Reading the only known response (that I know) on this IETF thread, the statement reads

  Regarding NSA's omission of P-521, P-256 and P-384 will satisfy all of the U.S. Government's requirements so only these are included in Suite B. We don't have a requirement that warrants the inclusion of P-521.

I'm unable to put these seemingly contradictory pieces of information together, so I thought I'd ask other people here. Why was P-521 excluded? Was it technical or non-technical? Any additional info would be appreciated.

EDIT:

This is not very directly related, but I checked some empirical testing results. Seems computation times roughly double going from P-256 => P-386 => P-521, for almost any EC operation. Take for example signing a short (1200 bytes) message.

P-256:  8ms ( 64 byte signature)
P-384: 15ms ( 96 byte signature)
P-521: 30ms (132 byte signature)

It's not directly representative of the entropic bottleneck above, more aligned towards the "good enough" line of thought. But then again, AES-192 should have also sufficed...


texts: Birthday Attack Probability of Collision in Introduction to Modern Cryptography

texts:
I have some questions about the chapter of Birthday Attack in Introduction to Modern Cryptography.

  When $q=\Theta(2^{l/2})$ the probability of this collision is roughly $1/2$

What's the meaning of $\Theta(.)$ and $\Theta(2^{l/2})$, and why the probability of this collision is roughly 1/2 when the $q=\Theta(2^{l/2})$

Thanks in advance.


texts: Hardness or negligibility of finding small non-trivial addition coefficients for random values to sum to zero

texts:
In my cryptographic scheme, I would like to rely on the hardness or negligibility of the following problem or situation, respectively. Note the original motivation: it shall be impossible to find two distinct ways how to sum up $n$ random strings $r_i$ into the same value, no modulo and limited number of additions (follows from overflow prevention in a somewhat homomorphic scheme), i.e., $\sum_{i=1}^n w_{1,i} r_i = \sum_{i=1}^n w_{2,i} r_i$ with limited non-negative integer coefficients $w_{\{1,2\},i}$.

Problem

Given a $\lambda$-bit random oracle (RO) with answers interpreted as (positive) integers and stored in a vector $\bf r$, either find an integer vector $\bf w \neq 0$ s.t. ${\bf w \cdot r }= 0$ and $\lVert{\bf w}\rVert_1 < 2^\nu$ where $2^\nu \ll 2^\lambda$, or answer that such a vector does not exist.

In practice, consider $\lambda \sim 128$, $\nu \sim 32$.

Thoughts

Without the $L_1$-norm limitation, the problem is fairly easy. Indeed, ${\bf w^{(1)}} = (\frac{r_2}{GCD(r_1,r_2)}, -\frac{r_1}{GCD(r_1,r_2)}, 0, \ldots, 0)$ is a "small" solution.

Further note that the (linearly independent) system ${\bf w^{(k)}} = (0, \ldots, 0, \frac{r_{k+1}}{GCD(r_{k},r_{k+1})}, -\frac{r_{k}}{GCD(r_{k},r_{k+1})}, 0, \ldots, 0)$, $k=0, \ldots, n-1$, constitutes a basis of a lattice $\bf W$ where each point $\bf w$ solves $\bf w \cdot r = 0$. It is commonly believed that the problem of finding a vector short-enough with respect to the shortest one in $\bf W$ is hard on average, known as the Shortest Vector Problem (SVP).

However, in this situation, we do not even know how long the shortest vector is, i.e., whether it fits the $L_1$ condition.

Also note that, on the one hand, querying the RO increases the chance of existence of such a solution, on the other hand, the problem of finding it becomes harder.

Ultimate Goal

Prove that either

existence of such a solution is negligible, or
finding such a solution is hard.

Question

Is there any known problem or a research area that would give at least a hint for my problem? Currently, SVP appears to me to be the closest one, however, it does not appear to be sufficient.


texts: Physical entropy source: How many bits entropy per byte is sufficent?

texts:
8 bit / byte  would be perfect obviously.

head -c 1M /dev/urandom | ent

gives ~ 7.9998 bits per byte.

Now, if I have a physical entropy source, how much entropy is sufficent. E.g. my sound card produces 7.8 to 7.9 bits per byte for 1M raw data generated via randomsound.

My main question: Is this amount of entropy sufficient to inject it into the kernels entropy pool?

Clearly, the data from the sound card is internally scrambled again before it is used to produce random numbers. In the end, the resulting entropy is similar to 7.999 bits per byte.


texts: Combining keys after key expansion: is it secure?

texts:
I've found an algorithm taht performs the following: expand the two keys using cryptographic hashing functions so the final keys will look like nonsense ASCII, then XOR them together to create a single key.

Is this algorithm secure?

Is there any benefit to xor together two keys rather than one with the message?


texts: Is there a hash tree scheme designed for complex data structures?

texts:
I have a JSON object with private data. It has the following (complex!) structure:

{
    name: "JB",
    age: 35,
    children:
        [ {
           name: "Alice",
           age: "5",
           favColor: "pink"
          },
          {
           name: "Bob",
           age: "8",
           favColor: "blue"
          },
          {
           name: "Charlie",
           age: "9",
           favColor: "green"
          },
       ]
}

I want to create a hash tree (or similar) that allows others to verify pieces of the data I send them - e.g. by declaring the root on public blockchain. The data structure is arbitrary - it could be anything.

For instance, I'd like to be able to share my age ONLY, and have the receiver be able to compute the hash and check that it is correct. Later, I may want to disclose to a different user that my first child is named "Alice" and her favorite color is "pink".

My understanding is that Merkle Trees are binary - each node has two leaves only - this seems to be the case in the npm libraries I’ve seen. Is there a fixed schema or method for 'flattening' complex structures like the one above into a merkle tree consistently?

Alternatively, is there another type of hash tree structure that provides this kind of complexity innately for data?

For example:

       Root ( = hash of name + age + children)
     /  |  \
    /   |   \
 name  age  children  (= hash of all children in array)
           /      | \
          /       |  \
         /        |   \
      [0]        [1]  [n]
     / | \
    /  |  \
 name age favC

It seems that however the tree is constructed, it is important that the original data's structure is somehow preserved and is can be scrutinised by the validator.

e.g. to prevent me from providing a child's age instead of my own.
In the case of a binary merkle tree: to account for the fact that a leaf index may represent entirely different data depending on the number of children they have.

What is the best way to approach this problem? I'm using Node.JS, and the neat Merkle Tools package, but I'm not sure the merkle tree is the right tool for the job.

Another way of phrasing this question is to ask: is there a hashing schema that allows us to consistently render an arbitrary Json object into a hash tree-like structure consistently? And which facilitates validation by sharing the data + the other hashes. Should I just combine a hash table with trees? Or a hash list with certain nodes being trees?

If I've missed anything important out, or you have any clarifying questions, I will do my best to improve the question. I have redirected the question here, on the advice of the S.O main site.

Many thanks.


texts: What pieces of information do you need to unhash a key to find out the original message?

texts:
I am very new to the hashing world and despite hours of research (AKA Googling) I still don't understand this piece of information. What are the different pieces of information that are needed in order to unhash a SHA-256 key to reveal the original message, besides the original message itself? Or if I am way off base, what information do you need that gets you the closest to unhashing the SHA-256 key?

The closest thing I could find was this question and I would comment a question, but unfortunately, I bear the newbie banner.

If this has been answered, a redirect link or some good reading materials outside of Wikipedia would be great! I am just not sure of how/if I am asking the right questions.


texts:
I can provide input to an application that encrypts plaintext via an unknown algorithm, which I would like to reverse. I can obtain plaintext:ciphertext pairs, and the length of the cipher depends on the length of the input. For example, for 2 character input:

'AA'      82 46 4C 0B 32 11 B7 17 01 35 E2 92 1D 32 91 94 03 D6 37 A0 1B 65 73 FE
'AB'      82 46 4C 0B 32 11 B7 17 01 35 E2 92 1D 32 91 94 42 48 22 84 0D B2 B9 FF
'BA'      82 46 4C 0B 32 11 B7 17 01 35 E2 92 1D 32 91 94 23 BA 6C 97 39 92 7E C4

Input of 3-5 characters results in a longer cipher:

'AAAAAA'      2F 84 BD 26 22 F7 BC 5C 23 CD 5C 80 46 02 E4 56 03 8B DD B9 1A 1D 13 B0 17 BF 1B 2F
'AAAAAB'      2F 84 BD 26 22 F7 BC 5C 23 CD 5C 80 46 02 E4 56 03 8B DD B9 05 26 CB C1 00 00 01 00

At 6 characters the cipher becomes 4 bytes longer still. I have collected some additional input and output here.

How would I go about reversing this encryption? It seems as if the output changes in rather predictable patterns for a given input, but I have no idea how to proceed.

Unfortunately, decompiling the source is not an option, since I cannot access that.


texts: Question on the remote coin flipping problem

texts:
I decided to ask the question here, because although the problem is mathematical, I'm interested in its application here. In the version i read in wikipedia, they suggested the following method for Alice and Bob to agree on a coin flip result from afar:

1)Alice gives Bob a commitment(a box), which contains her 'call', but Bob dosent know what it is.

2)Bob performs the flip and reports the result to Alice.

3)Alice tells the 'key' to Bob who now learns her 'call'. If the call matches the report, Alice wins, else Bob does.

First of all, I want to know how this 'box' is actually implemented, in a relevant crypto system. Based on how the 'box' is actually defined, Alice can always win as follows:
(We assume a 'box' to be a secure file, whose contents are absolutely unknown to Bob. Name this file F)

1)Alice gives Bob the 'box' which contains both possible calls 'tail' and 'heads' of the coin flip(but obviously Bob dosent know anything about the contents by the definition used above).

2)Bob performs the flip and reports the result to Alice(let it be heads).

3)Alice supplies the corresponding key $k_h$ to Bob, such that:
 $k_h(F) = 'heads'$, and alice inevitably wins.(if Bob reported tails, she would supply $k_t$ such that $k_t(F) = 'tails'$)

Basically the file here is a 2-key container, which returns a different result based on the key used. Is the definition of 'box' i gave wrong? What is the correct definition?


texts: what it means by A dot B yields C in Elliptic Curve Cryptography?

texts:
I don't understand what the dot notation is. Is it like a multiplication operation or an addition operation or what? and how is that related to the Elliptic Curve Discrete Logarithm Problem?
For example, this site is explaining an example of dotting two points on the Elliptic Curve


texts: Is there a consensus on what text encoding to use when hashing a string?

texts:
Let's suppose we are hashing a string input from the user via keyboard. A string can be interpreted in many different text encodings (ANSI, UTF-8, UTF-16 and many others). Based on what encoding is used, the underlying binary data and therefore the hashes can be completely different, even though it seems like the same text was entered and the same algorithm was used.

However, I noticed that no matter how many hashing tools I try, hashes are always the same. Hashing apple with SHA-256 gives the same output everywhere.

Is there a consensus on what text encoding to use when hashing a string input?
If there is, how wide-spread this consensus is?
And what is the rationale behind the choice?


texts: How does the Flickr length extension attack work?

texts:
I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there.

m = SECRET || data || padding` and `api_signature = md5(m)

The server sends data and api_signature to the attacker. The attacker now knows:

h = md5(m) = api_signature
data
length of data (Why does he know and why does he have to know?)

Goal of the attacker: append some extra data

How can he do that? He could take api_signature = h = md5(m) and use it as the Initialization Vector of the hash function and hash the extra data and another padding. This is the idea behind the hash length_extension attack, isn't it?

My question: The api_signature will change then because it is calculated like: md5(extra || padding) with the old api_signature as an initialization vector. How is this valid?

And overall: What does the server expect from a "normal" client when he sends this?


texts:
I have a question concerning the paper by Blum, Blum, and Shub introducing the $x^2 \mod N$ Generator.  It is clear that the outputs of the generator pass statistical tests for randomness: the larger the $N$ value the more uniform the output looks with more iteration. But it is unclear to me how the authors proved the output of the generator is uniformly random.  That is, it is not obvious to me that proving difficulty of, say, determining previous states given a present state implies the output of the generator is uniformly random.

Would anyone be able to walk me through a sketch of the proof showing the output of the generator is uniformly random, and thus that the generator is provably secure?


texts: Encrypting and MACing different data with same key

texts: It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a different key than the one used for encryption?  Is it OK to use the same key to MAC one piece of data if I'm going to re-use that key to encrypt some other data under the same key?


texts: Show how an efficient algorithm for computing discrete logarithms with base a can be used to efficiently compute discrete logarithms with base b

texts:
I have an exercise that says the following:
Let $p$ be an odd prime, and let $a$ and $b$ be generators $\mathbb{Z}_p^*$. Suppose that we have an efficient algorithm $A$ for computing discrete logarithms with base $a$. Show how this algorithm can be used to efficiently compute discrete logarithms with base $b$.
With considering a change of base rule, I have done the following:
B(b,x):
    return A(x) / A(b)

Is this correct and the end of the exercise? I would say that it is, but this is very easy compared to the other exercise I'm currently solving, so I think that I have missed something...


texts: Using beginning of TLS ecnrypted data to reveal secret

texts:
I have the following question about TLS security:

Assume TLS-PSK protected HTTP with AES256-CBC cipher.
When a TLS connection is established, client sends some encrypted data, where the
plaintext is well known to an attacker.

For example, it can be a HTTP request, like:

GET /some_resource HTTP/1.1
...

Can an attacker use intercepted ciphertext and known plaintext it to reveal the secret key?

Does TLS have any features to protect from that?


texts: How is it that homomorphic encryption can encrypt program code and run it without decryption?

texts:
In my journey of interest in the world of homomorphic encryption has led me to a concept floating around the internet where they describe homomorphic encryption being used with "mobile agents", which in and of itself a fascinating subject, but I digress...
Specifically from one paper...

Homomorphic  encryption  [is] a  technique  in  which  the encrypted  mobile  codes can  be  executed  directly  on  different platforms  without  decryption.

I think this could easily be used in blockchains employing zero knowledge proofs for anonymity and security, such as ZCash, that wish to implement "smart contracts" without any inputs, outputs, or code being revealed, extending privacy not just for transactions, but also "smart contract" code and possibly function. "Smart contracts" seem to me kind of like a mobile agent. Anyways...
How is this even possible? How would/does it work?
Edit : I removed the link to the paper in question because it was stated as a "nonsense paper".


texts: Elliptic curve point multiplication — who is wrong?

texts:
I am relatively new to ECC, but my understanding is that the result of a point multiplication must still be a point on the curve. I have implemented an ECC calculator in Python, to add and multiply points on any curve mod p.

My misunderstanding is about the curve defined $y^2=x^3+2x+2 \pmod{17}$, with $\# E=19$. As $19$ is prime, Lagrange's theorem implies that all points except the point at infinity are generator points for the cyclic group. Considering the generator point $p=(5,1)$, my program says the result of $891p$ is $(6,14)$, while other online calculators say the result is $(11,3)$, but this point is not even on the curve!. Nearly always, both my own and online programs agree on the resultant point, but occasionally, like in this example, they do not.

Any help on this issue is appreciated, as to who is correct?


texts: Is it possible to generate backdoored DH parameters?

texts:
I know it has been already asked and answered whether it's possible to generate weak DH parameters.

But "recentely" we experienced the Logjam attack, which makes use of the pre-computation capabilities of the GNFS to quickly break many discrete logarithm problem (DLP) instances.

Now I know that the main workload of the GNFS is to do the pre-computation for the given group (more than 99% of the required workload).

Now I've asked myself:
Is it possible to generate DH parameters that allow for speeding up the GNFS pre-computation given some (secret) knowledge?


texts: How to quickly detect incorrect password in encrypted file without compromising security?

texts:
I am developing a software to encrypt/decrypt files/streams using symmetrical encryption algorithm. During encryption phase data wil be compressed and encrypted.

When decrypting data, I want to be able to check whether supplied password is correct. For that purpose encrypted file contains header (which I would like to keep as small as possible), where some signature derived from password is going to be stored.

There are several condition that must be met:

A. Password checking must be as fast as possible and it should not require excessive CPU/memory resources. Risk of using weak/guessable password is NOT present as we declare in advance that only secure, long, random passwords are going to be used for encryption.

B. If we encrypt the same plaintext file twice with the same password, the header and encrypted text must not be the same.

I assume that a theoretical attacker has complete source code of my software. The one and only thing that the attacker does NOT have is password.
My question is - what kind of signature should I use so the security is not compromised?

Here are possible options that I was thinking about and my commentary to them:

Password hash (SHA, MD5, etc.). Probably not a good idea because of risk of precomputed dictionary attacks.
Hash of the salted password. Salt is going to be generated using pseudo-random number generator (PRNG). The initial seed of the PRNG is derived from the password. I suspect this won't help at all since we know that the attacker has access to the source code - so the attacker will always be able to generate salt for the given password and, hence, generate the hash. Then the attacker can write proprietary software which will be able to perform dictionary attack agains files encrypted with my software using our own hash-generating algorithm.
Using key derivation function (KDF), like PBKDF2. This does not meet condition A, because all good key derivation functions should deliberately use excessive CPU/memory resources.
Using HMAC. I am not very good at understanding HMAC, but I think that in this case HMAC would not be used for what it was designed. I don't need to verify integrity of the password AND the encrypted file (or, in cryptographical terms, key and the message). I just need to verify whether the password is correct.
Other options?

I would be grateful if someone who understands cryptography better than me could give me some ideas or comments.


texts: Break large exponent calculation into smaller calculations?

texts:
I am implementing SRP on an embedded platform. It has crypto acceleration and I am using its built in modular exponentiation function, however it doesn't seem to be able to handle an exponent over 32 bytes long. I have an exponent i need to use which is 64 bytes long.

Is there a way to break this exponentiation into smaller exponentiations that the modular exponentiation function can handle?


texts: How to Implement Deterministic Encryption Safely in .NET

texts:
I am trying to implement a deterministic encryption scheme in .NET.  This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, message] as the nonce. This is effectively the same as AES-SIV.

In .NET, there is no implementation of AES-SIV.  AES-CTR mode is also not available in .NET.  The only .NET compatible library which implements AES-SIV I can find is Miscreant .NET.  This is not FIPS validated.

Does anyone have any suggestions on how to implement a deterministic encryption scheme in .NET?

This post is a continuation of a previous post.

My Project: I have several bankers who will send the balance information for thousands of bank accounts to a server.  The account numbers will be encrypted using this scheme prior to sending to the server for security purposes.  The server deliberately will not have the private key [I'm setting up a zero-knowledge encryption scheme].  On the client side, Banker1 and Banker2 must be able to encrypt the account number in a deterministic way that allows any Banker to decrypt account numbers returned from the server.  For this reason, I decided to use HMAC(message) as the nonce for my encryption scheme and append it to the ciphertext.  AES-CTR[ k1, nonce, message] || HMAC[ k2, message] where nonce = HMAC[ k2, message].

Thank you!


texts: Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?

texts: I was wondering if the prime numbers defined for use with Diffie-Hellman in RFC 3526 are more trustworthy than generating one's own, especially considering the recent Arjen Lenstra paper (Ron was wrong, Whit is right) which criticized the similarities detected in public keys and prime numbers across the Internet. Am I better off generating my own safe primes, or am I better off using the ones defined in RFC 3526?


texts: Trying to find an algorithm to share portions of a key with multiple people

texts:
Sorry if this question's a bit basic, but I don't know of any way to ask it concisely enough for a search... What I'm looking for is a proven means of doing the following:

Create x number of strings so that any combination of at least y of those x can be used to recreate a message.

For example: if I have "this is my message" (the message), I'd like to split it up in some way where I can give 10 people (x) part of the message, but ensure that the message can be reconstructed accurately as soon as any 7 of those people (y) combine their individual components.

In reality this message would be a public key for encryption, although I don't see how that would really matter. Ideally, both x and y would be as variable as possible (one algorithm/approach which works when x=10 and y=7, as well as when x=50 and y=1, as well as when x=5 and y=5, etc).


texts: Is it possible that a signing algorithm produces no output?

texts:
I am reading Vadim Lyubashevsky's paper on Lattice Signatures without Trapdoors and I came across a somehow counter-intuitive part where he defined an algorithm $\mathcal{A}$:

$y\leftarrow D_\sigma^m$, where $D_\sigma^m$ is the discrete Gaussian distribution centered at $0$ with standard deviation $\sigma$ on $\mathbb{Z}^m$.
$c$ is some hashed value
$z\leftarrow Sc+y$, where $S$ is the signing key.
output $(z,c)$ with some probability.

The pair $(z,c)$ is the potential signature and can only be output with the given probability in step $4$. He also mentioned that if nothing was output, the signer runs the signing algorithm again until some signature is outputted.

I just can't imagine an algorithm that doesn't give an output wherein the algorithm above, it seems that it will always produce a certain output. It also seems to violate the definition of an algorithm by Knuth. Am I missing something here?

Thanks!


texts:
Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ?

If they are to be unique per message then what is the advantage of giving tweak directly into the message than giving IV ?

Edit : Is there a way in which we need not give unique tweak per message but get same security levels as giving unique IV per message ?  as there are many ways of providing a tweak .


texts: Is OTP with homomorphic encryption trivial?

texts:
If my key size is as large as the data I'm encoding, is it trivial to devise a theoretically secure homomorphic encryption scheme for integers (or else any finite/infinite group with order) that supports $+$ as an operation on encrypted data? Plus points if your scheme is computationally inexpensive or easy to understand.

Formally, $e(k,a+b)$ can be computed quickly  from $e(k,a)$ and $e(k,b)$ where $k$ is the key. Theoretically secure means it should be impossible to determine any $a_i$, given a large number of samples $e(k,a_i)$ unless $k$ is known. Also $e(k,a)$ shouldn't be constructible for known $a$ unless you know $k$

I tried coming up with an example, which I couldn't but it does appear quite doable.

A use case for this could be say secure online voting, wherein the vote count is a small data value but it would be good if the votes can be added in by servers who themselves don't have access to the vote count.


texts: Will D-Wave's quantum computers ruin classical encryption?

texts:
D-Wave has commercially available 512-qbit quantum computers now.  A lot of big names are taking it seriously.  Google, NASA, and USRA have joined forces to start a quantum AI lab.

How far are we from destroying classical encryption?  Perhaps a more direct question, what will it take for my bitcoins to be in danger of a quantum brute force attack?

EDIT: I posted this question after reading a similar one, but felt that it was relevant since the other question is 2 years old now and DWave seems to have made new developments (major increases in qubit depth, new interests).
The comment below mentions that DWaves machines aren't crypto-breaking capable, and also that QC is only effective against asymetric encryption (the bitcoin kind!).  I wonder if someone can expand on these points...


texts: Birthday problem applied to hash function with partition of the input set

texts: I am not able to understand why if we consider a regular hash function, it is possible to say that we are partitioning the starting set and then apply the the birthday paradox/problem. Can anyone explain?


texts: Parameter choice Supersingular Isogeny DH

texts:
In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as:

Supersingular curve $E$, and
bases $P, Q$ generating the torsion subgroup $E[l]$ respectively for Alice and Bob.

The parameters for the key exchange generated by Alice would be:

Random elements $m, n$.
The isogeny with kernel $K := \langle[m]P + [n]P\rangle$.
Some other stuff beyond this question…

So the question is:

Why does it not suffice to generate the torsion subgroup (respectively the isogeny, defined by kernel) with just one point $P$? Taken the subgroup $\langle P\rangle = E[x]$ i could also generate an isogeny. Also the final isogeny could be generated by Bob using only $\mathit{Alice}'$ resulting curve $E_{\mathit{Alice}}$ and the image of the the point $P_{\mathit{Alice}}$ as well as Bobs secret parameters.


texts: Verifiable, Distributed Secret Santa Assignments

texts:
My family was planning a secret santa and I thought about how I might write a little web app to dole out these secret assignments. But the downsides to this approach are obvious: there's no way for the users to know that I'm a) generating the results randomly and b) not snooping on the (secret) assignments myself.

In the real secret santa, there's no central authority giving out pieces of the assignment. Rather, there's a process by which each user draws names out of a hat and is trusted to redraw if they pick up a name violating one of the constraints (themselves or sometimes a spouse). While drawing, each user is trusted/observed to not be peeking into the hat and only redrawing under invalid conditions.

So my question is: under a message-passing framework, what scheme requires the minimal amount of trust, but produces a valid game where nobody knows the other assignments?

The closest I've been able to achieve is a ring system where a arbitrary starting client draws a random, valid assignment for themselves and then sends that assignment to the next one in the ring. Then this user randomly draws a valid assignment which is not in conflict with the previous assignment, ORs those two together and then sends it off to the next client. This could be repeated until a valid total assignment is generated (some assignments become invalid towards the end eg: the user at the end receives only one name: their own).

This is pretty sub-optimal though as the first and last assignments can be computed by the second and second-to-last users respectively. In addition, each user must be trusted to

Draw random names
Keeping the first valid assignment
OR-ing their assignment with the previous assignments and sending it off

I'd say the 2nd and 3rd are shared with the physical game (you're trusted not to throw multiple names in, take multiple names out etc...) but it's the 1st condition which I can't seem to eliminate (or verify).

Forgive me if this is a silly question, but I had fun pondering this while laying in bed for a few minutes and wondered if someone else might have any insights.

Thanks!


texts: Observing cipher suites and certificate algorithms without man-in-the-middle

texts:
I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without mimicking server certificate through a proxy in general?

My main goal is to obtain weak algorithms that parties agree upon.

For example, if client and server get on MD5 or SHA1, DES or CAST included cipher suite, or on SSLv3, or, if server sends my client a certificate signed with SHA1, or an expired certificate etc., I want to detect this traffic.

Note: I already asked a question about specific server technologies here: Server Fault Question


texts: Deep Learning application in decryption?

texts:
If the output of an algorithm when interacting with the [encryption] protocol matches that of a simulator given some inputs, it ‘need not know’ anything more than those inputs.

Can a machine learn to find a method to break encryption protocols?
How is that possible, to decrypt ciphers using deep learning methods?


texts: Regarding the feasibility of MPC protocols

texts:
I know that there is a general result stating that any function can be computed in an MPC protocol. In this question, I'm interested in understanding the practicality of MPC protocols.

Are any theoretical results regarding the feasibility of MPC protocols? To be more specific, are there any functions that are infeasible to compute in an MPC?
Even more specific, are there any 2-party computations that are impractical to run (assuming that both parties are honest), yet are practical to run by a single party that held both inputs?


texts: Encrypt without password, decrypt only with password

texts:
I'm trying to implement a password manager and I want to achieve this behaviour.

User enters a master password once (eg. when the program is first run) and a key/hash of some sort is derived and stored (from which the original password cannot be recovered)
User can then choose to store data in the password bank eg.
store --id=myid --data=datatoencrypt. This data is encrypted using AES without having to prompt for a password using the stored key from step 1

At this point the encrypted data stored cannot be recovered without the original password, but new data can be added without the original password

store get --id=myid
Please enter your password: *******
The data is: datatoencrypt

I hope this makes sense. Any pointers on how I can achieve this? (I'm guessing a combination of asymmetric and symmetric encryption


texts: Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits

texts:
I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$

For example if my IV is equal to 1, Calculating with Len would be 8-bit result, If we subtract, $\operatorname{len}(IV) / 128$ and calculating the result is 1 subtracted by 8 would be 7, Real number 1 or it is taken as 8-bit byte, and it would be and the rest would be 0?

And the 128 which is outside what is the function, multiply? And read the steps, but reading the explanation of the document and reading the formulas confuses me.

If $\operatorname{len}(\text{IV}) ≠ 96$, then let
$s= 128\big\lceil \operatorname{len}(\text{IV})/128 \big\rceil-\operatorname{len}(\text{IV})$, and let
$J_0=\operatorname{GHASH}(\text{IV}||0s+64||[\operatorname{len}(\text{IV})]64)$.


texts:
In the article "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any multiple of φ(n).

Imagine I know the public and the private key. But what I really want is the factors of n, the p and q but I connot use any factorization algorithm in a large number of n.

In the Miller's article it is suppose to say how I can find the two factores, knowing the public and private key. But I cannot understand how exactly it is done. Does someone know? Or have a small example?

Appreciated


texts: Correct method to encrypt data so that it can be decrypted only by Alice and Bob

texts:
I need to build a system that stores encrypted transactions. Transaction involves always two parties. Payer and payee. Both must be able to download encrypted transaction from server and decrypt it using their own private key. And likewise issuing transaction must be possible by either one just by knowing both's public keys.

Is it safe to encrypt exactly same message twice (using different public keys), first by Alices public key and then by Bobs public key?(and make both 'versions' available) That way Alice can decrypt the first one and Bob the second one using their private keys. If attacker knows that two encrypted messages are actually the same, can that information help him crack the encryption?

Or is there a smarter way? And what algorithm do you recommend? I was thinking of RSA


texts: Some terms related to secret sharing: Optimality, What does it mean?

texts:
In any secret sharing scheme we have to develop step by step.
After constructing such scheme we need to reduce share size. Why?
e.g. Robust secret sharing scheme is modified Shamir secret sharing scheme with error correcting REED SOLOMON codes.
In order to gain near optimality we need to reduce share size. Why? what is optimal in any secret sharing scheme? How do i know it's optimal?
From cheater resilient (t,$\delta$) robust secret sharing scheme ,it says that the scheme is optimal. How do they know?


texts: Concatenating "words," is it possible to create a key that is indistinguishable from one made in a truly random manner?

texts:
By concatenating "words" and adding them Modulo 26, can we create a key that cannot be distinguished from one that was generated in a truly random manner?
For example, let's say we use three "words" to create a key (EATED, PIG, ELEPHANTINE), whose lengths are coprime, using Modulo 26 addition:
  EATEDEATEDEATEDEATEDEATEDEATED...
  PIGPIGPIGPIGPIGPIGPIGPIGPIGPIG...
  _______________________________
  TIZTLKPBKSMGIMJTIZTLKPBKSMGIMJ...

  ELEPHANTINEELEPHANTINEELEPHANT...
  _______________________________
  XTDISKCUSFQKTQYAIMMTXTFVWBNIZC...

And sender and receiver have already agreed that they will only use certain values, say the 4th, 19th, and 21st letters of the final string, as the key.  (I, M, X) The rest will be discarded.  Then we use a different set of words and a different choice of values to keep, say the 6th, 11th, and 21st, determined ad hoc beforehand.  The sender and receiver must have shared this information beforehand in a secure manner, of course.
The point is to get rid of the one-time pad and only have a list of words and numbers on you.
Repeat with different sets of three or more words whose lengths are coprime until we have our key, let's say thirty characters long.
Let's say we use a combined dictionary of Mandarin Chinese, Russian, and English words that has a total of 180,000 possible words (Mandarin and Russian are phoneticized).  Let's say we choose each word in a random manner.
Only using a small number of letters from each result is going to create a short key and require effort, but the question is this: would such a key be indistinguishable from one generated in a truly random manner?
I think so--if the words are long enough and coprime to each other and the words were chosen in a manner that was random  i.e., it did involve a TRNG.
Indistinguishable or not?


texts: Is it possible to unpad a file that is not padded

texts:
I used "AES/CBC/PKCS5Padding" to encrypt some files. But I did not provide any identifier to detect if the file is encrypted or not. Now one way to detect if a file is encrypted or not, that I can think of, is to try to decrypt it and see if there is a padding miss match.

Now my question is,
Is it possible for some random file to match the padding scheme?


texts: Are there any deterministic multi-block encryption constructions that have an avalanche effect going both ways?

texts:
For common multi-block encryption schemes (CBC, CTR, CFB, stream ciphers, etc), if they are forced to be deterministic, a change in the plaintext will change only the current block and maybe future blocks, but the past blocks are unchanged.

Using DES-CBC as an example, I've fixed the IV as to force it to be deterministic. (DES is used here for the small block size, for convenience)

Input:  0001020304050607 08090a0b0c0d0e0f 1011121314151617 18191a1b1c1d1e1f 2021222324252627 28292a2b2c2d2e2f
Output: 4c72f896d0b5c010 96cafa256bd7bf8c 7f3dfa17eb0721d6 2db73b14cfa32977 e87a8caf18ace662 298640486525ca14

Now to change one bit in the third block.

Input:  0001020304050607 08090a0b0c0d0e0f 1011321314151617 18191a1b1c1d1e1f 2021222324252627 28292a2b2c2d2e2f
                                              ^ Change
Output: 4c72f896d0b5c010 96cafa256bd7bf8c 123ea45b2bc1d45b 876ee075d04e5c61 ea59edd03137781b 57cd1fafa7849fe2
                                   Change ^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^

You'll notice that the first two ciphertext blocks are the same.

Are there any deterministic constructions that allow for any change of any bit in the plaintext to affect every bit of the ciphertext?


texts:
I followed the algorithms 14.4 (computes 1st and 3rd coordinates in (X,Y,Z)#k modulo n) and 14.5 (factorization using ECM) in David Bressoud's book 'Factorization and Primality Testing'. I think the algorithm is similar to Lenstra's, it uses the formula Y^2 - X^3 - aX, where the values for X,Y and a are chosen at random.

Here is my code in C++: http://pastebin.com/EnqCyJkk

I also found someone else's implementation of this algorithm, it's easier to read than mine: http://futureboy.us/frinksamp/ECM.frink

The program eventually finds factors, but it is really slow, I'm not sure if this is just a slow algorithm, I'm using the wrong parameters, or I have coded something incorrectly.

Any input would be really helpful, I've pretty much given up on this factoring obsession :/


texts:
I need to copy a graph of elements with uuidv4s each, and separately stored relations containing element uuidv4s.

On copy, I need to change the ids. Of course all relation ids should still point to the correct corresponding location in the copy.

So I need a deterministic f(uuidv4): uuidv4 function.

I can work with a temporarily cached lookup table. But I wonder if there's a hashing function with the same result? This would give the added benefit of establishing a free relation between the original and the copy, which I otherwise will have to model as another relation.

E.g. I could create a new uuidv4 from a truncated sha256 output of the original uuidv4. But it does seem to violate the idea of random uuids for getting the necessary entropy.. Are there some thoughts on how the entropy may be affected?


texts: Increased security weaknesses when truncating SHA1

texts:
Given the following preconditions:

A plaintext A (~512bit length), that is hashed by using SHA-1 and truncated to (the first) 64 bits.
I know both, the plaintext and the truncated hash, and want to perform a Second Preimage Collision Attack.
Furthermore, a part of the new plaintext B, that should produce the same (truncated) hash value, is fixed (the same as in plaintext A), the remainder can be choosen randomly.

Are there any increased weaknesses when truncating SHA1 to the first 64 bits only (besides the decreased number of bits)?

Are there any other circumstances (like controlling a whole block of 512 bits, equality of both plaintexts in all but one word, controlling the last block, etc.), that could interfere with the truncation, so that there are further weaknesses that could facilitate the cracking?

Are there any attacks against SHA-1, that aim for a Second Preimage Resistance Attack?
Most of what I found were birthday attacks (that could increase the possibilty to find a collision from $1/(2^{80})$ to $1/(2^{60})$). I understand, that a preimage attack on full SHA-1 is not feasible, but a theoretical attack could help me to make the cracking of the partial hash possible.

The required number of tries to find a collision on this hash with a probability of 50% is $2^{63}$, right? This would take around 150 years on a single GPU.


texts: What is the difference between a PRF and a PRP, and are cryptographic hash functions the same as HMAC (PRFs or PRPS)?

texts: I read one answer to a similar question that put forth that a hash function is distinct from a PRF, however I've also found materials purporting that cryptographic hash functions are PRFs, and I'm not sure now. Also, is HMAC a PRP because of being keyed? I thought that a cryptographic hash function being keyed (i.e., with a constant prepended/appended to the input) was what determined whether it was a PRF or a PRP, however upon searching more I've become increasingly confused. Right now I think that a hash function is a PRF and that an HMAC is a PRP, and that this is because HMAC is keyed.


texts: Recover elliptic curve order from ECDSA signatures

texts:
I need the elliptic curve order to recover the private key from two signed messages with ECDSA.

What I have:

two signatures signed by the private-key I want to get
the messages that have been signed
the random $k$ used to sign both messages

So breaking the Cipher should go like that:

$k = (z - z')(s - s')^{-1} \bmod n$

$d = (s \times k - z)  r^{-1} \bmod n$

The Calculations are clear, but the elliptic curve order $n$ is missing.
Can I calculate $n$ somehow from the signatures like I can do for $r$ and $s$?  Or is there any other way to do this?


texts:
As defined in the specification of OCB, the tag depends only on the checksum (that is just the binary sum of plain blocs), so if we construct two messages that have the same sum (this is very easy to do), we can get two different ciphertexts that have exactly the same tag.

So we can easily mount a ciphertext integrity attack against OCB and the game of the semantic security can be win with a probability one (we can construct a new valid ciphertext using a previously obtained one).

What am I missing that OCB is still considered secure?


texts: Do well-known hash functions have any "impossible" output values?

texts:
What I'm wondering is whether the codomain and image of common hash functions are strictly equal… or whether there are any known values which have no possible preimage.

For example, SHA-1 outputs a 160-bit digest. Can it be proved that every possible sequence of 160 bits is a possible output of SHA-1 (even though corresponding preimages cannot be easily computed, by design), or are there certain outputs which can be demonstrated to be impossible based on the construction of the hash function?

This question about uniformity of hash function output seems related, though what I'm interested in has less to do with overall uniformity, and more with provable existence/non-existence of any preimage for specific outputs.


texts: Is NIST testing all the round 2 submissions to quantum-resistant crypto?

texts: Is NIST confirming the self-published quantum-resistant crypto round 2 data and do they make that available to the public when they do?


texts: Is a private RSA key vulnerable to a chosen plaintext encrypted with that private key?

texts:
I grasp that having known plaintext encrypted with the public key doesn't provide a means of discovering the private key (that being the whole point...).

But if one were in a situation where they didn't have access to the private key, but did have access to decryption by the private key, would the actual key be vulnerable?

So the attacker generates a plaintext and passes it to the decryption program as though it were a message encrypted with the public key. That plaintext thus gets transformed via the private key (though instead of going from ciphertext to plaintext as usual, it goes from plaintext to ciphertext). Would that plaintext-ciphertext pair reveal information about the private key or is it similar to trying to deduce the private key from a known plaintext and ciphertext pair encrypted using the public key?

On that note, is it possible to deduce the public key from a known plaintext and ciphertext encrypted with it?


texts: I know it is believed that primes appear to be randomly distributed among the integers.  Is there a formal conjecture or theorem that expressly states that the occurrence of the prime numbers is random?


texts: How can we decrypt all RSA messages given a function that can efficiently decrypt a small percentage of all possible ciphertexts?

texts: I saw this question in a paper and was not able to solve it. Assume that we are given an efficient algorithm called RSA_break() that can decrypt, without the knowledge of the private key, 1% of all possible ciphertexts encrypted using the public key (n,e) in RSA. Basically, for a single ciphertext, RSA_break() will deterministically output the entire original plaintext or return a failure. For 1% of the set of all possible ciphertexts, RSA_break() always succeeds, while for the rest 99%, it will always fail. How can I use this RSA_break() function as a building block to build an efficient algorithm to break all possible ciphertexts?


texts: "Homomorphic" one way function for public/private key pairs

texts:
Is there a signing scheme relying on a secret key $s_k$ and public key $p_k$ for which we can find a one way function $h$ such that we can efficiently calculate the public key associated with $h(s_k)$ from $p_k$.

For instance, with the ElGamal signing scheme, we'd be looking for a one way function $h$ such that for all $g$ and $s$ in $\mathbb{Z}/p\mathbb{Z}$ we can efficiently compute $g^{h(s)}$ from $g$ and $g^s$.

Alternatively, being able to verify that a given value is indeed the public key associated with the hash of the secret key would be enough.

(The goal is to get some kind of non interactive forward secrecy with certain properties.)


texts: How does padding oracle attack work with bytes larger than possible length?

texts:
I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented:

Assume that each block $C$ has 16 bytes, {..}. The MAC size in SSL 3.0 CBC cipher suites is typically 20 bytes, so below the CBC layer, an encrypted POST request will look as follows:
POST /path Cookie: name=value... \r\n\r\nbody || 20-byte MAC || padding

Then the authors go on explaining how one can decrypt a previously unknown byte of the cookie:

The attacker then replaces $C_n$ by $C_i$ and forwards this modified SSL record to the server.

I understand it so far. The only problem I have is this, since the padding is 1 to L bytes long (where L is our block size in bytes, 16 in our example) we only can decrypt bytes with values between 1 and L right ? Let's say the last byte in the block $C_i$ equals to 0x0020, how would I decrypt it ?


texts: Is this a secure (and correct) sign-then-encrypt technique for transferring messages?

texts:
After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the technique I'm using is considered secure and preferably best practice.

This process assumes that the sender and receiver have already exchanged public keys in a secure way and they are satisfied that the public keys are correct for the person they wish to communicate with.

I am using the following asymmetric keys:

RSA 1280-bit for encryption
ECDSA 256-bit for signing

The encryption process:

Prefix the plain text with the sender and receivers public RSA keys (to be used for confirmation by the receiver).
Get the SHA256 hash of the data from step 1 (public keys and plain text).
Sign the hash with senders private ECDSA key.
Prefix the original plain text with the signature.
Generate a random 128-bit key and 128-bit IV using a cryptographically secure RNG.
Encrypt the data from step 4 (signature and original plain text) using AES-128 in CTR mode with PKCS7 padding.
Encrypt the key and IV using the receivers public RSA key and prefix it to the encrypted message from step 7.
Send the encrypted data from step 7 to the other uses, preferably over a secure channel.

The decryption process:

Use the receivers private RSA key to decrypt the key and IV.
Decrypt the remainder of the message in AES-128 using the key and IV from step 1.
Extract the plain text message from the data in step 2 and prefix it with the expected sender and receivers public RSA key.
Get the SHA256 hash of the data from step 3 (public keys and plain text).
Extract the signature from the data in step 2 and verify the signature against the SHA256 hash.
If the signature in step 5 is not valid either the message has been altered or the expected sender / receiver was not correct, in which case abort.
Return the plain text message to the user.

From what I've been reading this seems to be the correct way to transfer the data securely from one party to another. I've not worked out if there is a better way to verify that the expected sender and receiver are correct.

Are there any changes I should be making to this process or is this the correct method to use?


texts: Which hash algorithms are suitable for use with Elliptic-curve cryptography

texts:
I try to use Elliptic-curve cryptography system first time really, so i confused about it.
this is the scenario:
First i want to hash a message then, sign it. i use javascript so i try to follow this code.

The reason of my confused is why this code use 'sha256' algorithm to hash a message? is there any reason for that?

Also is there any hash algorithm customized or preferred to use with ECC?

To be more clear, is ECC using to sign and generate keys but does not have a special algorithm to hash a message?

thanks.


texts: I need to encrypt/decrypt data from my software by AES, the problem is how to make the AES key secure, there is no HSM, should I hard code the key in my code? It seems that a hacker can read the key data by reverse engineering the software.


texts: Is there any recent cryptographic algorithm especially designed for low-level processors?

texts:
Most modern algorithms require relatively large amount of resources.
Is there any recent (and freely usable) encryption/decryption algorithm which is specially designed for low-level microcontrollers in mind? This means it has to run fast, (on a very simple, 8 or 16 bit, 10-20 MHz processor), be small (few hundred bytes to few kilobytes) and use as little RAM as possible.

The key is "modern" because if I took something designed in the 1970's (which would satisfy the requirements for a simple and low-level processor) it might have big security vulnerabilities.

If only the decryption part satisfies the requirements, it's also enough.


texts:
In many cases why going through the security proofs I have seen that some does it using a blackbox reduction to some known hardness assumption DDH and others do it using a hybrid argument by arguing the indistinguishability between the hybrids is equivalent to adversary's advantage in the DDH game.

What I don't understand how to decide when to use blackbox reduction techniques and when to use the hybrid one. Is there any good way to know which one is a good fit while proving security?


texts: How can I introduce a new method of encryption to the world?

texts:
The cryptography algorithm I designed is a completely new algorithm and has no similarity to other existing algorithms. But because I am an ordinary person, I have no facilities and the ability to introduce this algorithm except through my website http://twincodesworld.com.

Given the fact that there are no absolutes, this algorithm may also have weaknesses that would affect its validity. Therefore, the website was created solely for testing this algorithm, so that the algorithm will be publicly released if approved by experts in the field. But despite repeated attempts and correspondence with reputable technology websites, nobody was willing to help me. Please guide me and help inform this.


texts: Polynomial division hardware implementation

texts:
I am beginning the implementation of the polynomial binary division algorithm now as I understood i will be checking the MSB bit if 1 to XOR and shift the sum if 0 i will only shift.
What I am not getting well with is the numerator and denominator degree calculation and when to stop the the division
in a case of a polynomial division with M=8 and an irreducible polynomial :
X^8+X^4+X^3+X+1 will be divided by X^6+X^5+X^2+X
at first I will have to pad with zeros to obtain the same size

I have found that shifting the numerator by L and denominator by K until hitting the first '1' will give me the degree being M-L and M-K-1 of each polynomial
and the division will be of Deg(N)-Deg(D) cycles
in this example:
it will be:
Numerator: 100011011
Denominator: 01100110

Numerator MSB is 1 then degree(N) is M-0=8
Denominator MSB is 0 : then it will be shifted to the left by 1 and the Degree(D)=8-1-1=6
the needed counter is 8-6=2 steps and 8-6+1=3 XOR operations

what I would like to ask is this a correct way to start and won't the following degree calculation step includes a large hardware delay since it is done sequentially and M might get to 233

What is the best way of calculating the :
Degree of numerator and denominator
and when can i know where to stop the division

Thank you


texts: Have I understood pedersen commitment correctly?

texts:
I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed integer which then can be verified.

In the pedersen commitment scheme we have six pieces of data $p$, $c$, $g$, $h$, $x$, $r$. $p$ is the prime order of the group. $c$ is simply $g^x·h^r \bmod p$. $g$ and $h$ are generators of $\mathbb Z_{p\mathbb Z}^*$. $x$ is the committed value and $r$ is a random element.

The scheme would then proceed as follows.

We choose a prime $p$ and generators $g$ and $h$. Can this be some fixed elements that are used every time or must we pick new ones for each run? If so, how? $p=2g+1$ would work, but what about $h$?
We pick our committed $x$ and generate a random element $r$ in the group.
We calculate $c$ and publish $p$, $g$, $h$ and $c$.
To reveal, we simply reveal $x$ and $r$, which then can be verified by recalculating $c$.

Would this be a correct implementation or have I misunderstood something?


texts: Newbie question: one-way functions in cryptography

texts:
I'm reading this article on the basics of cryptography and it says that the main principle is about taking such an algorithm that knowing the end result and the algorithm, an eavesdropper wouldn't be able to determine the initial data.

They give an example:

Supposedly, I know the numbers in the second and third row, but don't know the x and can't derive x. But I can: all I need is to do something like this:

for (int i=0; i<100_000_000; i++)  {
      if (i%7==5)  {
        if (getPower(i, 3)!=-1)  {
            System.out.println(i+", " + getPower(i, 3));
        }
      }

}

It gives me:

243, 5
177147, 11

meaning, that 243 and 177147 are 3^5 and 3^11 respectively and also give the residual 5 when divided by 7. So it doesn't look like a one-way function to me.


texts: Would the Fiat Shamir identification scheme be more secure if I design it with an exponents higher than 2?

texts: Let's say both Prover and Verifier would use nth power instead of 2nd when creating public keys and when verifying. I know it would slow it down but would that cause the protocol to be more secure?


texts: Security of AES under modification of Sboxes and/or MDS mixing layer

texts: Is the security of AES algorithm increased by using many s boxes at the same time instead of using only one s box , and the same question for using many MDS  instead of only one.


texts: What is the security risk if an encryption key is not random?

texts:
Ok, I just jumped into crypto and now struggling with some points…

I read lots of resources, most of them mention how important the strength of the encryption key is. However, I could not find much info about that.

What if the encryption key is not generated randomly and somehow is fixed or easy to be guessed? And what if the key contains lots of zeros in it? What could be the security risks?


texts:
I want to truncate an AES128-CMAC from 16 down to 8 bytes length.
Citing RFC, "[...] It is possible to truncate the MAC. The result of the truncation should be taken in most significant bits first order. [...]".

When using CryptoJS to generate such a CMAC over "Hello World" using the key "0xDEADBEEF CAFEBABE DEADBEEF CAFEBABE", this yields: 0x2425a8ff 14cea36d 0a14b3e8 3dbfc68e.

I am not sure, whether my truncated CMAC according to the afore-mentioned definition is either 0x2425a8ff 14cea36d or 0x0a14b3e8 3dbfc68e.
Or in other words: Is 0x24 of the CMAC the most- or least-significant-byte?
How does it affect security when taking the wrong 8 bytes?


texts: Brute force attack on DES + property of DES

texts:
In a brute force attack on DES, it seems to me that one plaintext-ciphertext pair suffices to launch the attack. (I.e. suppose we are given a message $x$ and a ciphertext $c$ such that $DES_k ( x ) = c$, where the $56$-bit key $k$ is unknown. Then going through all $2^{56}$ keys will eventually give the result.) I am, however, unsure about this, as in Katz/Lindell's book Introduction to Modern Cryptography on page 179 (line -9) they seem to suggest that "these attacks require a large number of input/output pairs...". This sentence thus confuses me, as to me it seems that one pair suffices.
Related to the first point, is the following statement true?

Statement. For all messages $x$ and all keys $k_1, k_2$, if $DES_{k_1} ( x ) = DES_{k_2} (x)$ then $k_1 = k_2$.

I'm not sure if it holds. Have been thinking about it for a while.
In Katz/Lindell they say that an exhaustive key search happens "in time $2^{56}$". I do not completely understand this statement. I do understand that there are $2^{56}$ keys in total. So, in the worse case scenario, it will take $2^{56}-1$ "steps" (i.e. DES-applications). So if they speak about "time", do they always mean worse-case scenario-time?

However, the expected value (of the needed "time") seems to me to be $2^{56} / 2 = 2^{55}$. Is this correct?


texts: Is it insecure to encrypt the wrong plaintext?

texts:
Most plaintext must be fed as a string or a binary object to be encrypted.
However, it's often possible to mis-decode the plaintext before encrypting it.

i.e. If it's received as a string in JSON, you often don't know if the string
is an encoded representation (e.g. plain, hex encoded, base64 encoded, etc)

Example:

If the message to encrypt is received as 48656c6c6f (which is Hello in hexadecimal encoding), it's possible to accidentally encrypt 48656c6c6f instead of Hello.

When you decrypt, you'll get back whatever you started with, so it's easy to
never know you are encrypting incorrectly.

This results in a plaintext input where the variation per-byte is very small.
If you accidentally encrypt 01001000 as an 8-byte string instead of a single
byte (0x48, H), then each resulting ciphertext byte is the result of only
one of two inputs: 0 or 1.

Question:

Is it insecure to make this mistake?
Is the ciphertext somehow easier to break because you used the wrong plaintext?
What if you make this same mistake with the key instead of the plaintext?

Example Ruby code:

require 'openssl'

=begin

Most plaintext must be fed as a string or a binary object to be encrypted.
However, it's often possible to mis-decode the plaintext before encrypting it.

i.e. If it's received as a string in JSON, you often don't know if the string
is an encoded representation (e.g. plain, hex encoded, base64 encoded, etc)

Example:
If the message to encrypt is received as "48656c6c6f" (which is "Hello" in hex),
it's possible to accidentally encrypt "48656c6c6f" instead of "Hello".

When you decrypt, you'll get back whatever you started with, so it's easy to
never know you are encrypting incorrectly.

This results in a plaintext input where the variation per-byte is very small.
If you accidentally encrypt "01001000" as an 8-byte string instead of a single
byte (0x48, 'H'), then each resulting ciphertext byte is the result of only
one of two inputs: '0' or '1'.

Question:

* Is it INSECURE to make this mistake?
* Is the ciphertext somehow easier to break because you used the wrong plaintext?
* What if you make this same mistake with the KEY instead of the plaintext?

=end

real_plaintext = "Hello" # 5 bytes
plaintext_1 = real_plaintext.unpack('H*').first
puts plaintext_1 # 48 65 6c 6c 6f
plaintext_2 = real_plaintext.unpack('B*').first
puts plaintext_2 # 01001000 01100101 01101100 01101100 01101111
plaintext_3 = [real_plaintext].pack('m')
puts plaintext_3 # SGVsbG8=

# Stream cipher used here to make it more obvious about
# the different resulting lengths
def encrypt(str, method='aes-256-ctr')
cipher = OpenSSL::Cipher::Cipher.new(method)
cipher.encrypt
key = cipher.key = cipher.random_key
iv = cipher.iv = cipher.random_iv
cipher.update(str) + cipher.final
end

puts "Result of real_plaintext:"
result = encrypt(real_plaintext)
puts "Len: #{result.length} - #{result.unpack('H*').first}"

puts "Result of plaintext_1:"
result = encrypt(plaintext_1)
puts "Len: #{result.length} - #{result.unpack('H*').first}"

puts "Result of plaintext_2:"
result = encrypt(plaintext_2)
puts "Len: #{result.length} - #{result.unpack('H*').first}"

puts "Result of plaintext_3:"
result = encrypt(plaintext_3)
puts "Len: #{result.length} - #{result.unpack('H*').first}"


texts: What is the most an adversary can do in the context of public key masquerading?

texts:
Suppose two parties A and B are using a public-key encryption scheme in order to communicate securely. A and B both have a public/private key pair:

$$ A: (P_A, S_A), B: (P_B, S_B)$$

and A already knows about B's public key but has no proof of authenticity.
What is the most an adversary C can do while impersonating one of the parties (we assume there is no authentication employed). For example, if C masquerades as B and creates a key pair:

$$ C(P_B, S_C) $$

he may be able to trick A into sending it encrypted messages with the public key of B, but not more since not being in possession of B's secret key C cannot retrieve the message from A. But what more can C do from this point with retrieving the secret key of B? In a more concrete setting, how can the RSA scheme be exploited as mentioned above?


texts: Is it possible to cryptographically prove when was the last time a ciphertext was decrypted/encrypted?

texts:
I want to provide a service that encrypts and decrypts documents and I want to provide the users with proof that I haven't stolen their secret key and read their documents.

I know I can prove when a document was last modified with cryptographic timestamping.  Is it possible to prove a document was or was not encrypted/decrypted in a given time period?

Off the top of my head, I'm thinking maybe there's some way to arrange that some kind of proof-of-work would be needed to encrypt/decrypt a document, but I'm not comfortable with inventing my own crypto.


texts: Could a larger block size increase the security of the block cipher?

texts: I want to know if a larger block size increase the security of the block cipher?


texts: Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$

texts:
The Congress of ThéOùÇa enacted that civilian use of any public-key encryption system is authorized on the territory of ThéOùÇa, subject to meeting certain security requirements published by the Ministry of Defense. The essence of these is:

  ..must operate per the internationally recognized RSAES-OAEP algorithm and relevant requirements in PKCS#1 V2.2, with a 2048-bit public modulus $n$ product of two primes $p$ and $q$. In order to ensure separation of key domains with the Pailler cryptosystem used for national defense purposes, the key generator shall be such that $p$ and $q$ also meet the requirement $\gcd(pq, (p-1)(q-1))\ne 1$. Demonstration of conformance to that requirement shall be by submitting the mathematical description of the key generation method to the Ministry of Defense of ThéOùÇa.

Can a public-key encryption system lawfully usable by civilians on the territory of ThéOùÇa be secure? If yes, give a possible submission to the Ministry of Defense (English is spoken in ThéOùÇa). In either case, make a cryptographically convincing argument.

Thanks to Poncho for spotting a big mistake in my transcription of the Official Journal of ThéOùÇa, now fixed.

This is not homework. If you wonder, inspiration was that recent question.


texts: Is linear secret sharing over the addittive group of integers modulo $p$ with $p$ non-prime secure?

texts:
In Maurer, Ueli. "Secure multi-party computation made simple." Discrete Applied Mathematics 154.2 (2006): 370-381. I have found the following technique for $k$-out-of-$k$ linear secret sharing:

And the note regarding the domain says this:

Is using as domain $\mathbb{Z}_p$ (additive group of integers modulo $p$) with $p$ non-prime secure? Does it make any difference if $p$ is prime or not? What is the most general definition for the domain (I do not get exactly the meaning of the note)? My guess is that $p$ can be any integer.


texts: ElGamal cipher decryption (reposted not from guest account)

texts:
My sincerest apologies for having to repost this but I can't edit or post a comment from the previous one I asked with a guest account.

I'm learning about the Diffie-Hellman and ElGamal ciphers, but I'm really struggling trying to decipher the exercise my lecturer has given me.

The information I've been given (all in decimals) is

g

p

a (Alice private key)

A (Alice public key)

B (Bob public key)

C (ciphertext)

I've tried calculating a shared secret S = B^a mod p then inversing it and multiplying that by C as my lecturer described in the lecture but it doesn't work. Is that wrong and if yes what am I supposed to do??

I used this tool to perform the inverse operation (inverseMod(a,b))
http://www.mobilefish.com/services/big_number_equation/big_number_equation.php


texts: Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?

texts:
We have

a HMAC key (128 bit/16 bytes)
an AES key (128 bit/16 bytes)
an AES IV (128 bit/16 bytes)
a random salt (128 bit/16 bytes)

Each packet is signed with a HMAC (SHA256)

After each packet is sent, all those keys are packed together into a 64 byte array (HMAC + AES Key + AES IV + salt). Take the SHA512-hash of that nonce. Take the result and:

xor the first 16 bytes with the HMAC
xor the second 16 bytes with the AES key
xor the third 16 bytes with the AES IV
xor the fourth 16 bytes with the salt

The keys are generated using the Windows's Random Number Generator and shared via RSA with OAEP padding (PKCS #1 v2.1).


texts: What's the difference beteween SIDH and SIKE?

texts:
I'm a semi newbie in crypto (I've had that uni course of discrete math that includes basic cryptography principles) and wanted to go a bit further in isogeny graphs.

I have downloaded the C implementation of SIDH/SIKE from the Microsoft Github page and can't understand the difference between the two. However, most of the resources I find online are either sketchy youtube videos or unreadable academic papers using terms I am unfamiliar with. Any resources/ideas would be appreciated.


texts: How can I split a message in parts of similar size or smaller?

texts:
I have a 130-160 characters message that I need to split in say, 3 parts, and be able to reconstruct it by recovering all 3 parts. I also need that these parts are type-able, meaning that they can't be too long (I mean not much longer than the original message), and they can't contain weird characters.

I tried with Shamir but the results are too long. I used PassGuardian for that.

Any suggestions?

You can also help me with the tags so the right people is able to find this post.


texts: Encrypted counter as IV in CBC mode encryption using same key

texts:
I'm currently working with a secure transport protocol that defines the IV to be a counter (incremental nonce) to be encrypted with the same key. This is a followup to a protocol that did not provide any kind of IV.

Could you please describe the possible attack vectors on CBC encryption using this encrypted nonce?

Furthermore, the protocol has the following characteristics:

a MAC is calculated over each encrypted message and verified before decryption (including any parameters send)
session keys are used that are recalculated each time the protocol is initiated
the session is lost when any error is detected in the protocol
the protocol is half duplex, with the attacker having full capabilities on the communication layer, but limited (if any) influence on the sender and receiver
the cipher used is AES with sufficiently random session keys

Would these characteristics alleviate any of the concerns of using an encrypted counter using the same key?

Related question: What are the constraints for an IV using AES in CBC mode?

[EDIT]

Note that for this case the counter and IV are not send or included in the MAC calculation - which seems to be the main issue with the protocol.


texts: Challenges of Fiat-Shamir Transformation of ZK Proof / Sigma Protocol

texts:
Let $\Sigma$ be a sigma protocol whose commitment, challenge and response phases are $\Sigma_1, \Sigma_2, \Sigma_3$, respectively.

In Fiat-Shamir Transformation, the challenges are $H(\Sigma_1)$ where $H$ is some hash function.

However, in some literature, instead of having $H(\Sigma_1)$ it is $H(x \parallel \Sigma_1)$, where $\parallel$ denotes concatenation and $x$ is the common input. For example, if $\Sigma$ is the graph 3-coloring protocol, $x$ would be the corresponding graph.

Why consider the concatenation with $x$? Is $x$ there in order to prevent malleable attacks?
Consider a language $L \in$ NP and suppose that a prover P wants to prove to a verifier V that $x \in L$. We use the classical reductions of $x$ to a SAT instance and then to a G3C instance. Call this reduction $t$. In this way, $x \in L$ iff $t(x)$ is a 3-colorable graph. Now we can apply the Fiat-Shamir Transformation, and the challenges become $H(t(x) \parallel \Sigma_1)$.
Is it possible to make the challenges $H(x \parallel \Sigma_1)$ instead of $H(t(x) \parallel \Sigma_1)$, thus avoiding increase of the input of $H$?

Thanks in advance.


texts: Keys and key-stretching when authenticating requests?

texts:
I'm making a REST application and still a bit confused about this issue. basically, to authenticate incoming requests, I give out userId, issued timestamp,  expiry timestamp (normally 3 months after issue) and the signature for client to use for next requests. for every incoming requests, server will use userId, issued and expiry timestamp and calculate the HMAC using SHA-256 and here, I'm using a global secret key (so, 1 secret key is shared by all requests in an application).

My questions are:

I've seen people including http method, url, query params, etc as message payload. what's the downside of my approach of only using userId, issued and expiry timestamp and none of those?
Is it recommended to use 1 secret key per user instead of per application?
For password hashing, I know we need to use key stretching. Do we need to do the same with message auth? I'm worried that it might be too much a burden for server.


texts: What does this paraphrase of the birthday problem mean?

texts:
The following is an excerpt from A Generalized Birthday Problem - David Wagner:

  One of the best-known combinatorial tools in cryptology is the birthday problem:
  Problem 1. Given two lists $L_1, \space L_2$ of elements drawn uniformly and independently at random from $\{0, 1\}^n$, find $x_1 \in L_1$ and $x_2 \in L_2$ such that $x_1 \oplus x_2 = 0$.

It's not so intuitive for me to understand. In my understanding, the birthday problem is about the probability that at least 2 people in a room have the same birthday. How does the birthday problem transfers to this? Please give me some hints.