texts:
This may be trivial, and may be impossible... this is outside my field but willing to learn.

I have a hardware device that accepts a network MAC address (6 bytes of data) like this:
38-60-77-EC-1D-33

and produces a 2-byte hash, like this:
F0-9B

The same address always produces the same hash, and I can test any address I want, but only by hand. I have tried a handful of addresses to see if it's just a linear value, but it's not. This may simply be a checksum - there's no obvious security application, it's just a hardware handshake.

... is it going to be possible to reverse-engineer this? If so, how should I go about it?

This is going to be hard, isn't it.

Edit: Here are some samples:

00:00:00:00:00:00   684C
00:00:00:00:00:01   1717
00:00:00:00:00:02   96FA
00:00:00:00:00:03   E9A1
00:00:00:00:00:04   9520
00:00:00:00:00:05   EA7B
00:00:00:00:00:06   6B96
00:00:00:00:00:07   14CD
00:00:00:00:00:08   9294
00:00:00:00:00:09   EDCF

01:00:00:00:00:00   DF52
02:00:00:00:00:00   1BC7
00:01:00:00:00:00   BB1B
00:00:01:00:00:00   6434

Edit #2:
There is clearly a pattern. I've run 50 strategic numbers and so far I've figured out that:

The last digit repeats a pattern every 16 (F) numbers where every number appears exactly once. The digits change after 256 (FF) numbers but still repeat in groups of 16.
Also in each group of 16 numbers, the first digit is one of only 4 numbers. Each group of 16 (so far) uses a different 4 numbers, but the order they appear is perfectly consistent.

I think at this point it's just going to be "educated" brute force, but I'm much more optimistic than I was 4 hours ago. I've tried a few online checksum calculators, but if this sounds like a known algorithm I'd appreciate the help, and I'll keep hacking away...


texts: Type 2 to Type 1 pairing transformation - why not considered?

texts:
How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting $e' : G_2 \times G_2 \rightarrow \mu, (P,Q) \mapsto e(Tr(P), Q)$, where $e : G_1 \times G_2 \rightarrow \mu$ is Type 2 pairing and $Tr$ is the trace map?

The only drawbacks I can see is that points from $G_2$ have rather nasty representation and there is performance loss associated with the need to calculate $Tr$. Is it enough to not consider such object or are there other problems with this approach?


texts: Known methods for constant time (table-free) AES implementation using 'standard' operations?

texts: There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar approaches that allow a constant-time AES to be implemented using only standard C operations? The closest thing I've seen is this byte oriented AES implementation, but it uses input-dependent loops to compute logarithms and exponents for the sbox.


texts: Why an upside down path on the evaluation of branching program on encrypted data?

texts:
Suggested by Ricky Demer in this post, I am reading the paper "Evaluating Branching Programs on Encrypted Data"(TCC 2007), which uses one-round strong OT protocol to implement homomorphic evaluation of branching program (BP) on encrypted data with succinct ciphertext.

As it says on page 6, the natural way to evaluate a BP is

  The output $P(x)$ of a branching program on an input assignment $x$ ... defined by following the path induced by $x$ from [the initial node] $v_0$ to a terminal node $v_l$ ... The output is the value $\psi_V(v_l)$ labeling the terminal node reached by the path.

Apparently, this is a up-to-bottom process, from the initial node to one of the terminal nodes.

However, the encrypted version of BP evaluation on ciphertext $c$ (corresponding to the cleartext $x$) seems to use a totally different (and which is strange to me) method (on page 11):

  To evaluate $P$ on $c$, the server makes a bottom-up" pass on $P$, starting with the terminal nodes $T$ and ending with the initial node $v_0$ ... at the end of iteration $l$, the initial node $v_0$ is labeled by an OT answer which can be viewed as an (iterated) encryption of the output value $P(x)$ ...

So what's the omitted part of this upside down algorithm (that I should have known), and why?

PS: Another (maybe small) question, am I right to say $P$ of this scheme can be reused, on the contrary to Yao's one-time Garbled Circuit setting?


texts: Does the size of a file influence the randomness if used as random input?

texts:
(I am a cypto amatuer )
So in Openssl there is the "-rand" option for taking a file containing randomness for the RNG . So I thought taking a pretty big file would make it more secure .
So if you use a lets say 2048 bit random binary file form "https://www.random.org" made from cosmic noise you would be pretty safe right ? But the problem is that the if I used the file multiple times it is alway the same "random" input so i would have to make the file secret . So It would be better to change like one 0 or 1 in the 2048 bit every time using it right ? But here comes the Question : How much does changing a single character in 2048 bit affect the randomeness of the Output in the end ? Is it like hashing where the output is completely different after changing only one bit or will the output be pretty much the same ?


texts:
Is there already a cipher which uses a method like vigenere yet the shifted encrypting alphabets are mixed?

i.e.

ASDFGHJKLZXCVBNMQWERTYUIOP
BNMQWERTYUIOPASDFGHJKLZXCV
CVBNMQWERTYUIOPASDFGHJKLZX

etc.


texts: How to pad messages with large amount of padding

texts:
I'm playing around with an application for secure email-like communication and I want to perform length hiding padding on the plaintext messages so they always have a consistent size before encrypting with AES.

I would like to do PKCS7 style padding (if possible), because it's easy to figure out how much to strip from the decrypted output, but how would you do such a padding if the amount of padding exceeds what can be described with one byte? i.e. if I have a message that is 2.000 bytes in size and I want to pad it to become 16.000 bytes in size. This requires a padding size of 14.000 bytes which is 0x36B0 in hex, how would the padding look like for such a value and how can I know that I should take the last two bytes instead of the last byte to find the padding size?

Thanks in advance!


texts:
This is about the new W3 WebcryptoAPI draft standard.

Here is a post by one of it's authors

https://plus.google.com/u/0/105761279104103278252/posts/CSwVZ1RUijo

It says its in part trying to change the "Javascript Cryptography Considered Hamrful" problem. However if you look at the "Javascript Cryptography Considered Hamrful" article -  http://www.matasano.com/articles/javascript-cryptography/ - it seems as if most of the problems still remain unsolved. The only problem solved is that you won't have hand coded cryptographic functions in javascript - these will be provided by the browser. However, the remaining problems still remain.

Your thoughts?

(I originally asked this at stackoverflow but did not receive any useful response.)


texts: Does including the size of the hashed data improve security over just the hash

texts:
Trying to settle a discussion at work. We are mostly concerned with pre-image resistance.

Suppose we have a common secure hash function $H$ (e.g. SHA-1/SHA-2) and some message $M$ we want to hash. The message has length $M_L$. For the message we provide the digest $D$ and the length of data digested $D_L$.

With regards to preimage-resistance, for which common hash functions is it more secure to check that

$H(M) = D$ $and$ $M_L = D_L$

rather than just checking

$H(M) = D$

?


texts:
I've been reading the wikipedia page, trying to get a better understanding of how to produce a collision.

http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities

The wikipedia page above states:
"two colliding files is a template file with a 128-byte block of data, aligned on a 64-byte boundary that can be changed freely"

What does 64-byte boundary mean, Does that mean I can't change byte 64 but I can change the other bytes in the 128-byte block of data?

Furthermore, how do I verify that two different files generates the same md5 without using a program, just by looking at the bits?  (This part is a homework question, if you guys can point me in the right direction, that would be great).


texts:
Let $G: \{0, 1\}^n → \{0, 1\}^m$ be a PRG. We construct a function $G': \{0, 1\}^{m + n} → \{0, 1\}^{2m}$ defined as follows
$G'(x || y) = x || (G(y) ⊕ x)$
for all $x ∊ \{0, 1\}^m$ and $y ∊ \{0, 1\}^n$. (The symbol || denotes here the concatenation of binary strings.)
Is $G'$ a PRG?

I believe that it is not, but I could easily be wrong.
I know, given a random string s of length $2m$ (split into equal length strings $s_1$ and $s_2$), that $s_1$ would be equivalent to $x$, and that $s_2 \oplus x$ would be equivalent to $G(y)$. But since $G(y)$ is indistinguishable from $U_m$, I'm having trouble reaching the conclusion of my contradiction.
I'm still relatively new to all of this, so any help would be appreciated.


texts: Does it make any difference when salting database passwords with Random vs SecureRandom?

texts: I want to salt database passwords and then compute the hash but I wonder if I should use Random or SecureRandom? From an attacker perspective would it be easy to break if Random is used or SecureRandom is used or does it make no difference? if yes why? if not, why not?


texts: What are good combinations of public key algorithms or primitives for long term security?

texts:
There has been talk in literature about doing multiple encryption with different block ciphers or stream ciphers several times before, and the benefits and risks of such efforts. There may be hidden assumptions or weaknesses in designs of symmetric cipher algorithms, or perhaps they have been deliberately sabotaged by a hidden weakness by the design team, while on the other hand implementing multiple symmetric cipher algorithms introduces more ways that the code can go wrong and potential security problems in the implementation itself.

Focus on multiple symmetric ciphers to me strikes me as a misplaced concern, considering that the hardness assumption for symmetric ciphers seems largely based on the hardness of searching the keyspace. While its possible that there are breaks in one modern symmetric cipher that doesn't break another, it is starting to seem less likely.

Public key cryptography however relies on many different hardness assumptions, and so it seems strange to me that there hasn't been an effort to come up with protocols for multiple encryption with algorithms that have different hardness assumptions. The RSA problem is broken by factoring the modulus, elliptic curve cryptography is broken by discrete log, lattice based cryptography is broken by solving the shortest vector problem, and so on. And it seems all hidden subgroup problems for finite Abelian groups are broken in quantum computers (discrete log and factoring) and some groups that are 'close' to Abelian groups are also broken on quantum computers (factoring in quaternion groups for example.)

If we were to build a protocol or implementation that relied on multiple cryptographic primitives or algorithms for key exchange and signing, which  would be appropriate for such a scheme? Obviously some algorithms are more compute intensive than others, and some users would prefer more performance over security so we might want to rank them in terms of performance and a guess on the hardness.

I have in mind creating certificates that are grounded in multiple hardness assumptions, so if one link in the chain is broken, the whole scheme doesn't fall apart.


texts:
Are there any hard problems related to matrix factorization?
Suppose $E$ is hermitian with public eigenvectors such that $U^T\Lambda U = E$ with $U$ public but $E,\Lambda$ secret. Given $X$ secret, we would "encrypt" it as $EX = U^T\Lambda UX$ can you create instances such that $f(U,EX) \rightarrow X$ is not polynomial time?
I believe matrix inversion is polytime, but I am not sure if this is worst case or average case. First thing you can do is knock off the first term so $UEX = \Lambda UX$, and with $U$ public, but $\Lambda,X$ chosen perhaps to make the problem hard, is this still possible in polytime?


texts: How can I avoid calculating with huge numbers when implementing the RSA algorithm

texts:
There is 26-letter English alphabet.

There is the plain text: TRYAGAINLATER.
I need to encrypt it by RSA algorithm with the public key 53.
What is the ciphertext?

Therefore:
M = TRYAGAINLATER,
M=19 17 24 0 6 0 8 13 11 0 19 4 17.

Encryption: $c = m^e \pmod n = m^{53} \pmod{26}$

The problem is that $m^{53}$ is huge number. How can I avoid this?


texts: What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?

texts:
I am trying to understand the FIDO U2F Raw Message Format, especially the format in which a user public key should be provided.

The documentation says the following:

  A user public key [65 bytes]. This is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve.

I have parsed the following provided key pair in HEX format with the jsrsasign JavaScript library:

// p. 19. l. 340-341
var PUBLIC_KEY = '04b174bc49c7ca254b70d2e5c207cee9cf174820ebd77ea3c65508c26da51b657c1cc6b952f8621697936482da0a6d3d3826a59095daf6cd7c03e2e60385d2f6d9';

// p. 19 l. 338
var PRIVATE_KEY = '9a9684b127c5e3a706d618c86401c7cf6fd827fd0bc18d24b0eb842e36d16df1';

This gives me access to (hopefully) all relevant data for this keypair:

- ecparams
    - G:ECPointFp
        - curve:ECCurveFp
            - a:ECFieldElementFp
                - q:BigInteger
                - x:BigInteger
            - b:ECFieldElementFp
                - q:BigInteger
                - x:BigInteger
            - q:BigInteger
        - x:ECFieldElementFp
            - q:BigInteger
            - x:BigInteger
        - y:ECFieldElementFp
            - q:BigInteger
            - x:BigInteger
        - z:BigInteger
    - curve:ECCurveFp
        - a:ECFieldElementFp
            - q:BigInteger
            - x:BigInteger
        - b:ECFieldElementFp
            - q:BigInteger
            - x:BigInteger
        - q:BigInteger
    - h:BigInteger

However, I am completely lost trying to construct a message of 65 bytes from this information.


texts: What would be an adversary advantage in case of GCM authentication?

texts:
Philip Rogaway has written a formula for CCM mode where the adversary advantage is given as:
$$adversary\_advantage \leq \frac{q_{dec}}{2^t} + \frac{\sigma^2}{2^b}$$

Can we use this formula to find GCM data integrity? Is there a similar document for GCM mode?


texts: Will varying plaintext compensate for a fixed initialisation vector?

texts:
This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest.

I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option I have available is CFB mode with a fixed (0x00) IV. I can choose my cipher, and have chosen AES-256.

Encryption and decryption are performed without the need for the application to 'know' the key, which is stored securely 'elsewhere'.

For the sake of this exercise, the PANs are 16-byte numbers (16 decimal digits); the attack I'm currently addressing is theft of a copy of the database, with all the encrypted PANs, any of which can be repeated.

I fully understand that the use of a constant IV is a weakness, but this is beyond my control.

Will any of the following options mitigate the weakness?:

I have an 8-byte binary clock available whose contents change once every microsecond or better, and which repeats every ~130 years. I prepend this clock to the plaintext PAN before encryption, and discard it after decryption.
The same, except that I prepend and discard two copies, to complete the first 16-byte block.
I generate 8 bytes of random data and prepend.
I generate 16 bytes of random data and prepend,

Specifically, I should like to know:

a. Are 16 bytes sufficient while 8 are not?

b. Are random bytes sufficient while the µsec clock is not?

c. Do these options completely compensate for the weakness of the fixed IV?

At the risk of flogging a dead horse, some additional comments, following the excellent answers (especially from @D.W.)

I have always agreed to the principle of 'Do not roll your own', but now, even more so.
I think it relevant to point out that these 'messages' never transit, but are only stored 'at rest', and that the attack I'm defending against in this exercise is 'they stole my database'. So I'm not sure what
D.W.'s chosen plaintext attack is a real eye-opener.
In this scenario (input, charge, store, perhaps retrieve for refund), I'd like to understand better what advantages authentication would bring me.
I'd welcome further comment on using the TOD clock as an IV. Here are some additional details:

The TOD clock is 64-bit integer representing the elapsed time since 00:00 on Jan 1,1900.
The clock is updated in such a way that bit 51 is guaranteed to be updated once per microsecond. Bits 0-51 are the unsigned number of elapsed microseconds.
On faster machines, bits in the range 52-63 are also updated at their corresponding frequencies.
The system in question runs as a single image on a single real machine.
Clock synchronisation is unlikely to set the clock backwards, but let's analyse that case:
If at peak I'm doing 100 encryptions per second (the real number is a lot less), and I assume the slowest clock (1M per second). Let's suppose that the clock gets set back by 5 seconds (I believe that to be extraordinarily extreme. It's GMT, by the way so there's no daylight saving)
Now, I apply the birthday paradox to 1000 encryptions (5*(100+100)) in 5 million; the probability of two or more synonyms is less than 1.3E-7


texts: How does the energy consumption of the SHA-3 finalists compare?

texts: I am curious, is there any paper where SHA-3 competitors are compared in terms of energy efficiency?


texts: what is the difference between proofs and arguments of knowledge?

texts:
What is the difference between proofs and arguments of knowledge in the context of zero-knowledge?

I have read this sentence in this ePrint:

  It is useful to distinguish between zero-knowledge proofs, with
  statistical soundness, and zero-knowledge arguments with computational
  soundness. In general proofs can only  have  computational
  zero-knowledge,  while  arguments  may  have  perfect zero-knowledge.

It is also indicated in this article that:

  Zero-knowledge protocols come in several flavors, depending on how one formulates the two security conditions: (1) the zero-knowledge condition, which says that the verifier “learns nothing” other than the fact the assertion being proven is true, and (2) the soundness conditions, which says that the prover cannot convince the verifier of a false assertion. In statistical zero knowledge, the zero-knowledge condition holds regardless of the computational resources the verifier invests into trying to learn something from the inter-action. In computational zero knowledge, we only require that a probabilistic polynomial-time verifier learn nothing from the interaction.1 Similarly, for soundness, we have statistical soundness, a.k.a. proof systems, where even a computationally unbounded prover cannot convince the verifier of a false statement (except with negligible probability), and computational soundness, a.k.a. argument systems [BCC], where we only require that a polynomial-time prover cannot convince the verifier of a false statement.

Which I assume that a zero knowledge argument is just a zero knowledge proof that has computational soundness rather than statistical soundness.

Am I right?


texts: SHA-256 Hashing problem from binary values

texts:
For a school project we have been given some example hexadecimal numbers to hash like the following:

Len = 2 (in bits)
Msg = c0
SHA 256 - MD = 1e1cea10a23697dc97b423c259842ac12ee679d6b43f088f3c32b26dbbfb0d79

The binary representation of c0 is 11000000, but as the length is 2 units, I assume that the binary number to be hashed is 11, which corresponds to 3 in decimal. Using online hash converters, I cannot get the example hash value back. What am I doing wrong?


texts: Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?

texts:
New to site so this may have been asked before: Can multi-prime RSA, i.e. where N is product of three or more distinct primes, be used for secure communication while allowing distinct authoritative entities to decrypt the messages when under a proper court order to do so?

For instance, let $N=p\cdot q\cdot r$, let $(N,e)$ be the public key and let $(N,d)$ the private key as usual. But have the generating algorithm securely send $(N,e,p)$ to, say, the Supreme Court, $(N,e,q)$ to the Executive and $(N,e,r)$ to Congress. Then no one entity alone could decrypt, but any pair could.  Can this or some variation work? Would this require that two-prime RSA be outlawed?

It is also known that multi-prime RSA has a narrower range of exponents vulnerable to the lattice-based reduction algorithm attack. See N. Ojha and S. Padhye "Cryptanalysis of Multi Prime RSA with Secret Key Greater than Public Key", IJNS, Jan. 2014.


texts: Is there a cryptographic scheme that achieves both confidentiality and integrity?

texts:
Suppose that Alice wants to send a relatively long message M to Bob. Also, suppose that both Alice and Bob have a set of {PK, SK} for public key cryptography.
Alice proceeds to encrypt the message M with a symmetric-key K, using a symmetric-key algorithm, such as AES. Therefore, an encrypted message C is generated.
Afterwards, Alice goes on to encrypt the symmetric key K, using (firstly) her Secret Key and (lastly) Bob's Public Key. The idea behind the double symmetric key encryption is that both confidentiality and integrity will be achieved.
She sends C and the double-encrypted symmetric-key to Bob.
Bob firstly uses his SK and then uses Alice's PK to obtain the symmetric-key. Lastly, he is able to decrypt the ciphertext (C) and obtain the original message (M).


texts: What are the contents of a certificate and how can I view it?

texts:
I understand on a conceptual level that a certificate is nothing more than just a verified public key. The next question I have, is how exactly do I see the contents of a certificate? Apart from the public key it verifies are there other information that the certificate contains? Does the certificate also contains the signature of the public key etc. etc.
Pointers on how to further explore certificates would be appreciated!
Edit
I am mostly thinking about the ones used with HTTPS/TLS


texts: Security of CCM in TLS, in comparison to GCM, SHA or SHA2 for the digest

texts:
I've been looking into TLS cipher suites of OpenSSL and mbedTLS (previously called PolarSSL) and noticed that mbedTLS supports the CCM mode of operation (See list here), whereas OpenSSL does not. If I understand this correctly, this provides authenticated encryption and therefore covers the message hashing in TLS, like GCM.

Looking up CCM, I couldn't find much information on its security. How does it compare to GCM or SHA1/2?

Edit:

mbedTLS TLS cipher suites with CCM:

TLS-RSA-WITH-AES-128-CCM
TLS-RSA-WITH-AES-256-CCM
TLS-RSA-WITH-AES-128-CCM-8
TLS-RSA-WITH-AES-256-CCM-8
TLS-DHE-RSA-WITH-AES-128-CCM
TLS-DHE-RSA-WITH-AES-256-CCM
TLS-DHE-RSA-WITH-AES-128-CCM-8
TLS-DHE-RSA-WITH-AES-256-CCM-8
TLS-ECDHE-ECDSA-WITH-AES-128-CCM
TLS-ECDHE-ECDSA-WITH-AES-256-CCM
TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8
TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8
TLS-PSK-WITH-AES-128-CCM
TLS-PSK-WITH-AES-256-CCM
TLS-PSK-WITH-AES-128-CCM-8
TLS-PSK-WITH-AES-256-CCM-8
TLS-DHE-PSK-WITH-AES-128-CCM
TLS-DHE-PSK-WITH-AES-256-CCM
TLS-DHE-PSK-WITH-AES-128-CCM-8
TLS-DHE-PSK-WITH-AES-256-CCM-8


texts:
Is the MD5 prefixing attack still valuable to an attacker if he doesn't know the postfix of the string?

For instance,  what if the following sanity check was being used:

if attacker_controlled_sanity_code == md5(attacker_controlled + secret_key)

Clearly not an RFC compliant HMAC.  Despite the fact that the attacker doesn't know the entire md5'ed message mean that the prefix attack in md5 is useless?  Is there another problem with using a broken hash function in this way?


texts:
I'm now studying the block cipher substitution-permutation network construction and realized that it uses several small pseudo-random permutations instead a big one for saving memory (or that is one of the reasons).

Why does the PRP with input/output of $n$ bits utilize $\log(2^n!)$ memory? (When saving a full table of $\mathrm{Domain}\to\mathrm{Range}$)

I thought it should utilize $n\cdot2^n$.


texts: Generic result on the guarantees of using two differentially private noise mechanisms one after the other

texts:
Let $f$ be a function that takes a database $D$ as input and returns a real number. Assume that $f$ has sensitivity 1: for any databases $D_1$ and $D_2$ differing in a single record, $|f(D_1)-f(D_2)|\le1$.
To protect the results of this function with $(\varepsilon,\delta)$-differential privacy (DP), one can add noise to its result, and output $f(D)+X$, where $X$ is a random variable from a well-chosen distribution $\theta$ with values in $\mathbb{R}$.
Now, suppose that $\theta_1$ and $\theta_2$ are two distributions such that the mechanism above is respectively $(\varepsilon_1,\delta_1)$-DP and $(\varepsilon_2,\delta_2)$-DP. Without any additional assumptions on $\theta_1$ and $\theta_2$, what can we say about the mechanism $M$ defined by:
$$M(D)=f(D)+X_1+X_2$$
where $X_1\sim\theta_1$ and $X_2\sim\theta_2$? By post-processing, we know that it is at most $(\varepsilon_1,\delta_1)$-DP and $(\varepsilon_2,\delta_2)$-DP. Can we do better? (We can certainly find better and even tight bounds for specific distributions, like two Gaussians, but I'm interested in as generic a result as possible.)
The only related result I know of is amplification by iteration, but this seems to assume finite Rényi divergence, and is tailored for many successive noise additions, while I'm interested in a simpler setting with as little assumptions as possible.

Edit 1: Clément Cannone pointed out that Theorem 4.3 of this paper has a result in the case where $\delta_1=\delta_2=0$, which is $\varepsilon=\ln\frac{e^{\varepsilon_1+\varepsilon_2}+1}{e^{\varepsilon_1}+e^{\varepsilon_2}}$. The bound is tight for generic chaining of DP mechanisms, of which this problem is a specific case. This partially solves the question, although 1) the case where $\delta_1>0$ and/or $\delta_2>0$ is open, and 2) maybe additive noise is a specific enough case that better results are available?
Edit 2: Vitaly Feldman pointed out that results related to chaining also appear in this paper (Lemma A.1, Appendix B), which might provide a building block for a generic chaining result?
Edit 3: Ashwin Machanavajjhala suggests that amplification by mixing and diffusion mechanisms is another possible direction, although it requires strong assumptions on the noise distributions.


texts:
I'm new to the list, a layman in cryptography, but a competent programmer. Seeking your help for a practical algorithm that I can implement please.

Problem

Let a prover P hold an identity document D, e.g. a passport, that contains a date of birth field dob.

A verifier V wants to check that:

that I hold the document
that D.dob is >= <some date>

All without P exposing D or V trusting P.

thanks and regards
d.


texts:
I'm working on this problem. I'm given

$\begin{align*}
n_1 &=pq\\
n_2 &=(p+2)(q+2)
\end{align*}$

where $p$ and $q$ are twin primes, i.e. $p$ is prime and $p+2$ is also prime; similar for $q$.

Also, I have a fixed value of $e$ and a message $m$ encrypted with $e^{-1} \bmod (p-1)(q-1)$ and then encrypted with $e^{-1} \bmod (p+1)(q+1)$.

How can I get $p$ and $q$?


texts: Shamir secret sharing with two types of parties

texts:
Consider the Shamir Secret Sharing scheme based on polynomial interpolation.

In this scheme, every part has the same right: one piece of information of same value as the other ones.

The idea is to adapt this scheme in following way:

Suppose that we want to share a secret among politicians and generals.
The secret can only be retrieved if 3 elements are united and if in that group at least one is a politician and at least one is a general.

How can we do that? It is not clear to me what to do. Thanks in advance.


texts:
I'm researching cryptography for a school project, came across the above two ciphers, and something occurred to me. Would combining these two schemes give a considerably stronger encryption than either one individually?

Consider two encryption schemes: one in which only the vigenere cipher is used (which I'll call $E_1$), and one in which both the vigenere and playfair cipher is used ($E_2$).

When discussing $E_2$, assume all references to it's key will be referring to the key of it's vigenere cipher unless explicitly stated otherwise.

When trying to decrypt $E_1$, the first step is looking for repeated sequences of characters and recording their distance apart to help determine the length of the key, which is likely to be a factor of many of these recorded distances.

However, with an $E_2$ cipher on the same ciphertext, this won't work nearly as well. If E1 showed repetitions of odd length n, $E_2$ would show those same reptitions of length $n-1$ with either the final character or the first character missing, while even length repetitions would either be reproduced at length n or have both the end and the beginning cut off for length $n-2$. In addition, any given sequence will become one of two entirely different sequences based on where the beginning of the sequence falls at the start of a playfair pair or not.

This means two things:

Repeated sequences aren't quite as clear - particularly shorter ones (which are the most common): sequences of length 3 (notably the word 'the') for example, become one of two sequences of length two, which is considerably easier to form by chance (which is why repeated sequences of length 2 are often not used in vigenere cryptanalysis). Four letter repetitions suffer a similar fate - half the time, the playfair pass will instead make them into repeated sequences of length two as well.
If $E_1(P)$ produces n repeated sequences (a single repetition) of average distance m apart, $E_2(P)$ will, on average, produce 2 different repeated sequences, each with $n/2$ repetitions that are $2*n*$ distance apart. This means that the distances between the repetitions are significantly larger and could have significantly more factors, which would mean the length of the key is less certain to the cryptanalyst.


texts:
Say we have a computationally secure Message Authentication Code scheme (Gen, Tag, Ver).

Let $Tag'_k(m):=$ first half bits of $Tag_k(m)$. Let's assume the range of tags is $n$bits.

Is (Gen, Tag', Ver) secure?

An efficient adversary that breaks (Gen, Tag, Ver) can't be constructed using an effecient adversary that breaks (Gen, Tag', Ver) because the former still would have to guess the last $\frac{n}{2}$ bits. So I want to say it's not secure.

Yet I want to say it is secure because I can't think of an algorithm that can efficiently break (Gen, Tag', Ver).


texts: In ECC scalar multiplication, how do `add(Q, Q)` exceptions occur?

texts:
Consider some scalar multiplication algorithm for a prime order (Weierstrass) curve $E$ with order $\ell$. Bernstein and Lange's SafeCurves: Completeness page mentions:

  The problem is that the standard Weierstrass "addition formulas" don't always work: in particular, they fail for the doublings Q+Q.

Now let's say my scalar multiplication properly "clamps" any secret scalars $k$ such that it is ensured that $0 < k < \ell$. We also check that $P$ lies on the curve and $P \ne \infty$. Then we implement the scalar multiplication using a standard left-to-right DoubleAndAdd algorithm:

1: function DoubleAndAdd(k, P)
2:     R = ∞
3:     for i from n-1 down to 0 do
4:         R = double(R)
5:         T = add(R, P)
6:         R = select([R, T], k[i])
7:     end for
8:     return R
9: end function

Now my intuition thinks that add(Q, Q) will never occur in this algorithm.

Observation. First observe that in $m$ loop iterations we can only compute points $R \in \{∞, P, \ldots, [2^m-1] P\}$.

Argumentation. Now, assume that add(Q, Q) indeed occurs in this algorithm. In the algorithm, P is constant, so this will happen only when R == P before executing line 5. In the same iteration, R has just been doubled in line 4. During that same iteration before the doubling in line 4, R had the value [1/2]P $=\left[\frac{\ell + 1}{2}\right] P$. This means that we can always compute $R = \left[\frac{\ell + 1}{2}\right] P$ in $(n-1)$ loop iterations.

For example, if $\ell$ is the Mersenne prime $2^n-1$, then we have computed $R = \left[\frac{2^n - 1 + 1}{2}\right] P = \left[2^{n-1}\right] P$ in $n-1$ loop iterations. After filling in $m = n-1$ we realize that $R = [2^m] \cdot P$. But this contradicts our Observation. So add(Q, Q) can indeed not occur. □

Now I am not really sure if my gut is right, or if I should trust the SafeCurves page. Using the DoubleAndAdd algorithm above, is it possible for any exceptions to occur in the addition in line 5?


texts:
If you use the same ephemeral key in Elgamal, someone can read the future messages. I have two ciphertexts $y_1=62$ and $y_2=4$. The difference between two plaintexts is $x_1-x_2=138$

how do I get $x_1$ and $x_2$? Modulo is $157$


texts: Given a sha-512 hash of a value picked at random from the $2^{128}$ key space, how hard would it be to recover the original value?

texts:
More specifically is it reasonable to assume that someone with the resources of a state actor can feasibly compute a rainbow table of all the sha-512 hashes of values within the $2^{128}$ key space?

Am I correct in assuming that the most efficient attack in this case would be to compute a rainbow table, given that sha-512 doesn't have any known vulnerabilities?


texts:
My question is about practical limit for brute force attacks. As I know 3DES with 56 bits key length can be broken via brute force. I also heard the same news about 64 bit key length (correct me if I am wrong).

My question is about the minimal length of the key that can be considered as a non breakable by classical computers (not quantum ones). I have 90 bits in my mind but unfortunately don't remember the reasons for the number. I.e. it's impossible to perform $2^{90}$ operations on a classical computer in a reasonable time. Is it correct?  Could somebody provide me explanations for the number (90) or provide another answer.


texts: What is the computational cost of a public key certificate signature verification?

texts: What is the computational cost of a certificate signature verification in terms of exponentiation, multiplication and other computation operations?


texts:
Sorry in advance as I am not very skilled in crypto. I am a software developer trying to create secure applications.

I have implemented a diffie-hellman key exchange between client and server. The library I am using only lets me create a minimum size key of 64 bytes (512 bit).
During transport messages will be encrypted with an AES-256 cipher. This takes a maximum key of 32 bytes (256 bit).

Is it safe to use the first 32 bytes of the diffie-hellman generated key or does this create a hole in security?

I may be completely incorrect so please forgive me; AES-256 is a standard widely used encryption algorithm today and using a 32 byte key is secure. I didn't just wan't to the approach that "Because it works it must be secure"


texts:
What does it mean by a HASH of a message with zero length or rather why is it required?
What could be a possible scenario where this is used?

Also note that, for a given HASHing algorithm, the hash value of a zero length message is essentially pre-defined.


texts: How secure is this logarithmic encryption algorithm?

texts:
How secure would the following logarithmic encryption algorithm be when tested under the same conditions as high end encryption algorithms (AES, RSA etc...).

Note: For smaller text the text will be padded to form a minimum length of 1024 bits.

For encryption:
1.  Generate random numbers as same length as the message.  R = [5, 13]
2.  Turn message characters into ordinal numbers.  M = [97, 98]
3.  Encryption algorithm is as follows: M^x = R; to solve this: x = log(R)/log(M)

For decryption:
1.  To find the original ordinal number again: M = x_sqrt(R, x); x_sqrt is to find the nth_root of a number, where R is the the radicand and x is index.

Example:
R = [13]
M = [98]

Encryption:
M^x = R
: 98^x = 13
: x = log(13) / log(98)
: x = 0.559425856

Decryption:
M = x_sqrt(R, x)
: M = x_sqrt(13, 0.559425856)
: M = 98


texts: Are there any encryption schemes that enable to permute homomorphically?

texts: According to the Barrington's theorem, any circuit in NC1 can be converted to a branching program, whose main operation is the composition of permutations (along with the choosing of permutations according to inputs, which we omit here) . So I wonder whether there is a scheme that can directly encrypt the two-line notation of permutation, which also enables to do the composition of permutations on the ciphertext, except the general methods by using FHE/Multilinear mapping on permutation matrices?


texts: Why do we need Euler's totient function $\varphi(N)$ in RSA?

texts:
After we calculated $N = p * q$, we calculate $\varphi(N)$ and use it later to determine $e$ (PR) and $d$ (PU). But why?
For decryption and encryption, we only use $N$ and don't need $\varphi(N)$. So why can't we find $e$ and $d$ without Euler's totient function?
I know that $\varphi(N)$ is giving me how many integers are coprime to $N$, and if $N$ is a prime then it would be $\varphi(N) = N - 1$. But why is this useful? Or rather why is it a must for determining $e$ and $d$ in RSA?
Edit:
And why does $e$ need to be smaller than $\varphi(N)$?


texts: What is the security model of the FHE system introduced in Fully Homomorphic Encryption Using Ideal Lattices?

texts: How would one construct a security model to play against the adversary, and define the security of the overall scheme? This is in reference to the scheme introduced in "Fully Homomorphic Encryption Over Ideal Lattices".


texts: Why are the IV (constant) values fixed for HMAC/SHA?

texts:
Why do HMAC/SHA IV's have a fixed value? I refer to the arbitrary H constants which are included in the algorithm prior to any data being fed in.

Why aren't they exposed to the user, so one can decide on an IV and modify it accordingly (for example, in java they are provided at hash function specification, instead of being supplied by the user at init)?

How does modifying these IVs affect the algorithm?


texts:
This question is not directly about cryptography, but I feel that it is most suitable for this site.

DLOG problem: Given a prime $p$, $g$ a multiplicative generator of $\mathbb{Z}_p^\star$ and an element $y\in\mathbb{Z}_p^\star$ find $0\leq x< p-1$ such that $g^x=y$.

Suppose we know that $p$ is a prime of the form $10^n+1$.

Give an efficient algorithm for solving the DLOG problem in this scenario.

I observed that we can find using brute force the order of the element $y$ in time $O(n^2)$ which is poly-log in $p$. I don’t know how to proceed.


texts: Can blocks in AES-CBC ciphertext be manipulated in such a way that plaintext becomes shuffled?

texts:
Say we have a sequence of N 16-byte plaintext blocks encrypted using AES in CBC mode, with an IV, resulting in N+1 16-byte ciphertext blocks. Can this ciphertext be manipulated in such a way that, once decrypted, the plain text would become shuffled (i.e. some of its N blocks become reordered), but with no other modifications otherwise?

Since each block depends on the previous one, if we just shuffle ciphertext blocks, some resulting plaintext blocks may become reordered, but at the cost of others being changed completely. One can also remove some M first blocks of ciphertext, which would make M first blocks of the plaintext disappear as well, but I see no way to append those ciphertext blocks to the end of the message to decrypt properly. Does there exist some other ciphertext manipulation which would result in reordering the plaintext blocks once decrypted, but with no other change otherwise?


texts:
I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a high chance of collision? I believe GUID would suffer from that problem as many bits are reversed for date/time (and GUID version) and isn't meant to be used in that way.

Would RSA suffer from collisions if many keys were to be generated in the same moment? Is the amount of possible keys known? I know RSA is based on prime numbers and small numbers are to be rejected. I’m sure values above a certain amount of digits/bits are rejected because software may not be able to support those large values?

So: How many RSA keys before a collision? And if you would try to make many at the same time, would that give you a high chance of collision?


texts:
I try to recover public key from the given message $m$ and pair $(r, s)$ using curve that satisfies standard RFC7091. I am using algorithm from one of secp256k1 implementation but it seems that not any random $k$, that is $0<k<N$ give me a pair $(r, s)$ that I can recover a valid public key. I did check this question How does recovering the pubkey from ECDSA signature works and tried to use curve with this parameters $P=23, a=13, b=10, N=19, G=(18, 2)$ but I've got a valid pubkey with specified message only on very small subset of values $k$.

Is there any solution how I can calculate restrictions for $(r, s)$ generated pair to determine that my signature will be recoverable or I just have to try re-do signing operation until I get a valid one?

UPDATE:
I have figured out that there are different algorithms for signing/verifying in ECDSA and RFC7091:

In ECDSA we compute s as $s=k^{-1}(z+rd_A)\mod n$
In RFC7091 we compute s as $s=(zk+rd_A)\mod n$

where $z$ is the hash of message, $d_A$ is the private key, $k$ is random in $0<k<n$, $n$ is the subgroup order and $r$ is calculated similar to both algorithms.

So the recovery formula for pubkey in ECDSA: $Q=r^{−1}(sR−zG)$ shouldn't work correctly because of different value of $s$ producing by both algorithms.

Is there any possibility to modify recovery formula to work for RFC7091 standard?


texts: Can an RSA private key have several public keys?

texts:
Ok, so my cryptography lecturer in University posed this question at the end of the RSA key generation lecture as a brain teaser.

I have been thinking about this and I think I have come up with a way ( I am aware it's not practical and very vulnerable - but I would love for you guys to punch holes through it ):

Use RSA to generate public and private key pair.

Make an additive hash function that takes in any input and adds the
ASCII value of each character and gives that as an output. ( I am aware additive hash has horrible distribution, for example, ABC, BAC, ACB all have the same hash output -- but theoretically, this can be used as an advantage to solve our problem )

Now take your public key and generate several possible keys by jumbling up the on and off bits.

Give these jumbled up keys to potential customers.

Put our hash function on the server.

When a customer puts in his jumbled up public-key - Hash function
calculates the hash - which should be similar to original public key generated by RSA. The customer gets access.

Once again I am aware that this is very vulnerable and terrible. It cant be used in the real world. But does it answer the question my lecturer posed?

EDIT:

I am sorry for the confusion. This question has nothing to do with collisions and exploiting the maths ( Those are definitely valid ways to do that - but they weren't what my lecturer was referring too - they were discussed in the lecture itself. ). The way my lecturer asked this question was - " come up with ways to make several public keys related to a single private key - nevermind how vulnerable your solution is ".


texts: hash function notations and existing cryptographic hash algorithms

texts:
I am implementing Role-based access control by referencing the paper Enforcing Role-Based Access Control for Secure Data Storage in the Cloud. In page 6, they have mentioned to choose hash functions $H_1$ and $H_2$ during the setup
$$H1 : \{0, 1\}^∗ \rightarrow Z^∗_p,$$
$$H2 : G_T \rightarrow Z^∗_p$$
where $G_T$ be a cyclic multiplicative group.
Can anyone please explain me the notation of the two hash functions?
Should the two hash functions $H_1$ and $H_2$ be implemented using different cryptographic hash algorithms? or can I use $\operatorname{SHA-256}$ (for example) to implement both of them? If No, please recommend me cryptographic hash algorithms for them.


texts:
Is IV needed in ECIES (Elliptic Curve Integrated Encryption Scheme) used with AES-CTR?

The ephemeral key pair is generated randomly therefore the encryption key derived from the public key must be random, too. As I know, IV is required only if the symmetric encryption key is used more than once, but in ECIES, every time an ephemeral key is generated, new encryption key is derived from that.

Am I right or IV is still recommended in ECIS w?


texts: My SSH server public key is 2048 bits, but my account's private key is 4096. What is my effective security?

texts:
My SSH server has a 2048-bit public key. But my private key, for clients to login, is 4096-bit.

In this case, do I have the brute force protection of 2048 or 4096 bits?

My worry is that someone could brute force the private key and login to the server.


texts: Elliptic Curve Cryptography messages vs keys encryption

texts:
I have read a few tutorials about ECC implementaiton in C. What I am confused is this: Can I encrypt messages with ECC and without the use of any other algorithm, like AES, RSA or should I use them also?

What I mean is this: Can ECC alone can be used for text message encryption, or is it only for key generation?


texts: Generalization of Bezout Identity for Polynomials

texts:
Let $i \in \{1,\ldots, n\}$, $f_i(x)$ be a univariate polynomial, and $g(x) = \mathsf{GCD}(f_1(x), \ldots,f_n(x))$. According to Bezout identity, there exists $a_i(x)$ such that:
$$\sum_{i \in [n]}a_i(x)f_i(x) = g(x)$$
What will be the degree of the Bezout coefficients, $a_i(x)$?
When $n = 2$, $$a_1(x)f_1(x) + a_2(x)f_2(x) = g(x)$$
and $\mathsf{deg}(a_1(x)) < \mathsf{deg}(f_2(x)) - \mathsf{deg}(g(x))$ and $\mathsf{deg}(a_2(x)) < \mathsf{deg}(f_1(x)) - \mathsf{deg}(g(x))$.
I am not sure what will be the degree of the polynomials $a_i$, when $n > 2$. Any reference is appreciated.


texts: (Why) should I avoid using a randomized IV for CTR mode?

texts:
I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to the difficulty of generating nonces for CTR:

  In the first edition of this book, we recommended CTR. However, we are always learning more, and we now recommend CBC with random IV. [...] CTR is a very good mode, but only if the application can guarantee that the nonce is unique, even when the system is under attack. That turns out to be a major source of problems and security weaknesses. CBC with random IV has some disadvantages [...], but it is robust and stands up well to abuse. Nonce generation turns out to be a really hard problem in many systems, so we do not recommend exposing to application developers any mode that uses nonces.

To me this seems to be ignoring an obvious solution: use CTR with a random IV instead of a generated nonce. This would let us avoid these problems and keep the random-access fun of CTR. This possibility being ignored implies there's some issue with it, but nothing I've read suggests one to me.

I know that the value is used differently in the different modes...

CBC: the IV or previous output block are XORed with input block, then ciphered
CTR: the nonce is combined/XORed with the counter, then ciphered, then XORed with the input block

...but I don't see how this would prevent a random IV from being as secure as a properly-chosen nonce. It would also be unique, and would provide more bits of randomness than a nonce system (though I think this shouldn't be significant unless the cipher were  weak).


texts: Difference between XORing the IV and just pre-pending it to the plaintext before encryption with AES-CBC

texts:
The normal way of using AES-CBC is to XOR the IV with the first plaintext block

This way you have to pass the IV along the ciphertext.

What if instead of XORing we just put a fixed size randomIV in front of the plaintext:

Encrypt(randomIV + plaintext) = C1

And we don't have to send/tansmit separatly the IV since it is inside C1.
Decryption works similarly:

Decrypt(C1) = randomIV + plaintext

And we just remove the randomData (fixed size) to end up with the plaintext.

In essence, the first block of random data, when encrypted will work EXACTLY as a randomIV since it will be XORed with the second block

Except from performance loss (having to encrypt an additional block instead of XORing), can you think why this might not be secure.


texts: When adding two points on an elliptic curve, why flip over the x-axis?

texts:
Every introduction to elliptic curves that I've read hasn't explained this.

If you have two points P and Q on an elliptic curve, to find P+Q, you draw a straight line through the points, find the third point of intersection with the elliptic curve. To get P+Q, reflect across the x-axis. Why reflect across the x-axis?

For example, towards the bottom of this blog post they explain how to add two points on the curve, but not why you want to reflect across the x-axis.

Please ELI(someone who has taken a university crypto class that didn't cover ECC).


texts: Can anyone elaborate why KP-ABE is better than CP-ABE for television program broadcasting?

texts: I know the difference between KP-ABE and CP-ABE. I am not able to understand why   KP-ABE is better for broadcasting than CP-ABE ?


texts: How to determine the fastest OpenSSL cryptographic algorithm

texts:
This question does have to do with cryptography, but not necessarily with encrypting meaningful data. This is my first post here, so if I'm going about this question incorrectly please let me know.

Some quick back story:
I have a regular volume of hard drives that I need to wipe. I'm not wiping DoD stuff, and I really don't want to debate which method is the correct one to use. I have a method I use that I'll show here and that's what I'll continue to use for the time being. I'm also running the wipe from a Raspberry Pi because I don't have an extra PC available.

Because I have a regular volume, I tried to find a method of writing psudo-random data to a disk with the highest throughput.

This gives me 8-9MBps throughput:

dd if=/dev/urandom of=/dev/sda

And this gives me 9-10MBps:

dd if=/dev/zero of=/dev/sda

I need this process to move much faster, and I don't have access to any hardware-backed crypto.

I found this a while ago from someone else in the StackExchange network and it gives me 28-35MBps throughput:

openssl enc-aes-128-ctr -pass pass:<128-bytes-of-random-data> -nosalt < /dev/zero > /dev/<disk-to-wipe>

My question is, how can I quickly determine which crypo library will give the the most throughput for my application and still generate sufficiently random data for my use case? Are there additional crypto libraries that aren't installed by default? Is there something faster than openssl for this?

I know I could use an old laptop or some other device for this, but I don't have that now, and even if I did I would still want to optimize the solution for that device.

I hope this makes sense and is relevant to this community, but if this needs to be posted somewhere else please let me know.


texts: In case M is small is it possible to recover the message

texts: In the plain RSA encryption, suppose $N$ is 1024 bits and the public key $e = 17$. Is it secure to use this setting to encrypt very small message, say $3 \leq m \leq 9$? In other words, is it possible for the attacker to recover the message $m$ given the public key and the ciphertext $c = m^e \mod N$.


texts: Decisional Diffie-Hellman assumption vs decisional bilinear Diffie-Hellman assumption

texts:
For the Decisional Diffie-Hellman (DDH) assumption we know that:

Given $g^a$ and $g^b$ for uniformly and independently chosen $a,b \in Z_p$ the value of $g^{ab}$ looks like a random value in group $\mathbb{G}$.

For the Decisional Bilinear Diffie-Hellman (DBDH) assumption we know that:

In a group $\mathbb{G}_0$ of prime order $p$, let $a,b,c \in \mathbb{Z}_p$ be chosen at random and $g$ be a generator of $\mathbb{G}_0$. The adversary when given $(g,g^a,g^b,g^c)$ must be able to distinguish a valid tuple $e(g,g)^{abc} \in \mathbb{G}_T$ from a random element $R \in \mathbb{G}_T$.

I cannot clearly understand the difference between both. Can someone state the difference of each and when to consider each one. I know that DBDH is used when considering pairings but I am still confused about the difference of both.


texts: Are interactive proofs more secure their non-interactive counterpart?

texts:
Given an interactive zk proof, if we use fiat-shamir to make it nizk proof, does the proof become less secure?

Are there any new attack vectors that get introduced?

Is there any reason to use the interactive version over the non-interative version? Aside from both parties always being online

Are there any complexity theoretic comments that can be made about the distinction between interactive and non-interactive proofs?


texts: Diffie-Hellman: Should the subgroup have prime order?

texts:
Hi I previously asked a question about Diffie-Hellman parameters but wanted to make sure I got it right.

I need to generate parameters for the SRP protocol. My base strategy is to generate a safe prime q = 2*p + 1 where p is also a prime.
I want to use as low generator as possible, preferably "2". Now, all elements of (Z/qZ) is going to have one of the following orders: 1, 2, p or 2*p due to the group having order 2*p, so 2 must generate a subgroup of one of those orders. Since q is large, we can exclude 1 and 2 as possibilities, leaving p and 2*p as the only possible orders of the subgroup. It can be easily determined which it is by simply checking if 2^p = 1 mod q.

Now my question is, which is cryptographically preferred for security against the discrete-log attack? I.e. is it preferred to select p and q such that 2 has order p, or is 2*p preferable? 2*p clearly implies a subgroup twice as big. On the other hand, p is prime. I don't know if there's any special benefit to the subgroup itself having prime order.


texts: Why should I use an Initialization Vector (IV) when I have unique keys?

texts:
I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same.

I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to encrypt more than one plaintext. Is it insecure to use null IVs in this case? If it is insecure, why?


texts: PPT eavesdroper able to output $m_{0}$ and $m_{1}$ of different lengths

texts:
I've read the following two questions and their answers:

Messages of different lengths and one-time computationally-secret
Why is a non fixed-length encryption scheme worse than a fixed-length one?

I am still not convinced of what is the actual strategy of the adversary $A$. I understand that in case that the encryption scheme cipher depends on the length of the message to encrypt then $A$ could output $m_{0}$, $m_{1}$ of different lengths and would be able to tell which one was encrypted by the length of $Enc(m_{b})$ (where $b\gets\{0,1\}$).

Now, who promises that $|Enc(m)|$ depends on $|m|$?
Isn't it possible that $|Enc(m_{0})|=|Enc(m_{1})|$?


texts: What encryption to choose from the SSL library in python 3?

texts:
I've been researching some of the types of encryption that the python SSL library uses.

Among them the best I've seen are:

ECDHE-RSA-AES256-GCM-SHA384

TLSv1.2
Kx = ECDH
Au = RSA
Enc = AESGCM (256)
Mac = AEAD

ECDHE-ECDSA-AES256-GCM-SHA384

TLSv1.2
Kx = ECDH
Au = ECDSA
Enc = AESGCM (256)
Mac = AEAD

TLS_AES_256_GCM_SHA384

TLSv1.3
Kx = any
Au = any
Enc = AESGCM (256)
Mac = AEAD

I have sorted the encryption types according to their level of security, efficiency, and use. (Based on what you can research online, they are the most used and safest, especially the first).

The truth is that I don't know which one to choose for my project.

I would appreciate being guided and advised on which one to choose.


texts: Faster alternative to shamirs secret sharing algorithm

texts:
I recently discovered shamirs secret sharing scheme. Pretty interesting stuff. I noticed that a common case is to split a secret which is used to encrypt/decrypt something else. For example Vault is sealed with a master key that is split using shamirs scheme.

I thought it might be interesting to split a whole file into shards instead of the key that encrypts it. But I noticed shamirs scheme isn't pretty performant. Are there faster alternatives?


texts: What is the PRG period of stream ciphers such as RC4 or Salsa20?

texts:
I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example.

Let's say I want to encrypt a very long message. I pick a key with 128 bits and start encrypting using the RC4 stream cipher. How many rounds does RC4 have to run before its PRG starts over again? How about Salsa20: how long can that run with the same key before running the risk of leaking information?

I realize that as a practical matter the period will probably be far longer than any real-world message, but I am still interested in knowing the bound.


texts: What are these fields in ASN.1 encoding of RSA

texts:
Nice resource for ASN.1 structured RSA keys https://etherhack.co.uk/asymmetric/docs/rsa_key_breakdown.html in private key section shows following RSA private key related fields:

modulus
public exp
private expo
prime 1
prime 2
exponent 1
exponent 2
coefficient

I understand the majority of these fields as per https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Key_generation.

But what are the bolded exponent 1, exponent 2 and coefficient? I cannot find their use in RSA in the linked wiki article.


texts: How to compute $a$ in the complex discard method of NIST SP 800-90

texts:
I've got a question about the complex discard method that has been specified in NIST SP 800-90, appendix A.5.2, steps:

Use the random bit generator to generate a sequence of $m$ random bits, $(b_0, b_1, …, b_{m-1})$.
Let $c = \sum_{i=0}^{m-1}2^i \cdot b_i$.
If $c < r$, then
let $(a_0, a_1, …, a_{t-1})$ be the unique sequence of values satisfying $0 ≤ a_i ≤ r -1$
such that $c = \sum_{i=0}^{t-1}r^i \cdot a_i$ else discard $c$ and go to Step 1.

OK, so step 1 is the same as generating as many bits as required for the number, i.e. $m$ bits where $m$ is the number of bits required to encode $r-1$ where $r$ is the end of the range starting at 0 (and exclusive of $r$ itself, of course).

Then step 2 is basically interpreting those bits as a number.

Now step 3 suddenly introduces a set of output values for this random number generator, $(a_0, a_1, …, a_{t-1})$. These numbers need to confirm to the condition that added together after multiplication with $r$ to the power of $i$ up to $t$ that they are equal to $c$.

Wouldn't the numbers $a_i$ be too small in that case? How can the $a_i$ values be calculated?


texts: What is the non-programmable random oracle model?

texts:
I would like to know the difference between the random oracle model and

the non-programmable random oracle model.  What is the difference?


texts: Is there a scheme to force a party to generate a fresh key?

texts:
Is there a way to force one party to generate a fresh key, such that another party can be convinced that the key was freshly generated, without that party also knowing the key?

I'm motivated by a particular weakness in a particular voting scheme. I'll provide a simplified example for motivation.

We have two parties: Prover and Verifier. The prover is about to generate a secret and convince the verifier that the secret is correct. The prover wants the secret to be convincing to the verifier and only to the verifier, so the prover constructs a Designated Verifier Proof. However, there is a risk that the Verifier has been previously coerced into relinquishing their private key. If the Prover is in possession of the private key, the Prover can cheat the Verifier by using their private key to forge a designated verifier proof for an invalid secret. We want to eliminate this possibility by forcing the Verifier to generate a new key on the spot.

Basically, we want to provide the Verifier the ability to tell the coercer: "I'm sorry, I'm unable to use this key. The system forces me to generate a fresh key on the spot."


texts: How to solve cipher encrypted with Vigenère + Columnar Transposition?

texts:
Vigenère's weakness is Kasiski's test and index of coincidence. However, if you put columnar transposition on top of Vigenère, that weakness is gone. The text is now shuffled and you can't search for digrams/trigrams, because they will give you wrong key length pattern.

You also can't solve Columnar Transposition. For example, you try key length $i$ and you put the text in $i$ columns. Normal Columnar Transposition is solved by matching columns with each other and counting how good the match is (compared to English text digrams). The best match is then the correct column order. But because the text is encrypted with Vigenère and letters are substituted, you won't get correct result.

Is such a cipher considered very good / unbreakable or how does one attack it?


texts: Symmetric (in the execution of the protocol by the two parties) version of the Station-To-Station protocol?

texts:
The original Station-To-Station (STS) protocol is as following:

Alice : Generate $x$
Alice → Bob : $g^x$
Bob : Generate $y$, compute $g^y$
Bob : Compute $K = (g^x)^y$
Bob : Sign-then-Encrypt $(g^y, g^x)$ to obtain $E_K(S_B(g^y, g^x))$
Bob → Alice : $g^y$, $E_K(S_B(g^y, g^x))$
Alice : Compute $K = (g^y)^x$
Alice : Decrypt $E_K(S_B(g^y, g^x))$ using $K$ to obtain $S_B(g^y, g^x))$
Alice : Verify $(g^y, g^x)$, $S_B(g^y, g^x))$ using Bob's public key for signature.
Alice : Sign-then-Encrypt $(g^x, g^y)$ to obtain $E_K(S_A(g^x, g^y))$
Alice → Bob : $E_K(S_A(g^x, g^y))$
Bob : Decrypt $E_K(S_A(g^x, g^y))$ using $K$ to obtain $S_A(g^x, g^y))$
Bob : Verify $(g^x, g^y)$, $S_A(g^x, g^y))$ using Alice's public key for signature.

In this paper Authentication and Authenticated Key Exchanges, it mentioned that

Here is my thought about a symmetric version:

Alice : Generate $x$
Bob : Generate $y$
Alice → Bob : $g^x$
Bob → Alice : $g^y$
Alice : Compute $K = (g^y)^x$ and $E_K(S_B(g^y, g^x))$
Bob : Compute $K = (g^x)^y$ and $E_K(S_B(g^y, g^x))$
Alice → Bob : $E_K(S_A(g^x, g^y))$
Bob → Alice : $E_K(S_B(g^y, g^x))$
Alice : Decrypt-then-verify
Bob : Decrypt-then-verify

In fact, I got this thought first, but I am not sure if it is secure as the original STS protocol. So I try to find a reference online. However, I didn't obtain a confirmation.

Does this symmetric (in the execution of the protocol by the two parties)  version have problems?


texts: what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

texts:
I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for  Authenticated encryption with associated data (AEAD)  and NORX uses duplex/sponge mode with LRX structure , so , Is it possible to design AEAD cipher using duplex/sponge mode with ARX structure (Chacha20)? what are the advantages/disadvantages?

I could not find an example in NIST Lightweight candidates


texts: Non-standard signature security definition conforming ed25519 malleability

texts:
According to the paper “High-speed high-security signatures”…

  Malleability. We also see no relevance of "malleability" to the standard definition of signature security.

Aside from the example, how is ed25519 malleable by the non-standard definition of signature security?

To be more specific:

I'd like to know about any malleability with signatures/keys. The example provided seems not to be a risk because the key must also change. If anything's been discovered since this paper, that would also be helpful. I'm concerned with ECDSA type malleabilities and wonder if there's anything “close”.


texts:
Does anybody know a point-matching function for curve 25519?
Or has a straight-forward way how to derive any arbitrary point-matching function?
It should be like a reversible mapping from and to a 128+ bit number to and from points on the Curve 25519.
The aim is actually to have the point being on the edwards form of the curve.


texts:
I read an article about password schemes that makes two seemingly conflicting claims:

MD5 is broken; it’s too slow to use as a general purpose hash; etc
The problem is that MD5 is fast

I know that MD5 should not be used for password hashing, and that it also should not be used for integrity checking of documents.  There are way too many sources citing MD5 preimaging attacks and MD5s low computation time.
However, I was under the impression that MD5 still can be used as a non-cryptgraphic hash function:

Identifying malicious files, such as when Linux Mint's download servers were compromised and an ISO file was replaced by a malicious one; in this case you want to be sure that your file doesn't match; collision attacks aren't a vector here.
Finding duplicate files.  By MD5-summing all files in a directory structure it's easy to find identical hashes.  The seemingly identical files can then be compared in full to check if they are really identical.  Using SHA512 would make the process slower, and since we compare files in full anyway there is no risk in a potential false positive from MD5. (In a way, this would be creating a rainbow table where all the files are the dictionary)

There are checksums of course, but from my experience, the likelihood of finding two different files with the same MD5 hash is very low as long as we can rule out foul play.
When the password scheme article states that "MD5 is fast", it clearly refers to the problem that hashing MD5 is too cheap when it comes to hashing a large amount of passwords to find the reverse of a hash.  But what does it mean when it says that "[MD5 is] too slow to use as a general purpose hash"?  Are there faster standardized hashes to compare files, that still have a reasonably low chance of collision?


texts:
In 1992, cypherpunks was created as a mailing list for activists advocating for cryptography.

Arguably, the cypherpunks mailing list was the foundation for the movement and the centre of it all.

However, the original list is dead. All I really know of is the moderated cryptography list.

Where have all the modern cypherpunks gone?


texts: Key establishment from secret answer to a question using Socialist Millionaire Protocol

texts:
I have read this as telling that two parties sharing a low-entropy secret (such as a secret answer to a question) can use it to establish a high-entropy shared secret key across a classical insecure channel, with help of the Socialist Millionaire Protocol.

How is that achieved? Quantitatively, what's the probability for a MitM attack to succeed at least once in $n$ attempt?

Or asked differently, but equivalently: How to build a password-authenticated key exchange (PAKE) from a Socialist Millionaire Protocol (SMP)?


texts: What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

texts:
I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_.

The picture shows the extension of TLS1.3's ClientHello.

I view the OpenSSL code and find the rsa_pss_rsae_* scheme is corresponding to the scheme in Section 8.1 in RFC 8017 but what about rsa_pss_pss_* scheme?

And it's weird that I find some annotation like this:

  TODO this does not differentiate between the rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do no have a chain here that lets us look at the key OID in the signing certificate.

What's the matter with this chain and key OID?

In my understanding the signature schemes is only applicable to the type of private key (RSA or EC).


texts:
In Encryption Schemes for Computer Confidentiality, Pless describes how to use the J-K flip flop as a nonlinear combiner for linear feedback shift registers.
This generator was broken because the J-K flip flops are not correlation immune but my question concerns the basic nonlinearity of the J-K function itself: how do you measure its nonlinearity? For instance we know that Boolean functions with maximum nonlinearity are the bent functions, which have the farthest distance to all affine functions. Then we have the linear functions like XOR, so where would the J-K flip flop fit into this spectrum?


texts: AES confused about how ShiftRows() step works

texts:
Advanced Encryption Standard has a ShiftRows() operation that cyclically shifts last three rows of 16 byte block as shown here. This process is explained here in further detail.
But same documentation provides test vectors which have confused me a bit:
round[ 1].s_box    63cab7040953d051cd60e0e7ba70e18c
round[ 1].s_row    6353e08c0960e104cd70b751bacad0e7

So after shift row step, the 16-byte block has turned into a hex number labeled as round[1].s_row.
Converting into byte representation we have:
round[ 1].s_box  [99, 202, 183, 4, 9, 83, 208, 81, 205, 96, 224, 231, 186, 112, 225, 140]
round[ 1].s_row  [99, 83, 224, 140, 9, 96, 225, 4, 205, 112, 183, 81, 186, 202, 208, 231]

I had assumed that if we turn this 16x1 array into 4x4 matrix, first four elements would act as first row, elements 4..8 as second row and etc. in which case first four bytes [99, 202, 183, 4] should have remained unchanged.
However as we can see only elements at indices 0, 4, 8 and 12 are unchanged. Are definitions of rows and columns different in context of AES?
Here is how my implementation of AES transforms the hex labeled as round[1].s_box: 63cab70453d05109e0e7cd608cba70e1
[99, 202, 183, 4, 83, 208, 81, 9, 224, 231, 205, 96, 140, 186, 112, 225]
Edit: it is obvious that columns are transposed both before applying ShiftRow() and then after the operation is complete. This turned out to be the case for MixColumns() operation as well. Is there any particular reason for this?


texts:
In BB84 protocol, when Alice and Bob make key distribution, what is the private thing?
They select randomly bases and then make a measurement according to these bases. Used bases are private? I mean that does Eve know which basis was used at each position? If Eve dont know these bases, then How can Alice and Bod share using bases securely? In here, what is public and private?


texts: What are standard cryptographic assumptions?

texts:
I am struggling to understand what is meant by "standard cryptographic assumption".

The Wikipedia artice on the Goldwasser–Micali system (GM) reads "GM has the distinction of being the first probabilistic public-key encryption scheme which is provably secure under standard cryptographic assumptions."

But what are standard cryptographic assumptions? I suppose that

FACTORING: Given a positive integer $n$, find its prime factorisation.
Quadratic Residuosity Problem (QRP): Given an odd composite integer $n$ and $a$ with Jacobi Symbol $(a|n) = +1$ decide whether $a$ is a quadratic residue or a pseudosquare modulo $n$.

are commonly assumed to be difficult and thus "standard cryptographic assumptions". Is why GM is provably secure? But what about the RSA Problem (RSAP)?

  Given are a positive integer $n$ that is a product of two distinct odd primes $p$ and $q$, a positive integer $e$ with $\gcd(e, (p-1)(q-1)) = 1$ and an integer $c$. Find an integer $m$ such that $m^e \equiv c \pmod n$.

Is RSAP also commonly supposed to be hard? Is thus RSA provably secure?


texts: Realize a MAC using a Pseudo-random function?

texts:
Given a pseudo-random function and assuming that we do not have any other tools,
How can we construct a MAC?

I believe this can be done. Would like to know if there is more than one way of doing this.


texts:
From what I understand, CTR works by taking a counter, concatenating it with a nonce, and encrypting the result, which gets XORed to the ciphertext. For a 128-bit block cipher (ie. AES), my understanding is that the first 8 bytes of the CTR block is the nonce, and the second half (bytes 8-16) is the counter. CTR is a secure mode of operation, but what if I modified it like this:
The nonce is 16 bytes, the counter is 16 bytes. The counter block is equal to nonce XOR counter.
Basically, he counter blocks are just XOR of nonce and counter. Would this be secure, or would this defeat the idea of CTR and be insecure?
Edit: For more clarity, here's CTR mode and my modified mode:
CTR:
nonce = 12345678
counter = 00000001
CTR block = 1234567800000001

My scheme:
nonce = 1234567890abcdef
counter = 0000000000000001
CTR block = 1234567890abcdeW


texts: IKEv2 mutual authentication step, why not just signing prf(SK_pi) is sufficient?

texts:
I read from here that, https://tools.ietf.org/html/rfc7296
it mentioned,
2.15. Authentication of the IKE SA
the initiator signs the first message (IKE_SA_INIT request), starting with the first octet of the first SPI in the header and ending with the last octet of the last payload. Appended to this (for purposes of computing the signature) are the responder's nonce Nr, and the value prf(SK_pi, IDi'). It is critical to the security of the exchange that each side sign the other side's nonce.
SK_pi is derived from Ni and Nr, why not just signing prf(SK_pi) is sufficient?


texts: Why would someone prove security in the real-ideal model instead of Universal Composibility framework?

texts:
I am somewhat confused in the reasons why one would use the real-ideal model instead of the universal composibility framework.

The UC framework seems to me, to provide a much stronger definition of security. Is there some explanation to this?


texts: Is it possible to narrow down the possible keys used for AES CBC encryption, knowing a given plaintext and its ciphertext, where IV=0?

texts:
I'm brute forcing a ciphertext with a given dictionary to figure out which key was used. However, it's been hinted at that there is a way to narrow down the dictionary to a smaller subset of possibilities.

I know the plaintext, its ciphertext, and the IV (0). It was encrypted using AES-128-CBC and no salting was used during encryption.

At first I thought I was onto something because of:
$C_j = E_k(P_j \oplus IV)=E_k(P_j)$ for IV = 0. But I was dead in my tracks right after. Is this situation even plausible or am I barking up the wrong tree?


texts: Interactive assumptions not falsifiable?

texts:
Can someone explain why an interactive assumption is not falsifiable? Maybe I'm misunderstanding what the statement means, but isn't even a non-interactive assumption interactive, but just with a zero amount of interaction?

There is no context here, just this isolated paragraph in the intro of a paper:

  Due to a series of criticisms starting with [CGH98] more and more
  practical schemes are being proposed and proved secure in the standard
  model (i.e., without random oracles) and under falsifiable (and thus
  non-interactive) assumptions.

The paper never mentions this again. Neither does it define the term falsifiable.


texts: Schnorr signatures: multisignature support

texts:
Schnorr signature is mentioned as a promising upgrade to bitcoin to improve scalability. It support multisignature, several signatures can be aggregated into a single, new signature. But I fail to find any information on how is this made possible mathematically.

Some of my questions on the statement "several signatures can be aggregated into a single new signature":

1) Is it true that the "several signatures" can be generated using different private key?

2) If (1) is true, the "single new signature" can be used to verify all the messages that are signed by different private key? How does this work?

Is there any paper published regarding to this topic?


texts:
Considering a case, when modulus is large and hard to factor, exponent e=3 and there is a cipher-text which is created by padding plain-text with A's from left and the ride side such that the real plain-text lies in the very center.

Which attacks could apply in such case. Low-Exponent Cube root attack fails. Does the knowledge of some part of the plain-text such as A's become helpful ?


texts: Memory-hard proof-of-work: are they ASIC-resistant?

texts:
Is a memory-hard proof-of-work scheme necessarily resistant to speedups from custom ASICS?

Background: Bitcoin uses a proof-of-work scheme based on SHA256 hashing.  The scheme is compute-bound.  Initially, people would mine solutions on their PCs or GPUs.  However, eventually it was noticed that a custom ASIC (a custom-designed hardware chip) can compute SHA256 hashes much more rapidly and thus a custom ASIC can mine more efficiently and more rapidly, so people built custom ASICs that can compute SHA256 hashes much faster than any general-purpose CPU.  Today ASICs have a 100x advantage over mining on your PC, so PC-based mining is not very competitive.

Some folks have proposed fixing this by designing a memory-hard proof-of-work scheme.  A memory-hard scheme is one that fundamentally requires some minimum amount of memory (e.g., 1GB of RAM) to solve efficiently, and where there are no useful time-memory tradeoffs.  These are hard to design, but suppose we were able to construct one.  For instance, Cuckoo Cycle is one plausible attempt at such a scheme.  Suppose we use Cuckoo Cycle, or we find another scheme.  I've seen it argued that such a scheme would end the monopoly of ASICs and thus make mining more democratic, because ASICs can speed up computation-bound tasks but not memory-bound tasks.

Here's my question.  Is this argument correct?  More specifically, is it true that memory-hardness is enough to ensure that ASICs won't have much of an advantage over general-purpose CPUs?  What prevents an attacker from building a custom ASIC and buying off-the-shelf DRAM chips, and building systems that pair each ASIC with a DRAM chip?


texts: How secure is MD5 for one way authentication?

texts:
I have a server S1 with an Private String (PS) as an identifier shared with a server S2.

Every 10 min S1 publish the hash value of PS+the current time which is used as  public identifier (PI). Every one can see the value of PI in the internet. As S2 has the value of PS, he also use MD5 to get the hash value of PS+the current time and compare it to the value published by S1 and therefore identify that the value provide from S1.

My solution is working but I am wondering how secure it is ?
The private string PS shared between S1 and S1 looks like

PS=KJGFDFGHJK65456789876RFBNJK567Y7654RFGHJhhhHGE457UHKJHCDFG7654RF
hash=md5(hours time in millisecond+PS)
PI=fe**63**7b00-1cf0-11e6-b**d**f4-08002**00**c9a66

I use a mask to get some values from the hash and use them to construct the Public Identifier. The blood values are random values, not taken in consideration to identify the server. If someone collect the keys I am publishing for few days, will it be possible form him to identify the Private String S1 is using to generate public keys, or that the key provide probably from S1 and not another server ? I hope you understand what I mean, my knowledge in cryptography are very basic and it's hard for me to use technical vocabular.


texts: Cyclic Groups Other than $\mathbb{Z}^*_n$ or Elliptic Curves

texts:
I see two types of cyclic groups are most commonly used in cryptography:

modulo multiplicative group of integers with prime order
elliptic curves

Are there any other cyclic groups used in cryptography?


texts:
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = \mathrm{hash}(k||\mathrm{data})$ or $s = \mathrm{hash}(\mathrm{data}||k)$). The next ideas that were presented then were HMAC and CBC-MAC which are a lot more complex (but standardized).

Now I'm wondering what the security of the following "idea" would be (I'm sure that there a good reasons why it is not used as it is more simple than HMAC or CBC-MAC):

Compute the hash value $h = \mathrm{hash}(\mathrm{data})$.
Compute the ciphertext $c = \mathrm{enc}_k(h) = \mathrm{enc}_k(\mathrm{hash}(\mathrm{data}))$.
Set signature $s = c$.

Where $\mathrm{hash}$ is an arbitrary hash function and $\mathrm{enc}$ an arbitrary, symmetric block cipher using a key $k$.

I was not able to find any statements about such schemes, maybe I searched in the wrong place. However, it would be nice if you could help me with that question.


texts: How to decode a (Vigenère?) substitution cipher?

texts:
I am trying to decode a message that I suspect has been encrypted with a Vigenère cipher:

  Utl zluuocp zsc rvzu hbcp ztvibfz vrabzz utl ilry. Utlal flal cb fbaiz, qszu zbsciz. Utvu cllihl vhzb dvil v zhbf roarsou vabsci vci vabsci vci vabsci, hoyl v zeli-se rhbry. Qvry rhbzli toz lglz uoptuhg oc kaszuavuobc. Vavwlhhv rhscp ub utl avohocp ub dvocuvoc tla wvhvcrl. Qvry tskkli vci dbjli ubfvai utl wbf ftlal Vavwlhhv zubbi zuvaocp bsu bjla utl wbfzeaou. Vavwlhhv ztojlali vz utl pabse dbjli bc ub utl utabcl. Vavwlhhv, utl toz koazu dvul vci v kbadla wvadvoi bc Ubauspv, hvsptli. Ztl hvg zeavfhli oc v fvg utvu dvil tla hbby hoyl v hode avp ibhh. Utl brlvc fvz zuohh vci zohlcu vpvoc, utl bchg zbsciz tlvai flal utl ralvyocp wbvaiz vci utl zhve bk utl fvjlz vpvoczu ouz tshh. Vavwlhhv tvi zluuhli bcub utl ilry, zouuocp rabzz-hlppli fout tla wvry vpvoczu utl kbaldvzu. Utbzl ufb alvhhg val v evoa bk lxrlhhlcu zvohbaz. Sebc iozrbjlaocp utl laaba Zohjla tvi dvil, Hbsoz nsoryhg tvi utl rbby-rsd zsaplbc-rsd-eoavul ubzzli bjlawbvai. Vci kva corla ub wl vu zlv utvc zravdwhocp kba v raszu oc utl abspt-vci-usdwhl ubfc bk Ubauspv. Qvry utalf toz tlvi wvry vci kbaut jobhlcuhg, uagocp ub ztvyl utl zbsci bsu. Tl rabzzli ub utl avoh ub wluula zll toz dvulz. Tl zusry utl zubcl oc toz ebrylu vz v zflhhocp fvjl tllhli utl ilry. Qvry klhu vz utbspt utl zbcp flal vc lcuoug utvu tvi qszu fbsci ouz fvg vrabzz utl ilry vci fvz cbf tlviocp wvry bsu bjla utl fvula. Vavwlhhv ztojlali vz utl pabse dbjli bc ub utl utabcl. Utoz fvz dsrt wluula utvc uavjlhocp vz v zubfvfvg, vz tl tvi wlkbal. Ou fvz hoyl v zbcp, wsu cbu lxvruhg. Qvry vci utl ralf ilklvuli utl cbubaobsz Rveuvoc Ubaalcuz, ftbzl vcpla fvz ulaaowhl. Qvry nsoryhg qsdeli bsu bk utl fvg, ubeehocp ocub Koumfohhovd. Ftohl tl fvz ealevali kba vcbutla wvuuhl, utlg flal zhvry vci alhvxli. Kvocu ztvibfz flal rvzu sebc utl ozhvci wlhbf: tspl, whvry zvohocp ztoez, zlv dbczulaz, vci butla utocpz utvu tvsculi utl doicoptu fvulaz zlldli ub rvzrvil bjla utl tohhz. Vci utlc, utvu butla zbsci vpvoc -- utl wlvsuoksh, tvscuocp, hbjlhg, dviilcocp zbsci. Koumfohhovd pbu se kabd utl cbf-zhoeelag ilry dbal zhbfhg vci rvalkshhg. Ljlag uodl tl gvcyli ou bcl fvg, ou gvcyli ouzlhk wvry utl butla. Tl cllili ub hoptu utl hvculacz. Vz zbbc vz tl rbshi, tl fbshi koci v doaaba. Koumfohhovd pbu se kabd utl cbf-zhoeelag ilry dbal zhbfhg vci rvalkshhg. Qvry ubby oc v ille walvut, vci utl zvhu voa kohhli tod fout v tveeg kllhocp bk vijlcusal. Qvry tbozuli todzlhk se bcub utl wbf vci zfscp toz hlpz vabsci zb utvu utlg ivcphli bc loutla zoil bk utl wbfzeaou--utl hbcp ebhl utvu lxulcili bsu bjla utl fvula. Tl utbsptu ou doptu dvyl v corl eolrl bk qlflhag: dvgwl v clryhvrl ba zbdlutocp. Kvocu ztvibfz flal rvzu sebc utl ozhvci wlhbf: tspl, whvry zvohocp ztoez, zlv dbczulaz, vci butla utocpz utvu tvsculi utl doicoptu fvulaz zlldli ub rvzrvil bjla utl tohhz. Vavwlhhv, utl toz koazu dvul vci v kbadla wvadvoi bc Ubauspv, hvsptli. Utl ralf veelvali ub wl pluuocp wvry ub ouz cbadvh zlhk, vci utlc, zsiilchg, utl zbsci ocralvzli dvaylihg. Qvry fbshi tvjl utbsptu utlg tvi wllc dgzuorvhhg usacli ocub zuvuslz ok utlg flal cbu lvrt vwzlcuhg, hvcpsbabszhg, vci zohlcuhg rbcuocsocp utloa vruojouolz. Utl gbscp zvohba fvz dvyocp viqszudlcuz ub utl vzuabhvwl.

However, even after watching YouTube tutorials and reading from different websites, it still doesn't make sense to me like the Caesar cipher does. I do understand that the Vigenère cipher alternates between multiple Caesar ciphers, but I just don't understand how to decrypt it with no hints.

Could someone give me some kind of a step by step method for breaking ciphers like this?


texts: Increased CRC collision probability when adding bits to input message

texts:
The Scenario

I have a message string I need to transport over a wireless network that may be unreliable. This message string is about 100 bits long, and is packaged with an 8-bit CRC. When the message is received, it's validated with the CRC and unpacked. I would like to add a few "message version" bits to the message, but there's no room available.

Solution Attempt

Since I can't add a version number to the message, I would like to add the message version bits to the input string when computing the CRC, but only transmit the basic message and CRC as before (without the version bits). When the message is received, I'll compute the CRC for Version 1. If it fails, I'll try computing the CRC for Version 2. If that fails, the message has been garbled. If either one succeeds, then I know the version number.

Question

The problem is that I need to prove (or at the very least, convince myself with math) that increasing the bit number of the input message doesn't significantly increase the probability of a CRC collision.

I do not need a perfect answer here, since I understand that network simulation and choice of the CRC polynomial play huge roles. I'm using 0x2F for my 8-bit CRC polynomial, if that matters. For network error, I think it's reasonable to assume the error noise is really random (unless you think otherwise... all advice welcome).

My Attempt

Source: http://web.mit.edu/course/16/16.682/www/leca.pdf (See section "Performance of CRC")

When using the equations in this document, I find that the probability of detecting a transmission failure depends only on the number of bits in my CRC (r=8, in this case), so P = 1 - 2^(-r) = 99.6%. But surely the input bits matters in some way, right? I've seen this in other papers too, but I can't figure out if a simplification is being made. Help!

Thanks!


texts: What should be the size of a Diffie-Hellman private key?

texts:
I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman).

The RFC documents state:

  The private values $a$ and $b$ SHOULD be at least 256-bit random numbers, to give
  approximately 128 bits of security against certain methods of calculating discrete
  logarithms.

I can't seem to find any info on this – is it still valid advice?

Is the reason for this simply that the best known method for calculating discrete logs of $n$-bit numbers requires $2^{n/2}$ steps?


texts: Is it right that all block ciphers don't provide perfect secrecy like AES? If it's true, how can we prove that? If it's not true can you tell me a sample? Any reference or guidance would be appreciated.


texts: Can two different seeds produce the same output from a PRNG?

texts: In general, is it possible that two different seeds produce the same output from a PRNG? I'm not sure how many different types of PRNGs there are and maybe it depends on which one we consider. I know that an identical seed produces and identical output, but can different seeds stumble upon the same output (seed collisions)?


texts: Pseudo-random Number generation for Passwords

texts:
I am looking for a good pseudo-random number generation algorithm for passwords.

My scenario is that I have to generate 5K pseudo-random bits from a user-supplied password (6 characters). What are possible options and which one would be able to cover for my purposes?


texts: Difficulty of generating a string "The (md5|sha1) hash of this string is (x)" that hashes to (x) vs. regular hash collision between files?

texts:
I know that collisions in md5 and sha1 have been demonstrated in particular pairs of files (by incrementing some none viewable portion of a PDF, etc).

Would generating the above string be meaningfully more computationally difficult than generating such a collision?


texts: Examples of protocols that are insecure when run concurrently

texts:
I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent composition. I don't see why protocols might break when concurrently composed together.

Please provide some examples of protocols that are insecure under concurrent composition.

Does the same type of attacks hold for parallel composition? What's the difference?

Does the same type of attacks hold if the protocols are run many times one after another (Let's say to improve soundness error)?

Edit: @Mikero gave a nice MPC protocol that is not secure under concurrent composition. Can anyone give an example of ZK protocol that is insecure under concurrent composition?


texts: Should I use independent symmetric keys for each client should I use keys derived from a master key?

texts:
I have several clients that I communicate with from a central location. All connections are encrypted using static symmetric keys that are hard-coded in each client config file. I use a different key for each client because it is possible that someone gains access to the key of a client. In that case I want the attacker to be unable to access connections established by other clients.

Until now I was creating client keys manually by typing characters at random on my keyboard. I thought creating keys manually is not a good idea because in addition to being tedious it is error prone and somewhat insecure. So just now I was writing a key generator program that creates random keys for me.

But in the meanwhile another idea hit my brain: I can have just one master key and derive all client keys from it! For example suppose my master key is '123456', I can derive the first client key like this:

SHA256('123456'|'client1')

Is that OK?

Is it better to continue writing my key generator program and use separate and completely independent keys for each client or is deriving all keys from a master key acceptable?

Whatever approach I use, I need all client keys at a central controller  location, so if an attacker gains access to this central location he has all the keys anyway, thus seems there is no advantage to using independent random keys for me.

P.S.: My master key is not something like '123456'; It is really/sufficiently strong!


texts:
Gravatar is a service that serves avatars for users based on md5(email_address). The hash is embedded on websites, so it's public.

One of the problems with this solution is that it's easy to track users across websites, since the same e-mail will have the same hash.

I'm wondering if there's a cryptographic solution to that problem? Requirements:

A. It must not be practical to correlate users across websites by the avatar URL alone (hash/identifier for the same e-mail must be different on different sites)

B. The server, given a hash/identifier, can decode it and look user up in a large database in a better-than-linear time.

C. No clock synchronization, no challenge-response protocol (it must be possible to generate identifiers offline). Ideally it shouldn't require pre-shared keys for every website.

The only solution that comes to my mind is something like salt + hash(email_address + salt), which would meet requirements A and C, but not B: salted hash would force the server to re-hash e-mails of all users to find the relevant one.


texts: Examples of multi output bit balanced Boolean functions

texts:
I am trying to find out and learn more about Balanced boolean functions.
Wikipedia states that " a balanced boolean function is a boolean function whose output yields as many 0s as 1s over its input set", and states that an example of this is XOR.
I want to know how the same works for multi-output bit functions, where the output is a concatenation of two boolean functions essentially. Truth tables with examples for single and multi output to understand what this exactly means would be good to analyze it more.


texts: PRNG taking advantage of very large seed

texts: Can anyone suggest a good (CS)PRNG algorithm that takes advantage of having a very large (ideally arbitrarily large) seed? I'd like to use several kilobytes, perhaps several hundred kilobytes, of random data to generate up to a few dozen megabytes of PRNG output. The PRNG algorithms I'm aware of only take relatively small seeds: I'd like to make the most of the random input data I have.


texts:
I have to to find the shift value and the message for the following caesar cipher.
OC_VAWDGPM_VHWTVX_VXJOCVZ_GDX_MWO_VWIZVYGWIZ_NODI_

I have already tried it and with the shift value of 21 i get the following.
TH_AFBILUR_AMBYAC_ACOTHAE_LIC_RBT_ABNEADLBNE_STIN_

Does this look like the correct decrypted message to anyone?
How am i supposed to determine the correct answer?
I think I'm doing something wrong

Here are all the possible decryptions:

NB_UZVCFOL_UGVSUW_UWINBUY_FCW_LVN_UVHYUXFVHY_MNCH_
MA_TYUBENK_TFURTV_TVHMATX_EBV_KUM_TUGXTWEUGX_LMBG_
LZ_SXTADMJ_SETQSU_SUGLZSW_DAU_JTL_STFWSVDTFW_KLAF_
KY_RWSZCLI_RDSPRT_RTFKYRV_CZT_ISK_RSEVRUCSEV_JKZE_
JX_QVRYBKH_QCROQS_QSEJXQU_BYS_HRJ_QRDUQTBRDU_IJYD_
IW_PUQXAJG_PBQNPR_PRDIWPT_AXR_GQI_PQCTPSAQCT_HIXC_
HV_OTPWZIF_OAPMOQ_OQCHVOS_ZWQ_FPH_OPBSORZPBS_GHWB_
GU_NSOVYHE_NZOLNP_NPBGUNR_YVP_EOG_NOARNQYOAR_FGVA_
FT_MRNUXGD_MYNKMO_MOAFTMQ_XUO_DNF_MNZQMPXNZQ_EFUZ_
ES_LQMTWFC_LXMJLN_LNZESLP_WTN_CME_LMYPLOWMYP_DETY_
DR_KPLSVEB_KWLIKM_KMYDRKO_VSM_BLD_KLXOKNVLXO_CDSX_
CQ_JOKRUDA_JVKHJL_JLXCQJN_URL_AKC_JKWNJMUKWN_BCRW_
BP_INJQTCZ_IUJGIK_IKWBPIM_TQK_ZJB_IJVMILTJVM_ABQV_
AO_HMIPSBY_HTIFHJ_HJVAOHL_SPJ_YIA_HIULHKSIUL_ZAPU_
ZN_GLHORAX_GSHEGI_GIUZNGK_ROI_XHZ_GHTKGJRHTK_YZOT_
YM_FKGNQZW_FRGDFH_FHTYMFJ_QNH_WGY_FGSJFIQGSJ_XYNS_
XL_EJFMPYV_EQFCEG_EGSXLEI_PMG_VFX_EFRIEHPFRI_WXMR_
WK_DIELOXU_DPEBDF_DFRWKDH_OLF_UEW_DEQHDGOEQH_VWLQ_
VJ_CHDKNWT_CODACE_CEQVJCG_NKE_TDV_CDPGCFNDPG_UVKP_
UI_BGCJMVS_BNCZBD_BDPUIBF_MJD_SCU_BCOFBEMCOF_TUJO_
TH_AFBILUR_AMBYAC_ACOTHAE_LIC_RBT_ABNEADLBNE_STIN_
SG_ZEAHKTQ_ZLAXZB_ZBNSGZD_KHB_QAS_ZAMDZCKAMD_RSHM_
RF_YDZGJSP_YKZWYA_YAMRFYC_JGA_PZR_YZLCYBJZLC_QRGL_
QE_XCYFIRO_XJYVXZ_XZLQEXB_IFZ_OYQ_XYKBXAIYKB_PQFK_
PD_WBXEHQN_WIXUWY_WYKPDWA_HEY_NXP_WXJAWZHXJA_OPEJ_
OC_VAWDGPM_VHWTVX_VXJOCVZ_GDX_MWO_VWIZVYGWIZ_NODI_


texts:
I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions.

I am interested in what bcrypt does to the start of the final hash.

$2a$10$

I have two thoughts on this:

I know that Christof is speaking about HMACS in the lecture above not bcrypt, but the start of the final hash does seem alot like what he describes as 'padding', is it the same?.
The first part ($2a) is saying that there are two vars; a salt and a message, but I am not sure what the a is for here? The second part is the iterations or something to do with the salt length I think as there is no space between the salt and the message.


texts: Cipher based message authentication (CMAC) and block reordering

texts: Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?


texts: How can we prove that two discrete logarithms are equal?

texts: Suppose there are two elements $a = g^x$ and $b = h^x$, where $g$ and $h$ are generators in $Z^*_p$ and $p$ is a large prime. How can we prove that $a$ and $b$ have the same discrete logarithms with respect to $g$ and $h$ respectively without leaking the knowledge of $x$?


texts:
Are there good options for password hashing in embedded systems?  These systems often cannot afford slow hash functions.  I can think of a few approaches:

Store the (hashed) passwords in a HSM that limits lookup rate.
Generate high-entropy passwords, and do not let users choose their own passwords
Use hardware password hashing
Replace the password with RFID and a smartcard (probably a good choice anyway)


texts: How do you find the cipher formula for a cipher like this?

texts:
I'm new to ciphers and cryptology in general, so apologies in advanced.
((When I say I'm new, I mean I only started looking up cryptography in response to being given this cipher this morning, so I know absolutely nothing except for what I've googled thus far.))

I was given this cipher to solve, and I was able to figure out that it says:

"please post emergency information for each member of your family by your telephones so it is available when a real emergency occurs"

However, the person who gave me this asked for the cipher formula, and that is where I am confused. Is this a Caesar Cipher and an A1Z26 Cipher? Or is this an Affine Cipher? And how would one go about finding the cipher formula?


texts: Small complex multiplication field discriminant for solving ECDLP

texts:
I've seen from the SafeCurve criteria that one should try to avoid small complex multiplication field discriminant as it can speedup the discret log computation via the Polard Rho method.

However, I cannot find any information about how this additional information can improve the rho method. Especially, the SafeCurve page seems quite vague, mentioning that we do not know for sure if a small Discriminant (even really tiny like 3 for example) can lead to disastrous consequences or not. May someone explain how this particular structure can (in some cases) improve the rho method?