texts: Can the backdoor in Dual_EC_DRBG be used to create a public key stream cipher?

texts:
Dual_EC_DRBG has the property that if $Q = e\cdot P$, someone who knows $e$ can break the PRNG.

This seems to lead to a public-key stream cipher:

Alice chooses a random $P, e$, where $P$ is a generator.
Alice computes $Q = e\cdot P$.
Alice publishes $(P, Q)$ as her public key.  She retains $(P, e)$ as her secret key.

To send a message:

Bob chooses a random seed $S$.
Bob publishes the first $n$ bits of the output.
Bob uses the rest of the output as a keystream.

To decrypt, Alice uses her knowledge of $e$ to break "PRNG" and recover the keystream.

Is this system secure? Does it provide any advantage over other forms of asymmetric cryptography?


texts:
I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below,

For i=1 to n :
    j=constant;
    for i=1 to n':
        Use J here
        .
        .
    exit for;
exit for;

In my case, I don't want to j to get the correct value of constant.

If n is between 60 to 80, how feasible is to mount a fault attack such that j gets 0 (or other small value) instead of the constant?
If it is not possible to do it for all iterations, can I make this happen for some iterations?
For simplicity, let's assume that all the compiler optimizations are turned off. Or the code is written in assembly to remove any interference from the compiler.

Please let me know if something is not clear or you need more information.
Thanks in advance. :-)

EDIT 1:
the Constant is not ZERO. But rather a 32 bit value.

EDIT 2:
The platform is a microcontroller. Let's say, Cortex-M0 or Cortex-M4


texts: Security Considerations in using SHA-1 for One Time Passwords

texts:
SHA-1 is considered broken. That's why I'm assuming that using SHA-1 for RFC2289 OTPs is broken as well. Is this assumption correct?

Going further with this assumption using SHA-1 for RFC4226 HOTPs should be broken too, is it? Although this blog states the following: "it doesn't affect applications such as HMAC where collisions aren't important". Does this also applies for HOTP?

A detailed explanation would be really appreciated.

Thank you very much in advance.


texts: Calculation of the order of the cosets used in defining the Tate Pairing

texts:
I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the preamble to the Tate pairing. (See p. 70 ff., section 5.2 of of the PDF.). I'm having trouble following a few arguments and would really like some help please.
The setting is curves of embedding degree $k > 1$, $r∥\#E(F_q)$ (where $∥$ means divides, but just once).

Since there are $r^2$ points in the the $r$-torsion subgroup $E(F_{q^k})[r]$ we usually have $r^2∥\#E(F_{q^k})$.

Ok so far.

Thus, let $h = \frac{\#E(F_{q^k})}{r^2}$ be the cofactor that sends points in $E(F_{q^k})$ to points in $E(F_{q^k})[r]$.

I don't follow this part. Presumably he's asserting that with this $h$, we can take any point $P ∈ E(F_{q^k})$, and we will get $hP ∈ E(F_{q^k})[r]$? I don't see how $hP$ would necessarily be a point of order $r$?

Let $rE(F_{q^k})$ be the coset of points in $E(F_{q^k})$ defined by $rE(F_{q^k}) = \{[r]P : P ∈ E(F_{q^k})\}$.
The number of elements in $rE(F_{q^k})$ is $h$

I don't see why the order of this 'coset' is $h$?

and it contains the point at infinity; from here we will simply denote this coset as $rE$. Following [Sco04], we can obtain another distinct coset of $E(F_{q^k})$ by adding a random element $R$ (not in $E[r]$) to each element of $rE$. In this way we can obtain precisely $r^2$ distinct, order $h$ cosets.

Without knowing the answer to my previous question ("why does $rE$ have order $h$") I can't yet accept this step. I believe it will follow from Lagrange's Theorem directly, if I can be convinced that the order of $rE$ is $h$.


texts: Multiplication in Tower Field $GF(2^4)^2$

texts:
I'm currently reading an article which deals with "Squeezing Polynomial Masking into Tower Fields " for performing an efficient multiplication of elements in $GF(2^8)$.
Thereby it is explained that one first hast to do an affine transformation on the elements in $GF(2^8)$ and apply the actual multiplication in the tower field $GF(2^4)^2$. The paper defines an overall algorithm to perform the multiplication in the smaller field according to:
Multiplication: The multiplication $c = ab$ of two elements $a,b \in GF(2^8)$ can be computed in $GF(2^8)$ as:
\begin{equation*}
\begin{cases}
c_h = &(b_h + b_l) (a_h + a_l) + b_l a_l\\
c_l  \ = &b_ha_h\gamma +b_l a_l
\end{cases}
\end{equation*}
where

$a \mapsto \phi(a_h, a_l)$,

$b \mapsto \phi(b_h, b_l)$,

$(c_h,c_l) \mapsto \phi^{-1}(c_h, c_l)$

and all operations defined in $GF(2^4)$.
Apparently $\phi$ denotes the isomorphic mapping, which bijectively maps the elements from $GF(2^8)$ to $GF(2^4)^2$.
In the follwoing it is also stated that the generator polynomial is given according to $\mathbb{F}_{2^4}[y]/(y^2 + y + \gamma)$.
Consequently, I started to tabulate the required multiplications in the smaller field which yield the following code
for(uint8_t i = 0; i <= 0xF; i++)
{
    for(uint8_t j = 0; j <= 0xF; j++)
    {
        uint8_t result = gf_2_4_multiply(i, j);
        gf_2_4_table[i][j] = result;
    }
}

Nevertheless, now I fail to understand how the decomposition into the smaller field has to be done. Thereby, I encountered a post from intuition-behind-mapping which I do not really understand. In particular I do not understand how the mapping matrix must be applied to perform the transformation into the smaller subfileds. Additional to that, I do not understand the meanig of $\gamma$ in this context. For that reason, I would be gradeful if anyone could give me a few hints or explain how the overall multiplication/mapping to the smaller field works.
Best regards
ratbaldmeyer


texts: Edwards / Montgomery ECC over binary extension fields

texts:
I recentely had a discussion about the redesign of our ECC code for the library I'm collaborating on and the person I was discussing with came up with Edwards and Montgomery curves over binary extension fields. I suspect he just did this because "why not?" as it seems to be straight conclusion to think they exist for the binary case and they are special for the prime field case.

This made me think and look into the addition law for Edwards curves over prime fields and it looks like you can't trivially do this over binary extensions fields.

So I had the following questions regarding (twisted) Edwards / Montgomery curves over binary extension fields:

Do they exist?
Are they any special, like Curve25519 and Curve448 are (i.e. easy side-channel resistant implementation)?
Are there standardized curves for them?

I suspect 1) to tell me "yes", because these curves can theoretically normally defined via the equations. I don't know about 2) but suspect they aren't special (or I would have heard of them) due to the vastly different implementation of the underlying field arithmetic between the prime and binary case. I doubt 3) holds, but I may have just missed them.


texts:
If a database stores password encrypted by using salt values, how are they stored?

I read somewhere, it uses timestamps.
So is the timestamp also stored?

How about when a user tries to login next time, then how are timestamps considered?


texts: Is there an algorithm or hardware that can sign/verify natural time?

texts:
PGP/GPG can used to sign text, others use public key to verify them. So one could say, that these cryptographic algorithms deal with space.

Are there any algorithms that can deal with time? E.g. I sign a document at 2011-12-31 23:59:59, others can verify this document is really, truly signed at 2011-12-31 23:59:59.

I know there are solutions based on a common trusted time source (a notary), but is it possible that a pure algorithm solution exists? Or perhaps some amazing dedicated piece of hardware can do this? (E.g. half-life of certain well-known material, etc.)

In a simple way: Can we give nature a private key and ask nature to sign our documents using a natural timestamp?


texts: Division of Point in Elliptic Curve: Getting Back Point

texts:
Let $P=(x_p,y_p)$ be a point on elliptic curve $E (a, b) := y^2=x^3+ax+b$, for an integer $n$, there exists a point $Q=(x_q,y_q)=nP$ on $E (a, b)$.

If $(x_q,y_q)$ and $n$ are given, what is the algorithm to find  $(x_p,y_p)$?

If possible provide code for python.


texts: Formal security of recycled random blinding in a Paillier scheme

texts:
This question is a follow-up/variant on a previous question.

Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the costly exponentiation of standard re-encryption:

$c \gets c \cdot r^n \mod n^2$ (with $r \in \mathbb{Z}_n$ random)

We could pre-compute a large pool of exponentiated values $r_i^n, i=1...p$, then for each re-encryption, take the last re-encrypted ciphertext and multiply it by $k$ randomly chosen $r^n_{\sigma(1)}, ..., r^n_{\sigma(k)}$.

What would be the security (both practical and theoretical) of such a method?

The size of ${p}\choose{k}$ for manageably high values (say $p = 1000$ and $k = 20$) makes the odds of two blinding random variables $R = \Pi_{i=1..k} r_{\sigma(i)}$ being equal, negligibly low in general (and even more so if we only consider successive pairs of such values).

An attacker could possibly raise their chance of finding a collision by comparing every possible products of the resulting ciphertexts together, but even assuming all ciphertexts available to them are indeed generated from this method and setting aside the very large computing cost, the chances of any two products being equal still seem negligibly low.

Am I missing any other possible attack vector? Does a formal security proof seem achievable?

Edit: Possible proof outline

Estimate (comparatively small) chance of accidental collision between $R^{(i)}(c)$ and $R^{(j)}(c')$, respectively $i^{th}$ and $j^{th}$ re-encryption of ciphers $c$ and $c'$ (maybe treating separately cases $c = c'$ and $c = c'$).
Estimate chance of accidental collision between any two products of $R^{(i)}$: $\Pi_{i = 1...m} R^{(a_i)}$ and $\Pi_{j = 1...n} R^{(b_j)}$, which requires:

$\{a_i\}_i \cap \{b_j\}_j = 0$ (any case where that is not true could be reduced to the previous case)
$\Sigma_i a_i = \Sigma_j b_j$

The main part would therefore be to compute the number of $a_i$ and $b_j$ verifying conditions 1 and 2, given a maximum number of re-encryptions $s$ of a maximum total number of plaintexts $t$. This seems achievable.

Does that seem like a sufficient proof, however?

Edit 2: Actually, condition 2 above could be made even stronger. If we note $r^(i)_1, \dots, r^(i)_k$, the $k$ random values selected by the $i^{th}$ re-encryption, for a collision to be more likely than between two random values, we must have:

$\{r^{(a_1)}_1,\dots,r^{(a_1)}_k,r^{(a_2)}_1,\dots,r^{(a_2)}_k,\dots,r^{(a_n)}_k\} = \{r^{(b_1)}_1,\dots,r^{(b_1)}_k,r^{(b_2)}_1,\dots,r^{(b_2)}_k,\dots,r^{(b_m)}_k\}$

Proof ad absurdum: if there is one value $r^{(i)}_j$ in one set but not the other, then the product of the values in that set is $C * r^{(i)}_j$, with $r^{(i)}_j$ statistically independent from the other set and, for all purposes the two sets are statistically independent.

Edit 3: in all the above, it would probably make computations easier to use a draw with replacement instead (and therefore consider $n^k$ combinations instead of $n\choose k$).


texts: Is the matrix step of GNFS still the hardest part?

texts:
When the factorization of RSA-768 was announced in December 2009: the sieving took about 24 months and the matrix step took 119 days (4 months). So sieving took about 6 times as long. This is despite them over-sieving, meaning they spent longer on the sieving so that the matrix step would be easier.

When the factorization of RSA-220 was announced in May 2016: the sieving was done from May to September 2014 (5 months), but the authors say code developments were done between October 2014 and January 2016 to make the matrix step easier. After that they only spent 48 hours on the $\texttt{lingen}$ part of the matrix step, and a few days in the program $\texttt{mksol}$.

These dates, timings, and program names come from  here. But the specific code developments that were made between 2014 to 2016 remain a mystery to me. Has there been a bottleneck surpassed in the matrix step, or is it still considered the most cumbersome part of the factorization process?

A related question, regarding the precise cost of the matrix step, which doesn't seem to be given anywhere, can be found here.


texts: Calculating t and epsilon for a computationally indistinguishable pseudo random generator

texts:
I have a PRG $G : \{0, 1\}^n \rightarrow \{0, 1\}^{2n}$.

How would you go about calculating the optimal size of $n$ given that you have

$$\epsilon = \cfrac{1}{2^{80}}$$

and, $t = 2$ years for a PRG that is (t,$\epsilon$) pseudorandom i.e

$$| Pr[D(r) = 1] -  Pr[D(G(s)) = 1]| ≤ \operatorname{\epsilon}(n).$$

I know that I should take into account how many computations a computer can execute per second, but I'm unclear as to how exactly I end up finding $n$.


texts:
I'm trying to establish E2E secured channel with nearby devices (using WiFi direct).
Obviously, I wouldn't like to rely on internet connection. Can I use the signal protocol without a server?

1)Will it be secure to just publish the prekey to the other peer, and after the key-exchange compare the keys' fingerprints?

2) Is it better to compare the fingerprints of the prekey?

3)What hashing method should I use in order to generate keys' fingerprints for comparison? Can I generate a short a pin code or will it be insecure? (I guess it depends on which fingerprints I compare prekes or the actual key).


texts: Composition of weak one way function is not a strong one way function

texts:
Given $f(x)$, a weak one-way permutation, how to prove that $f^T(x)$ is not a strong one-way function? Here $f^T$ denotes
$T$ times self composition of $f$ and $T$ is a polynomial in input length.


texts: Isn't AES-NI useless because now the key length need to be longer?

texts: AES-NI speeds up both encryption and decryption. The encryption is as secure as the time needed to brute force the decryption. Doesn't it mean that the application developers will just need to increase key length until the time taken is almost the same as without AES-NI?


texts: How would you name and/or describe this algorithm?

texts:
First up: this is not a decoding request or anything. This is about terminology.

Twice per year, we email another department to ask for a new licence file for their software. They are always slow to reply. The licence files are encrypted, but I noticed only a couple of characters change between revisions. My 'home-grown crypto' sense tingled. I surmised the characters that changed might correspond to the expiry date in the plaintext.

Ciphertext:

GO9ETBBE
GO9ETCBE
GO9WTBBE

Plaintext:

20150101
20150601
20160101

You can see it's not a substitution cipher. However a particular character at a particular position is always mapped the same way. For example, '1' at the third position is always mapped to '9'.

I amused myself by reverse engineering the rest of the algorithm (Python code):

letters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 "
secrets = "C3H8NJ1AX5VRU 2F04KYDIS6PQMOG9TLB7EWZ"

def decrypt(ciphertext):
    plaintext = ""

    for i,x in enumerate(ciphertext):
        j = secrets.index(x)
        j -= i # offset moves backwards 1 each character
        j %= len(secrets)
        plaintext += letters[j]

    return plaintext

def encrypt(plaintext):
    ciphertext = ""

    for i,x in enumerate(plaintext):
        j = letters.index(x)
        j += i
        j %= len(secrets)
        ciphertext += secrets[j]

    return ciphertext

Anyway, my questions are:

Is there a name for the "a particular character at a particular position is always mapped the same way" assumption?
How would you describe the algorithm? Colloquially I'd call it a "substitution cipher with a rolling offset"


texts: How to select a good scale for letter frequency in a text?

texts:
I needed to use a scale in a code to determine which sentence in a file has been encrypted by a single-character key.

The scale that i currently used is:
+2 for every occurrence of a vowel or a space and +1 for other alphabets, numbers and some characters.
The sentence with the maximum value using above scale helped me in finding the solution.

Is there some standard scale used by cryptographers based on character frequency?


texts: Getting a random number on an STM32L0x1 device for SRP6a

texts:
I'm trying to get a random number for a STM32L0x1 MCU to use it in protocol SRP6a.
(I know that there are MCUs with an embedded hardware random number generator. But it would cost twice as much as the MCU I'm using right now.)
Now some questions arise:

Would a "bad" random number seed (like reading values from ADC) negatively affect the security of SRP6a?

If yes: how to get a "good" random number (random enough for SRP6a) on STM32L0x1?

What about the following approach:
a) Create the random number seed externally at the factory and save it in EEPROM of the MCU
b) Every time the MCU is (re)started, run a one-way function (like a hash) on the seed, save that new seed and use it for the software random number generator.


texts:
Assume I have an encryption scheme $E(k,m) = (P(k,r), G(r) ⊕ m) $ and given that $G$ is a PRG , $P$ is a PRP and $r$ is a random n-bit nonce.

My question is:

  If I run this encryption twice with the same message but different r
  (due to nonce behavior), will I get the same c?

I know that PRG is deterministic, but in this case, the $r$ always changes.

Please help!


texts: How do we compare performance of two encryption algorithms?

texts:
Suppose I want to compare between RSA and Paillier encryption algorithms. I have coded two different programs in the same programming language. Now how to compare between these two and in what aspects they can be compared?

Are there tools available for same?


texts:
A5/2 could be attacked with cipher-text only, using the Error Correction Code, in order to retrieve the session key.

For the purpose of simplicity suppose that the error correction code copy the plaintext 4 time.
e.g., for $=1010101$ we will encrypt the following bits: $1010101 \space 1010101  \space 1010101 \space 1010101 \space 1010101$.

Here's an example of a message and a corresponding cipher:

$'= 1010101 \space 1010101 \space 1010101 \space 1010101 \space 1010101$
$= 0110100 \space 1000001 \space 1101111 \space 0000101 \space 1010111$

Bold bits are from the same bit in plaintext.

How can I find the session key this way?

I guess I need to make some linear functions, such as:

$p_0 \oplus k_0 = 0$,

$p_0 \oplus k_8 = 1$,

etc...

But I can't really find the key this way.


texts: Is using EAX mode with a 64-bit block cipher a bad idea?

texts:
EAX mode produces an authentication tag no longer than the length of the underlying cipher's blocksize.  So in the case of using Blowfish (a 64-bit block cipher) in EAX mode, the resulting tag would be 8 bytes.

Is an 8-byte tag sufficiently long (I doubt it)?  Could such a short tag subject the ciphertext to any sort of cryptanalysis to which a longer tag could resist?

I understand, of course, that there are plenty of reasons to prefer a 128-bit block cipher...  I'm merely curious.


texts: Different ways/algorithms for implementing AES

texts:
I have seen a couple software implementations of the Advanced Encryption Standard. They are pretty much straight forward, i.e. they are implemented exactly the same way as the AES is described. This makes an implementation of AES very easy to achieve. Nevertheless I was wondering if there are other ways of implementing it? Other algorithms for achieving a faster or more secure implementation?

For example, with ECC I know that there are different algorithms for implementing the point multiplication (double-and-add, double-and-add-always, Montgomery Algorithm).

So, are there different algorithms for implementing AES?


texts: Can MGF1 within OAEP and PSS be replaced by a XOF?

texts:
Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains SHAKE128 and SHAKE256 could MGF1 be replaced?

It seems to me that there is only one input to MGF1, called the seed. It seems that MGF1 is directly replaceable with a XOF which also has one input and one output. In that case we could call MGF2 = XOF, and the XOF (hash) function would simply be one of the SHAKE functions specified in the SHA-3 standard.

Will a extendable-output function directly cover the security requirements expected from a mask generation function?


texts: How does Microsoft's BitLocker Recovery Code work?

texts:
I don't trust Microsoft BitLocker because it is closed source, which makes it so people can't audit it. But now I'm really interested in how its recovery code works. In my own knowledge, encrypted data can't be decrypted without knowing the key, but BitLocker breaks it.

So, I have three questions want to ask:

How does the recovery code work?
How can I implement a recovery code function on
any encryption algorithm in a mathematical way?
Will it be a possible backdoor/vulnerability to hacker?


texts: How are secure hashing and encryption algorithms proven?

texts:
Given that:

  You should always use proven secure hashing and encryption algorithms,
  rather than attempting to write your own.

What's the process for criteria for an algorithm being proven?

Is it necessarily a peer review process? Does an algorithm need to withstand exploit attempts for N amount of time by M many experts?

Or, is there a mathematical proving process that security experts can apply on their own to evaluate an algorithm?

From the consumer perspective, how can early algorithm adopters vet new potential algorithms? Or put another way: When should security-concerned folks start considering new algorithm X?


texts: Can chaining hash functions reduce security?

texts:
Is there a concrete case where chaining cryptographic hash functions reduces security?

I'm thinking of things like md5(md5(x)) or sha256(sha1(x)), as common in password hashing (even though neither function above is suitable for it).


texts: TLS: Does Diffie-Hellman make private keys useless

texts: When we are using TLS these days we use DH to establish a session key. So where in the TLS protocol do we determine that the host that we're talking to actually possesses the private key corresponding to the x509 certificate that it provided earlier? Or is this no longer required?


texts: How to create an ultra-secure connection between two clients with xor?

texts:
At work, I was asked to create ultra-secure connection over lan between two computers. It will be some kind of messager. I have a bunch of same random data in them(near 100mb). Also I can start a server with same data. I will not have access to clients, so I will not be able to update the random data on them.

Can I use XOR?


texts: What is the difference? I found it quite hard to check for integrity using Gpg4win. Checking for hash was easy with Online MD5 & SHA1 Hash Generator For File. Is there any advantage to use Gpg4win? I often see that software developers leave their PGP and signing keys for verification and quite few leave a hash for that purpose. Why?


texts:
I have on more than one instance come across statements which suggest that zero-knowledge proofs are not practical. One example is: "Our theoretical constructions use zero-knowledge proofs, and therefore they do not suggest a practical way of implementing a pseudonym system." from the paper Pseudonym Systems.

What is the basis for this? Is it a caution which was common in the past which is now obsolete? I can think of recent systems, e.g. Z-cash, which uses zero-knowledge proofs in practice.


texts: Negative exponents in Shoup's threshold RSA?

texts:
I'm trying to implement threshold RSA operations, starting with decryption based on

  Peeters, R., Nikova, S., & Preneel, B. (2008). Practical RSA Threshold Decryption for Things That Think. Retrieved from http://www.cosic.esat.kuleuven.be/publications/article-1178.pdf

and running into problems where it seems I would have to raise by a negative exponent. The formula is on page 9:

$$
w = \prod_{j\in S} x_j^{\lambda_{0,j}^S}
$$

Peeters et al. reference

  Shoup, V. (2000). Practical threshold signatures. Advances in Cryptology—EUROCRYPT 2000, 207–220. Retrieved from http://link.springer.com/content/pdf/10.1007/3-540-45539-6_15.pdf

for definitions, which to me seems to have the same issue. I'll quote Shoup page 212:

  Let $\Delta=l!$. For any subset $S$ of $k$ points in $\{0, \ldots, l\}$, and for any $i \in \{0, \ldots, l\} \setminus S$, and $j \in S$, we can define $$ \lambda_{i,j}^S = \Delta\frac{\prod_{j^\prime \in S\setminus\{j\} }(i-j^\prime)}{\prod_{j^\prime \in S\setminus\{j\} }(j-j^\prime)} \in \mathbf{Z} $$

(which Shoup defines as equation (2), but I couldn't get the embedded LaTeX to do that)

Shoup uses $\lambda$ on page 214:
$$w = x_{i_1}^{2\lambda_{0,i_1}^S} \dots x_{i_k}^{2\lambda_{0,i_k}^S}$$

(where $x_i$ were previously calculated to be in $Q_n$, e.g. the subgroup of squares in $\mathbf{Z}_n^*$, n being the RSA modulus, though I'm a little bit out of my depth as to what consequences this has. In any case, Peeters et al. don't use the subgroup of squares.)

My problem is: $\lambda_{0,j}^S$ is negative quite often. Simple example $l=3, k=2, S=\{1,2\}, \Delta = l! = 6$.

For $j=1$: $\lambda_{0,1}^S = \Delta \frac{ (0-2) }{ (1-2) } = 6 \cdot 2$

For $j=2$: $\lambda_{0,2}^S = \Delta \frac{ (0-1) }{ (2-1) } = 6 \cdot -1$

How am I supposed to use that in an exponent?


texts: Questions Regarding Basics of Lattice-Based Cryptography

texts:
I had some questions regarding the basics of lattice-based cryptography I was hoping someone could answer:

What are the advantages of using a parallelepiped vs a grid?

Does a parallelepiped grant us something that a standard grid does not?

I only ask as I never see anyone use a standard grid when discussing lattice-based cryptographic scheme.

What minimum lattice-size (X * Y) must we use in order to ensure a secure implementation?

In other words, must our lattice / grid be 100 x 100 in order to be secure, or must we use a larger lattice / grid (ex 1000 x 1000 or 10,000 x 10,000)?

How do we determine the length of our shortest vector?
How do we determine the lengths of our basis vectors?
Can the origin of our shortest vector be located anywhere on the lattice / grid, or are certain places less secure than others?

In other words, would placing the origin of our shortest vector at the origin of our lattice be more or less secure than placing the origin of our shortest  vector at some other location?

What is the most secure way to choosing the random point, used in the CVP (Closest Vector Problem) lattice-based cryptographic scheme?

In other words, would choosing the random point at the origin of our lattice / grid be more or less secure than choosing some other location on our lattice / grid?

Thank you.


texts: Does Argon2id provide less protection against side-channel attacks than Argon2i theoretically and/or practically?

texts:
LUKS 2 encryption uses Argon2i as the default PBKDF. As the key is used on each access, I guess side-channel attacks are a significant threat factor. However, as I'm not a cryptographer, I am not qualified to say but I'm still interested whether this choice has its grounds.
Specifically, I am not interested in whether Argon2i provides less protection against TMTO, but whether Argon2id provides less protection against side-channel attacks. Also, it is interesting whether using Argon2id is practically safe enough for situations in which side-channel attacks are the main threat factor.


texts: Does 3-DES take approximately the same time to encrypt 1B and 1KB?

texts:
I am using 3-DES to encrypt some data in Java. I decided to run some tests and plot some graphics to decide how to optimally pack data for its encryption (see how encryption/decryption time behave depending on the length of the plain text), so I measured the time to encrypt one thousand Strings of incremental size (first one of length 1, second one of length 2, etc.) and then did the same the other way around (decrypt the first results).

I find that the decryption time increases with the size of the resulting plain text, although the time/character decreases as a rule. However, for encryption all the tests take approximately the same amount of time (it takes as long to encrypt a 2-character String than a 1000-character String, ~0.003 ms).

Is this something inherent to 3-DES, to how Java implements it or maybe I measured the time wrongly?


texts: Multiple signatures on one OpenPGP key. How are they combined? Where are they stored in OpenPGP certificate?

texts:
When one OpenPGP public key is signed multiple times by different keys, how these multiple signatures become visible on one OpenPGP certificate/key?

For example, I participated in a key signing party and got my public key signed by different people, some people emailed me my signed key, some people uploaded the signed key to key server by themselves, how all of these signatures become visible on my public key (in the OpenPGP certificate)?

Also how long can OpenPGP certificate be? For example, if I had my key signed by 10.000 people how will it look like?


texts: Textbook RSA: Public key used to decrypt ciphertext and checked against known plaintext

texts:
In textbook RSA with no padding schemes, is it possible to forge a ciphertext that decrypts to a known plaintext when the ciphertext is encrypted using the private key and decrypted with the public key?

Specifically, assume the plaintext and public key are known. The private key is unknown. In this scheme, person A encrypts a message with the private key. Then, person B decrypts this ciphertext using person A's public key. Person B then checks the decrypted message against a static predetermined plaintext to validate that the message actually originated from person A, almost like a signature. The plaintext is not a hash but rather a relatively small magic number.

I want to know if there are any feasible attacks against this scheme to forge a fake ciphertext c that decrypts to the expected plaintext, without knowing the private key.

In this case, the exponent is 65537 and the key is 2048 bits.


texts: Cryptographically correct way to roll a giveaway winner

texts:
I'm looking to create a fair selection of a giveaway winner, but I am versed enough in cryptography theory to determine if the below would hold up to public scrutiny if published on github.
The reason I am not using random.choice is for a "suspense" factor, where participants will be removed one by one until only one is left. I first shuffle the list, then pick random participant entries to remove.
Can someone who is well versed on this topic maybe give me some pointers or tell me I am doing it completely wrong?
from Cryptodome.Random import random

    def __init__(self) -> None:
        """Initialize object."""

        self._participants = {}

    def roll(self) -> List[str]:
        winners = []
        logs = []

        for participant, entries in self._participants.items():
            for _ in range(entries):
                winners.append(participant)

        random.shuffle(winners)
        while len(winners) > 1:
            remove_entry = random.randint(0, len(winners) -1)
            del winners[remove_entry]

        return logs

    def add(self, name: str, entries: int):
        """Add an entry."""
        self._participants[name] = entries


texts: Will repeatedly applying a hash function to the prior result visit all possible hashes?

texts:
If one were to take a message, say "Hello world!", and compute the MD5 hash:
86fb269d190d2c85f6e0468ceca42a20
Then, taking the MD5 hash of this, and repeating that procedure:
d522231cf8bd5bd3bceb31c640bcab9a
64bb07c8a424dbb918495fa428702998
ed64b3e94672013dd88c415b8575dede
95119774bf93c232892b4f3071348abd
0d1fff8e1426591625a888451ed893c2
3e858eba431292825240db61628a817a
055609b11d0a06b46eff40bcb52eca09
8860c0fbffff97c16f1aa617e3b243e5
518ca0b27a1990b5bac51799c2c1b636
b62fd7e949b2995312b9fbddccd6b19f
b1d831a1d1c6ed8a81e4cb908f5aa36e
dd4e0883a48b1fd3a3a08e26cbc6adc4
3f4a12f0cdc506141badd00bf498dbad
be536872dde5b558975fd3a7dfec4884
402b32bb6839f17028deb13e60dd32ad
...
Given an infinite number of repetitions of the above, is it possible that all possible hashes will be computed an infinite number of times? Is it possible that given some initial message, there may be a revisiting of the initial hash just shortly after the start of the procedure, ie. if the MD5 of 402b32bb6839f17028deb13e60dd32ad was 86fb269d190d2c85f6e0468ceca42a20 again.


texts: Feedback on rolling my own entropy gatherer

texts:
First of all, I don't recommend doing this. This was something I created when I didn't know better and didn't have a solution available to me.

Long ago I created my own entropy gather for a cryptography project. I used a window and had the user type with the keyboard while moving and clicking the mouse. I kept the milliseconds of the timestamp on each message, as well as the X, Y of the mouse and the values of the keystrokes.

Basically in designing the method I examined  the messages and only kept the values that changed significantly (unpredictably) from message to message. For example the date, hour and minute of the message was discarded since all the messages were collected on at close to the same time.

I then created an algorithm to "stir" the pool. This just used the built in simple random number generator to shuffle the values around a user defined number of times. After the fact I wondered if this was a good idea or not.

After that I would extract numbers from the pool (removing them not to be used again) each time I needed a random value as a seed. I would warn the user if the pool got to small and allow them to add more entropy. I would stir the pool before each use and after gathering.

I know that today there are cryptographically secure random number generators built into most operating systems and development libraries, so I would discourage anyone from rolling their own solution today, but I am curious if the methodology I described was effective and if there was anything I did or didn't do that could improve it.


texts: Is it acceptable to add a setup algorithm in the public key encryption?

texts:
I saw in the paper How to Use a Short Basis: Trapdoors for Hard Lattices and New Cryptographic Constructions at page 29 that key generation algorithm of PKE can use a common random matrix $A$.

Is it OK to add a setup algorithm that generates some common public parameters?


texts:
I was learning about Merkle trees and understood that if A, B, C and D are the leaf nodes, then their parents will be H(H(A)+H(B) and H(H(C)+H(D)) rsp. and the root will be H( H(H(A)+H(B)) + H(H(C)+H(D)) ). What if instead of this, the parents of the leaf node were: H(A+B) and H(C+D) and the root be H(A+B+C+D)?

I intuitively know this may not be a good choice but can someone explain it in a better way?


texts:
I'm looking at a piece of (non-object oriented) code where functions return point-at-infinity for a specific prime curve if a calculation errors out. This is even the case when validating arguments to the functions; obviously the point-at-infinity is used as a "magic value" (comparable with returning nil when a function fails).

Can I assume that each and every one of the occurrence of point-at-infinity is actually an error in the code itself? Should I just create an error each time I find point-at-infinity?

Or, if above is not the case, are there any valid EC calculations that may result in point-at-infinity? If yes, what would be an appropriate action when this occurs? Does it make sense to validate each time that a function never returns point-at-infinity (assuming that I get rid of the code-generated point-at-infinity return values, of course)?


texts: Security services provided by digital signature

texts:
Which of the security services can be provided by digital signature?

data integrity
non-repudiation
sender authentication
receiver authentication

I think it can provide non-repudiation. Because receiver cannot deny the message as it was assigned by the sender.
Am I right? Are the other services provided by the digital signature?


texts: Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?

texts:
A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form of reducing one scheme to a more basic problem or scheme. Furthermore, there are many different ways of formalizing security, and equivalence between security definitions is shown via reductions as well.

The concrete security approach for reductions, as introduced by Bellare, Desai, Jokipii, and Rogaway in FOCS '97,  moves away from polynomial reductions and instead focuses on finding concrete bounds, so as to provide a more nuanced view of security. They discuss various formalizations of security for symmetric encryption schemes, including indistinguishability under chosen plaintext attacks (IND-CPA). Two variants of IND-CPA they come up with are left-or-right (LoR) and real-or-random (RoR), which they prove to be equivalent in the following sense:

Let $\mathcal{E}$ be an encryption scheme. For all adversaries with time complexity $t$ making at most $q$ queries to $\mathcal{E}$ totalling at most $\mu$ bits,
$$\mathbf{Adv}_{\mathcal{E}}^{\text{ror-cpa}}(t,q,\mu) \le \mathbf{Adv}_{\mathcal{E}}^{\text{lor-cpa}}(t,q,\mu) \le 2\cdot\mathbf{Adv}_{\mathcal{E}}^{\text{ror-cpa}}(t,q,\mu)\enspace.$$
Note that the bound on the right-hand side includes a factor 2. There are encryption schemes for which the factor of two is absent. For example, for the identity function we have that $\mathbf{Adv}^{\text{ror-cpa}}(t,q,\mu)$ approaches $\mathbf{Adv}^{\text{lor-cpa}}(t,q,\mu) = 1$ for $\mu\to\infty$,
which leads me to my question.

  Does there exist an encryption scheme $\mathcal{E}$ for which  $$\mathbf{Adv}_{\mathcal{E}}^{\text{lor-cpa}}(t,q,\mu) = 2\cdot\mathbf{Adv}_{\mathcal{E}}^{\text{ror-cpa}}(t,q,\mu)\ ?$$


texts: Is this problem on $\mathbb{Z}_p$ really hard?

texts:
I just want to know if there's something obvious that renders this hard problem useless. Not a full cryptoanalisys. Any hint on whatever is welcomed.

We will work with the Ring $\mathbb{Z}_{p}$, $p$ prime.

Now, we define a function $f:\mathbb{Z}_{p}\times\mathbb{Z}_{p}\mapsto\mathbb{Z}_{p}$,
as $f\left(a,b\right)=\frac{-a\,b+a+b+z}{a+b-1}$, $z\in\mathbb{Z}_{p}$, $z$ is a public constant value.

Next, we define a series as follows:

$a,b\in\mathbb{Z}_{p},\ s_{0}=a,\ s_{1}=b,\ s_{n}=f\left(s_{n-2},\ s_{n-1}\right)$

And for a given element of the series, $s_{n}$, a value $r_{n}=f\left(s_{n},a\right)$

The question is, taking into account that the function $f$ is not
associative, how difficult is, knowing $b$ and $r_{n}$, recover
the value of a secret $a$. As an example of sizes let's say $n=256,\ p\sim2^{256}$.

This problem leads to a public key cryptosystem described here:

https://drive.google.com/open?id=1OeKh_ZJF-i7_KzWFRv8jodk3YkXe2qyv

Daniel Nager - daniel.nager@gmail.com


texts: Prove that the following MAC is insecure

texts:
I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved:

Gen generates a uniform $k \in \{0, 1\}^n$.

To authenticate a message $m_1 || m_2$ with $|m_1| = |m_2| = n$, compute the tag $F_k(m_1)||F_k(F_k(m_2))$.

Any help?


texts:
Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several possible strategies:

During the key exchange, A and B both generate and send nonces $N_a$ and $N_b$ which are mixed in the key derivation function with $S$ to produce a unique key for the exchange. We leave the IV = 0.
During the key exchange, A and B both generate and send nonces $N_a$ and $N_b$ which are mixed to produce and IV. The key is derived from S.
During the key exchange, A and B both generate and send $N_a$, $N'_a$, $N_b$, $N'_b$. $N_a$ and $N_b$ are mixed with $S$ to produce the key. $N'_a$ and $N'_b$ are mixed to produce the IV.

In other words: random key/fixed IV, fixed key/random IV or random key/random IV.

Which one is preferable? (Assume HMAC-SHA256 or similar for mixing keys/IV)


texts: Why does Neumann think cryptography isn't the solution?

texts:
What did Peter G. Neumann mean by:

  If you think cryptography is the answer to your problem, then you don't know what your problem is.

(eg: quoted in the New York Times, February 20 2001)


texts: I know that one time pad is malleable. Can you give me an example of an encryption scheme which is non-malleable?


texts: How can a company have its own Certificate Authority for internal use?

texts:
It is possible for a company to deploy its own CA ? How would browsers accept the certificates ?

Supposing a company does not want to use the role of a commercial server like Windows Server or any other as a CA, how can a company deploy its own CA ?

Are there any reliable free projects that can help?

Or the company needs to hire high-level experts, get its CA approved by top level CAs and then the browsers will accept its certificates.


texts:
I'd like to map a random ID of 16 bytes (sourceID) to another random ID of 16 bytes (targetID).

The operation should:

only be reversible by me
be deterministic

There are about 1 million source ID's that need to be mapped. The target ID is public, while the source ID is private.

I was thinking of using AES with ECB to map the source ID to target ID.

mapID(sourceID, key) = targetID

What is the likelihood of someone being able to reverse the process if they only have the targetID?

Is this a terrible Idea?


texts: Why is Shamir Secret Sharing not secure against active adversaries out-of-the-box?

texts:
This linear secret sharing scheme allows us to share a secret between n parties, such that only an honest majority can reconstruct it.

I understand that – because I do not allow the user to certify the authenticity of the shares nor the value they reconstruct (using for instance VSS or some kind of homomorphic MAC) – they are secure only on the semi-honest case. However, in my mind that problem is more related to integrity, because that even if the adversary sends an incorrect share, the output is unpredictable, and as far as my understanding goes, indistinguishable from randomness.

If that is the case, is there any way an active adversary can learn something by deviating from the protocol i.e., information about the private inputs of the honest parties? If that is so, what would it be?


texts:
I am currently trying to create a secure key exchange between two parties. I have a good implementation of PGP that works well for my app, but my DH is really slow and doesn't work well; so I was thinking that maybe I could perform the key exchange with PGP.

My idea is this:

Party 1 -> public key -> Party 2
Party 2 -> public key -> Party 1

Party 1 generates random bits and sends them to party 2 with the public key
Party 2 generates random bits and sends them to party 1 with the public key

Shared key = Sha256(Party 1 random concatenated with  Party 2 random)

Would this be secure? (assuming that the implementations of Sha256, PGP, and the random generator are to par.


texts: Was Enigma really that hard to crack, given that you had access to hundreds of messages per network per day?

texts:
Well, I guess that I have always been a little bit suspicious ... so to speak ... of the "official stories" about the difficulty of recovering Enigma message texts during WW2, because it seems to me that they're always focused on recovering "one message, in isolation."  Whereas, the actual situation faced by the intercept stations is that they were every day flooded with messages ... all of them encrypted using exactly the same (of course, unknown) network-key settings, differing only by their per-message keys.

So – my question is: "did all of that 'daily network-key mumbo-jumbo' actually matter," if you could be assured of a sufficient number of messages each day which ultimately differed from one another only by a three- or four-letter wheel setting?

I could go on at some length, but I think the question is clear:  could not cryptanalysts have exploited the process of statistically comparing the gathered messages against each other, treating most of the machine as simply "a pair-swapping transposition table that didn't change?"


texts: How to prove the hardness of Rabin's function?

texts:
I am unable to prove the following theorem:

  If for a $1/(\log(n))$ fraction of the quadratic residues $q\pmod n$ one could find a square root of $q$, then one could factor $n$ in random polynomial time.
  $n$ is the product of two large distinct primes.


texts: Is PKCS7 a signature format or a certificate format?

texts:
I always though PKCS7 was a signature format.

However, on the net I find several references to PKCS7 being a certificate format - for example, this talks about PKCS7 certificate: Extract raw certificate from PKCS#7 file in JAVA

Or: What's the difference between X.509 and PKCS#7 Certificate?

So is PKCS7 a signature format or a certificate format or both?


texts: How does wNAF work with prime finite fields?

texts:
According to wikipedia, in the precomputation step of the w-ary non-adjacent form (wNAF) point multiplication method you do $d \bmod 2$ and, later, $d \gets \frac{d}2$.

The mod operation doesn't make a lot of sense in the context of a prime finite field since division over a finite field doesn't produce a remainder. Rather, it's the numerator multiplied by the modulo inverse of the denominator. But I guess in this context it can probably just be taken to be the same thing as "is d odd".

But what about $d \gets \frac{d}2$? Outside of the context of prime finite fields that would normally be the same thing as right bit shifting by 1 but in the context of a binary field idk that dividing by two is the same thing as right bit shifting by one. It could be "multiply d by the modulo inverse of 2".

The fact that the while loop is doing while (d > 0) do kinda makes me think it's doing bit shifting but idk.

Any ideas?


texts: In what sense are silicon PUFs unclonable?

texts:
I see quite a few publications on Physically Unclonable Functions implemented using regular silicon IC techniques; for example A 0.19pJ/b PVT-variation-tolerant hybrid physically unclonable function circuit for 100% stable secure key generation in 22nm CMOS (10 authors at Intel), at 2014 IEEE International Solid-State Circuits Conference, with free preview there. The device is summarized as

  ..creating a golden key at first array power-up during tester-time operation and thereafter recreating this golden value from the inherently noisy raw PUF value during regular field operation. The golden key is used to compute an Error Correction Code signature, which is stored on-die as fuses. During regular operation, error correction circuits mix raw PUF bits with ECC fuse values to regenerate the golden key with 100% accuracy.

A reference for that principle is given as: FPGA Intrinsic PUFs and Their Use for IP Protection (4 authors at Philips), in proceedings of CHES 2007.

I wonder in what sense these things are unclonable.

In particular, I fail to understand why it would not be possible to replace the noisy PUF array and its sensors by ROM with content the (probed) raw PUF value, replace the ECC data/signature by ROM too, letting the error-correction circuitry do its thing; or replace the whole thing by a small ROM or wires defining the golden key.


texts: How secure is the encryption with OTP and an OneRNG?

texts: I bought an HWRND last week. What do you think, how secure is the encryption with that and the OTP? (http://www.moonbaseotago.com/onerng/theory.html).


texts: Finding the private key in Diffie Hellman

texts:
Lets say there are 2 parties X and Y. They have agreed on prime number P and generator g. X uses the secret key K.
After the key exchange they calculated the common secret key g^4.

What are the 2 possible values for the secret key of Y?


texts: What would be a really secure way to encrypt sensitive data on a web site

texts:
The problem

I need to encrypt sensitive client information in my site and make sure that even in the worst case scenario that the site gets hacked the information cannot be retrieved. (I guess is similar to the credit cards situation)

What I see around

I found many discussions regarding how to secure the credit card information and the approach I see around in forums is to use an algorithm like AES to encrypt the data using a key stored in the code or a configuration file or similar.

My guess of whats wrong

Surely that would make the data secure as long as the attacker only gains control over the database and no other file in the server, but, if someone was good enough to break your security or find an exploitable hole in your system is a good chance he also gained access to the key, and therefore, is still a chance he can decrypt the data.

A possible approach I think it could work

I'm thinking I could split the key in two parts, have one part in a file readable only by the web server's user and the other part shared by the users with rights to see that data in this way:

First the key is assigned to the first admin user and I use the user's password (which is not saved anywhere) to encrypt that part of the key and stored encrypted with that users information.
When another user is to be assigned that part of the key, then the first admin would decrypt the key and encrypt it with the new user's password and store that with that user's information, and like that for any other user.

Update for more clarification:
Having a message $m$ I will use a key $k$ that I will generate, and then when storing that key to use later I will split (or XOR it or something) so that $k$ now will be the result of some operation applied to $k_1$ and $k_2$, for example: $k = k_1 \oplus k_2$, then I save $k_1$ in a file readable only by the web server user. And to save $k_2$, I will use the user's password as key $s$ to encrypt $k_2$ and store it with the user information, and therefore there will be $n$ different $r$, where $r$ is $f(k_2, s)$ where $s$ is different by each user and therefore $r$ is different by each user.

So that to recover $m$ from the encrypted version $e$ and $d$ being the algorithm to decrypt we need to: $m$ = $d(e, d(k_2, s) \oplus k_1)$, and as $s$ is the user's password, you can't decrypt the message unless you the password of a person with access to the data; the system will never have stored the complete key anywhere.

This way even if gained access to the complete server there would be no full key to decrypt the sensitive data.

Would that be a good way?

Does this makes sense? are other/better ways to achieve it? (I'm sure there are).
So, that is what I'm after, to know what other/better ways solve this can someone with actual knowledge on encryption can tell me (I consider my self a complete newbie on cryptography).

Note:

It seems there is a confusion on my question being off topic. I want to clarify that I'm not looking for any implementation, what I'm after is to know what the recommended algorithm and techniques are suggested for this kind of situation, so I can proceed to research and implement them.


texts: Breaking a small-scale Example Diffie-Hellman?

texts:
I started to read about Diffie-Hellman exchange and I encountered a problem which I don't know how to solve.

Given $g=3$, $p=131$, $g^x\bmod p=112$, $g^y\bmod p=74$, compute $g^{xy}\bmod p$

$113$
$110$
$112$
$111$

How could I compute $g^{xy} \bmod p$? Or at least verify which one is correct.
Any idea?


texts:
I'm trying to understand the STS protocol (using the wikipedia page as source), but I don't see how this protocol is any more secure than DH regarding man in the middle attacks.

If Alice and Bob don't know each others public keys, and have no secure channels at all, then an attacker (Charlie) could forge asymetric keys (x',x'G) and (y',y'G), and make independant connections between Alice and Bob for each of the 8 steps of the basic STS protocol as described on the wikipedia page.
Alice would believe Bob's key is y'G, and vice versa.
Charlie would be able to decrypt each of the signatures using the two different shared secrets (xy'G and x'yG), and then sign (y'G,xG) with xy'G and sign (yG,x'G) with x'yG and encrypt them again. So the encryption and signing of the (yG,xG) pair doesn't seem to make any difference to me.

If Alice and Bob have a secure channel allowing them to exchange their public keys then I don't see a way for a MITM attack even with regular DH.

Can someone help me identify where I'm wrong ?


texts: Authenticated sharing in MASCOT protocol

texts:
I am studying MASCOT protocol for multiparty computation and I am stuck in the comprehension of the authentication protocol $\Pi_{[[ \cdot ]]}$ and its security proof.
Supposing the initialize phase of $\Pi_{[[ \cdot ]]}$ has been called, if one party $P_j$ wants to share some values $x_0, \dots, x_l$ using function Input of $\Pi_{[[ \cdot ]]}$, then at some point (step (3)):
for every $i \not= j$, $P_i$ and $P_j$ call $\mathcal{F}_{\text{COPEe}}.$Extend, where $P_j$ inputs $x_0, \dots, x_l$ (while in the initialize phase $P_i$ had input $\Delta^{(i)}$).
Thus $P_i$ receives $q_h^{(i,j)}$ and $P_j$ receives $t_h^{(j,i)}$ such that
$$q_h^{(i,j)} + t_h^{(j,i)} = x_h \cdot \Delta^{(i)}, \text{ for } h = 0, \dots, l.$$
Here $\mathcal{F}_{\text{COPEe}}$ is the correlated oblivious product evaluation functionality.
Then, for each $i \not= j$, $P_i$ sets $m_h^{(i)} = q_h^{(i,j)}$, while $P_j$ sets $m_h^{(j)} = x_h \cdot \Delta^{(j)} + \sum_{j \not = i} t_h^{(j,i)}$. In this way they obtain MAC shares of each $x_h\cdot\Delta$. Observe that here $j$ is a fixed value.
Instead, dealing with the security proof of $\Pi_{[[ \cdot ]]}$ (theorem 2 in the paper), it seems to me that $\mathcal{F}_{\text{COPEe}}$ is called in a different way and that MACs are computed differently too.
Indeed it seems that $\mathcal{F}_{\text{COPEe}}$ is called between each pair of parties $(P_i,P_j)$ for $i\not= j$, where $P_j$ inputs $x_h^{(j)}$, its share of $x_h$, for $h = 0, \dots, l$  (index $j$ is not fixed anymore). In this way, $P_i$ would receive $q_h^{(i,j)}$ and $P_j$ would receive $t_h^{(j,i)}$ such that:
$$q_h^{(i,j)} + t_h^{(j,i)} = x_h^{(j)} \cdot \Delta^{(i)}.$$
Then they seem to use as MAC shares the values:
$$m_h^{(i)} = x_h^{(i)}\cdot \Delta^{(i)} + \sum_{j \not = i} (q_h^{(i,j)} + t_h^{(i,j)}).$$
Can this make sense or am I misunderstanding something? I thought of this because it would make sense of some formulas used in the proof, where $j$ is not a fixed value. For example in (citing the paper, page 32):
"Generally, the sum of the honest parties' MACs is given by
$$\sum_{i \notin A} m^{(i)} = \sum_{i \notin A} x^{(i)}\cdot \Delta^{(i)} + \sum_{i \notin A} \sum_{j \not = i} (q^{(i,j)} + t^{(i,j)})".$$


texts:
On the surface, SHA1 and MD5 look pretty similar. Their diagrams include chunks of bits, bit rotation, xor and special functions. Their implementations are roughly the same length (at least the ones I've seen). Yet it's widely known that MD5 is broken, but currently SHA1 isn't.

Is the security difference from the increased rounds? SHA1 has 80 compared to MD5's 64. Or is it the greater digest size? SHA1 seems to be described as "more conservative", but I'm not sure what that means.


texts: Possible SHA-256 implementation weakness

texts:
I came across a SHA-256 implementation that seems not to conform to the standard and because I can't change the implementation I would like to know if it's safe for use or can be a potential weakness.

For the last 32 byte block instead of performing this: (As copied from wikipedia)

Add the compressed chunk to the current hash value:
h0 := h0 + a
h1 := h1 + b
h2 := h2 + c
h3 := h3 + d
h4 := h4 + e
h5 := h5 + f
h6 := h6 + g
h7 := h7 + h

It overwrites the current hash value:

h0 := a
h1 := b
h2 := c
h3 := d
h4 := e
h5 := f
h6 := g
h7 := h

Aside from this difference, the implementation in question is equivalent to the pseudo code in wikipedia. It does not produce equivalent output to a correct implementation of SHA-256.


texts:
I recently championed quantum key distribution networks.  This has led me to also question quantum random number generators. It appears that randomness is randomness, even if  made by custom quantum hardware featuring lasers and photon genies.

It would seem that there is a great deal of chaff and hype surrounding quantum generation of anything at all, and so I'm left wondering what is the qualitative difference between:-

which is a 4 Mbps quantum beam splitter[*] selling for ~€1300 and

when coupled with a simple von Neuman[+] extraction technique?

This is not a facile question.  I'm interested in any tangible substantive difference between the two sequences of random bits other than speed. Are they just as random if not as fast? And therefore are quantum RNGs further examples of electronic snake oil?

It's easy to immediately berate such quantum hardware as pure marketing.  No one's as cynical as I am, but the evidence suggests that there are non gullible people (indeed commentators, universities and IT organisations) buying these. £M's are globally spent on researching new /faster quantum generators.  NIST has one.  Why should they bother demonstrating measurements outside of the cone of influence when they could use a smart card or dice?  Are all of the people being fooled all of the time? That's meant to be impossible.

[*] A laser beam is split with a semi-mirror and detection of photons in the two resulting beams produces random bits. There is a white paper here describing this kit.

[+] This experiment produces independent and identically distributed random bits (not 1 - 6) due to the shaker cup eliminating correlations between throws, and the von Neumann extractor removing die bias. 1 truly random bit is generated every two throws (slightly less on average).


texts:
Does anyone know of an efficient way of breaking a modified Caesar cipher (where the key is a set of numbers (the amount of shift) that is repeated throughout the plaintext, e.g. {1,2,3,4,5}) via brute-force?

The way I'm currently trying to crack it is as follows:

Generate all possible key combinations ( 5 numbers between 1 & 25)
Use the generated key to "decipher" the message
Use frequency analysis on deciphered messages to see which one is the best fit

As you can probably guess, the way I've come up with is the least efficient (in terms of time and memory) and I was wondering what would be the best way to decipher the message.


texts:
Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value.  I do not want the encrypted value to be recoverable - just the following:

$\varepsilon(x) = (\varepsilon(x) \oplus \varepsilon(-1)) \oplus \varepsilon(1) = (\varepsilon(x) \oplus \varepsilon(1)) \oplus \varepsilon(-1),$
$\varepsilon(x+1) = \varepsilon(x) \oplus \varepsilon(1) \ \mathrm{and}$
$\varepsilon(x-1) = \varepsilon(x) \oplus \varepsilon(-1)$
$\forall x \in \mathbb{Z}$

$x$ can never be recovered because the secret key will not be known (an original $\varepsilon(x')$ is chosen as $0$ and it will only be manipulated or used in encrypted form).  It is ok (and perhaps even desirable) if $\varepsilon(x + n)$, computed (only) recursively as a series of single increments or decrements, is worse than $O(n)$ but no worse than about $O(n \log n)$ and there should be no limit on $n$ - that is, the further I go in a direction, it gets a little harder to keep going, but not impractically so.

It seems to me that this is perhaps within practicality for Gentry's scheme if the hints for $\mathrm{sK}$ can be reused forever for $\mathrm{recrypt}()$, but I might be misunderstanding this (or all of it).  Then, Gentry might be overkill, since I don't seem to need multiplication ($\varepsilon(-1)$ does not need to be calculated as $\varepsilon(1) \otimes \varepsilon(-1) $, right?).  I think any PHE supporting unlimited additions is good enough.  Gentry's numbers "stiffen" - but is that the case with all systems?  If they stiffen at about $O(n \log n)$ that's what I'm hoping for worst case.

I'd like to implement this in F# but 1) I need a good choice of algorithm supported by .NET or with an implementation in F#, and 2) How can I disable padding in such a scheme which normally one would be crazy to want to do?

The purpose is to create a dimension whose origin is unknown, but which can be navigated relatively.  I'm below novice at math and latex and formalisms so if my attempts above are totally asinine, I apologize.  Do you recognize an equivalent scheme that doesn't require HE?


texts:
Let $G$ be any group where group operations, as well as finding the inverse of an
element, can be performed quickly, but the discrete log problem is difficult. Consider
the following cryptosystem:

Alice chooses an element $g ∈ G$, a message $m ∈ G$, and an integer $k_A$.
Alice computes $s = mg^{k_A}$ and sends $s$ to Bob.
Bob chooses an integer $k_B$, computes $t = sg^{k_B}$ , and sends Alice $t$.
Alice computes $u = tg^{−k_A} = mg^{k_B}$ and sends $u$ to Bob.
Bob computes $ug^{−k_B} = m$ and recovers the message.

Is this cryptosystem safe?
I've noticed that Eve has $s$, $t$, and $u$
and that they are all divisible by m. Does this mean it's not safe? Or what am I missing?

Help is appreciated


texts: RSA: Letting $p$ and $q$ have different bit-size

texts:
I am aware that there are concerns if $p$ and $q$ are close i.e. $\Delta=|p-q|$ can't be too small. But I would like to know if there are any known attacks for cases where $p$ and $q$ take on different bit-sizes. (Don't mention extreme cases where the bit-size is close to the modulus.)

Are there vulnerabilities? Can we select $k\pm i$ bits for $p$ and $q$ respectively (where $k$ is the bit size of the modulus and $i$ a small integer)?


texts: AES-CBC streaming configuration IV usage

texts:
I am interested in the implications of using AES-CBC in a streaming configuration.

Reading the specifications of a few protocols I notice that when using AES-CBC
they include IV + ciphertext + HMAC in every frame of data sent.

If a stream of data is being sent would it be safe to instead send an IV initially,
but then simply continue using the existing CBC context for the data sent later in the stream?

For example:

context = createAESCBC(mySecretKey, myUniqueIV)
cipherText1 = context.encrypt(pkcs.pad("hello world!"))
// write cipherText1 and HMAC to socket

cipherText2 = context.encrypt(pkcs.pad("foo bar"))
// write cipherText2 and HMAC to socket

instead of:

perFrameIV = generateIV()
context = createAESCBC(mySecretKey, perFrameIV)
cipherText1 = context.finalize(pkcs.pad("hello world!"))
// write perFrameIV and cipherText1 and MAC to socket

perFrameIV = generateIV()
context = createAESCBC(mySecretKey, perFrameIV)
cipherText2 = context.finalize(pkcs.pad("foo bar"))
// write perFrameIV and cipherText2 and MAC to socket

I am aware of AES-CTR, and AES-GCM. I am interested specificially in CBC.


texts: Why the group order has to be prime for pairing-based cryptography

texts:
I'm trying to get into pairing-based cryptography and I don't see why the group order of the group G in  the pairing function

e:G*G-> G_t

has to be a prime number.

I don't find an argument why groups of order p^k for a prime number p and some entire number k cannot be used?


texts:
In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a fixed length? Can a smart attacker take advantage of it?

Does hashing a password with a random salt make the password stronger?


texts: Read the result of the hash by SHA-256 as a number

texts: I want to read the full output hash of SHA-256 as a number. How I can do it? Is it in the range of 0 to 2^256?


texts: Is steganography valid only for digital images or also for printed images?

texts: If I embed some information in an image using steganography and then I print that image, will I be able to retrieve information from the printed image or not?


texts: Decrypting without using the private key

texts:
Let $g$ be a generator of a multiplicative group $G$ of order $q$, $x$ be a private key, and $h=g^x$ be a public key of an exponential ElGamal cryptosystem.

Given a ciphertext $c$ produced as the ElGamal encryption of a given plaintext $m$, that is $Enc(m,h,r)=(g^r, g^m h^r)=(R,S)=c$, it is obvious that this ciphertext can be decrypted by using the private key $x$.
So $Dec(c,x)=\log_g \frac{S}{R^x}=m.$

However, it seems also quite clear to me that another way of decrypting it without being in possession of the private key is by knowing the random value $r$, so $\log_g \frac{S}{h^r}=m$.

Let's assume we have a protocol in which Alice first publishes some encrypted message, and after a while, she wants to reveal it by just revealing what the random value $r$ was. This may remind a Pedersen commitment scheme, with the difference that when opening the encryption, I would like Alice to reveal only $r$, and not both $r$ and $m$.

Does this make any sense? How certain can Bob be that the value $r$ that Alice just revealed, is the one she actually used to generate $c$, and she didn't make it up?


texts:
I am read this paragraph and I have a doubt.

  "An adversary to PKC $\Pi$ is given by two probabilistic polynomial
  time algorithms, $A = (A1; A2)$. In the first stage, the "find"
  stage, the adversary analyzes the public key and tries to determine
  which plaintexts, when encrypted, are vulnerable to attack. This is
  the job of $A1$. In the second stage, the "guess" stage, the adversary
  $(A2)$ will be presented with a challenge ciphertext $y$, an
  encryption of one of the plaintexts he found in stage 1."

What is the "new" in use the challenge ciphertext $y$ if I know the its plaintext?  How I will be able to make attack?


texts: Proof of the standard pseudorandom generator + XOR encryption scheme in Goldreich

texts:
Reading Goldreich's Foundations of Cryptography II, I found this proof for the security of the common pseudorandom generator + XOR encryption scheme (Proposition 5.2.12 in the book):

  Assume you have a secure pseudorandom generator $g \colon \{ 0,1\}^n \to \{0,1\}^m$, and you construct your encryption scheme in the standard way by XOR'ing the output of $g$ to a message of length $m$. To prove that this is one-message-IND-secure, Goldreich proceeds as follows:

  Assume, for the sake of contrdiction, that there is an adversary $\mathcal{A}$ (really a poly-sized circuit in the book, but that is not important here) against this encryption scheme, such that for $x,y \in \lbrace 0,1 \rbrace^m$, $U_n \in \lbrace 0,1 \rbrace^n$ and
  polynomial $p$ we have: $$ |Pr[\mathcal{A}(x \oplus g(U_n)) = 1] -
 Pr[\mathcal{A}(y \oplus g(U_n)) = 1] > \frac{1}{p(n)}.$$
  Observe that for $U_m \in \lbrace 0,1 \rbrace^m$ we have: $$  Pr[\mathcal{A}(x \oplus U_m) = 1] = Pr[\mathcal{A}(y \oplus U_m) =
 1].$$
  Then, WLOG: $$ |Pr[\mathcal{A}(x \oplus g(U_n)) = 1] - Pr[\mathcal{A}(x \oplus U_m) = 1]| > \frac{1}{2p(n)},$$ which
  contradicts the security of $g$ (since we can distinguish its output
  from random).

My question

How do you get to that last inequality in step 3? In particular, how do you derive the term $\frac{1}{2p(n)}$?


texts: Given C is a code of length n. Containing M code-words with a distance d

texts:
I'm studying for my exam and came across this question below.
I don't understand how to get $d$. I get $C$ is a code of length $n$.
Containing $M$ code-words with a distance $d$.

$(n,M,d)$

But how do I get $d$ below?

  Give one (5,4,d) code in … as below …
      Z^(5) base 2.

  C={
  0,0,0,1,0
  0,1,1,0,1
  1,0,1,1,0
  1,1,0,1,1
  }


texts:
So, maybe this is a dumb question, or maybe it's something someone's already done and it's really common, but whatever, here goes:

Why do we sign a message with our private key and then encrypt it with our contact's public key, instead of encrypting our message with our private key and then encrypting it again with our contact's public key?

Wouldn't the latter be better?


texts: Early propagation of carries in the BLAKE hash function

texts:
The BLAKE paper uses round constants derived from $\pi$ to improve diffusion, even if the additions modulo $2^{32}$ are replaced with bitwise XOR when processing a null message and null initial state:

  The higher weight in the original model is due to the addition carries induced by the constants $c_0,\dots,c_{15}$. A technique to avoid carries at the first round and get a low-weight output difference is to choose a message such that $m_0 = c_0,\dots,m_{15} = c_{15}$. At the subsequent rounds, however, nonzero words are introduced because of the different permutations.

However, the BLAKE2 paper describes changes it made to BLAKE that remove these constants:

  Constants in G initially aimed to guarantee early propagation of carries, but it turned out that the benefits (if any) are not worth the performance penalty.  This change saves two xors and two loads per G, that is, 16% of the total arithmetic (addition and xor) instructions.

This statement was made as part of an argument that reducing the number of constants in BLAKE2 does not weaken it, while simultaneously decreasing RAM and ROM footprint. Unfortunately, unlike many of the other trade-offs it discusses, no further explanation is given. What are the benefits of guaranteeing early propagation of carries that lead to BLAKE's constants, and why are these benefits in doubt?


texts:
I have a bcrypt hash: $2b$10$kn7yEh2nYiDqDYNY.hjiZOtASBKT9uO4KozbFWDW2XLYnW58nkpq and a list with given plaintext passwords. How can I get the password from the list?
Is $2b$10$kn7yEh2nYiDqDYNY the salt?
TOMATCH="$2b$10$kn7yEh2nYiDqDYNY.hjiZOtASBKT9uO4KozbFWDW2XLYnW58nkpq"
SALT=b"$2b$10$kn7yEh2nYiDqDYNY."

for word in words:
    hash = bcrypt.hashpw(word.encode('UTF-8'), SALT)

    if TOMATCH == hash:
        print(word)
        break

However, with this I get ValueError: Invalid salt. What am I doing wrong here?


texts: What is wrong if you use a key in a Caesar cipher that is greater than 26?

texts:
TL;DR- why can't we have a key cipher greater than 25 in the Caesar cipher?

Let's suppose the key is K = 30.
The message I want to send is "H E L L O W O R L D"

Now converting each letter to a number from 0-25, we get 7-4-11-11-14 22-14-17-11-3.

Adding 30, we get 37-34-41-41-44 52-44-47-41-33.
But as the cipher text ranges only from 0-25, we now have to use the modulo function on every letter by 25.

We end up getting 12-9-16-16-19 2-19-22-16-7

Now on receiving this message, all one has to do is subtract the key 30 from each number, add 25 and then convert back each number to its corresponding alphabet.

So why do we have to restrict the key-space of a caesar cipher to 0-25?


texts: How were the diffusion statistics for norx calculated?

texts:
I was reading the norx specification and came across this section, which provides some kind of statistics about the diffusion of the norx round function. However, I don't see how these values were calculated or what they really mean.

If I could also find out how the diffusion was visualized in the figure following the statistics, that would be greatly appreciated.


texts: Does knowledge of equal exponents decrease security?

texts:
Say I have a group $G$ with two different generators $g_1$ and $g_2$, where the discrete log from one to another is unknown.
Also, there are two public commitments $g_1^{r}$ and $g_2^{r}$, where it is publicly known that they are raised to the same $r$ (but unknown which $r$).

Does the latter piece of information compromise security in any way?


texts: How does TLS 1.3 work with PQC signatures?

texts:
I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512.
Do PQC signatures work the same as modern algorithms in TLS 1.3?


texts: Minimizing size of signed message with discrete-log scheme

texts:
How can we sign a small message with a discrete-log scheme so as to minimize the size of the whole signed message?

Detailed objectives, notation:

It is of paramount importance to minimize the total bit size $c$ of the cryptogram $C$ carrying the whole signed message $M$, e.g. because $C$ will be keyed-in (appropriately transformed to characters). $M$ is an arbitrary bitstring of $m$ bits, for some parameter $m$ with $32\le m\le256$.
We restrict to asymmetric signature algorithms loosely based on the discrete logarithm problem in some group (we note $q$ its order), e.g. because some directive only allows that or integer factorization which is inappropriate given 1; schemes using pairing-based cryptography are out. We have unrestricted choice of symmetric primitives likes hashes.
It must be arguable that a competent adversary using public knowledge and classical computers is unlikely to exhibit a forged signature (in a chosen-messages setup) with $2^w$ work for some parameter $w\approx80$, in a sense such that $w=67$ represents the work reported for the factorization of RSA-768:

  Our computation required more than 1020 operations. With the equivalent of almost 2000 years of computing on a single core 2.2GHz AMD Opteron, on the order of 267 instructions were carried out.

Each signature generation and verification must be feasible with $2^{32}$ work, but performance is otherwise non-critical, as well as key size (public and private).

Questions:

Are there better schemes than DSA and ECDSA variants with message recovery (see bibliography in this question), and which one(s) can we choose? What is the corresponding maximum capacity (that is, the largest $m$ such that we have full message recovery, and larger messages start to require increasing $c$)?
Are we better using group $\mathbb Z_p^*$ with $q$ a prime factor of $p-1$ as in plain DSA, or an Elliptic-Curve group, or..?
What parameters is it reasonable to use (for DSA variants: size of $p$ and $q$; for ECDSA variants: curve..), and what's the $c$ achieved?

Update: I now realize that the Schnorr signature scheme of 1989 yields $c=m+3w$-bit (for at most $2^{w/2}$ signatures). That's a candidate (related question).

Extras:

In (EC)DSA, we can trim a few bits from $C$ (reducing $c$ by $z_s+z_v$), by having the signer iterate signing until $z_s$ prescribed bits are (say) all set; and the verifier iterates verification with incremental values of $z_v$ other prescribed bits, until finding a signature that verifies. We can increase $z_s$ and $z_v$ within the limits set by requirement 4, with almost no reduction of security. Can we better leverage that leeway? E.g. by increasing $p$ in DSA, or somewhat using an entropy-stretching KDF (PBKDF2, Argon2..)? [for the DSA aspect of that, see this question]
Does things appreciably change, allowing lower $c$, if we relax security requirement 3 to distinguish between total breaks that allow the adversary to recover the private key or otherwise sign any $M$ at low cost, and those that would be unprofitable to an adversary if each forgery requires $2^{w'}$ work with $w'\approx w-16$?


texts:
I understand that a client and server certificate is required, however the validation process isn't clear to me.

Is it simply that the certificates are check to ensure they're valid, aren't revoked, and are signed by the same root ca? Can certificates from different root CAs (both trusted by client and server) be used? Are there any other specific checks?

Sources

https://www.juniper.net/documentation/en_US/sbr-carrier7.5.0/information-products/topic-collections/sbr-admin-guide-10/index.html?id-98057.html
https://tools.ietf.org/html/rfc5216


texts: Input existence proof for known partial input and hash

texts: Let $h$ signify the hash (Merkle–Damgård construction) generated from some input of known length $n$. Given $h$ and an input $k$ of length $n_1$, is there a way to prove that there exists (does not exist) some (any) $r$ of length $(n-n_1)$ such that $h=H(r||k)$?


texts:
Recently I read about pseudorandom generators and I have some observations:

My conlusion is a such that a secure implementation of a PRNG had to be blocking or returning an error code when it is too little entropy. If a PRNG does not do so it means that it cannot be secure- we cannot be sure that returned pseudorandom bits "comes" from true random bits (achieved with a sufficient entropy). Yes?
The presentation Understanding and Managing Entropy Usage points
PRNG provided by OpenSSL does not reseed itself (a slide 32). Does it mean that in long-running application we have to reseed manually? Otherwise we don't have secure PRNG? If yes, how to reseed? Every minute? Every Hour? Every generated 1024 bytes? How to be sure that a seed was taken when entropy was sufficient?
If you know about books/chapters/blogs that covers my doubts let me know!

Thanks in advance :)


texts: Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?

texts:
Suppose I want a strong 20-bit blockcipher.  In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits.  The set of permutations should be close to a randomly-chosen subset of size $2^{128}$ of all $2^{20}!$ permutations on 20 bits.

I don't want you to build a new blockcipher from scratch.  Instead, assume you have a "strong" blockcipher like AES (128-bit blocksize, 128-bit keysize) and use this to build your 20-bit cipher.

Of course, your construction should be practical (i.e., you should be able to run it in both directions with reasonable amounts of time and memory).


texts: Conditions for a successful Differential Power Analysis attack

texts:
From this paper, there are two conditions for a successful DPA attack:

i) there exists an intermediate variable in the implementation that is correlated with the power consumption and
ii) this variable exclusively depends on the plaintext (or ciphertext) and a small part of the key.

My question is that, on the condition i), does the variable need to appear on the calculation of the algorithm? Can a variable that is not explicitly computed correlate with the power consumption?


texts: How are constructs with data-dependent swaps and rotations cryptanalyzed?

texts:
Linear and differential cryptanalysis seem well suited for constructs with a (relatively) simple fixed structure of boolean expressions. But some ciphers incorporate swaps of array elements where the indices to be swapped are dependent on dynamic cipher state and others may include rotations by a variable number of bits. In the case of RC4, the entire cipher state is embodied in the permutation of a fixed set of integers.

This would seem to induce a combinatorial explosion in the number of expressions needed to track bias through the system. Is that a good thing?

Side-channel challenges aside, are such constructs unambiguously stronger than those made from fixed structures, or are they just harder to analyze?

What math is used to attack/analyze them?


texts: Confusing XOR notation in textbook sample solution

texts:
I am preparing for the midterm exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook makes this problem more confusing instead of clarifying it. $\oplus$ denotes XOR operation but what are we trying to XOR with?

$c = \oplus c_i$ and $i \in I(c)$, but $c_i$ is getting XOR with what?

Any help would be appreciated.

Textbook question:

Textbook sample solution:


texts: Can Shor's algorithm factor multi-prime numbers?

texts:
I know that Shor's algorithm can factor semi-primes ($N = p \times q \space, \{p, \space q \in \Bbb{P} \space \vert \space p, \space q \gt 0 \} $).

Assuming that all prime numbers are so large that it's infeasible to compute with any known classical algorithm, can Shor's algorithm also factor multi-primes, meaning where $N$ has more than two prime-factors?


texts: Verifiable secret sharing - Benaloh scheme; some doubts not answered earlier

texts:
I reviewed the paper "Secret sharing homomorphisms: keeping shares of a secret secret" by J.C. Benaloh yesterday and I had some difficulty understanding his version of verifiable secret sharing to address " k-consistency."

We say that a set of n shares $s_1$, . . . , $s_n$ is k-consistent if
every subset of k of the n shares defines the same secret.

The literature goes on to state that

It is easy to see that in Shamir's scheme, the shares $s_1$, . . . ,
$s_n$ are k-consistent if and only if the interpolation of the points
(1, $s_1$), . . , (n, $s_n$) yields a polynomial of degree at most d =
k - 1.

My first question is that I can clearly see that the polynomial of degree at most (k-1) will imply that any subset of the k parties will be able to recover a number (secret) but I don't see how this guarantees that they will be able to recover exactly the original secret.
In a later paragraph, the following statement is made

For each polynomial P' not in A, the (point-wise) sum P + P' is opened
by releasing $S_i$ + $S'_i$ (mod r) and $x_i$ * $x'_i$ *
$(y_{i})^{\lfloor{(S_i + S'_i)/r}\rfloor}$ where the ith point of P'
is given by E($s_i, x_i, Y_i, N_i$)

I understand that we are using a homomorphic encryption scheme here and the reason to do so is that we cannot release values from the chosen polynomial P (which evaluated at 0 gives us our secret.) Hence, we need to perform computations on the encrypted points and function values.
I am unable to understand the why the point-wise polynomial addition is so complicated - I would have imagine it just involved adding the function values  modulo r?
For reference, here is the encryption scheme described in the paper -

Before beginning, a prime number r is fixed such that r $\geq$ $\vert$
S $\vert$ the size of the secret domain. To develop an encryption
function E, one selects primes p and q such that r $\mid$ (p - 1)
and r $\nmid$ (q - 1). Let N be the product N = p*q. The developer
releases the pair (N, y) where y is relatively prime to N and y is not
an rth residue modulo N.   To use E to encrypt a value s, one randomly
selects an z and forms E(s, x, y, N) = $y^s * x^r$ (mod N)

Apologies for a rather long question - thanks in advance!


texts:
Consider the following definition from section 2.2 of this research paper

We write $\mathcal{P}()$ for the power set of the set $$. An $-$partition
$Ω=\{_1,\cdots,_\}$ of a set $$ is a disjoint family of $$ nonempty
subsets of $$ with $=_1∪ \cdots ∪ _$. Let $Λ⊆\mathcal{P}()$ be a family of
subsets of $$. For a permutation $$ on $$, we define
$(Λ)=\{():∈Λ\}⊆\mathcal{P}()$. A family of subsets $Λ⊆\mathcal{P}()$ is said to
be $Ω-$partite if $(Λ)=Λ$ for every permutation $$ such that
$(_)=_$ for every $_∈Ω$. We say that $Λ$ is $-$partite if
it is $Ω-$partite for some $-$partition $Ω$. These concepts can be
applied to access structures, which are actually families of subsets.

My doubt lies in $(Λ)=\{():∈Λ\}⊆\mathcal{P}()$ because the paper does not define the permutation function on a set, but used it. I didn't came through any standard defifnition of permutation function on set which gives another set which is different from the input set because the order of elements in a set is immaterial.
What I am clear from the context is
$$\sigma: P \rightarrow P$$
$$ \sigma(A \in \mathcal{P}(P)) = B \in \mathcal{P}(P)$$
but I don't know what exactly $B$ is.
What is the definition of a permutation function over a set?
In addition, can you give some example of the above $Ω-$partite ?


texts: Is there a maximum number of encryptions I should make with the same RSA key?

texts:
From an answer to the question RSA maximum bytes to encrypt, comparison to AES in terms of security? I learned that there is a theoretical limit of how much data can be safely encrypted with symmetric block ciphers (like AES for example) with the same key. The answer says that for a block size of n bits there are theoretical concerns when approaching 2^(n/2) encrypted blocks with the same key, and a comment suggests to use 2^(n/4) for a more defensive approach. For AES with its 16 bytes per block, both figures would be significantly more than any single AES key would ever encrypt in my application, so I needn't worry about that.

Nevertheless, even if this limitation bears no practical relevance for me and I have not understood why it exists, I still consider it "good to know" (e. g. because for other symmetric block ciphers with smaller block sizes, it might become relevant).

Hence I'm wondering: are there a similar hypothetical limitations for RSA? In other words: is there some kind of "maximum number of encryptions" I should do with the same RSA key, or is it truly infinite how many times I can encrypt something (in my case: varying 128-bit AES keys) with RSA (assuming the private key remains private forever and there's no attack found)?

Notes:

I haven't yet found anything about it, mainly because when something like this is asked, the answers tend to immediately focus on how much data can you encrypt at once, but they don't say anything about the maximum number of encryptions.

And finally, for completion's sake: I'll use RSA-2048+OAEP-SHA256, but the question is targeted towards RSA in general, for any padding algorithm, and if the answer varies by padding algorithm used, that'd be nice to know.


texts: RSA hybrid decryption via PKCS#11 - unwrap or decrypt?

texts:
I have an application that does RSA hybrid encryption/decryption – i.e., messages are encrypted with a fresh AES key, which is then itself encrypted with RSA-OAEP and sent with the message. Decryption then does the reverse.

I want to now provide support for hardware security modules (HSMs) via PKCS#11. (The application is written in Java, so this will actually be via some wrapper such as the default SunPKCS11 library). I can see two options for implementing decryption:

Use the HSM to decrypt the temporary AES key and return the raw bytes of that key to my application, which then does the AES decryption in-memory.
Use the HSM to “unwrap” the AES key as a (sensitive) session object and then use the HSM to perform the AES decryption.

My instinct is that option 1 will generally be faster than option 2 on a server with AES-NI instructions. As the AES keys are unique to each message, it also doesn’t seem less secure - the AES key is therefore no more sensitive than the message itself.

Are there any reasons to prefer option 2? My only thought is that if a customer has spent a lot of money on a FIPS-compliant HSM then they may want all crypto to be performed on the device for compliance reasons. Is that a likely scenario?


texts:
In Introduction to Modern Cryptography by Katz and Lindell, p. 70, they define a pseudorandom generator by:

  Let $l(\cdot)$ be a polynomial and let $G$ be a deterministic
  poly-time alg. s.t. for any input $s \in \{0,1\}^n,$ algo $G$ outputs
  a string of length $l(n).$ We say $G$ is a pseudorandom generator if
  the following conditions hold:

  (Expansion) For every $n$ we have $l(n)>n$

  (Pseudorandomness) For all probabilistic poly-time distinguishers $D,$
  there exists a negligible function $negl$ s.t. $$\left| P[D(r)=1] - P[D(G(s))=1] \le negl(n) \right|,$$ where $r$ is chosen unif. at random
  from $\{0,1\}^{l(n)}, $ the seed $s$ is chosen unif. at random from
  $\{0,1\}^n,$ and the probabilities are taken over the random coins
  used by $D$ and the choice of $r$ and $s.$

I would like to clarify how we should be thinking about the distinguisher, $D$. I understand that it is typically any polynomial-time algorithm, but how do we interpret its output? Do we assume that when $D$ "thinks" its input is truly random then it outputs a $1$, and otherwise outputs a $0$?


texts: Methods for converting from HVZKP to ZKP: Precommitting the Initial Communication

texts:
In my studies, I have seen two common ways that an Honest Verifier Zero Knowledge Proof can be converted to a Zero Knowledge Proof.  Either make the proof non-interactive with Fiat-Shamir's Heuristic (thus removing the Verifier) or make the Verifier commit the challenge beforehand.

Wouldn't it also be secure for the Prover to commit his initial communications in a Pedersen Commitment?  The protocol would look like this:

The Prover calculates the initial communications
The Prover commits the initial communications and sends the commitment(s) to the Verifier.
The Verifier sends a challenge.
The Prover calculates the response.
The Prover sends the response and the information to open the commitment(s) to the Verifier.
If the transcript is valid and the initial communication matches the commitment(s), the Verifier accepts.

If my reasoning is valid, this would make the Zero Knowledge Proofs parallelizable without worrying about any meaningful interdependencies.  The commitments that would be used are perfectly hiding, and thus reveal nothing about the contents, meaning the Verifier has no real information about this proof until his inputs are completed.  This means the Verifier can't use information from ZKP 1 on ZKP 2's challenge and use that response for part of ZKP 1's challenge, which, as far as I understand, is a problem in parallel composition of Zero Knowledge Proofs.

The downside is the initial communications can be large and it could cost a lot of exponentiations and communications to commit them all in Pedersen Commitment and send them, but you may be able to commit using a hashing function instead, but these aren't perfectly hiding.


texts: Can HKDF be instantiated with HMAC-SWIFFT?

texts:
While reading through "Cryptographic Extraction and Key Derivation: The HKDF Scheme" by Hugo Krawczyk, I found the following text intriguing:

  In some cases, well-defined combinatorial assumptions from the hash functions will suffice while in others one has to resort to idealized modeling and “random oracle” abstractions.

I assume it implies that: HKDF can be secure in certain cases even when the hash function is not a "random oracle".

When I recall that "a PRF appears random if it's selected randomly from the family of functions with the same domain", I think this means when the HMAC key is selected appropriately, the output from HMAC function should satisfy the requirements and goals of HKDF.

Is my reasoning true / somewhat plausible / wrong? Can HKDF be securely instantiated with HMAC-SWIFFT and in what situation?


texts:
“How to Build Time-Lock Encryption” by Jager

“Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan

I looked through the references, googled, searched GitHub but couldn't find an implementation of either of them in any programming language.

Are these theoretical with no implementation yet?

I would greatly appreciate a link to an implementation if one exists.


texts: Prove that the $x^8+x^4+x^3+x+1$ is irreducible over $\mathbb{Z}_2[x]$

texts:
I am new to this field. I am doing some cryptography course and have encountered $\text{GF}(2^8)$ in the famous AES algorithm. Although I do not have a strong relevant math background with this stuff(ring/field), I am really interested in it. My textbook has a question which says to prove that:

$$x^8+x^4+x^3+x+1$$ is irreducible over $\mathbb{Z}_2[x]$.
I am stuck at this point where I don't have much intuition about proving irreducibility over the whole $\mathbb{Z}_2[x]$.
Any help will be much appreciated!


texts: Excluding specific factors for Pohlig-Hellman

texts:
I want to use Pohlig-Hellman and BSGS to solve the discrete log of an Elliptic Curve which has a composite order generator.

The tricky part is, one of the composite factor groups is large (99bits), so I want to exclude it from the Pohlig-Hellman/BSGS.

Is it possible in SageMath to apply the discrete_log() function to an elliptic curve, and exclude one of the generators factors?

Is there a trick with Chinese remainder theorem?


texts:
The RSA algorithm can be used to generate a permutation.

Given two prime numbers $p$ and $q$, the key length is $n=pq$.

If $a$ is the private key, then $b$ is the public key, where $ab \equiv 1 \pmod {\phi(n)}$.

We define a permutation $\pi : \mathbb Z/n\mathbb Z \to \mathbb Z/n\mathbb Z$,
given by $\pi(k) = k^b \pmod n$.

Is anything known about these permutations from a group-theoretic point of view?


texts: Homomorphic encrypted streams (Paillier)

texts:
Situation: Alice (violin) and Bob (drums) play music together and want to (real-time) stream the concert to Carol. In order for Carol to save bandwidth, the stream is sent through a server which combines (integer addition) the two streams which it receives from Alice and Bob and sends the resulting single stream to Carol. In order to secure the stream from hacking attacks on the server, the data is encrypted.

For the encryption scheme, I am thinking of using homomorphic encryption (e.g. Paillier) in order to allow the addition operation without decryption.

Does the communication need to be synchronized? Do both streams need to start at the same time?
Symbols are encrypted independently and combined with random. $\Rightarrow$ No need for synchronization.
What is the effect on dropped frames (e.g. when using UDP)? What can I do in order to circumvent potential problems or do I need to switch to TCP?
Symbols are encrypted independently and combined with random. $\Rightarrow$ Dropped frames have no effect on other frames.
Is it possible that Alice and Bob use symbols of different length? The goal is to implement variable bit rates (the symbol size of each participant could be transmitted in plain text if necessary).
Example: Alice uses symbols of 8-bit while Bob uses symbols of 16-bit. Is it possible to decrypt the addition of the encrypted symbols?
Edit: Is my assumption right, that the ciphertext will have the same size as $n$ anyway?
Can this scheme be easily adapted to $n$ participants? What do I have to watch out for?

Edit: Since each symbol is encrypted independently, 1. and 2. don't seem to cause problems.

Edit 2: Number sizes

How should number sizes be chosen in practice? Is n_length of 2048-bit good?
Encoded data should be $< n/3$. And $n$ should be chosen randomly, right? So when I want to use 2016-bit for data, $n$ needs to be at least $2^{2016} \cdot 3$ thus reducing key complexity by this factor, right?
I want to encode symbols of 16-bit data. Because of the summation, I need to add headroom by the number of senders of $log_2(num_{senders})$ bits. How should I deal with (8/16/32-bit) alignment for fast pack/unpack/calculations?


texts:
I am using Android's keystore to generate a key which is protected by fingerprint authentication. This key can be used to encrypt any secrets. In my case, I want to encrypt a user password (which is needed to access the app contents. Usually that's a reasonably strong letter-number-special-characters password.). The encrypted password is stored in the app's preferences. While these preferences are not fully public, I don't consider them secure storage.

Assuming an attacker has access to the encrypted password, I would like to expose as little as possible about the password itself. One thing that comes to my mind is password length. From the length of the encrypted text, it can be seen if the password is more than 16 characters or not. (I could hide this by always appending random text to have a fixed length of text for passwords < N characters, with N sufficiently high).

Are there any more serious issues? Is there any best practice on how to encrypt user passwords?


texts:
What are the advantages of using end-to-end and link encryption together? In which situation we can use both?
If I understand correctly.
In link encryption, all data are encrypted, including headers, addresses, and routing information. So at each router it is decrypted to see the details and encrypted again and forwarded to next hop. Right?
In end-to-end encryption, Headers, addresses, and routing information are not encrypted, and therefore not protected.
So when we use both together at the end using link encryption all the data would be encrypted.


texts: Secure Multiparty Sum in malicious model using threshold encryption

texts:
Suppose $n$ actors each hold a plaintext $p_i$. We wish to find $\sum p_i$, without leaking any information about individual $p_i$. Any actor (or any link in the network) could be controlled by an active adversary. More precisely, these protocols can be proved secure against a polynomial time bounded adversary who can corrupt a set of less than $n/2$ parties initially, and then make them behave as he likes, we say that the adversary is active.
In article Multiparty Computation from Threshold Homomorphic Encryption there is approach to multiparty computation (MPC) basing it on homomorphic threshold crypto-systems. I'm unsure how to make multiparty sum secure in malicious model (against less than $n/2$ active adversaries) following this approach. I'm under impression that it's quite simple:

each player uses additive homomorphic encryption to calculate ciphertext $E(p_i)$ of his own imput, sends the ciphertext to other parties and attach proof of plaintext knowledge to the ciphertext
verify proofs, add ciphertexts to calculate $E(\sum p_i)$
decrypt sum $E(\sum p_i)$ using threshold decryption to calculate $\sum p_i$

Could you confirm that what I described above is secure in malicious model (against less than $n/2$ active colluding adversaries)?