texts: Correct way to read a given permutation cipher?

texts:
In some literature I am reading – where they are explaining the permutation cipher – they have two examples, which encrypt a small block of text. But they seem to contradict each other:

First example:

  permutation: ${1\text{ }2\text{ }3 \choose 3\text{ }1\text{ }2}$, plaintext: VEN, ciphertext =NVE

Second example:

  permutation: ${1\text{ }2\text{ }3 \choose 2\text{ }3\text{ }1}$, plaintext: TEN, ciphertext = NTE

Am I missing something? The second example makes sense to me, but not the first. Why isn’t the ciphertext for the first example not ENV?


texts: Why does an algorithm need a keyspace? I thought the person encrypting would define his/her own key.


texts: Is finding collisions in a part-hash not often enough a bad problem?

texts:
My situation: I've been working now for a couple of months on my own unique hash function, I've changed it many times and had two main versions but I won't bore anyone with the details of my work; at least not here. I'm here to ask a question that's specific and helpful to anyone attempting to design a cryptographic hash. (I hope)

Now I'm more than aware that simply being a normally-distrusted random function, does not make a cryptographically secure hash.

MY QUESTION however IS:
If collisions are found LESS often than would be predicted by a random function, is this an alarm-bell that we may have some empirical weakness?

Allow me to elaborate:

In my tests, I found that any given set of 32 bits  (from a set position in the hash) from an array of unrelated input (or related input but different output) hash functions were indeed seemingly random until I noticed that: In order to find a collision: one would have to go through about 89000 different attempts on average (although obviously the numbers swayed massively). Since the birthday bound is only 65536 (or ~77000), something seems amiss. Since my testing involved using batteries of different PRNGS to create the inputs aswell as non-random methodical ones and I ran these tests hundreds of millions of times, meaning I've made literally billions of hashes... I don't think it's my testing that is flawed or that my sample sizes are too small.

I can say with almost 100% confidence, that it is taking more attempts to find a collision than would be expected of a truly random (ideal) output.

Side note: I tried with 16 bit, 40 bit samples, etc and always came up with the same results: collisions were LESS frequent.

2nd Side note: When describing the hash as a PRNG or indeed a PRNG using the hash, it passes birthday-spacing tests on the dieharder suite just fine (I find this bit very confusing).

If anyone can explain this strange phenomenom (the passing on dieharder but failing on my own tests) then extra points but what I want to know is:

So given we do have a "Desired probability of random collision" in a given hash (and logically speaking any smaller word within that hash) then what happens when in a given word (and presumably the hash in general) collisions are found less often than expected? What info do we gain about the likely hood of pre-image attacks? Non ideal distribution or any other info in fact?

I know this is probably a hard question to answer but maybe not.


texts: cryptographic accumulators: accumulator size vs. max. number of set members?

texts:
Here's a basic question about cryptographic accumulators, or at least ones based on fixed-size accumulator values (such as RSA ones based on modulo arithmetic), that is strangely not even mentioned in most of the key historical papers or Wikipedia.

Cryptographic accumulators are being touted as a magical solution for the application of distributed certification/licensing by government/corporate authorities.  For example, I have heard claimed that the DMV (Department of Motor Vehicles) could publish a hash function and an accumulator, both of which were of constant size---or at least a size that does not grow linearly with the number of licensed drivers---and that would allow me (a driver) to present a proof to you (a car rental company) that I am licensed.  The car rental company could then check that proof without learning the driver license number of any other licensed driver.  All the crypto papers focus on the last property (privacy).  For the purposes of this SE question, I will take that as granted.

I have a much more simple question:

This immediately strikes me as impossible.  How can a constant-size accumulator contain set membership information for a variable number of members?  That seems to violate basic information theory.  How can, say, 512 bits of accumulator contain information for millions of "bits" of information (if we assume that somehow each licensed driver was only 1 bit of information)?  I could then use an accumulator to compress anything to 512 bits :)

Clearly, I am missing something very fundamental about how this whole thing works, including that the claim itself may be wrong or my understanding of its application is wrong:

does a, say, 512 or 2048 bit accumulator allow one to track only a limited amount of set members, but that number is much more than 512 or 2048?  If so, how many, and how can this possibly work?  Why does it not violate information theory?
is the set membership test that is done by a cryptographic accumulator probabilistic and/or does it suffer false positives or negatives (e.g. like a Bloom filter), and does that explain why it seems information theory is being violated?
does the DMV example I cited above require more than just a basic (fixed-size, e.g. RSA) cryptographic accumulator to work?  Does it require an accumulator whose size is linear in the maximum number of set members?
does the DMV example I cited above require other storage that I didn't mention above (for example, does each license holder have to store a constant amount of data that none of the other parties could generate even if everyone revealed their secrets to everyone else) and therefore the storage required across the system is, in fact, linear in the number of license holders?
more generally, what is the relationship between the accumulator size in bits and the maximum number of members that can be tracked, and are there other tradeoffs (e.g. probability of getting the correct answer) that can also be tweaked in designing the hash function?

Another way to think about it: some folks like to introduce cryptographic accumulators using the (non-secure, non-private) example of assigning each member its own prime number and the published accumulator simply being the product of all the primes of the members in the set.  Then my "proof" consists of handing you the product of all the primes in the set except my prime, and you can multiply them together to see they make the published product.  Well, in this simplified case, clearly the accumulator is going to get bigger as there are more primes that may be factors inside it.  But the other cryptographic accumulator algorithms (e.g. RSA) use modulo arithmetic and other methods that constrain the accumulator size...so how many members can be tracked given a particular limitation?

Thanks.

NOTE: Chat about this topic going on here: https://chat.stackexchange.com/rooms/88146/cryptographic-accumulators-accumulator-size-vs-max-number-of-set-members


texts: Could Riemann hypothesis solve certainly RSA?

texts:
I don't have the background for dealing with Riemann hypothesis but is well known that covers the prime distribution below a specified number.

In order to solve the RSA problem you have to factor the semiprime or calculate the totient itself, that's hard as factoring the modulus.

Question is, could Riemann hypothesis be used to calculate how many coprimes are below the modulus by counting the primes below $n$ and also counting how many products of those primes are below $n$, except those involving $p$ and $q$?

If the previous is negative, can someone clarify why some people say that Riemann hypothesis could "break" RSA?

Thanks for your patience and comprehension.


texts: Threshold signature verified by an equivalent key

texts:
I am looking for references for the following problem:
Consider we have a DSA with the keypair $(sk, pk)$ and a message $m$, such that its signature is $s = sig(m,sk)$ and the verification result is $v=ver(s,pk) $.
Now, I would like to have a threshold DSA with 2 players (for simplicity) with keypairs $(sk_1, pk_1)$ and $(sk_2, pk_2)$ such that their signature $s_t=sig_t(m,sk_1, sk_2)$ is equivalent to the original $s$ in the sense that $v \equiv v_t = ver_t(s_t,pk_1,pk_2) \equiv ver(s_t,pk) $.
Simply speaking, I would like to sign with a threshold signature but verify with one master key.

Have there be any work in this direction?
What keywords and topics
should I be looking for?


texts: Why does SHA-2 call for doing 10* padding in addition to appending the message length?

texts:
Appending the length of the message when padding of a SHA-2 message is sufficient to satisfy the Merkle-Damgård construction.  However the padding in SHA-2 also pads with 10* between the end of the message and the message length data.  I know that 10* padding lets one turn non-block-aligned length messages into block-aligned length messages in a reversible way.  However, because the padding already encodes the bit length of the original message, this 10* padding is redundant.  Using the bit length data we can already determine where the original message ends and 0* padding would be sufficient.  In fact, in "One Way Hash Functions and DES. Advances in Cryptology" in Crypto’89, Merkle uses 0* padding followed by the length.

So my question, why does SHA-2 call for doing 10* padding in addition to appending the message length?


texts: How can I prove a truncated hash fuction need not be collision resistant?

texts:
Let $H : \{0, 1\}^∗ \mapsto \{0, 1\}^ n$ be a collision-resistant hash function. Define $H_0(M) = H(M)\mathbin\|0^{n−10}$. That is, $H_0$ appends ($n − 10$) zeros to the output of $H$. Clearly $H_0$ is collision resistant.

Now let $H_{00}$ be the result of truncating the output of $H_0$
to $n$ bits. The question is to show that if the truncation is done incorrectly, then $H_{00}$ will not be collision resistant. In other words, a truncated collision resistant function need not be collision resistant.


texts: On the fly signatures and zero-knowledge

texts:
I am reading some articles which explain on the fly signatures (also called online/offine signatures).

The principle is that a few operations do not depend of the message we want to sign, so these values can be precomputed and use in the future to sign the message.

Let's see an example with the Schnorr signature:

  $p$ and $q$ two primes such as $ q|(p-1)$
  $\alpha$ an element of order $q \bmod p$
  $\mathcal{H}$ a hash function
  $s \in [1,q]$ the private key
  $\alpha^{-s} \bmod p$ the public key

  Signature of a message $m$:

  Choose randomly $k \in [2, q-1]$
  Compute $r=\alpha^{r} \mod p$
  Compute $x = \mathcal{H}(m || r)$.
  Compute $y = k - sx$
  Send the couple $(x,y)$.

As said before, we remark that steps 1. and 2. are independant of the message $m$ and can be precomputed.

It is explained that signature algorithms derived from zero-knowledge identification schemes are the best suited to implement this kind of signature.

Why is the consideration of zero-knowledge so important to apply this method?


texts:
I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus seems to be that our application should be FIPS 140-2 compliant if we use a FIPS certified library.

We are using the AES algorithm from a FIPS certified library — iOS commoncrypto — for the encryption of database and disk files. We generate a key dynamically based on a random salt for each encryption of a file (CBC mode, same key for different block of same file). However, we don't use any initialization vector.

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?


texts: Question on the Quadratic Residuosity Assumption

texts:
I am reading the Handbook of Applied Cryptography and on page 99 the authors write
, after showing that $QRP \le_P FACTORING$:

  It is believed that the $QRP$ is as difﬁcult as the problem of factoring integers, although no proof of this is known.

I am not quite sure what "as difficult" means, do they say that it is assumed that $QRP \ge_P FACTORING$?


texts:
I wont give the name of the company, but here's a quote from a white paper they published:

  Our innovative Polymorphic Key Progression Algorithm (PKPA) technology is designed to overcome the flaws and inadequacies associated with today’s encryption algorithms.

I know enough about crypto to be dangerous, but my thoughts are that this is a technology that is trying to solve a problem that doesn't exist. They cite numerous hacks, but am I wrong in assuming that such hacks are very seldom the result of the crypto technology, and instead usually the result of someone leaving the keys in the car?


texts: Combining AES-SIV and a password-derived key

texts:
I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$:
$$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$
where

$AAD$ is a string of 48 bytes, of which 21 bytes are a random salt $S$.
$K = \textrm{PBKDF2}_{\textrm{SHA256}}(\textit{password}, S, \ldots)$, where $\textit{password}$ might be reused.

So, the salt $S$ is both included in the $\textit{AAD}$ and used to derive the 256-bit key $K$ fed to the SIV encryption function.

(The fact that attackers might observe that the same $P$ is encrypted when the same value for $S$ happens to be generated (however minuscule the odds are) is not an issue.)

I have learnt to be very suspicious of any cryptographic construction I myself come up with, and because I have never seen a scheme like this, I have to ask: is there problem with this method? I can't possibly think of one, but that's hardly enough for me to be sure it isn't flawed.


texts: Argon2id internal iterations vs multiple Argon2id calls ?

texts:
TLDR;
Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times?

I'm asking that for 2 reasons:

Firstly, we use SRP protocol where the deprecated SHA1 is replaced by Argon2id inside our PWA (Progressive Web App, so in JavaScript) but Firefox and Google currently discuss to inform user when an operation take too much CPU or RAM. Their goal is to fight against website that doing bitcoin's mining in the background. I don't want this require user's confirmation each time we use Argon2.

Secondly, as we can't known which CPU/RAM are available for the smartphone in JavaScript, we can't known the ideal number of iterations to ideally doing, so we need to find this with the help of a chronometer, we can call Argon2id as many time as possible until 3 seconds elapsed. Of course, we also keep in memory the number of calls used the first time, to do the exact same number of calls the next time we want to compare.

BTW, the last RFC 8018 of January 2017 still recommend PBKDF2 and this KDF is natively supported in browser (WebCrypto API) and faster than any external library, so may be the solution is to not use Argon2 and to use WebCrypto PBKDF2, with the same method of multiple calls until 3 seconds elapsed?


texts: How to prove that a one way function is uninvertible?

texts:
Suppose we define the "hard to invert" part in the definition of one-way functions differently:

  A function $\ f : \{0,1\}^* \to \{0,1\}^*$ is called uninvertible if it is easy to compute $f$ but there does not exist a PPT (polynomial time) algorithm $\ A$ such that, for every string $x$, on input $\ (1^k; f(x))$, $\ A$ outputs $x'$ such that $\ f(x) = f(x')$.

How to show that if $\ f$ is a one-way function, then it is an uninvertible function.

I know that if $\ f(a,b) = a\land b$, and let $x$ be an output of $\ f$. So there cannot be unique values of $a,b$ such that this is invertible. So basically this is uninvertible. I am not getting the connection between PPT algorithm and uninvertible function.


texts: Role of session identifier in Otway-Rees protocol

texts:
According to Wikipedia, Otway-Ress protocol is as follow:

  The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$ is a session-identifier, $N_A$ and $N_B$ are nonces):

\begin{align}
 A & \rightarrow B : M,A,B, \{N_A,M,A,B\}_{K_{AS}}\\
 B & \rightarrow S : M,A,B, \{N_A,M,A,B\}_{K_{AS}},\{N_B,M,A,B\}_{K_{BS}}\\
 S & \rightarrow B : M, \{N_A,K_{AB}\}_{K_{AS}},\{N_B,K_{AB}\}_{K_{BS}}\\
 B & \rightarrow A : M, \{N_A,K_{AB}\}_{K_{AS}}
\end{align}

What is the role of $M$, the session identifier, in the security of protocol?

What will happen if we remove all $M$ in the protocol? (I think there will be no flow, I don't understand the role of $M$)


texts: Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?

texts: The RFC for AES-KW doesn't actually mention authentication. It only mentions integrity, where the unwrapping/decryption process should produce an identical IV of A6A6A6A6A6A6A6A6. Is this integrity check effectively performing authentication, or is it possible for a third party to generate a key that will produce the same IV when unwrapped with an arbitrary key-encryption-key?


texts: Inversion in $GF(2^{10})$ Using Composite Fields

texts:
I'm designing a circuit that uses many $GF(2^{10})$ inverters.  Normally for this sort of thing I use lookup tables.  (Itoh-Tsujii is not efficient for these smaller fields.)  This application is for an ASIC so the 1024-deep ROM will be optimized by the synthesizer.  However, I recalled that when I built an AES encryptor, I used a Satoh S-box which efficiently computed the inverse in $GF(2^8)$ by splitting an element into two composite-field elements in $GF(2^4)$, performing an extended Euclidean algorithm which required finding an inverse in the much-smaller $GF(2^4)$, and then converting composite-field elements back to $GF(2^8)$.

The question is:  could I do something similar to invert elements in $GF(2^{10})$ by using composite fields in $GF(2^5)$?


texts: Why is RSA private exponent much larger than RSA public exponent?

texts:
RSA private exponent is much larger than RSA public exponent. For example, for a 2048 bit RSA private key, the private exponent can have more than 2000 bits. But the public exponent is usually 65537 (0x10001) which has a much shorter bit length.

Here is my guess of the reason. Let's use define the following symbols to describe RSA algorithm:

$n$: modulus
$e$: public exponent
$d$: private exponent
$P$: public key $(e,n)$
$S$: private key $(d,n)$

Encrypt a plain message $M$ with $M^e \text{ mod }n$. Decrypt a encrypted message $C$ with $C^d \text{ mod }n$. Since $d$ is much larger than $e$, decryption incurs much more mulipliation compuatuation. So the use of a large priavate exponent is to make the decryption harder.

Is my guess correct?


texts: Does there exist the method of projective coordinates for the computation of scalar multiplication for Koblitz curve?

texts: Although the computation for scalar multiplications for Koblitz curve can be efficiently executed by TNAF method, but it still need to compute the multiplicative inverse for each point addition.


texts: Doubling the block length of a given block cipher

texts:
IMHO the main essence of a Feistel cipher of block length $n$ is the working of a non-linear function $F$ that is applied to the two halves of the block of length $n/2$.

Now suppose a certain block cipher of block length $n$ as well as two keys of it are given. If one employs the given block cipher in the sense of $F$ on each half of a larger block of length $2n$ in parallel (actually invoked alternatingly with the two keys) for a number of rounds, one obtains evidently a new block cipher of Feistel genre having doubled block length and requiring a doubled key length.

Could anything in general be said on the security (or insecurity) of such a scheme?

It may be of interest to also examine the special case where the two keys are identical.

The scheme can be trivially generalized to achieve a block length of the larger cipher of $m \times n$ where $m \geq 2$ operating on $m$ subblocks of length $n$ as follows, with $E(K,P)$ denoting the given block cipher and $K[*]$ denoting the array of the keys:

for i in [1 .. number_of_rounds] do

    for j in [1 .. m] do

        subblock[j+1 mod m] ^= E(K[j],subblock[j])

Note that, in case $m$ is not fixed but the plaintext length is $m \times n$ (and there is one or more keys) one obtains a special kind of block chaining with the given block cipher.

Certainly there is an efficiency issue that needs to be examined for practical applications of the scheme.


texts:
Let F be a pseudorandom function (length preserving). We have the following scheme:
To encrypt $ m \in \{0,1\}^{2n}$, parse m as $m_1||m_2$ with $|m_1|=|m_2|$, then choose $r\leftarrow\{0,1\}^n$ and output the ciphertext $(r, m_1\oplus F_k(r), m_2 \oplus F_k(r))$.
Is this scheme EAV secure?
I think that it is not EAV secure because we use twice the pseudorandom function with the same r, but I can not prove it formaly.


texts: does using an HMAC protect against hash table DoS attacks?

texts:
For a hash set where the values are supplied by a third party, one concern is that an attacker can run a denial of service attack by creating many values that all fall into one bucket of the hash table, causing accesses to take linear time instead of amortized constant time and overloading the system. (Since it’s a set, let’s assume that exact data matches are not stored, so you can’t fill the bucket just by writing the same value many times.) What’s the best defense against this type of attack?

Using a cryptographic hash helps because it makes it hard to generate values that have specific hashes — but if there are N buckets and N is not super large, simply generating random data will still produce a hit approximately once every N tries. So if an attacker knows (or can guess) your hash function, they could still attack your system fairly easily by precomputing a bunch of colliding values and then uploading just those values.

It seems like an HMAC / some other kind of keyed hash would be a good way to prevent an attacker from knowing what bucket their data will end up in, but will it also cause values which hashed to the same bucket using the original hash function to be distributed evenly (seemingly randomly) across buckets?

Also, if that works, I was wondering if an HMAC is necessary, or if using some other hash method that uses a secret (for instance using the keyed versions of the BLAKE2/3 hash family) would work just as well.


texts: Why could the error term be sampled coefficient wise?

texts:
In SEAL homomorphic encryption library, it implements the BFV and CKKS. We know the error $e\in R_q$ which is a Guassian distribution. When sampling an error term $e = \sum_{i=0}^{n-1} e_ix^i$, it just samples $e_i$ from some discrete Guassain distribution over the integers.
However, it seems that the discrete Guassian distribution over high dimension lattice could not be sampled coefficient wise. What goes wrong ?


texts: Pencil & paper encryption, some thoughts on polyalphabetic techniques

texts:
I have an idea for a simple cipher that builds on old techniques that I thought I would share with this group.  It has probably been done but I have not been able to find a reference to it.
Given two individuals who wish to encrypt their correspondence, brevity and a one time pad is pretty bullet proof.  However there are weaknesses that can be exploited. Using a key word that can be deduced as well as common letter pairings, complexity and mistakes in the ciphering or deciphering and finally the pad or letter grid itself.
My idea is to remove as many of these failings as possible and make a quick and easy process.  Starting with the letter grid or square.  Blocks of jumbled alphabets have been used, paragraphs from books but what ever the the source the letters must be put into a table format, at least 2 copies, that are correct.  Unless one just uses a book cipher then you just need two identical books.  I do crossword puzzles and realized every day there is a solution to yesterday's puzzle in the paper.  A ready made pad accurate across the distribution of the paper.  All that is needed is the index line and column.  There are holes in the puzzle, black zones, and those could reveal the structure of the pad given enough encrypted words.  But could those be embraced.  That took me the actual enciphering technique.  Instead of complex routines what if I just use a frame.  Knowing that I need an E, I pick one in the grid and then use a piece of paper to find the two index letters, one for the column one for the row.
To summarize,
Look in the paper on a specific day and retrieve the crossword solution.
Clear text, "buy in my name"
Find a letter b in the grid or table
Put the corner of the piece of paper on the grid so that it points diagonally to the b
Follow the paper edges to the two indexes and read the characters that identify the square with b in
it.  Repeat.  Spaces could be indexed to blacked out squares.
To decipher,
Get the crossword solution for the proper date and time
Put the index row and column in place
Use a piece of paper to read the clear text from the grid
There are obvious problems, beyond my general unfamiliarity with the process, but my question would be a historic pointer to this process if there is one.  Opinion on the security of the process, breaking the cipher.  And finally given the process how many times could one use that grid?  Obviously the New York Times crossword would be a far better source than a kids crossword .. but.


texts:
I am beginner to Cryptography. And recently I came across the requirement like "use of SHA-256 in cryptography".

Does "use of SHA-256 in cryptography" imply use of SHA-256 both in HMAC and DH key exchange, assuming these are the only uses of hash in system?

I would be very thankful if people can provide their views.

EDIT

To explain the situation…

There is requirement to use SHA-256 in our product (embedded system) for SSH. As far I understand, SHA-256 is used in two places: one in diffie hellman key exchange and another in HMAC calculation. The confusion is – if we are planning to use SHA-256, then shall we use it in both the places or only for HMAC calculation?


texts: Is MITM possible after key exchange phase done successfully in RSA?

texts:
Is MITM attack theoretically possible after public/private key pair exchange is done successfully? Say Alice and Bob have genuine public keys of each other. Is MITM possible further during the authentication phase between Alice and Bob?
Please find the protocol below:
Alice and Bob have key pairs. Assume Alice and Bob have the correct public key of the other party. (i.e. key exchange is already done successfully.)
Now,
Ia and Ib are the identities of Alice and Bob.
pu_a and pu_b are the public keys of Alice and Bob.
pr_a and pr_b are the private keys of Alice and Bob
No_a and No_a’ are the nonce generated by Alice; No_b is the nonce generated by Bob
Sig_a and Sig_b are the signatures generated by Alice and Bob respectively by encrypting the message content with their private key:
Sig_a = Encpr_a(No_a’, No_b, Ib); Sig_b = Encpr_b(No_b, No_a, Ia)
Alice verifies Bob by decrypting Sig_b with pu_b, and checking if No_a is there; while Bob verifies Alice in the same way.


texts: How to prove that a predicate is not hard-core?

texts:
How can I prove that given a predicate $hc$ and a one-way function $f$ that $hc$ is not hard-core?
I was thinking about something like that:

i define $f(x) = (g(x), hc(x))$ that is one-way but $hc$ is not hard-core 'cause it's value is easly reconstructable from the output.

Is it right? How can I actually prove that?


texts: How does OpenPGP handles situation when signatures on one OpenPGP key contradict each other?

texts:
For example, I was on a key signing party. After a party, one person signed my key with full trust and sent this signature to me by email. Then that person changed their mind and signed my key with marginal trust and uploaded that signature to a key server by themselves.
I have uploaded first signature with full trust to the key server after the person uploaded the second signature.
How these signatures will be combined on my OpenPGP key?


texts: Reducing the XOR's in Implementation Cost

texts:
Suppose that we want to implement the following equations in binary finite field.

$$
\begin{array}{l}\tag{1}
y_{{1}}=x_{{1}}\oplus x_{{2}}\oplus x_{{7}}\oplus x_{{8}},\\
y_{{2}}=x_{{1}}\oplus x_{{2}}\oplus x_{{6}}\oplus x_{{8}},\\
y_{{3}}=x_{{1}}\oplus x_{{2}}\oplus x_{{7}},\\
y_{{4}}=x_{{2}}\oplus x_{{8}}.
\end{array}
$$

My question: Is it possible to implement  the given equations in $(1)$ with five $\operatorname{XOR}$?

My try results in six $\operatorname{XOR}$ for implementation cost. For example;

$$
\begin{array}{l}\tag{2}
u_1=x_1\oplus x_2,\\
u_2=x_2\oplus x_8=y_4\\
u_3=x_6\oplus x_8,\\
u_4=u_1\oplus x_7=y_3\\
u_5=u_4\oplus x_8=y_1\\
u_6=u_1\oplus u_3=y_2\\
\end{array}
$$

Thanks for any suggestions.

Edit: As Dear fgrieu said with greedy thoughts, the answer is as follows:
$$
\begin{array}{l}\tag{3}
u_1=x_2\oplus x_8=y_4\\
u_2=x_1\oplus u_1\\
u_3=u_2\oplus x_7=y_1 \\
u_4=u_2\oplus x_6=y_2\\
u_5=u_3\oplus x_8=y_3
\end{array}
$$

Thanks to greedy thoughts.


texts: Exploiting AES with IV similar to password and fixed key

texts:
While reviewing a 'secure communication protocol' made by a colleague, I noticed a usage of AES-128 CBC that caught my eye. I think they are trying to implement a HMAC but have made some very questionable decisions.

The steps look like this:

The IV is initialized to be the same as a user's (plaintext) password with just one byte changed.
AES CBC takes the password, this IV, and a key as input, however the same key is used each time.
The output of this encryption is then XORed with the original password, giving the user's password hash.

Now presuming I have the key and some hashed passwords, is it possible to obtain the original plaintext passwords, in order to prove to my colleague that this system is horribly broken?


texts:
Would XDES be more secure than 3DES, where X is a number  > 3?
Like 10DES... If so why aren't we using it?


texts: Using ECC CDH test vectors with ECDH when h >1

texts:
I am writing formal tests for a system with a number of crypto requirements including support for ECDSA, ECDH and HMAC. The system is required to support the following EC's: NIST curves P-224, 384, 521, 192 and 256 ($h=1$) as well as K-163, 233, and 283, and B-409 and 571 ($h \ne 1$). Being new to crypto in general I did some research and found that there are test vectors by known agencies like NIST, SECG, and IETF (I think), that I can use for verifying the system is implemented correctly. But for ECDH specifically, I could find test vectors only for the $h=1$ curves. However, I found NIST ECC CDH test vectors for all of the curves. So I had to read up on ECC CDH versus ECDH. This website helped the most in that regard.

My question is: can I use the test vectors intended for ECC CDH to test the $h \ne 1$ curves on my ECDH system simply by premultiplying the private key from the test vector by the known cofactor of the curve and expecting the right result to come out? Perhaps if the key overflows the expected number of bits, maybe not, in which case I can simply rule out that test vector from the test?

(Now if it's dodgy to use regular ECDH with $h>1$ curves, just remember: I didn't write the requirements!)


texts: Secure logical AND using Ishai-Sahai-Wagner Scheme

texts:
I want to try to implement a secure AND the way it was described here:
https://eprint.iacr.org/2010/441.pdf

It says that there are two bits a and b and that they have been split into d+1 shares. How can I split a bit? I guess there isn't something more atomic than a bit, isn't it? Can you give me an example on how to do this?
I mean I could say that, for example:

Let $d$ be 4. Assume that $a$ = 1, then I can split it into the following 4 shares: $a_1 = 1, a_2 = 1, a_3 = 1, a_4 = 0$ because then it holds that $1 \mathbin{\oplus}1\mathbin{\oplus}1\mathbin{\oplus}0 = 1 = a$. Is that what is meant with the $d$ shares? I assume these shares are random values?

I tried a first implementation of the secure AND as follows:

void SecAND(char a, char b, char* arr, char* brr)
{
  int i; int j;
  int d = 4;
  int r[4][4];
  int c[4];
  for(i = 0; i < d; i++)
  {
      for(j = i+1; j < d; j++)
      {
          srand(time(NULL));
          int rij = rand() % 2;
          r[i][j] = rij;
      }
  }

  for(i = 0; i < d; i++)
  {
      for(j = i+1; j < d; j++)
      {
          r[j][i] = (r[i][j]^(arr[i]*brr[j]))^(arr[j]*brr[i]);
      }
  }

  for(i = 0; i < d; i++)
  {
      c[i] = (arr[i]*brr[i]);

      for(j = 0; j < d; j++)
      {
          if(j != i)
          {
              c[i] = c[i] ^r[i][j];
          }
      }
  }

}

Can this be correct?


texts:
The RSA assumption states that it is hard to find $m$, given $c = m^e \bmod{n}$, $e$, and $n$ (for appropriate choice of $n,e$).

Suppose that there exists an algorithm, $D(c,e,n)$, that finds $m$ in 1% of cases.
What could be a pseudocode of an algorithm that can use $D(\cdot,\cdot,\cdot)$ and finds $m$ easily for any $c$?


texts: Shannon cipher with fewer keys than messages

texts: Alice and Bob have a set $\mathcal{M}$ of $|\mathcal{M}|$ messages and a set $\mathcal{K}$ of $|\mathcal{K}|$ keys. Alice wants to send a message $m \in \mathcal{M}$ to Bob. She uniformly picks a key $k \in \mathcal{K}$ and encodes the message $m$ with it to create $x = e(m,k)$ (She uses different keys for different messages as much as possible). Bob knows the encoding and uses the key $k \in \mathcal{K}$ to decode $m$ as $m=d(x,k)$. If $|\mathcal{K}| \ge |\mathcal{M}|$ perfect secrecy is achievable and the best strategy for Eve who only knows $|\mathcal{M}|$ will be simple guessing. If $1 \le |\mathcal{K}| < |\mathcal{M}|$, then some keys are used multiple times and there is some information leakage to Eve. What is the best (maximum likelihood) decoding strategy (algorithm) for Eve assuming that she knows the encoding and decoding strategies? I appreciate any comments or if you can direct me to a good reference on this.


texts:
I am trying to implement the Fluhrer, Mantin and Shamir attack, one of the ways to break WEP. I seem to have hit on a problem. I have no idea whether or not it is a programming error, or if I don't understand the practical part of the attack properly.

Can I get some verification that I understand how to use it correctly or incorrectly?

Here is how I understand WEP and the FMS attack:

For some constant root key (say 104 bits), random 24 bit IV is
generated per message and prepended to the root key. That new key is
used to encrypt some data (packets).

RC4(IV + root key).encrypt(data)
That data can somewhat be considered a constant, since packet data
should have known headers.
Many packets are collected (I generated 6 million (IV, RC4(IV + root key).encrypt(data)) pairs) to make the (253/256)^252 chance of the sbox not changing in certain places be more obvious.
With those packets, you get "votes" from each packet on the most likely correct root key byte. To get the votes, do:

For 3 <= i <= 15 (104 bit root key)

For each packet

Only use packets with IVs that have the form IV[0] = i, IV[1] = '\xff'
For that packet, combine the IV with whatever root key that has been recovered (so for i = 3, the temp key would be IV + "" = IV)
Run the RC4 Key Scheduling Algorithm with the temp key, to try to find those times that the sbox doesn't move the ith index to an unknown place. Return the sbox and j after the using up the temp key once (the (i-1)th KSA step).
Get the byte that was used to encrypt the plaintext by xoring the plaintext at character i - 3 with the ciphertext at i - 3 (to start at index 0). KB = pt[i - 3] xor ct[i - 3]
Figure out the index of KB in the sbox in the current state (after step i - 1, before step i), sbox^-1[KB]
Get the "vote" of the current encrypted data by doing sbox^-1[KB] - j - sbox[i] (to "undo" the j = j + S[i] + K[i mod K.size()] and swap)

After all the packets have been processed, get the highest voted octet, and add that to the recovered root key. Then increment i.

So, at i = 3, you would use IV + root key = "\x03\xff\xXX" (last IV byte can be any value) to find root key[0] = '\RK0'

and at i = 4, you would use IV + root key = "\x04\xff\xXX\RK0"

and continue this until all the bytes are found.

Are these step correct for implementing the FMS attack? Am I using the wrong indexes? Using RC4 differently from WEP (significantly enough to cause problems)? I am currently able to recover only the first byte of the key (maybe). Does something change for each consequent byte that I didn't take into account?


texts: How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

texts:
From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key through them.  At this point, the attacker may directly brute force the, say AES128, key.
It is nice to not over-tune the parameters of KDFs, so that the user is not needlessly suffering using a slow application.  I think it is ideal if the KDF is tuned only so that the user suffers least while still maximum possible security out of, say, AES128-CBC (or whatever other symmetric cipher).
An easy way is to explore all improvements in hardware and algorithm design, in order to get an estimation how long would it take certain well-funded organisations have to wait until they finally manage to decrypt my cipers.  But I think this approach is needless complex as I think we can probably say a lot about the computational bounds of KDFs by simply studying the problem from an information theoretic perspective.
Below is an attempt. My question is: can we make it tighter?

What I have done so far:
Let's say that $f$ is a 128 bit encryption/decryption function, and the KDF function is $k$.  also let's say that a single round of $k$ equals the encryption/decryption of a single block by $f$.  Let's say that our password has only $70$ bits of entropy.
So the total attempts to bruteforce all keys is $2^{128}$, while the total attempts to bruteforce the password is $2^{70}$.  Since $f$ and $k$ computationally cost equally $c$, then the actual cost of bruteforcing the keys is $c \times 2^{128}$, while the password is $c \times 2^{70}$.  In this case, the adversary will obviously go after bruteforcing the password.
To make the attacker not find the password easier to break, we can repeat the KDF $k$ for $r$ many times until the difficulty matches.  Basically:
$$\begin{split}
c2^{128} &= rc2^{70} \\
2^{128} &= r2^{70} \\
\frac{2^{128}}{2^{70}} &= r \\
2^{128-70} &= r \\
2^{58} &= r \\
\end{split}$$
If the KDF $k$ is itself is implemented by recursively calling $k$, then this $c$ is guaranteed, and simply repeating it long enough, recursively, will guarantee that the difficulty of bruteforcing the password via the KDF $k$ is as hard as bruteforcing keys with $128$ bits of entropy.
Meaning, if $r > 2^{58}$, then for the attacker would find it easier to bruteforce the key directly.  In this case, the attacker would totally ignore the KDF $k$ and move on to bruteforce $f$'s key.  In other words, $r>2^{58}$ is pointless.
Update:  the above is also implemented as part of ciphart.


texts: Is there difference between Algebraic Homomorphic Encryption and Fully Homomorphic Encryption Schemes?


texts: RSA key requirements so that it can decrypt a DES key

texts:
I came upon a solved exercise that uses a client's RSA key to encrypt a DES key. It has the following phrase:

value of n for RSA key generation has been chosen accordingly so that the DES key can be encrypted.

However it does not go on to explain what the requirements are and why. Could someone point this out to me? Many thanks.


texts: Pseudo-random generator explanation by Bruce Schneier

texts:
I am reading about Pseudo-Random Sequences in Applied Cryptography book by Bruce Schneier. Description is provided below.

  A pseudo-random sequence is one that looks random. The sequence's
  period should be long enough so that finite sequence of reasonable
  length —that is, one that is actually used— is not periodic. If you
  need a billion random bits, don't choose a sequence generator that
  repeats after only sixteen thousand bits. These relatively short
  nonperiodic subsequences should be as indistinguishable as possible
  from random sequences. For example, they should  have about the same
  number of ones and zeros, about half the runs (sequences of the same
  bit) should be of length one, one quarter of length two, one eights of
  length three, and so on. They should not be compressible. The
  distribution of run lengths for zeros and ones should be the
  same [643,863,99,1357].

My questions on above text

What does statement "or example, they should  have about the same number of ones and zeros, about half the runs(sequences of the same bit) should be of length one, one quarter of length two, one eights of length three, and so on. " mean?
What does statement "Theere should not be compressible"?
What is number 643,863,99,1357?

Thanks for your time and help


texts:
In RFC6628 section 2.2, they say:

  w = The password remembered by the user.
  W = The password verifier registered in the server. W = g^w mod p, where g and p are agreed upon in advance.

They claim resistance against server compromise. But if an attacker gains access to the password verifier W, how much work is the attacker required to do per password guess, in order to conduct an offline brute force dictionary attack?

If I'm not mistaken, the answer to this question is: The work required for each password guess is to raise a single large exponent, and compute a single large modulo-division. This is not comparable to pbkdf2, bcrypt, scrypt, or similar, and probably should not be considered a strong enough rate-limiter to protect a low entropy password against server compromise.


texts: Pollard's Kangaroo: How random does $f$ have to be?

texts:
I'm implementing Pollard's kangaroo algorithm as described here.

Wikipedia's description of the protocol says that you should have "a pseudorandom map $f:G\rightarrow S$."

Does anyone know what happens if you weaken the properties of the map? I'm trying to implement this (don't worry, it's for research--nothing nefarious) so a full hash function like SHA-256 seems like overkill in this situation (especially since $S$ is so small). Has anyone mathematically analyzed what would happen if you use something that is a bit weaker than a full-fledged Random-Oracle-like hash-function? Heuristically, I'm finding that even something ratched like using $f(p) = S[p.y \bmod |S|]$ when $G$ is an elliptic curve group does not seem to recognizably affect the number of hops before the wild kangaroo is caught.


texts: RSA: least significant bit position in key

texts:
How can I show that $C' = 2^e·C^* \bmod N$ when it is decrypted will add zero bits in the least significant bit position of the key?

I am not sure if the cause is multiplying by a ciphertext which would lead the key to be multiplied by it as well.


texts: Security of zero knowledge proof protocols

texts:
When designing a protocol based on zero knowledge proofs, be it based on the discrete log problem, or on a Hamiltonian cycle in a graph, or something else, I assume there are security considerations, like there are security considerations in the use of conventional ciphers.

For example, when using AES (or any block cipher for that matter), one has to make sure that the IV is random, and a good block cipher mode is chosen.
When using RSA, one has to use a secure padding scheme, pick a high, but not too high exponent (0x10001, for example).

I wonder whether there exist this kind of considerations for several ZKP systems too; e.g., on how to generate a "good" graph for the Hamiltonian path problem.
I.e. I wonder how to make sure that Victor cannot gain Peggy's knowledge, using side channels, timing attacks, statistical attacks, or something alike? Has there been interesting publications to read upon this topic?


texts: In "Lecture Notes on Cryptography" what does "PTM" mean?

texts:
I came across a handbook named "Lecture Notes on Cryptography" from Shafi Goldwasser and Mihir Bellare and I read their definition 3.1 about poly-time indistinguishability:

  Let $X_n,Y_n$ be probability distributions on $\{0,1\}^n$ (That is, by $t\in X_n$ we mean that $t\in\{0,1\}^n$
  and it is selected according to the distribution $X_n$).

  We say that $\{X_n\}$ is poly-time indistinguishable from
  $\{Y_n\}$ if $\forall \text{PTM } A, \forall \text{polynomial } Q, \exists n_0, \text{s.t. } \forall n>n_0$,

  $$\left|\Pr_{t\in X_n}(A(t)=1)-\Pr_{t\in Y_n}(A(t)=1)\right|<\frac1{Q(n)}$$

What I don't understand is what "PTM" means, can you please explain it to me?


texts:
I am reading a paper by Shacham and Waters on Compact Proofs of Retrievability. In this paper on page number 3 under section 1.1 in the very first line the author states that an encoded file is broken into n number of blocks $m_1,m_2...m_n \in Z_p$ for some large prime p.

I am not able to understand that in terms of programmimg what does it exactly mean to have a chunk of file data in a group/field. On the same page they mention an equation:

  $σ_i = f_k(i) + αm_i \in Z_p$

What is the value of this $m_i$ in this equation. Is it the number of bytes/bits in each block? What value of $m_i$ would I take if I have to calculate this $σ_i$ in the equation ? The calculated value of sigma lies in the group of prime order $Z_p$.

I am not sure if I have posted the question in the right forum but I could not get any comments in stack overflow hence I have posted it to a forum I find closely related to. Any help will be valuable.

Thanks and Regards


texts: Is packing an executable just like encrypting it?

texts:
What's the difference between encrypting a file and packing it?

Can I encrypt a file that is already packed? Can I pack a file that is already encrypted, or does packing already do both?

If I pack a .exe file will it be considered as encrypted?


texts:
We often embed items from one space into another space, e.g. embedding plaintext items from $\{0, 1\}^m$ into some ring $R_q/\langle x^N + 1 \rangle$ for RingLWE.

What is the inverse of this action called?

(Feel free to move this question to Math.SE or other related. Though I am specifically interested in the opposite of embed in the context of math and crypto, rather than the general English language.)


texts: Why would Diffie-Hellman Group 21 be 521 bits rather than 512?

texts: Diffie-Hellman groups tend to increment in key sizes as you'd expect up until group 21. Any idea why the key size is 521 rather than 512? I haven't been able to find an answer at all.


texts:
It has been well known for a long time that NSA played a primary role in the development of the Digital Signature Algorithm (DSA).

DSA is a sort of hybrid of the ElGamal and Schnorr signature schemes.

My question is this. Based on what we know now, why did NSA invent a new scheme rather than just adopt ElGamal or Schnorr? I am looking for informed speculation based on what is known today about the relative strengths and weaknesses of these schemes, with references. (References for the strengths and weaknesses, I mean, not for the speculation.)

If your speculation is that NSA did something to weaken DSA, what could they possibly have gained other than the ability to forge signatures?

Or was DSA just the result of IP concerns? If so, I would like to see a reference for that, too.


texts:
I am researching post quantum cryptography and I've stumbled upon this article which presents a PKC with an np-complete (SAT) trapdoor.

I was wondering if someone could help me understand the way the encryption works. From what I understand the cipher text is a formula which consist of a bit (the message) which is then xored with variables taken from the public key. Doesn't it mean that the bit is actually in "plain sight" inside the cipher text ?

Surely I am missing something.


texts: Is using AES-256 with a key of less than 256 bits of entropy still quantum-resistant?

texts:
Encrypting with AES-256 is widely claimed to be post-quantum secure.

But let's take a case where you use an initial key that has less than 256 bits of real entropy. In this example, let's work with a 128-bit key that has 128 bits of real entropy. We stretch it with something commonly used, like PBKDF2 with 120,000 iterations. We use the 256-bit result as the encryption key for AES-256 to encrypt some secret.

Is the the secret still secure against brute force attacks by a quantum computer, the kind can halve (or worse) the effective security of a symmetric cipher using Grover's algorithm? (Edited to add:) We assume the attacker knows the specifics of the above scheme, but not they length of the entropy or the initial key.


texts: How were semagrams encrypted in the pre-digital era?

texts: Historically messages in languages that use alphabets have been encrypted manually according to some kind of algorithm (e.g. mono- and poly-alphabetic ciphers). But how wew messages encrypted in a semagram-based language like Chinese?


texts:
I have watched dozens of videos on YouTube talking about quantum cryptography and how the BB84 algorithm works. However, none of them bothered to explain how the quantum key exchange process works in detail; that is, for newbies like me. Thus I still have many unanswered questions.
Given the following scenario where Alice is the sender and Bob is the receiver:
1- How Alice and Bob agree on which of the two beam-splitter bases (Horizontal-Vertical and Right-Left) correspond to which classical bits (1 and 0)? How do Alice and Bob agree on when actual transmission starts, when it is time to send/receive a photon taking note of an event?
2- I understood that once Bob has measured all of the photons sent by Alice, he would record the list of the beam-splitter bases he used to measure those photons and send this list to Alice to check his bases against hers. If Alice finds a match, she would tell Bob to use the received qubit state as part of the key. Otherwise, she will tell him to discard it. Right?
3- If point two holds correct, I would like to know how Alice could detect an eavesdropper, Eve, and warn Bob about that based on Bob's beam-splitter bases list?
4- Where does Heisenberg's Uncertainty Principle come into action in QKD?
I hope to get some detailed answers.


texts: What tests can I do to ensure my random number generator is working correctly?

texts: In the past I have used the Chi-squared test to check the statistical randomness of my generator. Is this a good test to use? Are there other tests?


texts: security in the standard model → random oracle model?

texts: Can a protocol proved secure in the standard model be considered secure in the random oracle model?


texts:
In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.)

My question is, can $m^e$ be greater than $N$ (obviously, before taking the modulus)?

In that case is there a possibility like  $ m_1^e=m_2^e \pmod N$, i.e. can we get a collision?


texts: AES-CBC-128 Known plain, IV, Cipher attack

texts:
Let's say we have a single char 'A' and we encrypted it as much times as we want with a fixed Key and a random IV
So now we have list of the IVs used, the result ciphers and ofc the known text "A"

Is there's any possible solution to get the key used ?


texts: A general definition for cryptocurrencies

texts:
I am trying to find the definitions to several terms related to digital currencies. Unfortunately, I am always ending up on Bitcoin-oriented pages and websites which only take Bitcoin itself into consideration. So far, I managed to understand (actually, “guess” would be more appropriate) the following:

Digital currencies is the generic term for a currency which exists only as a sequence of zeros and ones on a digital support.
Electronic money is a way to realize a digital currency, it introduces a system where there is a central authority of trust in charge of managing the wallets of users and certifying all the transactions. Cryptography is only used to secure the communications between the users (buyers/sellers) and the central authority.
Cryptocurrency is another way to implement a digital currency, it defines a way to perform secured transactions and to control the creation of new units with the help of cryptographic schemes and protocols.

Now, lets venture a bit further and try to list the security properties that must (or may) be implemented by a cryptocurrency:

Unfalsifiability: The creation of new legitimate (or not) cryptocoins must be under strict control of the system.
No double spending: Once cryptocoins have been spent for a transaction, they must not be reusable by the original owner in another transaction.
Centralized/Distributed: The transactions using the cryptocurrency is done in centralized/distributed manner.
Anonymity (Optional): A transaction may be anonymous, meaning that the previous owner of a cryptocoin should not be easy to find.
Fraud tracing (Optional): A fraudulent transaction may lead to the unveiling of the original fraudster.

I guess that there might be dozens of optional properties to add… but, lets stop here.

So, my question is: are my definitions valid, or did I forget something (maybe some properties)?


texts: Mitigating the effects of server-compromise in an end-to-end encrypted system

texts:
I'm working on a chat system that will be end-to-end encrypted, and I've run into a problem. As you know, in end-to-end encrypted chats, the server isn't trusted at all; it's why we have fingerprint checking etc.

The problem came about when I was considering group chats. If Alice, Bob, and Eve are communicating, and Jill decides to join the server, we'll have to re-do the key exchange for her. But what if Jill is a malicious attacker? We'll be giving her the encryption keys! The solution I had in mind was to place each "trustworthy" client's public key in a file on the server, just like SSH does, and then the clients can identify themselves with a digital signature on connection. Now, as D.W. pointed out, this requires trusting the server, which is against standard end-to-end spec. In fact, any solution that allows the server to choose who is in the chat requires trust in the server.

Because what if the server is compromised or dishonest, and instead of attempting an MITM attack, it decides to add his own public key to the authorised_keys file? Then he can connect as a legitimate user and steal the session key. (This is how SSH does it, and I'm not sure how it mitigates this possibility, so as a side-question, clearing this up would be helpful.)

In an end-to-end encrypted system, what degree of control does the server usually have? I mean Signal Messenger has to have thought about this scenario and mitigated it.

Let me direct my question like so: what is the recommended practice for deciding who is a part of an end-to-end encrypted group chat? By recommended practice, I mean to communicate that an answer that draws from a well known and trusted protocol, or thing, like the signal protocol, would be optimal. The requirements are that the server should not be trusted and confidentiality and security for the clients should hold up in the adversarial model. They should also hold up if the server is compromised.

Obviously if the server cannot decide who is in the group, then the clients would somehow have to authorise each additional member, but seamlessly. How should I handle this? The idea is that the server is always up and clients can join and disconnect at any time, like a chat room.


texts: Am I correctly understanding TLS 1.2 PRF (Pseudorandom Function)?

texts:
According to RFC 5246 Section 5

PRF(secret, label, seed) = P_<hash>(secret, label + seed)

and

P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
                       HMAC_hash(secret, A(2) + seed) +
A(0) = seed
A(i) = HMAC_hash(secret, A(i-1))

According to my understanding first iteration of P_hash is

P_hash(secret, seed) = HMAC_hash(secret, A(0) + seed) and A(0) = seed

So,

P_hash(secret, seed) = HMAC_hash(secret, seed + seed)

Is it correct? Or is the first iteration rather

P_hash(secret, label) = HMAC_hash(secret, A(1) + Seed)

and

A(1) = HMAC_hash(secret, A(0))


texts: Decrypting a small Message using RSA with a Private Key

texts:
If I have a private key of (43, 341). What would be the steps I need to take to decrypt a small message using RSA? I have looked online and everything seems very confusing. Any tips or advice would be helpful.

I have gotten this far:

p=31  q=11
p*q=341
O(n)=(31-1)(11-1)=300
e=7
(43*e)%300=1  e=7
public key (e,n) (7,341)
Private Key (d,n)(43,341)
encryption of m=2   c=2^7%341=128
decryption of c=128 m=128^3%341=2

What would be the next step to decrypt a message?


texts: If a cryptanalytic breakthrough is made, what process should be followed?

texts:
If a researcher manages to make a cryptanalytic breakthrough on a cryptographic algorithm or protocol that is in use, what should they do?

Has this ever happened before? What are the implications for release and how do those relying on such systems ensure they are not caught in a situation where the crypto-system on which they depend is trivially broken?

Specifically:

What details would you make available online?
Who would you release full details to?
How are affected parties notified?


texts:
The idea is to share $n$ images among $n$ persons so that all images can be
reconstructed by someone in possession of all shares.

However, there must not be any data overhead (which means the shares sent
to the persons must not be bigger in size than the original images. In other terms: No data overhead).

The idea is to encode two images $A$ and $B$ like this:

$$Q = A + B + Secret\\
U = A - B + Secret$$

which allows for reconstruction of $B$ through

$$Q - U = A + B + Secret - A + B - Secret = 2B\\
B = (Q - U) / 2$$

after that $A$ can be reconstructed by

$$A = Q - B - Secret$$

$Secret$ is required because simply doing $A + B$ or $A - B$ visually leaks
information about the images to the other persons. The trick is to calculate
the secret through the image $B$. (For example by calculating a hash of B
and then feed it to a PRNG and then use this PRNG to generate the secret numbers you add to each pixel (ask for a new number for every pixel)).

In Pseudo-Code:

seed = hash(B);
r = Random(seed);
for (x,y) to (WIDTH, HEIGHT):
  secret = r.nextInt(255);
  Q[x,y] = A[x,y] + B[x,y] + secret;
  U[x,y] = A[x,y] - B[x,y] + secret;

Arithmetic is $\mod(M)$ of course, where $M$ is a reasonable odd modulus for the
required color depth etc. This method can be extended to more than two images. The odd modulus is what allows one to reconstruct the result uniquely.

The question now is: what fatal security flaws does this method have, if any?


texts:
I am currently studying stateful hash based signatures. In the XMSS paper the authors claim that XMSS signatures are 4 times smaller than those of MSS-SPR. However I do not get how it is possible,
because I do not understand the differences between both of them.

As the paper of MSS-SPR does not contain any One Time Signature scheme, a fair comparison should use the same OTS in both schemes. The only other difference I get is pseudo-random versus true random but it is unsufficient because it should not affect signature size:

pseudo-random generation of secret keys must not change the signature at all
pseudo-random generation of salt is helpful to reduce the public key size, but should not change the signature size either

So can someone explain to me where does this factor 4 come from?


texts:
I've found the following problem in one of my courses. Any tips on how to solve this would be appreciated!

  Alice has the key pair $(pka,ska)$. Bob has the pair keys $(pkb,skb)$. They want to establish a secret common key $k$ for a fast encryption (using $AES$).

  How?
  How if both want to participate in choosing the key (none of them trusts the other)


texts: How secure is the E0 stream cipher used in Bluetooth?

texts: The question is about E0, the stream cipher used to secure Bluetooth communication. The impression I get is that it's more secure than A5/1. Also, why wasn't AES used instead?


texts: Questions about length key of RSA 2048 bit

texts:
I use putty gen to generate RSA key, I choose length of key is 2048 bit, it generate public key:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA10prz5/FvHX7cx5aowiF+eO8uQuKTYSU0rA0x5yNPD5yTI0HGmEBTnhia4iOhOzwg0BevOZR1SClBpCRTZViym2Z+ohAGt65mWq+2LLhRf3MNpcM6Ttm8IXFxRiVR9iALk9cPsXu6zz4x7RT9vZG7rE1+KbeeSn1gacpCeudsEYCDOrgenH78hNXCLcc6TdKOWnBlASf8coj/T1czUW78S9tcqu7bFrR7N6xfj9M0d8e8oyBOqYrhv3uFmLxvVQ2yxZrJ0ILhAf8KhrflX6SytO5s/K5zTWRkjhwg83V8Qs30LWd79xJgpaUESaWFeS17x6iit8uEjMtPqBGnqLryw== rsa-key-20160620

I don't know why this key is 2048 bits?


texts: CBC encryption + CBC MAC reusing key in MAC-then-Encrypt

texts:
I'm reading the Handbook of Applied Cryptography by Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure.

My question is: in MAC-then-encrypt structure, that textbook's p.367 states

  Example (improper combination of CBC-MAC and CBC encryption) Consider using the data integrity mechanism of equation $\big(\ C'=E_k(x\mathbin\|h_{k'}(x))\ \big)$, with $E_k$ being CBC-encryption with key $k$ and initialization vector $IV$, $\ h_{k'}(x)$ being CBC-MAC with $k'$ and $IV'$, and $k=k'$, $IV=IV'$. The data $x=x_1\mathbin\|x_2\mathbin\|\ldots\mathbin\|x_t$ can then be processed in a single CBC pass, since the CBC-MAC is equal to the last ciphertext block $c_t=E_k(c_{t−1}\oplus x_t)$, and the last data block is $x_{t+1}=c_t$, yielding final ciphertext block $c_{t+1}=E_k(c_t\oplus x_{t+1})=E_k(0)$. The encrypted MAC is thus independent of both plaintext and ciphertext, rendering the integrity mechanism completely insecure.  Care should thus be taken in combining a MAC with an encryption scheme. In general, it is recommended that distinct (and ideally, independent) keys be used.

Why is it problem that MAC is independent of both plaintext and ciphertext? Are there any instances where an attacker could use this fact? (I know that MAC-then-encrypt structure vulnerable to padding oracle attack.. however, in that case, the attacker could perform the actual attack.) I think that encrypted MAC part always results in 0 being encrypted, but there is no practical way to exploit this fact. Isn't it?


texts: How to perform the modular reduce of Rijndael's finite field

texts:
I am trying to understand how to calculate the modular reduction of Rijndael's finite field.

The example on this page says that {53} • {CA} = {01}, because (11111101111110 mod 100011011) = {3F7E mod 11B} = {01} = 1.

I am able to get to the point where I have 3F7E mod 11B, but cant seem to figure out how the reduction works.

      11111101111110 (mod) 100011011
     ^100011011
       1110000011110
      ^100011011
        110110101110
       ^100011011
         10101110110
        ^100011011
          0100011010
          ^100011011 <-- here, right shifted two places?
            00000001

From this example, why does it right shift two places at one point?

I also found an example that 0x1b*0xaa equals 0x8c. Trying to solve this myself I get to the point: 0xE0E mod 0x11B

 111000001110
^100011011
  11011010110
 ^100011011
   1010111010
  ^100011011
    010001100
   ^100011011
     10010111

This makes it 0x97


texts: When we encrypt-then-MAC, how do we defend the 2 parts?

texts: When we encrypt-then-MAC (which is the recommended case), do we send both in the same package? Both can be modified along the way, isn't it? how do we defend the 2 parts?


texts: Number of keys when using symmetric and asymmetric encryption?

texts:
Quoting part of my homework/assignment:

  How many keys are required for secure communication among 1000 person if:

  Symmetric key encryption algorithm is used?
  Asymmetric key encryption algorithm is used?

My guess:

For symmetric they each need to maintain and transfer their own key, so probably $1000 \times 1000$, and for asymmetric maybe just $2000$, each having one public one private.

Is that correct?


texts: Why are Fortuna entropy pools reset after a reseed?

texts:
I've implemented LibTomCrypt's version of fortuna and am wondering about the pool resetting after a reseed. In fortuna.c in libtomcrypt we have the following (which is that part that adds the entropy from the pools into the key),

for (x = 0; x < LTC_FORTUNA_POOLS; x++) {
  if (x == 0 || ((prng->fortuna.reset_cnt >> (x-1)) & 1) == 0) {
      /* terminate this hash */
      if ((err = sha256_done(&prng->fortuna.pool[x], tmp)) != CRYPT_OK) {
         sha256_done(&md, tmp);
         return err;
      }
      /* add it to the string */
      if ((err = sha256_process(&md, tmp, 32)) != CRYPT_OK) {
         sha256_done(&md, tmp);
         return err;
      }
      /* reset this pool */
      if ((err = sha256_init(&prng->fortuna.pool[x])) != CRYPT_OK) {
         sha256_done(&md, tmp);
         return err;
      }
   } else {
      break;
   }
}

Once the pool has been added to the key, it is reset, why is that? I realise that at that point the entropy has been included in the key, so it has been used, but why not just keep adding entropy to the pool and have it keep all the entropy from the beginning of time? Is there any disadvantage if the pools are not reset?


texts: How exactly are PRNG's used to encrypt material, and what makes one any more secure than the other?

texts:
I hope my question isn't as lazy as the title indicates. What I want to ask is how people literally integrate a PRNG with encrypting material.

I wrote a silly little script in Python a while back that took a 9 digit seed, then produced a list of 'random' numbers using a linear congruential generator. That was cool and all, but when I tried to use that with my silly internet chat program (Also in python) I failed to see what use it had. Hey, I could match letters, symbols, and numbers to the various digits as a sort of substitution cipher, but that didn't seem really secure at all. If substitution was used every-time, then no generator would be better than the other

I googled for a bit about my question, but all the results didn't seem to go into any specifics about how one would use these randomly generated numbers to encrypt anything. Anyhow, I chose to give it a shot on Cypto, and am hoping someone can either point me to an answer so this can be closed, or equally, provide an explanation.


texts: Could this "symmetric RSA" scheme provide key compromise resistant communications?

texts:
This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel.

Specifically, assume that Alice and Bob wish to communicate securely over an untrusted network, so that others cannot read or forge their communications.  Obviously, assuming that Alice and Bob can establish a shared secret in advance, they can achieve this simply using any standard IND-CCA2 secure symmetric authenticated encryption scheme.

However, let's assume that Alice and Bob also wish to minimize the impact of either party's key material being compromised; specifically, even if an attacker learns Alice's key(s), she should not be able to read messages sent by Alice to Bob or forge messages from Bob to Alice, and vice versa.

As I noted in my answer to the linked question, this can be achieved by combining public-key encryption and digital signatures: basically, Alice and Bob each generate an encryption key pair and a signature key pair (i.e. four key pairs in total, for two-way communication), exchange the corresponding public keys, and encrypt and sign their messages.  However, fkraiem gave an alternative suggestion involving just a single RSA key pair, which I interpret as follows:

Alice and Bob together generate an RSA modulus $n$, i.e. a product of two large primes $p$ and $q$.
They select a random exponent $e_A$ coprime to $\lambda(n) = \operatorname{lcm}(p-1,q-1)$, and let $e_B \equiv e_A^{-1} \pmod{\lambda(n)}$.
Alice stores the modulus $n$ and exponent $e_A$, while Bob stores $n$ and $e_B$.  Both erase all other intermediate values, including $p$, $q$ and the other exponent.
To send a (padded) message $m$ to Bob, Alice encrypts it as $c \equiv m^{e_A} \pmod n$, and transmits $c$ to Bob.  To decrypt the message, Bob computes $c^{e_B} \equiv m^{e_A e_B} \equiv m \pmod n$.  Similarly, Bob can send messages to Alice in the same way, just swapping $e_A$ and $e_B$.

Obviously, this scheme will not be secure for arbitrary unpadded messages, for the same reasons that textbook RSA isn't secure.  That said, it might be possible to combine this with a suitable randomized padding scheme to make it secure, although I'm not sure if any of the standard RSA padding schemes would work here; all the RSA padding schemes I know of are meant for either encryption or signatures, whereas this scheme would seem to effectively require both at once.

Thus, my questions would be:

Can this scheme work at all, or is there some generic attack that breaks it regardless of padding?
If this scheme can be made secure using a suitable padding scheme, what would such a padding scheme look like?

(I was hoping it might at least be possible to make this system work in key encapsulation mode, but that seems to be trivially vulnerable to bidirectional forgery if one party's key is compromised: if Eve knows Alice's key, she can not only forge messages from Alice to Bob, but can also intercept any message sent by Bob, decrypt it to learn the encapsulated ephemeral key, and then use this key to send any message she likes to Alice.  So that, at least, would seem to be a non-starter.)


texts:
This may sound a little bit of basic but here it goes…

Which of the following is correct?

“Cryptography is under the security field”, or
“Security is under the cryptography field?”

Cryptography is all about encryption and decryption. Encryption/Decryption requires a key. Isn't security the same? Security also depends on key/password, to keep data secure. I can feel that they are co-related but I'm not clear about the differences. Can anyone clear this out?

EDIT: With the word "under" I meant pure dependency, and "Security" hints at Information Security.


texts: Generate a unique 64 bit numeric database key without collisions at $2^{32}$ birthday threshold?

texts:
What is the best way to generate a unique 64 bit numeric database key from a string?

For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash to 64 bits, but collisions are likely at $2^{32}$ (~ 4 billion) entries.

However, if instead you truncated the hash to (64 bits - X bits), and concatenated the resulting hash with the first X bits of the input string, you would reduce the chance of collisions since two similar strings are unlikely to produce the same hash code:

key_bits = 64
x_bits = 8
hash_code = sha256(url_string)
key = truncate(hash_code, key_bits - x_bits) + truncate(url_string, x_bits)

Is this correct? Is there a better way?


texts: If PRF is non invertible, why does Ctr-mode work?

texts:
I am currently taking Dan Boneh's Cryptography I course online.
I have just finished the segment discussing the Cipher Block Chaining and Counter-Mode.
I am having difficulty understanding why Ctr-Mode works as an encryption algorithm as PRFs are fundamentally non invertible, as per my understanding. Any clarification on this would be highly appreciated!


texts: Is modulus a prime number important for non-symmetric cryptology?

texts:
From this link
Generation of a cyclic group of prime order
we know how to generate a prime order group.

This illustrates why a prime order group is important.

But why is modulus a prime number also important?

In the theory of RSA, the modulus $N=pq$, and $\operatorname{totient}(N)=(p-1)(q-1)$， if we can find a factor $p'$ of $p-1$, then we can claim there is a $p'$ order sub-group? But it is not a modulus prime group, the $N$ is a composite number, is such a group useful?


texts: End-To-End encryption for VoIP teleconference applications and many-to-many lag-sensitive applications

texts:
There are various protocols that allow you to have privacy-enhanced chat.

Those can be either 2-party chat such as:

OTR
SIGNAL

or multiparty chat such as:

SIGNAL
(n+1)sec
mpOTR
GOTR (2013 spec and 2008 ones)

But nowadays many protocols, alongside with Instant Messaging (IM), support multi-party video and voice exchange such as Skype and Google Hangouts. What protocols exist to ensure the security properties on applications for privacy-enhanced multi-party/teleconference application?

I am asking because teleconference applications are lag-sensitive ones and there is the real-time factor as well. Also, the data flow is stream based ones instead of message-based ones so ratcheting per message - like signal does - is a no-go (because there is no message concept, to begin with).

The common key for the VoIP group can be done via exchanging special messages and running a Group Key Authentication protocol but what about forward secrecy and the transcript integrity protection messages?

Do you know any protocols that support multi-party VoIP as well (even academic purpose-oriented ones without any practical value)?


texts: What are the pros and cons of Pedersen commitments vs hash-based commitments?

texts:
Obviously, it's possible to create a commitment scheme comm(r, S) by using a hash function H and computing H(S||r). This scheme is secure under the assumption that H is collision and preimage resistant, which (IMO) is a lighter cryptographic assumption than the discrete log assumption.

So I guess my question is, why are commitment schemes like Pedersen commitments used which do require the latter assumption? What efficiency or security benefits they bring? And are there still any benefits to using hash commitments?


texts: Security proof. Adversary source of random coins.

texts:
Consider the game-based security proofs, i.e. a game played between the challenger and a PPT adversary.

My question is... what is the source of random coins for the adversary?
Is is valid to say that the challenger provides the coins to the adversary?

"If" the challenger is the one giving the coins to the adversary, then I assume it will be possible for the challenger to initialize the adversary on the "same" coins and expect a deterministic behaviour.

If someone has a link for further explanation it would be really healpul.
Thanks a lot.


texts: How to factor an RSA256 public key with YAFU?

texts:
(Layman's terms please, I'm just a kid stuck on a puzzle)

I'm trying to factor the following RSA256 public key to find the corresponding private key:

MDwwDQYJKoZIhvcNAQEBBQADKwAwKAIhAIl47p5SrV3uMTsUAbwE0E+j+QynAY/CVq/Gf8IAOQy7AgMBAAE=

I got as far as downloading a YAFU factorization program found here, which I was told is capable of factoring such a key in 103 seconds on a core i7. This program works great for factoring base 10 numbers, but I have no idea how to use it on a  RSA key. Any help would be hugely appreciated. Thanks!


texts: Security of generating one long hash and using half as a secret key and half as a "public" hash vs generating two hash values?

texts:
My question is what would be more secure, generating 2 hashes (one key and one hash) with the same password and two different salt values, or generating one long hash with a single salt, taking the first half as a secret key and the second half as a hash for the password.
I would be interested in the security differences of both approaches and in the perfomance differences.
I would assume that generating one long hash will be faster than generating 2 short hashes, however i am not sure if the difference is relevant for practical purposes.
As for the security getting the password will be practically impossible in both cases, however i am using the first half of the hash as a key, not the password itself. I am unsure how hard it is to guess a hash given one half of it.
I am working on a bibifi contest and have to create a secure logfile.
The catch is, that i am receiving only a password and i cannot pass along any information except in the log itself.
For the log i need to check the integrity of the file and the correctness of a given password (and distinguish the two cases).
To be able to do this i thought about generating two argon2 hash values with the same password and different salt values, appending everything to the file and mac all of it to ensure integrity.
The file would then look like this:
hash
salt1
salt2
iv
ciphertext
mac


texts:
I'm tring to choose an way for an Encryption mothod for my research?
So,I want to choose one-layer encryption or multilayer encryption,and I want it to be easy to applicable.

when I search about it, I found Homomorphic and linear programing that used for encryption. But still I could not find an way that never used for research topic.


texts: Multiparty Computation to calculate addition of shares without revealling individual shares

texts:
I have $n$ persons, each holding a secret integer $x_i$ ($i$ from $1$ to $n$) and I'm looking for a way for them to jointly compute the sum of these secrets without revealing to each other their individual secrets.
Verification of the sum isn't important in this problem, as an error will cause an abort at a later point. The important issue is that they not get information about the numbers held by the other parties.
My other question is can this still be done / does it require a different solution if the addition is over a finite field?


texts: Why aren't public-private keys sufficient to build a block chain? Why do we need proof of work/stake?

texts:
Taking the simple case of Bitcoin here:
If all nodes can validate published transactions by checking the signature (created using the private key of the sender) of the transaction against the public key of the sender, why isn't that sufficient to validate a block?
I understand that we also solve the puzzle of finding a nonce that when combined with a block's contents, gives us a hash that has N number of leading zeroes. Why do we need this at all? Isn't it enough to check the validity of each transaction in the block?
As for double spending, if a miner decides erroneously to include both transactions, nodes can see there isn't enough balance and reject such blocks. As for which transaction of the two to take, the code could have a way to order transactions and if an attacker decides to do the opposite intentionally and decides to spam the network (since there's no proof of work cost) but how does the attacker benefit from that?


texts: why do we take computational distinguishability over ensembles

texts:
In the Cornell lecture notes, computational indistinguishability is defined as

Definition 69.4 (Computational Indistinguishability). Let $\{X_n\}_n$
and $\{Y_n\}_n$ be ensembles where $X_n$,$Y_n$ are distributions over $\{0, 1\}^{l(n)}$ for some polynomial $l(·)$. We say that $\{X_n\}_n$
and $\{Y_n\}_n$ are computationally indistinguishable
if for all non-uniform p.p.t. $D$ (called the “distinguisher”), there
exists a negligible function $e(·)$ such that $∀n ∈ N$

$Pr[t ← X_n, D(t) = 1] − Pr[t ← Y_n, D(t) = 1] < e(n)$
My question is, why do we need ensembles of distribution? Why not just define it over two distributions $X$ and $Y
$?


texts:
In textbook RSA, the Euler $\varphi$ function
$$\varphi(pq) = (p-1)(q-1)$$
is used to define the private exponent $d$. On the other hand, real-world cryptographic specifications require the Carmichael lcm function
$$\lambda(pq) = \operatorname{lcm}(p-1,q-1)$$
to define $d´$.
It is clear that the $d´$ divides $d$, and therefore using $d´$ may be more efficient than using $d$.
My question is: Are there any further reasons, e.g. regarding security, why one should not use $d$?


texts: Allowing third party to verify and/or replay a draw

texts:
I’m not an expert in crypto, and I would like to design draw system (like a lottery, but choosing one of the participants), the most open possible, allowing a third party to verify the data/draws, and even replaying it with the data, giving the exact same results.

Would it be helpful to verify the draw, if I publish the seed of my RNG, and would it be OK (as in “not compromising any security”) to do so?

Ultimately, my goal is to eliminate any chance of influencing the draws.


texts: Is anyone aware of Du atallah multiplicative secret sharing scheme for dot products for > 2 party scenario?

texts:
I am working on Du Atallah's multiplicative secret sharing scheme for more than 2 party scenario.

Is anyone aware of its multiparty version (more than 2 parties).

The paper for 2 party can be found in Section 4.1 of this link.


texts: Is the one-time pad secure if the key is computed so the ciphertext will consist only of "A"?

texts:
I recently learned about the one-time pad method, which has perfect security if the following conditions are met :

The key must be truly random.
The key must be at least as long as the plaintext.
The key must never be reused in whole or in part.
The key must be kept completely secret.

As a thought experiment, I wondered : what if you choose the key so the ciphertext will only be "A"s (or whatever other letter) ? This would break the rule n°1, since the plaintext is not random and the key is linked to it. Does that mean that such a ciphertext can be broken ?


texts:
I have a communication system that's currently encrypted using AES-256-CBC. Someone on Information Security StackExchange asked whether I'm using HMAC, so I'm looking into Fernet.

Fernet seems to use AES-128-CBC (link). This seems to me to be a) less secure than what I'm using and b) not sufficient to meet the requirements of some sensitive companies/entities that require AES-192 or AES-256.

Is this a problem? How should I decide whether to stick with my current approach or HMAC w/AES-128-CBC through Fernet?


texts: Simulation aborted because the adversary doesn't use the random oracle

texts:
I'm trying to construct a proof for an encryption scheme in the Random Oracle model. This encryption scheme is like a PKE scheme but with an additional function that kind of "alters" ciphertexts without changing the underlying message using some special keys (I don't want to go into the scheme details for not diverting attention from the actual question; let's call this function "Alteration", for simplicity). In principle, the scheme is designed in such a way that in order to create valid ciphertexts, you have to use a hash function $H$ at some moment during the encryption. I later use this fact in the proof to construct the decryption oracle: assuming that $H$ is a random oracle, I use the random oracle table to extract the necessary information for answering the decryption query, and if the adversary has not used $H$, then it outputs $\perp$. The adversary cannot distinguish this behavior from a real-world execution. So far so good.

The problem I'm facing right now is with the Alteration oracle. Everything goes smoothly as long as the adversary uses the random oracle. However, the adversary may query the Alteration oracle with a ciphertext constructed without using the random oracle, but the real-world version of the Alteration function is unable to detect such situation and simply outputs the altered ciphertext correctly. In the proof, the simulator cannot respond to the query since the adversary has not used the random oracles and the simulator does not have the required special key. The thing is that I don't see that these queries are beneficial at all to the adversary: the resulting ciphertexts would also be not valid, as the original ones, so their decryption would fail.

Therefore, in order to avoid a situation where the adversary could detect a difference between the simulation world and the real world, the only think I can think of at the moment is to abort the simulation in such situation. Of course, simply letting the proof go this way would invalidate it, since the adversary could make these problematic queries arbitrarily. I was thinking in trying something similar to the "artificial abort" technique used in the Waters IBE scheme. However, before continuing in that direction, I have the following questions.

Do proofs in the Random Oracle model generally require to handle the situation when the adversary is not using the Random Oracle (e.g., producing invalid ciphertexts)? If not, do you know any example of a scheme defined in the RO model where a similar situation occurs?


texts: Generating a random point on an elliptic curve over a finite field

texts:
I have coded an implementation of elliptic curves in order to apply some of the ECC algorithms. However, in most of them, Alice needs to choose a point P on a given curve. What is the general procedure for selecting such a point?

Given a small example such as $y^2 = x^3 + x + 1$ over $F_{25}$, is there an algorithm to generate a random point on the curve? In my implementation points on this field are represented by polynomials, if that is relevant.


texts: can i find the algorithim of a prng by entering previous sequence

texts: Is there any software or can i find it manually the algorithm of a prng by entering previous sequences of results. there is 38 possible outcomes and results can repeat.


texts:
according to wikipedia:

RSA-617 has 617 decimal digits (2,048 bits).
RSA-2048 has 617 decimal digits (2,048 bits).

What is the main difference between them?


texts: What is the current state-of-the-art of function-private functional encryption?

texts: Are there any known constructions of functional encryption with function-privacy for arbitrary functions (e.g. not just inner-product)? If so, are these constructions currently feasible or for now just theoretical?


texts: How well do ARX algorithms preform (in terms of diffusion)?

texts:
I have been researching ARX algorithms, but I would like to know how well does ARX (both single or multiple rounds of) provide diffusion compared to an s-box or an SP network.

Also, are there any modifications you can make to an ARX algorithm to make it provide more diffusion?


texts: Use of crypto on QR codes for access control

texts:
I want to create a process whereby registered users receive a QR code on their phone and then they present this code to a camera. The camera should scan the QR code and then decide if the QR code is legitimate, in which case access is granted.

According to my very basic understanding, the camera would be equipped with a "public key" and the QR codes (sent to the users) should all be generated using a matching "private key". The camera then performs a basic decode and allows/denies access.

What cryptographic techniques are suitable? How are they used?

EDIT

The core behind the question is around the event where the web-cam needs to validate a random QR code. This should be achieved using local keys/hashes without the web-cam having to connect to some database in order to validate the QR code. So my question, I suspect, is a very basic one around cryptography: Can the camera have some key stored in memory (typically on a Rasberry Pi) and be able to validate the QR code (again without connecting to the internet). If my question is nonsense then please discard altogether.


texts: How to brute-force keepass2 master password while knowing partially the password

texts: I forgot my password for my password database I use with Keepass2. It's a smallish password, with 10 characters, and I mainly only forgot the first few characters (3-6). Is there a way to brute-force this with a program I compiled called JohnTheRipper, I don't know how to use it, and use it in a way that already has a few chars in and a few guidelines to follow. Help? And I also had a key file with it, does that affect everything? My OS is Ubuntu GNOME 16.04.


texts:
How does TLS differ from SSH from a strictly cryptographic perspective?

I know that there are many non-cryptographic differences between them, but I would like to know the cryptographic ones.


texts: Verify that a point belongs to secp256r1

texts:
I need to verify that the point in this public key
04 11 95 23 03 f0 f1 f1 45 67 14 98 e4 39 80 ce 25 39 02 6e 72 34 fe 02 38 8a ea cc fb 3a 3d 4d dc d9 6d 3c fe 8b 55 bf ea c3 3a a1 59 13 54 b3 91 79 45 b7 3b 49 d9 0e 96 2a de 79 d3 49 dc 79 ca
is in secp256r1. I already know the parameters $a$ and $b$ of the curve, but they are pretty big and they are hexadecimal. I've been trying to pass it to decimal, but I'm not getting it. Should I compute it in hexadecimal? I do also don't understand what are the coordinates of the public key. I mean, the public key is supposed to be a point with x-coordinate and the least important part of the y-coordinate, as the public key begins by 04, isn't it? I'm really sorry, but I'm confused about how to approach this.
Note: I saw some questions that were basically the same as mine, but the numbers were much smaller. I do also have PARI/GP to use.
EDIT: I tried with SageMath, and the result was
y = 98344895439910594971593461997930184197459096557735598026509132013917697767882
a = 115792089210356248762697446949407573530086143415290314195533631308867097853948
b = 41058363725152142129326129780047268409114441015993725554835256314039467401291

Then, I tried y^2 == x^3 + a*x + b, and it gave False, but I know beforehand that the point belongs to the curve. Can you tell me what I am doing wrong?.


texts:
Let's say I want to use RSA to encrypt a message 'Rocket will be launched at 2am' that has 30 letters.

I use the keys from this example: https://etherhack.co.uk/asymmetric/docs/rsa_key_breakdown.html, so the modulus is 129 bytes long (1032 bits long number). So my message is shorter than the modulus and I can encrypt it.

(Let's assume I don't use padding scheme.)

What I have to do now with my message to encrypt it?

I have to convert it to a number $m$, so I use some encoding to convert each letter to byte and I concatenate the bytes? (how do I choose that, is there a convention, will encoding and endianness be written into ASN.1 keys)

According to RSA I now have to compute:
$$c(m)=m^{65537} \pmod{\text{...1032_bits_long_number...}}$$

and message is 240 bits long number. Is this the procedure?


texts:
In general it's hard to calculate the roots of a given polynomial $P(x)$.
But the other way back calculating the coefficients is much easier (Vieta's formulas).

If this is a one-way function, is it possible to create a public-key cryptosystem
based on these facts? Or does it already exist?


texts:
In an application we need some way for a user to authenticate, but have the challenges of very restricted functions to use.

Each user has got a 16bit-number he can't change. We want to calculate some individual "secret" for some of the numbers that allow users to have higher access rights. The aim is to make it as hard as possible for other users to generate a valid secret for a different number even if they know some valid combinations.
Brute forcing on the device itself would take ~10 seconds per try, so I think that won't be an issue.

We are only able to use basic mathematical and logical functions, XOR and Modulo and sine/cosine. Also the length of our integers are limited to a maximum of only 32bit.

We thought about some asymmetric signature that is easy to verify (for example Rabin), but it seems that 32bit are just too unsecure.

An alternative would be some kind of symmetrical mac.
Would the best way be to implement some kind of own "mac" by implementing combinations of the usable functions? Or is there any better way?

I found this answer to a similar question, but don't really get why the mac solution isn't brute forcable offline. Is it because we suppose the attacker doesn't know that mac algorithm?


texts: Problems understanding the applications of pseudo random number generators

texts:
I am trying to explore different methods used to generate pseudo-random numbers for my project in maths and I would be very grateful for some help or references to valuable sources as it is very hard to explore this field without background information.

Although the mechanism used to create PRNs are quite clear for me, I have problems understanding how they are really applied. I was wondering which algorithms I can use to generate a 4-digit code. When you generate such codes, do you always convert the generated numbers to bits? What tests do you use to check if the sequence of those 4-digit numbers is actually random?

Thanks a lot for help!


texts: Instead of generating keys, is it possible to type your own? For example, could all the characters be A's for example sake. Or do they have to be generated because they are based off of prime numbers or because it would be to hard to create a matching public key as well?


texts: RSA Signature Verification Implementation on Cortex M0

texts:
I have to implement RSA Signature Verification procedure (RSA-2048) on a Cortex M0 based MCU. My budget is 15kB Flash and 2-4kB Flash RAM.

Is it even possible to do RSA on a low end MCU based on Cortex M0?


texts: Given a public-key encryption and signature scheme, define a new primitive

texts:
I'm new to cryptography and am currently working on the following question:

Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $\Pi_s=(\mathcal{K}_s,\mathrm{sign},\mathrm{verify})$, and you are asked to define a new primitive $\overline{\Pi}=(\overline{\overline{\mathcal{K}}},\overline{\mathcal{E}},\overline{\mathcal{D}})$ that achieves both privacy and authenticity. How would you do it? Give at least one construction and a convincing informal argument of security. Discuss any operational/implementation issues that might arise if you want to support “large” plaintexts, and how you would address them in your construction.
As a second part, what if you want to expand the API for $\overline{\Pi}$ to accomodate associated data? How would you modify your construction(s)? Keep in mind that associated data is “context” information that does not require privacy protection but does require authenticity protection.

I'm working on a solution to the first part using CTR mode, because it seems to achieve the requirements well, especially with supporting large plaintexts. Does this seem like a reasonable approach?
Also, I'm having an issue coming up with an answer to part two. Can CTR mode support associated data? If not, is there a better way to go about this?


texts: Is storing the hash of a key together with ciphertext encrypted with that key secure?

texts: Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses -- or is it always a bad idea? Assume the cipher is AES-128 or -192 and the hash is SHA-256, and also assume that the key was derived from a pass phrase.


texts:
Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes? In other words, does ChaCha20 with a 128-bit key theoretically require 2^128 attempts to brute force, as with AES-128?

PS: Notwithstanding that ChaCha is a stream cipher.


texts: Order Preserving Encryption for Numeric Data Values

texts:
How can I ensure order of encrypted data i.e., Enc(m1) < Enc(m2) where m1 < m2, and all messages are integer values.

I have gone through Order Preserving Encryption discussed in Enabling Search over Encrypted Multimedia Databases.

According to the literature, for sorted data values (i.e., words), lower limit (l_w) and upper limit (U_w) are defined according to the frequency count of a word and estimated value (encoded value) is selected by Linear Spline Interpolation within the defined limits.

I am finding it hard to define lower and upper limits for the following data values. I want to encode the frequency with the range of [0 – 10,000] and DocCount with in [0 - 500]. However, I have only one data point (i.e., w_i) within each range (i.e., l_w_i to U_w_i), how can I find interpolant of the values.

DocCount    Word Frequency
10          1
8           2
6           3
5           4
3           5
2           6
1           7
0           8
0           9
0           10

Or

Is there any other way through which I can ensure order of the encrypted data. On StackOverFlow I was referred to homomorphic encryption – I am familiar with Pascal Paillier crypto system, any idea how can utilize it to preserve order among encrypted values.


texts:
I've seen that there is several kinds of PRF, and sometimes people speak about strong PRFs.

When proofs of a protocol or algorithm are given based on the assumption of the use of a PRF, are they speak implicitly about strong PRFs?


texts:
Look at the hex dumps of encrypted1.bin and encrypted2.bin . They both have same password A which was used to encrypt sampletext

[achilles:~/Arena/crypto] $ openssl enc -e -des -in plaintext -out encrypted1.bin
enter des-cbc encryption password:
Verifying - enter des-cbc encryption password:

[achilles:~/Arena/crypto] $ openssl enc -e -des -in plaintext -out encrypted2.bin
enter des-cbc encryption password:
Verifying - enter des-cbc encryption password:

So both are encrypting the same text with the same password. Now when I hexdump them I get

[achilles:~/Arena/crypto] $ hd encrypted1.bin
    00000000  53 61 6c 74 65 64 5f 5f  50 cc a6 a8 6f 52 cf 53  |Salted__P...oR.S|
    00000010  c7 8e 71 ea 98 4b 2a 8c  a1 4d bd 0f d0 90 62 cb  |..q..K*..M....b.|
    00000020  b1 a0 7a ef b5 a8 c1 14                           |..z.....|
    00000028
    [achilles:~/Arena/crypto] $ hd encrypted2.bin
00000000  53 61 6c 74 65 64 5f 5f  0c c2 44 d0 19 bb a9 5e  |Salted__..D....^|
00000010  af 56 24 ce b3 b4 30 4f  61 1c f4 ba bd fc 1d a7  |.V$...0Oa.......|
00000020  b4 99 77 b9 1c 15 8a 42                           |..w....B|
00000028

How is this possible? How can the hexdump completely vary for the encryption of the same plain text with the same password and same algo (DES). And when encrypted1 and encrypted2 are decrypted they give me back the SAME plain text?