texts: How does concatenating diverse hash functions affect collision resistance?

texts:
Let's suppose I take 3 different types of hash functions and concatenate them for future safety so that: digest = Hash3( Hash2( Hash1( text )))

Does the birthday attack mean in this case that I must double the input data set size of every hash function starting from the end?

If so, does it mean that if the output hash function had to have a 128 bits digest, the middle one must have a 256 bits long digest, and the first one 512 bits in order to gain a collision resistance that takes 2^64 trials?


texts: Does iterative hashing of mouse/keyboard input improve its properties as an entropy source?

texts:
In the questions, Are mouse movement coordinates useful as a seed for a RNG? and Is this a good entropy collector and whitening technique? the posters each talk about collecting mouse and keyboard input as a source of entropy. The replies make the good point about this being dangerous and requiring a large sample to ensure sufficient entropy for cryptographic purposes.

I am wondering if the quality of these inputs as entropy sources would be improved given the following scheme and, if so, by how much?

Imagine a system where X is some input from the user (e.g. mouse coordinate pair or key code combined with current timestamp) and H is some latest-generation hashing function and e is our current entropy pool state after each iteration. After the first input is collected we have:

e = H(X1)

This has low entropy. We collect another sample from the user and this time combine with the previous entropy and and hash it:

e = H( X2 + e )

or:

e = H( X2 + H(X1) )

Then we keep doing the same thing for each new value collected, combining it with the previous entropy and hashing them together:

e = H( Xn + e )

or:

e = H( Xn + H(Xn-1 + H(Xn-2 + H(Xn-3 + ...))) )

Does hashing iteratively like this in any way change the rate of improvement of the quality of the entropy produced, or is it about the same as collecting all of the samples and hashing them once like this:

e = H( X1 + X2 + X3 ... Xn )

Update

This answer to What happens to entropy after hashing? also has a good analysis that I think applies here:

  If we have a Hash function SHA which doesn't have any collisions, then it has no effect on entropy; that is, H(X) = H(SHA(X));


texts: How does secret sharing solve the partial exposure problem?

texts: I have been trying to understand how secret sharing methods like Shamir's secret sharing solve the problem of a share revealing information about the secret. I guess there are some random numbers involved, but how is it done mathematically?


texts:
I would like to know if there are any known attacks, besides from side-channel attacks (differential fault attack, correlation power analysis, template attack), against MICKEY 2.0 or MICKEY-128 2.0.

I already did a deep research on the web using several scientific databases, but I did not found anything besides the above mentioned.


texts: Private Information Retrieval--Is it still theoretical?

texts: Are there any real world products in which private information retrieval techniques are used?(a data hosting server oblivious of which data item was fetched from it?)If not what are the major barriers for its implementation?


texts: Can two cipher letters per plaintext letter easily defeat character frequency analysis?

texts:
For a class 5 years ago I wrote a paper about "defeating character frequency analysis by using  two cipher letters per plaintext letter" (jamesjava.blogspot.com/2009/08/defeating-character-frequency-analysis.html).

Quote:

  Using two letters in the cipher text for each letter in the plaintext can be a good way to create a flat character distribution.

  The algorithm is to partition the 676 2-letter combinations based on the standard character frequency. i.e. if the standard frequency for a letter is 5% then it will get 5% of the 2-letter combinations (randomly selected). This doubles the size of the data, could include spaces & punctuation, and makes a much larger key.

  Note that some letters may get dropped because they occur less than 1/676 (0.15%) of the time. Both 1-gram and 2-gram frequency analysis produce a nearly uniform histogram (variation appears to only be caused by rounding). Two-gram results: P&P=5,117%; SH=5,013%.

  Therefore this technique was extremely effective with no obvious weaknesses.

I didn't get much feedback from the professor so I wonder if anyone can comment on this and tell me if my conclusion is correct.


texts: Are key evolving signatures (or forward secure signatures) that secure?

texts:
Reading this paper Forward-Secure Digital Signature Scheme I discovered the notion of key evolving signatures. The intuition behind these signatures is clear: one uses different private keys to generate keys in different periods of time, while maintaining the same public key.
The paper stresses that whenever a secret key is used it has to be deleted from memory (either physical or computational), to achieve forward security. What happens if not? What if I decide to sell my past secret keys to an adversary before erasing them?
These signatures have been recently used in blockchains like AlgoRand to ensure that even if an adversary is able to discover the secret key in period $i$, he is not able to discover secret keys from previous periods (hence, not being able to rewrite the history of the chain). Anyways, what happens if users decide to sell past keys to this adversary? He would be able to rewrite the history as if it would have been used a standard signature scheme.
Clearly, this scheme has a better security; but it is not still secure enough in worst cases.


texts: Encrypting with Davies-Meyer hash function scheme

texts:
So I need to to illustrate Davies-Meyer hash function for a message “123” with 1-byte blocks. I can use the extended ASCII representation where each character is represented as a byte. And I can pick the initial value of hash H0 as all zeros.

So far I've padded the message, but now I'm stuck and don't understand where to go from here. Here is what I have so far...

x = 123

l = 24 bits or 11000

[0000 0001][0000 0010][0000 0011][1][0000…0][0000…0001 1000]

The first block is "1", the second is "2", the third is "3", the fourth is the appended "1", the fifth and so on is 423 zeros, and the last block is the length of 24 bits, totaling 512 bits.

Now I'm thinking I gotta divide the 512 bit block into 16 words of size 32 bits. But I'm not sure how to do that or hot to apply the Davies-Meyer hash function to it.


texts: Computational indistinguishability with Example

texts:
Based on computational indistinguishability definition no PPT
  algorithm can distinguish $X$ from $Y$, where $X=\{X_n\}_{n \in N}$
  and $Y=\{Y_n\}_{n \in N}$ are ensembles of probability distributions
  and $X_n$, $Y_n$ are probability distributions over $\{0,1\}^{p(n)}$
  for some polynomial $p(.)$.

The above definition is not clear to me. Can anyone explain that with a clear example (e.g. roll a die or flip a coin). As the examples for the pevious posts about the same topic are not very clear.

Side note: I believe there is a lack of clear explanation and examples in the literature about this topic. So any good example would help the other learners too!


texts: Is there a construction of an order preserving hash function that keeps the preimage property of a crypto hash function? By order preserving hash function (OPHF) i mean for $x<y$ then $OPHF(x) < OPHF(y)$


texts: Capacity of Advanced Encryption Standard in terms of File Encryption

texts:
what is the capacity of AES in terms of File Encryption?
is it really good to encrypt a large files in AES? ex. I am encrypting a 8GB of File... is it still good to used AES?
is it still good to used AES-OFB in encryption of large files?

What also will be the issue if I used AES-ECB in file encryption? is the only issue will be the odds of having a same 128-bit block of data?


texts: Sigma protocol with Pedersen commitment and Hash function

texts:
Suppose I construct a Pedersen commitment as $g^m h^r$. I could pick the randomness in a "pseudo-random" fashion, such that $r = H(m)$. My questions are as follows:

Given that $H$ is collision-resistant, does the security properties of the Pedersen commitment still hold? (i.e. is it still hiding and binding?)
Is there a way to construct a Sigma protocol which would prove in Zero-knowledge that a) I know $m$ and b) The commitment randomness is picked such that $r=H(m)$?

Edit: I do not require some specific hash function. Any pseudo-random function would serve my purposes.


texts: What cryptography is suitable to motivate High School students to learn math?

texts:
A High School math teacher in the Bronx asked me if I knew of any way to use cryptography in a way that motivates students (15 to 18 years old) to learn math.

I do know that many of them want to protect (encrypt) Snapchat pictures, and understand how SSL and encryption "works".

Is anyone aware of a curriculum, or is willing to share a mental outline of an age-appropriate set of challenges that will get them thinking in the right direction?    The focus is for non-math majors who need to "justify the reason" for learning math, and to gain a sense of empowerment and removing fear from the word "encryption".

One exercise could be to "use exponents to encrypt a password", or other weak crypto that can be done with a pen and paper.   I also want to get students thinking about prime numbers, and why they are important, and other similar "building block" concepts.


texts: Mathematical proof of a combined hash function

texts:
I´ve just started with crypto and I am trying to solve an exercise sheet. I am, however, not good at mathematical proofs and got a bit stuck on a certain - probably easy - question:

I´ve got three hash functions:

$H_1:=  \{0,1\}^* \to \{0,1\}^a$
$H_2:=  \{0,1\}^* \to \{0,1\}^b$
$H_3:=\{0,1\}^* \to \{0,1\}^b$

And I have to proof that: If at least one of $H_1, H_2, H_3$ are collision resistant $M:=  \{0,1\}^* \to \{0,1\}^{a+b}$ for  $M:= H_1(x)||H_2(x)||H_3(x)$ is collision resistant, too.

Intuitively I would say that $H_2$ and $H_3$ are not collision resistant, since they are shortened to the same length $b$.

I have started with assuming that $M$ is not collision resistant by changing the definition to:

$h(x_1) = h(x_2) = h(x_3) $  for a triplet $(x_1,x_2,x_3)$.

But I am not quite sure, if this is the correct way to do it.

Can I even proof it in one go? Or do I need several steps - like proofing $H_2 = H_3$ first?


texts: RSA Signature : Process of Sign the message and Verify

texts:
I have read that the RSA numeric signature works as the following:

Generation of keys : $p,q,N,e,d$
Process of signing the message $m$ (which is BigInteger) : it uses the secret key $sk=(p,q,d)$ so that $s=m^d\bmod N$ where $N=p*q$.
Why do we use the secret key to sign the message?
How I can hash the message ?
Process of verification that uses the public key $pk=(N,e)$ and a couple (message $m$, potential signature $s$), and consists in:  verifying whether the signature is valid (return true) or not (return false).

Can I get more information and explanation here in the verifying process? (I have read somewhere they use encrypt method and others use decrypt method).


texts:
I can't seem to wrap my head around what benefit OAEP provides (specifically with RSA). Lets consider really small numbers for a moment. If the random source in the padding algorithm gave a random value in the range of 1-100, then each unique message value could be represented by 100 different padded values. Isn't this the same as a homophonic encryption scheme? It doesn't prevent frequency analysis, CPAs, CCAs, etc, it just makes them more difficult to perform?

I know that in real world applications the values and ranges involved are extremely large. Do we consider RSA+OAEP secure because the number of possible padded representations of a message is some insanely large number, and thus not feasible to bruteforce with current hardware?

If an adversary had unlimited computing power, or if we are using a very small modulus, does OAEP actually matter?


texts: Encryption Scheme & Perfect Secrecy [Katz & Lindell]

texts:
An encryption scheme consists of the following data

a plaintext space $\mathcal M$
a ciphertext space $\mathcal C$
a key space $\mathcal K$
a key generating algorithm Gen
encryption and decryption algorithms $\operatorname{Enc}_k$ and $\operatorname{Dec}_k$ for each key $k\in \mathcal K$

I would like some clarification on the following extract from Katz & Lindell:

More specifically, my question is:
What does, say, $P(K=k)$ mean exactly? What is the domain and codomain of the random variable $K$? What is the set $\{K=k\}$? Also, what is the domain of Gen?


texts: is using secp256k1 curve for ECIES considered safe?

texts:
I read SafeCurves it indicates Secp256k1 is not SafeCurve by their standards but bitcoin and ETH use it in their blockchain.

I researched more and figured out that using Secp256k1 ECDSA(singing algorithm not encrypting)
is safe and has no problem, since those laking standards are not important in ECDSA but are in ECIES

so my questions are :

how much Unsafe is using secp256k1 for ECIES and what dangers/weakness it exposes
/what attack it makes possible
should I avoid secp256k1 completely(for ECIES) or I can use in some circumstances
what cures are safe for ECIES  (since Curve25519 is only implemented for ECDSA)


texts:
I've found this method for using ECDH for asymmetric encryption.

Is there a similar method for using ECDH (rather than the more usual ECDSA, let's say my hardware can do ECDH but not ECDSA) to accomplish authentication?


texts: Indeterminate Message Validity as a Noise Source in High Volume Channels

texts:
Question Rephrased:

Does randomisation of valid and invalid messages in a high volume channel add security?

Scheme: valid messages are identified by a pre-shared random number sequence and noise- large volumes of random messages which can be encrypted by a large range of dummy keys- are ignored by the receiver but can be used to consume the resources of an attacker regardless of the attack mechanism/approach.

Any such arrangement using high volumes of noise must allow the receiver to ID valid messages. A truly random pre-shared number list would appear to be superior to any other sequencing.


texts:
I'm trying to evaluate some changes to an existing codebase and one question that has come up is the block cipher mode. For legacy reasons we've been using AES in CBC mode, however it's unclear why this decision was made. I'd like to propose moving to GCM, but I'm unsure if this will affect decrypting the data we already have stored.

In general I'm curious if the block mode actually affects the cipher text or if for a given key AES(X) = Y for all block modes.


texts: Vigenère cipher frequency analysis not working

texts:
I'm writing a C++ program to use the Kasiski method to crack the Vigenère cipher. I'm testing it with a bit of Shakespeare encrypted with the key ABCDEFGHIJKL. It can find the key length, (even when I changed it), but when I started using frequency analysis, the poem's frequency doesn't seem to fit with normal english; in some lines, T occurs twice as much as E when I try to do frequency analysis.

cout << "The key length is most likely " << len << "." << endl;

for (int i = 0; i < len; i ++) {
    string m;
    int j = 0;
    do {
        m += ciphertext[i + len * j];
    } while (i + len * j++ < length(ciphertext));
    cout << m << endl;
}

So I input

UQEITXUWCDZNFVKEYOZBQOBGFUWMTTDPNDSQSVLWSUITNBTZUJHQNTKBXCFRGGUXMKZTRXREBPG
EWXVEBYQAVVUELKVCBPZDUWQITXAWCKVQBTPWFMHQWCEMTGDSKZYWDLWQTCQHGEVXYYDUOIHRIZ
OMVDZPJGWSXRLMYXZYPTHESJIGJCWQFRWSXGFENOYPUJHLJGYBJMSQBPGXMKAPXEDMOFQEYAYIU
CSADMVXMGANUODTJUKINXAWCSDMDQQWZSTICSZZEGYSZZSGCYMQXKVLJJAWMSPFPUOIJVAWBVPQ
QRHVHNHVLOEAETHERGFMCRPDFUWLJXBJOYCUOVKEYYSMNZZREGDXMCOICNCQBOVQFEJWVOHTFPZ
IMGCMBRFRGNHHTLMBQSDYPTWEQIVQUWFEUILZJAZXJEDQUJHVJYAPNBPEQGFXYNHBVKVQTEDPFS
PBHYQEPNRRLRPNNPZDXJRATASLKOLDUJHAMOWAJXOEDQURXUMBRWPFIGRTUXLABYCEXTRRLZOMY
BZGEODRXIVVCEXQMAWLJVHVPCZREGVTNYLLUYGQUJHPFCZLNVLKUJHMSYVTNXNQPHRJKOJMJXOF
IGVTZXUACRLFQCWMJTAUNBTFPHWLJAUEXBETZVDOJYDPNXSQIKPWJRMURQSFIKVUZOLBDCXMLGZ
MYNHJJBPNPFNMSCOWFYFXEVKIXKMIANPXTDHEWZVOAEYFBPGWBKHBDXOQSCZIFXFTRPPNVVWLFZ
APNNCQBFRJXUTMCRTZHCIXJXKMJDSFIGXRIOZKXFPDFFFSZTAZHPCANYKSXKIWDBYZPVUEAKSTN
BCQUWURXVBHIVPEUJHANRSIWNXMLGVYXXHBQOCNFCUXMUZMRVWEXGKEAKAPJXQXZVRSYNLZBDSM
UYHOSUDVXDZRUJXWHUUALSPZDGGSJYTITONAXCUHXUMCBKWXBPGXMAZBQOYMUKYIMALWOBPEPNX
XNUUQBCTOLNLIIULZFSETUJHTFRLKJCEAGVKSZMOBJXOQOVH

and it finds the length 12 and it gets the 1st, 13th, 25th, etc. characters, and it correctly gives

UFFSUGBVUBTTOJPFUBODJDEXPQEFOEBFGPUUQTPXUDIXEMEUUPIQPZIILPETBSVBHIFNPUULFXZUUDXBUPL
UGO

But when I analyze the string separately, there are almost twice as more Us (correspond to T) than Fs (correspond to E). I think I did something wrong here…


texts: Why is the following RSA PRNG cryptographically secure?

texts:
One requirement states that the generator has to withstand the next-bit test.

Consider the following PRNG, where we calculate next output $x_i$ via the formula
$x_i = x_{i-1}^ e\mod n$.

I can see that this PRNG withstands the "state compromise extensions" (can't guess previous states).  However, given $x_i, e, n$ an adversary can easily compute all future numbers.

Why is this generator still considered cryptographically secure?


texts:
It was shown by Camacho that in batch deletions in accumulators, the information to update all witnesses is at least linear in the number of elements deleted.

I am wondering if there are accumulators with batch additions, where the information to update all witnesses is sublinear in the number of elements added. In the conclusion of his paper Camacho writes "such an accumulator can be trivially implemented by signing the elements of the set". However, I am interested only in publicly updatable accumulators where anyone (not just a privileged "manager" with a signing key) can update the accumulator.

Another non-publicly updatable accumulator is the RSA accumulator, where batching can happen by reducing the exponent modulo Euler's totient $\phi(n)$, which is to be kept secret by the manager.

Are there publicly updatable accumulators with batch additions?


texts: Do any cryptography algorithms work on numbers besides primes?

texts: I know prime numbers are important for several algorithms and protocols. Are there any algorithms and protocols that don't require primes?


texts: Which platforms are most vulnerable to Simple Power Analyse Attack

texts:
In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used.

In the RSA decryption process with the "Square and Multiply" algorithm, both square and multiply operations are executed if bit value in key is $1$ and only square operation is executed if bit value in key is $0$. We can observe on the power graph which operations were executed during decryption process. With this kind of graph it is possible to reconstruct the key.

Which platforms are most vulnerable to this kind of attack ?


texts:
I know a plaintext - ciphertext couple of length 6 for a hill cipher where its key is a [3x3] matrix.

Based on what I've read and learned, to attack and crack keys of [n x n], if we know a plaintext - ciphertext duo of length $n^2$ then we have our set of n equations with n variables, and this is generally solvable. However in my case there is only length of $6$ instead of $n^2 = 9$ .

My question is, how will I solve this problem and find the key? Or, since this is an obvious homework question, what should be my way of thinking? I cannot think of anything else but matrix multiplications and inverses but they do not help me at all.


texts: Why is SKEYSEED derived using the nonce as a key?

texts:
In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as
SKEYSEED = prf(Ni | Nr, g^ir)
In other words, we invoke a pseudorandom function with the concatenation of the initiator and receiver nonces (that are sent in the clear) as the secret, and the Diffie-Hellman shared secret g^ir as the seed.
What is the rationale for this? Shouldn't the arguments for prf be reversed so that the secret is actually, well, secret?


texts: Use of Initialization Vector in a Hash Function

texts:
Why is an Initialization Vector used in a hash function?

Some hash functions do not seem to need an IV, why do other hash functions need one?


texts: Really simple RSA style public private key generator

texts: I am giving a talk to high school students and would love to do a real life encryption/decryption demonstration. I am not too familiar with the maths but is it possible to create like a 5-10 bit public-private key set, so I can get two teams to encrypt / decrypt  a message that is passed across the room? I need something simple enough to do on paper?


texts: How to calculate degree of confusion of an encryption algorithm?

texts:
I am programming an encryption-decryption model in python 3. I want to check its strength. I found 3 methods to check, they are:
1. Degree of diffusion
2. Degree of confusion
3. Integrity check

For diffusion, i found that we can calculate hamming distance then divide it by no of bits and multiply by 100. Is the correct procedure?
2,3 For these two, can someone explain me the procedure on how to calculate this?

Also, is there any other method that can tell about the strength of the model?


texts: Is there an efficient algorithm that allows to construct a cryptographically secure $n$-bit hash function based on two unkeyed $n$-bit permutations?

texts:
Let $f(x)$ and $g(x)$ denote two independent, “ideal”, unkeyed, public $n$-bit permutations (two publicly known bijective functions that produce $n$-bit outputs from $n$-bit inputs), where $n$ is an arbitrary natural number greater than or equal to $3$ (the number $3$ is here because it is the minimal size of a “cryptographically significant” S-Box).

Does there exist an efficient iterative algorithm (based on $f(x)$ and $g(x)$ as the underlying functions) that allows to construct a cryptographically secure $n$-bit hash function for $k$-bit inputs, assuming that $k$ is an arbitrary natural number greater than or equal to zero (that is, there should be no limit on the maximum length of the input)?


texts: Multiply by 3 problem with MixColumns in AES

texts:
I have problem with multiplying bytes by 3 in MixColumns (as in Cryptography And Network Security)
$$\begin{bmatrix}02&03&01&01\\01&02&03&01\\01&01&02&03\\03&01&01&02\end{bmatrix}\times\begin{bmatrix}87\\6e\\46\\a6\end{bmatrix}\mapsto \begin{bmatrix}47\\37\\94\\ed\end{bmatrix}$$
87 = 10000111 => SHL = 00001110 => 00001110 XOR 00011011 = 00010101
6e = 01101110 => SHL = 11011100 => XOR it with the byte ibtself 11011100 XOR 01101110 = 10110010
(If XOR it with 0x1b then XOR it with the byte the answer won't be correct)
4e = No changes (Multiply by one)
a6 = No changes (Multiply by one)
00010101 XOR 10110010 XOR 01001110 XOR 10100110 = 01000111 = 0x47
Next One:
87 = No changes (Multiply by one)
6e = 01101110 => SHL = 11011100 => 11011100 XOR 00011011 = 11000111
46 = 01000110 => SHL = 10001100 => XOR with 0x1b = 10001100 XOR 00011011 = 10010111 => XOR with the Byte itself 10010111 XOR 01000110 = 11010001
(for this one I should XOR with 0x1b first to get right answer)
a6 = No changes (Multiply by one)
10000111 XOR 110000111 XOR 11010001 XOR 10100110 = 00110111 = 0x37
As you see for the first one if we XOR it with 0x1b we wouldn't get the right answer but for the second one, we have to do it to get the right answer. why does this happen?
same problem with this case (used in AES Rijndael Cipher explained as a Flash animation)
$$\begin{bmatrix}02&03&01&01\\01&02&03&01\\01&01&02&03\\03&01&01&02\end{bmatrix}\times\begin{bmatrix}d4\\bf\\5d\\30\end{bmatrix}\mapsto \begin{bmatrix}04\\66\\81\\e5\end{bmatrix}$$


texts: In RSA, why would we ever want to find the values of p and q if we already know phi(n)?

texts:
I'm studying RSA for the first time, and I know that $p$ and $q$ must be kept secret because with them we can calculate $\phi(n)$, which then lets us calculate the private key $d$. So $p$, $q$, and $\phi(n)$ are all kept secret.
Is there any reason we'd want to find $p$ and $q$ by working from the definition of $\phi(n)$ though? I'd think that an attacker wouldn't care about the specific values of $p$ and $q$ - if they have $\phi(n)$, they can calculate $d$ rightaway.
I ask this because I read this thread which showed how to get $p$ and $q$ from $\phi(n)$. I just don't see why we'd ever want to do that though. Why would an attacker care if $p$ = some number and $q$ = some other number, if they already have $\phi(n)$?


texts: Password re-use by another person or on another service

texts:
How does having the same password in different services make it less secure? How does having the same password as someone else make it less secure? Very basic question that I've always wondered about; I've been reminded by GitHub recently seen this message,

  The password you provided has been reported as compromised due to re-use of that password on another service by you or someone else.

and,

  Generate a unique password for GitHub. If you use your GitHub password elsewhere and that service is compromised, then attackers or other malicious actors could use that information to access your GitHub account.

Theoretically, how would that work? Shouldn't a different salt render it almost useless to any attacker?

  different salt values will create completely different hashed values, even when the plaintext passwords are exactly the same [Wikipedia]


texts: Exponentiating big numbers for RSA operation

texts:
I am following the book "Network security private communication in a public world - 2nd edition. Section 6.3.4.1 Exponentiating big numbers.

base = 123, exponent = 54, mod = 678

What I understand is that, first I need to convert 54 into binary, i.e. 110110. Then I should do (base^exponent)%mod only at those exponent where the exponent bits are set. For example:

123^2 = 123 * 123 = 15129 % 678 = 213

123^4 = (123^2)*(123^2) = (213^2) mod 678 = 621

123^16 = (123^4)(123^4)(123^4)*(123^4) = (621*621*621*621) mod 678 = 219

123^32 = (123^16)*(123^16) mod 678 = 501

If I do this, I am not getting the right answer which is (87). Can someone point out my mistake and help me understand the scenario.


texts: Difference in elliptic curve order and finite field size

texts:
Must the prime finite field, Fp, an elliptic curve is defined over always have a greater number of elements than the cardinality of an elliptic curve.

For example, If I have Elliptic Curve defined by y^2 = x^3 + x + 1 and I can calculate that the
E.cardinality() = 14. Must the prime field I chose be >14?
Would there be any loss in security if I chose 11 as the prime field?

Would this be different if I chose the prime field beforehand?


texts: How to maintain the width of the cipher image in ECC Image Encryption from Singh and Singh (2015)?

texts:
I am a beginner in cryptosystems and I hope I would be accepted in the community.

I was trying to implement Singh and Singh (2015) ECC image encryption algorithm on Matlab.

I have been able to encrypt and decrypt images successfully with the algorithm. However, the width of my cipher image increases by (1/group) x plain image width.

group = log p / log 256

where p = prime number of the finite field

We initially take "group" number of pixels, convert them to a number of base 256 or 258[if we add 1 or 2 to the pixels randomly to reduce correlation] and point-add encryption to this 'big Integer'. But when we bring this big Integer (of base 256 or 258) to pixels, we have group+1 pixels. This is increasing the width of the image. However, according to the results, this should not be the case.

Actually, I cannot comprehend step 8 of the 4.1 Image Encryption process from this paper.

Can you please help me understand this?


texts: Discrete Gaussian Sampling in Authenticated key exchange from ideal lattices

texts:
I am implementing the key exchange scheme proposed by zhang et al. on Sage. In the implementation of the scheme, they have used the two distributions $\chi_{\alpha}, \chi_{\beta}$.

  How to choose $\alpha, \beta$ and what should be typical values of $\alpha\ and \ \beta$ to have 100% correctness of the scheme (that is alice and bob will have same shared session key?

The second confusion is that on page number 12, (where the protocol is defined) they have done the rejection sampling and provide steps to do this. In this they state that repeat the step 1~3 with probability $1-min(\frac{\mathcal{D}_{\mathcal{Z}^{2n},_\beta}(z)}{\mathcal{D}_{\mathcal{Z}^{2n},_\beta,_z1}(z)} ,1)$. See the the highlighted image bellow:

  How to define M with respect to $\alpha \ and \ \beta$ and use the above probability condition to apply the repeat condition through step 1~3?


texts: Why develop new stream ciphers when block ciphers can be trivally made into streams?

texts: I've just been reading about a new drop-in replacement for the RC4 stream cipher, but why develop new stream ciphers when AES can be made into a stream with a little XORing?


texts: Best practices when encrypting a file with three different ciphers

texts:
I have some files that contain important information, so I want to encrypt them by the most secure encryption method possible.

I've read countless StackExchange answers on similar questions and some Wikipedia articles about different ciphers, cryptoanalytic attacks, bad software implementations, cipher modes, etc. Google searches have not helped me in deciding which cipher mode is best, as this may depend on other factors that I will choose in my encryption process.

Having realized that one bad choice when encrypting a file may lead to failure, I want to describe my encryption process and have someone review it for anything that might weaken the encryption.

I do understand that it's impossible to brute force a cipher like AES256, Twofish (256-bit version), or Camellia256--in any practical length of time, according to academic consensus. With that said, I don't want the security of my files to depend on the soundness of a single cipher. Therefore, even if a vulnerability were to be found in one cipher, say AES256, my files would will still be protected by another.

By using multiple ciphers to encrypt my files, I know that I may not be increasing the security of the encryption against brute force per se; rather, I want to increase the security of the encryption against the future failure of a single cipher.

The following may be important in determining things like encryption order, encryption modes, etc.

Process:

1) I will be using GnuPG, and the ciphers I trust are AES256, Twofish (256 bit), and Camellia256, in that order.

2) There will be about 10 or 20 files, but I'm not sure yet. All the files are less than 1MB, and some only contain a few words/passwords, etc.

3) Since GnuPG can't encrypt a whole folder, I will need to compress the folder containing my files to a tar.gz file.

4) I will then encrypt this tar.gz file this way:

Enc1=Encrypt(TarFile, Camellia256, Passphrase1)

Enc2=Encrypt(Enc1, Twofish [256 bit], Passphrase2)

Enc3=Encrypt(Enc2, AES256, Passphrase3)

Questions:

I) Does the amount of the encrypted data matter? If so, what are the minimum and maximum sizes for the encrypted data?

II) Should I add some trivial data to the folder that I want to encrypt, like some random .png or .mp3 files, to avoid the cipher leaking some plaintext data?

How about when I encrypt the Enc1 file, should I add some trivial data to it before encryption?

III) Since I have to compress the folder that contains all the files to be able to encrypt it, does this weaken the encryption in any way? If this is the case, since I can't encrypt a folder without first compressing it, is there a solution?

IV) Knowing that I trust the security of the ciphers in this order--AES256 > Twofish (256 bit) > Camellia256--which one should I encrypt with first and which should be the last?

V) Since I will be encrypting using these three different ciphers, is it important to use different passphrases for each encryption?

VI) Knowing that I will only use ANSI characters--this includes alpha-numerals, lower and uppercase and some special characters--what is the minimum size of the passphrase that I should use? Is there a maximum size for the passphrase past which it will be less secure like in some kind of overflow? Can I use 100 characters? How about 1000 characters?

VII) Knowing all of this information about the data that I want to encrypt, and that I value security over speed, which commands/options/flags should I use with GnuPG to encrypt my files for each cipher to offer the best security possible?


texts: Scrypt with weak parameters, for proof of work?

texts:
I need a proof of work/memory that takes about 100ms to complete, and as short time as possible to validate. Hashing random values and a nounce to get enough leading zeroes is my current approach, and my plan was to use blake2 for the hash function, but I couldn't get it to work. I did however get scrypt to work, but it's obviously a lot slower, and even when reducing parameters below recommended values, the speed isn't great.

Does it make sense to use a proof of work where the work is only 32-256 times larger than the work required to validate it? Should i look for another approach?


texts: How is hybrid (RSA+DH) more secure than RSA quantitatively?

texts: Is there any graph that serves as a comparative analysis for the factorization problem vs discrete logarithn problem? I am implementing an hybrid encryption algorithm (RSA + Diffie-Hellman) and it is necessary for me to show qualitatively that the hybrid (RSA+DH) is more secure than RSA.


texts:
There is a web API (for a game) that sends and receives data encrypted in hex format. I'm interested in accessing the api outside of the game client (mobile app). When sending a request with an invalid query, the server sends an encrypted response (as a hex string) that is different every time (same length), but I'm fairly confident that the dencrypted message is the same.

I've been doing some research lately about d/encryption and have a feeling that it is impossible, but I figured I'd ask in case I'm mistaken.

Q: Given a (unlimited) series of hex strings that all decrypt to the same message, is it possible to figure out (brute force?) the encryption?

Here are some of the values:

6683A5C618FDA544DF87F6
1CD9EE2E62A7EE3E85CC1E
7AE3FDAA049DFD58BFDF9A
73863C600DF83C51DA1E50
39B4789847CA781BE85AA8
1C024088627C403E5E62B8


texts: If RSA Signature is not Decryption, why is it not advisable to use same keys for enc/dec and sig/ver? What is the proof where you may be exposing your private key when you use the same one for decryption and signing? This is for RSA OAEP.


texts: True random numbers generated by sensors

texts: Is using sensor raw data a good way of generating true random numbers? I mean using an IPhone's gyro/accelerometer raw output as a base for generating an array of true random numbers.


texts: what is the impact of smaller bit size sbox

texts: There are multiple S-boxes type, as DES uses 4 bit S-box and AES uses 8 bit S-box. I want to know how this effect the security?? If we use 4 bit or 8 bit. apart from the DC attack. Both provides confusion then why 4 bit and 8 bit different size


texts: Is full Homomorphic encryption quantum resistant?

texts:
Since most of our asymmetric encryption algorithms are going to be out-of-date in a couple of year due to Shor's algorithm, I was wondering about the future of FHE schemes.
I have found this paper, which states:

"It is impossible to construct secure group homomorphic encryption in the
quantum world, if the plain-text and cipher-text spaces form abelian groups."

And I'm asking: are there any candidates which are also quantum resistant?


texts:
Are there any fast, secure, one-way, unkeyed almost-pseudorandom permutations? I am looking for something that can hide a MAC, without requiring a secret key and while being much faster than public key crypto.  It is important that it is a almost-PRP, not a PRF.

By "almost-PRP", I mean "a one-to-one function that is also preimage resistant"


texts: Are formal methods used for cryptographic protocol design?

texts:
I decided to learn more about the application of formal methods to cryptographic protocols and found this interesting talk by Cathy Meadows at YouTube.

After doing research about how people are using formal methods, it seems to me that they're not being used for design. In other words, formal methods are being applied by researchers to cryptographic protocols that were already designed and published by organizations.

Why are those organizations not applying those same formal methods while they're designing the protocol? Why don’t those organizations seem to care about formal methods in the first place? Is there a disagreement between academia and industry about the usefulness of those tools?


texts:
Given two different safe primes $p_1$, $p_2$ we construct the subgroups $G_1$ of prime order $q_1 = \frac{p_1-1}{2}$ and $G_2$ of prime order $q_2 = \frac{p_2-1}{2}$. Let $g_1$ be a generator of $G_1$ and $g_2$ be a generator of $G_2$.
We assume that the discrete logorithm is hard in both groups.

Alice randomly selects some secret value $ s \in \mathbb{Z}_{min\{q_1, q_2\}} $. Alice calculates $ x_1 := g_1^s \in G_1 $ and $ x_2 := g_2^s \in G_2 $ and a cryptographic hash $ H(s) $.
Alice sends $x_1$, $x_2$ and $H(s)$ to Bob via a secure channel.

Is there some pratical way that Bob can be sure that Alice indeed has sent values $ x_1 = g_1^a $ and $ x_2 = g_2^b $ such that $ a = b $? If not, can Alice provide additional data without revealing $s$ to convince Bob?

This question is somewhat related to "How can we prove that two discrete logarithms are equal?". However in our case two generators from two different groups are used instead of two generators from one group.

EDIT: Regarding the comments from poncho and Yehuda Lindell I further clarify what I mean by "discrete logarithm equality for independent groups":

I would like to use the following definition for $dlog_{g}$:
 $ {dlog}_g(g^e) := $ smallest $ x \mid x \geqslant 0, g^x \equiv g^e \pmod p $

Given $ s_1 = dlog_{g_1}(g_1^s) $ and $ s_2 = dlog_{g_2}(g_2^s) $
then $ dlog_{g_1}(g_1^s) \ $ equals $ \ dlog_{g_2}(g_2^s) \ $ iff $ \ s_1 = s_2 $


texts: Two files encrypted with related data versus one file

texts:
I have some code that takes a list of credit-card numbers, splits the number into two chunks, one chunk is 8 characters long, the other chunk is the remainder.

Each series of chunks is saved into individual files, for example my test data looks like (these are test CC numbers):

378282246310005
4111111111111111
4242424242424242
378734493671000
4242424242424242

So, file X would contain:

37828224
41111111
42424242
37873449
42424242

and file Y would contain:

6310005
11111111
42424242
3671000
42424242

Each record is separated by a common delimiter (a newline character).

File X is saved to a TrueCrypt volume using AES, and file Y is saved to a different TrueCrypt volume, also using AES, but using a completely unrelated key.

My question is, does doing this lower cryptographic strength due to this structure?

The reason why I bring this up is that if you know the contents of one file, you can make assertions about the contents of the second, due to credit-card numbers adhering to LUHN-10 (mod10) specifications.

For example, if I know file X's contents, I know the corresponding record in file Y must pass the LUHN-10 check, and therefore knowing file X exposes information about file Y, Y's potential value is reduced by a factor of 10.

Slightly off-topic, but does storing a single file with full credit card numbers separated by a common delimiter expose information, if the attacker knows the structure of the file?


texts: Problems with calculating inverse of finite field $GF(2^8)$ of AES

texts:
I know this question is being asked to death here but please hear me out.
I was learning how to encrypt using AES and in one of the methods, we have to calculate multiplicative inverse in the finite field $\operatorname{GF}(2^8)$ to make $S-box$.
I learned finite fields and its operations but while calculating the inverse of $x^7+x+1$(83 in hex) with $\bmod x^8+x^4+x^3+x+1$(standard for AES).
Here my calculations using extended Euclidean algorithm:
\begin{align}
(x^8+x^4+x^3+x+1) &= (x^7+x+1)(x) + (x^4+x^3+x^2+1)\\
(x^7+x+1) &= (x^4+x^3+x^2+1)(x^3+x^2+1) + (x)\\
(x^4+x^3+x^2+1) &= (x)(x^3+x^2+x) + 1\\
\end{align}
now calculating $s$ and $t$ for $$(x^8+x^4+x^3+x+1) \cdot s + (x^7+x+1)\cdot t = 1$$

let $a = x^8+x^4+x^3+x+1$,
$b = x^7+x+1$,
$c = x^4+x^3+x^2+1$,
$d = x$

$$c + d(x^3+x^2+x) = 1$$
$$c + (x^3+x^2+x)(b + c(x^3+x^2+1)) = 1$$
$$c + (x^3+x^2+x)b + (x^6+x^4+x^3+x^2)c = 1$$
$$(x^3+x^2+x)b + (x^6+x^4+x^3+x^2+1)c = 1$$
$$(x^3+x^2+x)b + (x^6+x^4+x^3+x^2+1)(a + b(x)) = 1$$
$$(x^3+x^2+x)b + (x^6+x^4+x^3+x^2+1)a + (x^7+x^5+x^4+x^3+x)b$$
$$(x^6+x^4+x^3+x^2+1)a + (x^7+x^5+x^4+x^2)b$$
now, (c inverse)
$$c^{-1} = t* \mod a$$
$$c^{-1} = t$$
$$=x^7+x^5+x^4+x^2$$
that is in hex = B4
which is not what this table shows
http://tratliff.webspace.wheatoncollege.edu/2016_Fall/math202/inclass/sep21_inclass.pdf
the inverse should be 80(hex).
While I was trying different values, I found that the values which are two steps or less in
Extended Euclidean algorithm is correct means when it takes more than 2 steps I am getting different values of course I may be just mistaken here but this is what I know.
Ps:- I am trying to solve this mystery for 3 days now so any help is appreciated thank you


texts:
I have used AES CTR mode of operation. Each time a file is uploaded an encrypted file is obtained and the corresponding cipher is got – this is a mini project I have done.

I wanted to know so as to what methods I could use to

validate the cipher to just prove that it is a valid cipher got by the actual encryption technique and not just the one generated by some random number generation method
it would be better if I can get a tool that subjects cipher to attacks (brute force, letter frequency analysis) to just prove that the cipher is secure (for validation purpose).

I am aware of the NIST validation, but since this is a mini project, I wanted some simpler solution. Does anyone please have suggestions?


texts:
I'm trying to make an GHASH() function and need some clarification.
Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result.

From my understanding X1 is a first round of GHASH function and effectively a result of multiplication of 16B of ciphertext and 'H'. From test case

X1<-C * H
X1<= '0388dace60b6a392f328c2b971b2fe78' * '66e94bd4ef8a2c3b884cfa59ca342b2e'

My implementation gives a different result. I also have tried some online tools which gave a totally different numbers as well :(

So the question is do I got it right that X1 is a result of multH(C,H)?

Thanks


texts: Security of RSA variants with $e=n-2$ and $e=n$

texts:
RSA as defined by PKCS#1v2.2 allows public exponent $e=n-2$. And textbook RSA was born with $e=n$ (see second bullet here).
Are these variants essentially as secure as (textbook) RSA with fixed $e$? With random $e$? Can we reduce the security of one to the security of the other, or of another variant of RSA?

Note: as in RSA with fixed $e$, we choose $p$ and $q$ large random distinct secret primes. And further:

for $e=n-2$, it must hold $\gcd[q-2,p-1]=1$ and $\gcd[p-2,q-1]=1$ ;
for $e=n$, if must hold $\min(p,q)$ does not divide $\max(p,q)-1$.


texts: Why should the input value on a DPA attack be non-constant?

texts:
I actually was wondering if anyone could help me out with the following problem:

Let's assume we are attacking the first SubBytes() operation on AES with the help of a differential power analysis attack, for a DPA attack we need to know the plaintext in order to create the hypothesis and to apply the used power model (in this case Hamming weights) later on. The relationship between the simulation and the real power traces is calculated with the correlation coefficient. This is totally understandable from my side.
However, it is always stated that the known input value must not be constant because it will not yield in any result.

This is actually the thing I was wondering about. I came up with the idea that – in case that the values are constant – I will have the same Hamming weights for all my hypotheses. However, the real traces will still slightly vary in power consumption. Applying the correlation coefficient now will eventually lead in no correlation at all, hence yielding $0$ as the result.

Is this assumption correct, or am I thinking in the wrong direction here?

I already did some research on this subject, but was not able to find the right answer to my solution.


texts: How does a birthday attack on a hashing algorithm work?

texts:
A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits.

That means it takes about $2^{n-1}$ tries on average to find a colliding message $y$ for a given message $x$ so that $H(y) = H(x)$ while $y \ne x$.

However, a birthday attack (e.g. both $x$ and $y$ can be selected arbitrarily, but $H(x) = H(y)$ is of course still required) is supposed to be much faster, and take only $2^{n/2}$ tries to find a collision.

I see how that works out in terms of time complexity - since we are now looking at all tuples of all guesses so far, of which there are $n^2$, the probability of a collision now grows quadratically instead of linearly.

But shouldn't we also need space to store all of the already tried $x$ and $y$? If we don't, how can we even compare all the tuples of all the hashes enumerated so far? That seems to make such a birthday attack practically impossible, since $2^{n/2}$ bits of storage are a lot, not even thinking about the problem of accessing all that storage in constant time.

Update: I've found http://www.cs.umd.edu/~jkatz/imc/hash-erratum.pdf, which seems to say that the attack is possible with constant space. However, the proof and explanation given are way above my head.


texts: How to know which key was used for an AES encryption?

texts:
I am starting a project where several categories of sensitive data have to be accessed within a table. Based on his role, a user can see clear text columns (not encrypted), accessible columns (decrypted for his role), and can't see the content of other columns (encrypted).
This implements segregation of duty (for example) :

Database administrator can only see clear text columns
Person A can only see person's details to validate data
Person B can only see revenue details to build statistics

Role management rules dictate which role uses which key, and keys are highly protected. But after a few years of people moving and roles adapting, how can I make sure the system still knows which key was used when?
I can imagine two solutions:

Build a solid log of keys usage
The key signature hash is present in the cryptogram

Even though I don't think one can guess the key from the hash, I'm afraid this would introduce a weakness...
How would you proceed?


texts:
I am using AES-CBC, authenticating using HMAC-SHA512 and I was wondering whether my thought process and implementation are correct.

The message send over the network is: HMAC(64Bytes),IV(16Bytes),Ciphertext
The MAC is calculate as follows: HMAC(sha1(secretKey),Plaintext)

Is there a significant reason to use SHA-512 over SHA-256?
Should I treat the secretKey differently or generate a complete new pair entirely for the authentication of the ciphertext


texts:
Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized.
I need it to verify any future message comming from the same source.


texts: Is this DIY remote lock protocol secure?

texts:
I need your advice on following scheme of exchange protocol between remote lock and key. I'm planning to use following algorithm:

Key generates unique value that never repeats (in reality it's just counter that increments every time the button is pressed), let's call it "NONCE1".
Key sends a request to the lock which consists of NONCE1 and H1 = MD5(NONCE1 + KEY1). Second part is used only for "signing" the request, attacker wouldn't be able to generate valid request if he doesn't know KEY1.
Lock checks if H1 = MD5(NONCE1 + KEY1), this is used to check if incoming request is coming from the key (or at least from the one who is aware of the value of KEY1). Additional steps that were not described previously is:

Lock checks if NONCE1 of the previous key request less than NONCE1 received just now. This part prevents acting on previously processed requests, attacker who has such request won't be able to go any further. I'm trying to leave him in the situation where old requests are not accepted by the lock, and new requests couldn't be generated because he can't reproduce it without KEY1.
Lock sets NONCE1(previous request) = NONCE1(current request)

Lock generates completely unique value that never repeats, let's call it "NONCE2".
Lock sends a response to the key which consists of H2 = MD5(NONCE2 + KEY2). NONCE2 - is counter based (in order to completely exclude possible collisions), so in order to hide it's "counter - based nature" from an attacker, MD5(NONCE2 + KEY2) is used here.
Key does H3 = MD5(H2 + KEY3) and sends it back to the lock
Lock checks if H3 = MD5(H2 + KEY3) and acts on that

What could be possible vulnerabilities? Is it safe enough to use MD5 in this particular case?

I've added some additional "substeps" to clarify it a little bit

Accepted suggestion / solution is following:

Get rid of steps 1 - 3
Replace MD5 with HMAC-XXX


texts: Randomize (encrypted) data to hide the behaviour of the data source

texts:
I'd like to transmit a small amount of data, typ. 4 - 16 Byte through a channel that can be eavesdropped at any time.

The behaviour, the way the data changes, should be protected too.

I could encrypt it using XOR with a 4 - 16 Bytes key like this:

c = m x k

This means c is the same for the same m. When observing the cipher, it's actually not interesting to decrypt the actual data because the cipher reveals enough information about the data source.

When observing the data - encrypted or not - it should ...

... NOT LOOK LIKE THIS:
t=0 12587200
t=1 12587200
t=2 12587200
t=3 97387419

... BUT LIKE THIS:
t=0 23443623
t=1 53453566
t=2 91372718
t=3 18347444

The data either

lineary increases (with variable increment) or
over a long time period, changes around a relatively fixed average value or
does not not change at all over a long period of time or
is guessable with not much effort

It's clear to me that, since the data might not or little change, it should be randomized before encryption.

Constraints

No security by obscurity - the algorithm is known to an eavesdropper
The data may be

broadcasted by the source (updated in a defined interval, during this time period an eavesdropper may see the same data) or
get actively read by one peer

The receiver/reader may miss a message update so it should be able to sync
Message loss is acceptable for the receiver
Both peers cannot rely on a stable and tamper-free timebase
CPU power and memory requirement is limited
The data and the behaviour can be seen unconfidential after a while

I see one option, suitable for broadcasting and active read: combine the data with a pseudo random factor derived from a confidential IV known to both sides. That combination is then encrypted using the also confidential key.

It could look like this:

 T = 5 mins     # Update interval, e.g. 5 mins (unconfidential)
 K = 0x1BC07410 # Key (confidential)
IV = 0xB9EF72E5 # LFSR seed (confidential)
 r = 1000       # initial rounds (unconfidential)
 R = 0          # LFSR round counter
 n = IV         # pseudo noise from LFSR

def HIDE(m):
  n = LFSR(n)
  return m x n

def ENC(m):
  return m x K

# initialize once
while R < r:
  n = LFSR(n)
  R = R + 1

while True:
  R = R + 1
  m = READ_FOUR_BYTE_MESSAGE()
  Feed to broadcasting or store for retrieval: ( ENC(HIDE(m)), R )
  sleep(T)

It's clear to me that an eavesdropper might brute force probe IVs cycled R times through the LFSR and XOR it with the cipher to know that the message did not change between the update intervals.

My questions

Have I missed other attacking vectors?
Is there anything to improve the security but increasing IV and key lengths?
Please guide me what basics I should learn


texts: Timing attacks on homomorphic encryption

texts:
I've been wondering for a long time about programs that could potentially break fully homomorphic encryption schemes:

//Given input vector A
if(A[0] == A[1])
   while(true) ; // or do any time consuming calculation
else
   return <anything>;

System could execute such programs and using timing methods determine information about encrypted data. It could of course ask more clever questions about the data than equality and possibly decode full encrypted vector.

What is wrong with my thinking here?


texts:
Typically when rainbow tables are discussed MD5 hash is used as an example. It's not quite clear whether this attack is specific just to MD5 or to a certain subset of hashes or to just any hash function.

Is rainbow table attack applicable to any hash?


texts: Why multiple homomorphic operations on a ciphertext leaks no information about the plaintext?

texts:
Scenario:

Assume I encrypt message $m$ using Paillier encryption, so I would get $c=E(m)$.

I give the identical $c$ to two different parties, parties $D$ and $E$.

Party $D$ computes: $c_{D}= E(m)^{h_1}=E(m \cdot h_1)$
Party $E$ computes: $c_{E}= E(m)^{h_2}=E(m \cdot h_2)$

Values $c, c_{D}$ and $c_{E}$ are given to a malicious server.

Question: Does the server learn anything about values $m,h_1$ or $h_2$? if yes/no why?

Remark 1: It seems to me it cannot learn anything about the messages, because given $c$ it can do homomorphic operation on its own to get the ciphertexts $c_{D}$ and $c_{E}$; and if it could the homomorphic encryptions would not be secure anymore. But, the problem is that we have not changed the random value $r$ (in encryption) so all ciphetexts possess the identical random value.

Remark 2: I mentioned Paillier because I'm using it right now, and the question can be generalized for any homomorphic encryptions.


texts: Password Derived Signature Authentication

texts:
I'd like to avoid sending user passwords over the wire. Would the following challenge response protocol be secure (served over TLS)? I know this is similar to SRP.

Sign-up

Client takes password and randomly generated salt and inputs them
into scrypt.
Client takes scrypt output and uses it to create a signing keypair using
nacl.sign.keyPair.fromSeed
Client sends salt and public key for later authentication

Authentication

Client calls challenge endpoint to get salt and challenge token.
Client regenerates keypair using method above.
Client signs challenge token and sends it the verification endpoint.

The challenge token would only be used once per attempt
A fake salt and token would be returned if the user wasn't found
Verification endpoint would be rate limited


texts: I'm thinking about buying a USB TRNG. How do I evaluate its randomness? I'm sure some are better than others but which is which? Are thermal-noise better than radio-noise TRNGs?


texts:
Is there any advantage to using an IV larger than a cipher's block size?

Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this:

[IV] [Ciphertext]

Normally, the IV will be 256 bits, or 32 bytes, if the block size is 256 bits.

Is there any advantage at all in using an IV larger than this, and just splitting it and encrypting it as future blocks in the file?

ie:

# python pseudocode
iv = read(64) # read 64 bytes
cipher = AESGCM256(iv[0:32])
cipher.encrypt(iv[32:64])

block = None

while ((block = read(32) is not None):
    cipher.encrypt(block)

Since the IV is a known value, is there any benefit to having a longer IV and splitting it in this regard? Conversely, is there any flaw in doing it this way?


texts: Which multiplicatively homomorphic encryption scheme supports encryption of 0?

texts:
I want a multiplicatively homomorphic encryption scheme that supports encryption of 0 (e.g. Elgamal doesn't support).

I also want the multiplication to be operated on the ciphertext of 0, i.e., if one of the ciphertexts is encryption of zero, the product is also encryption of 0.


texts: What is the viability of a hybrid vigenere cipher?

texts:
So a vigenere cipher's main weakness is that you can use frequency analysis on each alternated alphabet, and thus crack the cipher with relative ease... But that implies that you know what the frequency of the plaintext is.

So what if you hybridized vigenere cipher with some other algorithm that obscured the frequency? At first glance, this doesn't seem like a remotely weak system.


texts: XSalsa20 + Poly1305 authentication wtihout tag

texts:
Do I understand correctly that XSalsa20 + Poly1305 provides authentication without a tag? If so, then how does that work?
I came to that conclusion by reading http://nacl.cr.yp.to/secretbox.html, "Secret-key authenticated encryption", where it states (as far as I understand) that the ciphertext has the same length as the plaintext.


texts:
Wikipedia: Rijndael's Forward S-box

I'm writing C Code to generate S-boxes but I'm stuck.

Would you mind explaining one entry of the S-box? (say for x = 0x2). Here is what I got.

The inverse of $2$ in $GF(2^8)$ for polynomial $x^8 + x^4 + x^3 + x + 1 = 142$ (in decimal). Now if I apply the affine equation, it results in $86$ (0x56). What's wrong with my approach?

The additive constant for S-Box = 0x63.

In case it helps and/or makes sense, here's my C code.


texts: What cryptanalysis is possible against two independent keystreams XORed against plaintext?

texts:
If a wise person was unsure about which commercial cryptography standards are truly secure from the fascist powers that be, it would seem the obvious option for companies and individuals is to now use two independent algorithms to encrypt. To be clear I am not talking about a cascade cipher in CBC mode e.g. $Encryption_2$($Encryption_1$($plaintext$)), where an attacker can unravel one layer of encryption at a time because they have direct access to the resulting ciphertext from each algorithm.

I am talking about using two unique keys and two block cipher algorithms in Counter Mode (or stream cipher algorithms) to generate two unique keystreams, then XORing (⊕) them together with the plaintext. For example:

$Key_1$ = 256 bit random key
$Key_2$ = different 256 bit random key
$IV$ = 128 bit random initialization vector for AES
$Nonce$ = 192 bit random nonce for XSalsa20
$Keystream_1$ = $AES$$_C$$_T$$_R$$(Key_1, IV, Counter)$
$Keystream_2$ = $XSalsa20(Key_2, Nonce, Counter)$
Ciphertext = $Keystream_1$ ⊕ $Keystream_2$ ⊕ $Plaintext$
Decryption = $Keystream_1$ ⊕ $Keystream_2$ ⊕ $Plaintext$
Data sent over wire = $IV$ | $Nonce$ | $Ciphertext$

The key exchange, MAC and transport protocol are out of scope for the question, I want to focus on the encryption part.

It would appear that an attacker's methods of cryptanalysis for each individual algorithm would not work as they do not have access to the plain ciphertext of either algorithm because the keystreams from each algorithm are XORed together.
Known plaintext cryptanalysis would not work either. For example the first 5 bytes are hello, and they have a resulting ciphertext of xAi3z. With a single keystream they could get those 5 bytes of the keystream which would be the plaintext ⊕ the ciphertext. Then over the course of multiple ciphertexts/known plaintexts there might be a weakness to deduce the original key which generated the keystream. However with two independent keystreams, a cryptanalyst can't know which combination of bits make up the combined keystream. For example: they know plaintext bit 0 and ciphertext bit 1, but do not know whether the keystream bits were definitively a 1 or a 0 bit, nor which bit came from which keystream.

Advantages:

Protection from non-public flaws or weaknesses in either encryption algorithm.
Cryptanalysis is almost impossible?
Decryption requires breaking both algorithms.
Brute force required to find two random keys instead of one ($2^{256} + 2^{256}$) or $2^{128} + 2^{128}$ (on a quantum computer).

Minor disadvantages:

Generating and exchanging two keys instead of one.
Slightly more network traffic required to send an extra IV or nonce with each transmission.
Slower encryption and decryption.

My questions:

Assuming both algorithms are implemented properly, the random number generators produce truly random data and there is an attacker in a privileged network position intercepting multiple ciphertexts, how or what kind of cryptanalysis could the attacker perform against this scheme to break the confidentiality of messages?
Is there a faster method than brute force to find the two encryption keys or break the confidentiality of messages?


texts: How long brute force AES-128 at 24 bits of key

texts:
I have 1 block of encrypted data with AES-128, but I know 104 bits of 128 bits the key.
How long it will take to brute force 24 bits of a key at Intel I 7 CPU? How can I calculate that?


texts: Why does the EdDSA use a 2b-bit hash function?

texts:
The EdDSA signature of a message $M$ under key $k$ is created as:

Define $r=H(h_b,....,h_{2b−1},M)\in\{0,1,...,2^{2b}−1\}$.

Define $R=rB$.

Define $S=(r+H(\underline R,\underline A,M)s)\bmod\ell$.

Output $(\underline R,\underline S)$ as signature (where $\underline S$ is the $b$-bit little-endian encoding of $S$).
My question is: why does it use of $2b$-bit hash function? What will happen if we use of $b$-bit hash function in the above equations? The $r$ in 1 has $2b$-bit, but it computes the $R=rB$ in 2 and $S$ in 3 at the $\ell$ module. Note that $\ell$ has $b$-bit. Why don't we use the hash function with $b$-bit output? Is there any security problem with this?


texts: Clarification regarding multiple modular exponentiation

texts:
If the base is same and exponents are different,
for example:

$R_1=b^x\bmod{p}$; $R_2=b^y\bmod{p}$; $R_3=b^z\bmod{p}$;
($p$ is large prime (2048 bit); $x$, $y$ and $z$ - 160 bit integers))

To calculate $R_1$, $R_2$ and $R_3$ at the same time, then my question is:

Does the calculation finish in around one exponentiation or three exponentiations? (I feel it is one exponentiation time)


texts: Why was Rijndael the only cipher to have a variable number of rounds?

texts:
Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? It may have reflected the intention of having three different security levels and leaning towards speed for the "lower" security level, but that still doesn't explain why only Rijndael did this instead of settling on, say, 14 rounds.
Is there some cryptographic attack which is unique to Rijndael which would warrant this?


texts: Why is this a fix to Bleichenbacher's attack?

texts:
Looking at this excellent explaination of the attack, I have one additional question:

  It says that: ""To prevent this attack, SSL servers do not inform the client about padding woes. If decryption fails because of a bad padding, then the server continues with a random pre-master secret (the true failure will then occur when processing the Finished message).""

Why does this prevent the attack?
Why doesn't the attacker just infer that the connection failed because of the bad padding? Why else could the connection fail?


texts: Is OTP useful in modern electronic communication?

texts:
I have seen from time to time questions about various OTP schemes and "OTP" (i.e. stream cipher) schemes. The most common OTP troubles appear to be:

How to extend size of previously generated key or how to generate key.
How to get key material securely to the recipient.

In electronic communication or storage encryption OTP appears scheme that is impossible to make work and if it works benefits are not clear. Requirement that the key needs to be the same size than input seems to be unbearable for many of modern use cases for encryption.

Is there any practice where OTP is useful in modern cryptography except:

As a component used on some proofs.
As a example ideal of encryption algorithm.

I.e.: Is it possible to base on OTP and provide the "information theoretic" strength to hashing (apparently not), authentication, etc.


texts: Review: peer-to-peer encrypted communication

texts:
I'd like to ask you to review security of the following communication scheme:

network is strictly P2P, based on DHT (peer discovery)
root user can create a virtual private network (network private and public keys)
peers belong to private networks
if peer wants to join the virtual network, they need to pass their public key to the root, to sign it with the network key
peers uses DHT to find other nodes (peers) and establishes direct communication using UTP. The communication is encrypted with a common secret key, decided by both sides (Diffie Hellman).
both sides can verify if the other peer's public key is signed with the network certificate.

Questions:

how can I implement certificate revocation? I considered passing announcements between peers
is there a way to detect that an attacker stole a private key? I thought about a fingerprint based on MAC/computer name/etc.

The best option for me would be eliminating the root user at all and let the group decide if invite/revoke another peer or not.

I know that the signal implements private groups, but in this model you don't have all peers available for 100% time, so you can't decide together on the new key once somebody joins/leave - hence certificates.

Thank you in advance for any ideas, complaints, hints.


texts: If you receive a message with a digital signature, how do you know what verification key to use and the verification algorithm?

texts:
Really, I'm asking how do you know who sent it?

My confusion has arisen from the following scenario...

Problems with Signing-then-encrypting.

If Alice digitally signed some data and then encrypted the data and the digital signature using Bob's public encryption key,

Bob could behave maliciously and...

1. decrypt and recover the data and the digital signature;

2. encrypt the data and the digital signature using Charlie's public encryption key;

3. send this ciphertext to Charlie, who decrypts it and verifies Alice's digital signature.

So Charlie can decrypt the message using his private key but how does he know what to do with the digital signature? How would he know what verification algorithm to use? How would he know who signed it?


texts: What's the reason for applying the hash twice when hashing with salt?

texts:
One of the typical approaches to computing a salted hash is this:

hash(salt+hash(secret))

where hash is something like SHA-256 hash function - taking any size input and returning fixed size output. What's the need for the hash(secret)?

Why can't I just do this:

hash(salt + secret)

where + is simply concatenating two byte arrays?


texts: Broadcast encryption not using symmetric keys

texts:
Is there a common scheme for broadcast encryption that doesn't involve an exchange of a shared key? I'm aware that traditionally a common symmetrical key would be given to all parties and exchanged securely using the recipients' public keys.
I'm building an application on the Ethereum blockchain where I want to use one message to transmit information to all recipients involved securely. Unfortunately, this means revoking keys becomes an expensive process due to Ethereum transaction costs, as I would have to redistribute a new symmetric key to all recipients again.
Is there any way to encrypt a message using a set of public keys that could be decrypted by any of their respective private keys so that revocation is not so expensive? I would not include the revoked public key the next time I send an update. The message is quite a small amount of text, so size should also not be a problem.


texts: How would you explain this very simple add/modulo asymetric encryption?

texts:
I am working on a presentation aimed at developers without a strong mathematical background (like me). I would like to explain how asymetric encryption works with an non-fully-secure but working example.
I found one on Stackoverflow based on addition and modulo :

given a range from 1 to M
given a and b where a+b = M
a is the public key, b is the private key
x is the clear data (just a number)
y is the encrypted data
y = (x + a) mod M
x = (y + b) mod M

Example :

M=10, a=3, b=7, x=4
y = (4+3) mod 10 = 7
(7 + 7) mod 10 = 4

Vilain knows the algorithm and a, y, M.
We suppose Vilain cannot guess b from a.
Reverse modulo has multiple results :

4 mod 3 = 1
7 mod 3 = 1
13 mod 3 = 1

Meaning Vilain cannot easyly find

x+a

from

(x+a) mod M

Even this is really simple, and I "feel" the modulo "wrap-around" I could not find anyway to explain WHY this works :

y = (x + a) mod M
x = (y + b) mod M

Does anyone could try to explain it to me ?


texts: Is AES reducible to an NP-complete problem?

texts:
Is breaking AES NP-hard?  Can the security of AES be reduced to a NP-complete problem?

If it is reducible, what does the reduction look like?
If it is not reducible, why do we assume it is secure?


texts: Reordering non-block-aligned parts with DES in ECB mode

texts:
I was given a ciphertext file which was encrypted using DES in ECB mode. It is known that the plainttext that was encrypted has the following form:

Each line of text consists of a payroll followed by a name (no spaces):

32 characters for the name;
8 characters for the pay amount;
1 newline.

An example plaintext file would be:

abcdefghikabcdefghikabcdefghikab00000000
abcdefghikabcdefghikabcdefghikab10010010
abcdefghikabcdefghikabcdefghikab10010010
abcdefghikabcdefghikabcdefghikab10010010
abcdefghikabcdefghikabcdefghikab10010010
abcdefghikabcdefghikabcdefghikab10010010
abcdefghikabcdefghikabcdefghikab11111111

and it was encrypted using this command (of course the key was not given, for obvious reasons):

openssl enc -e -des-ecb -nosalt -in plaintext.txt -out ciphertext.enc

The ciphertext file is of size 288 bytes since there are 6 newline ('\n') characters and DES encrypts in 64 bit blocks it's easy to tell that there are 7 entries in this payroll list.

The Objective: exchange the first line with the last.

If all the entries were on one line with no spaces this would be an easy task as DES in ECB mode you can move around the 64 bit blocks without being detected. All I would do is take the first 40 bytes and exchange them with the last 40 bytes. However since there is a '\n' character at the end of every line this approach does not work. I feel a bit stuck. All I'm looking for is a point in the right direction.


texts: How can we define $\epsilon$-differential privacy for non-deterministic algorithms?

texts:
We know that  non-trival deterministic algorithm does not guarantee privacy and randomization is essential for privacy (pp.16 in [Dwork and Roth 2014] ).  The well-known $\epsilon$-diferential privacy is defined for randomized (probabilistic) algorithm (see the link https://en.wikipedia.org/wiki/Differential_privacy).
From a broader perspective of uncertainty, I wonder whether we can define a similar diferential privacy notion for non-determinstic (multi-valued or set-valued) algorithms? And how?


texts: Security of querying multiple Merkle trees

texts:
Suppose Alice has committed to several sets of values using Merkle trees. For example, let's say there are 2 sets of values, and each set represents leaves of a separate tree like this:

$a_0, a_1 ... a_n$ are the leaves of tree $A$
$b_0, b_1, ... b_m$ are the leaves of tree $B$

Victor wants to make sure Alice didn't cheat by including a lot of invalid values into the trees. So, he queries each tree in $x$ random positions, and Alice provides Merkle proofs for the requested leaves. If all proofs check out, Victor is satisfied.

A common way to make the above scheme non-interactive is to use roots of the trees as seeds to PRNG, specifically:

$PRNG(root_A)$ would produce $x$ positions at which tree $A$ should be queried.
$PRNG(root_B)$ would produce $x$ positions at which tree $B$ should be queried.

I am wondering if a slightly different approach can be used to improve security (and thereby reduce the number of queries needed). Specifically:

Alice would first calculate $h=hash(root_A + root_B)$,
Then, she'd calculate positions for tree $A$ as $PRNG(h)$,
And positions for tree $B$, as $PRNG(hash(h))$,

The thinking is that this setup makes it more difficult for Alice to cheat. In the original setup, Alice could try many different permutations of $A$ until $PRNG(root_A)$ resulted in query positions that are just right. And then, she could do the same for tree $B$.

But with the new setup, any change to either of the trees changes query positions for both trees simultaneous. Thus, potentially, many more permutations would be needed.

If this scheme works, how would it affect the number of queries? In the original setup, $2x$ queries were required, how would it change in the new setup?


texts: Why in one time pad must the key distribution to be truly random

texts:
One time pad required a truly random key.
Why canwt it be a psudo-random key?
For example, if the key distribution is that for each bit the probability to get 1 is 0.6 and the probability to get 0 is 0.4, and the eavesdropper knows it, how can he decrypt the message (assuming that the key length is at least as big as the message length)?
Thank you


texts: Why is the point at infinity on Edwards Curve different to Weierstrass curves?

texts:
If I understand correctly, the identity point on all elliptic curves is the point at infinity.
But on the Edwards curve, this can be written in Affine form?

Does this have something to do with the fact that Edwards curve formulas are complete?

What would the point (0,1) be on the Weierstrass curve signify? If b=1, then we can represent this point on the Weierstrass curve?

It still has not clicked with me, the fact that the point at infinity is in the group, yet it cannot be represented? But somehow it can b represented on the Projected form, which is another form of the same curve? Whereas Montgomery is a different curve entirely?


texts: If you SHA something that already has work put into it, is it still safe?

texts:
For example, let's say I did 1,000,000 rounds of PBKDF2 on some string (along with a high entropy salt).

If I then run the result plus some string through a simple SHA512 hash function, is it still secure due to the amount of work put into it, or has it lost something?

Example:

var x = pbkdf2(someSalt, somePass, 1000000);
var y = sha512(x + someString);

Is y safe?


texts: Certificate Master Public Key with Pairing

texts:
I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(this last used to generate the user's secret keys).

Now, is there a possibility in order to certificate this Master Public Key generated with Pairing(i.e. using a X.509 certificate or similar)? How can I trust of this MPK?


texts: Is CBC block cipher mode susceptible to reordering attacks?

texts: Regarding reordering attacks, is CBC block cipher as vulnerable as ECB? why? If CBC can prevent reordering attacks (that is, after reordering, the decrypted plaintext will make nonsense so the receiver can detect that it must have been tampered with during transmission), why do we still need mechanisms like sequence number to prevent reordering attack?


texts: Can RSA key be determined when encrypted text is displayed alongside the clear text?

texts:
I would like to encrypt some text and display part of the encrypted text alongside the clear text as a means to prove that I generated it.
For example, let's say I have the text ABCDE that I want to prove that I generated.  Using RSA encryption with a private key, I encrypt this text and display the last few characters of it:
szqKTeKU=
Now I want to display both these on a label.  It'll have ABCDE on it and underneath, the text szqKTeKU=.
Later on, if we want to verify that this label with ABCDE was indeed generated by me, we can go back through the encryption process again, extracting the last characters and looking for a match.  Since the key would be a secret, only certain people would be able to complete this verification (actually, in practice, a program I will write will do it).
Now, my question is: does the fact that I display the clear text as well as part of the encrypted text defeat its security?


texts: Total anonymity against malicious agents

texts:
Suppose we have $N$ parties, two of whom are Alice and Bob, while some fraction of the remainder are malicious agents working together. We form a network where each party can pass an encrypted message to another indirectly by routing it through other parties. Alice and Bob know a key secretly, so they can communicate privately because the other parties who look at the message just see noise and pass it on.

But now suppose the malicious agents are really malicious; they can sneak into Bob's home and learn the key, and they also can spy on the entire network to track every movement. Now it becomes easy to unmask Alice. The malicious agents check every message they get with the key, and they'll eventually notice that they always see messages meant for Bob originating with Alice.

So my question is, assuming the agents can acquire as much info through Bob and the network at large as desired, is there a way to modify this protocol such that Alice can't be unmasked? I.e., that the agents will have no way (or a computationally-infeasible way) of guessing Alice is a more likely candidate than any of the other parties? The protocol can be somewhat unreliable if necessary. Obviously it will require some second layer of encryption, but I don't know what to look for.


texts: Security of three-pass mutual authentication under ISO/IEC 9798-2

texts:
Based on 5.2.2 of the international standard ISO/IEC 9798-2 (http://bcc.portal.gov.bd/sites/default/files/files/bcc.portal.gov.bd/page/adeaf3e5_cc55_4222_8767_f26bcaec3f70/ISO_IEC_9798-2.pdf)

Why does the protocol swap the 2 nonces in TokenBA (Rb||Ra, instead of directly taking Ra||Rb in TokenAB) ? If we do use Rb||Ra, and assume the size of blocks in the messages are equal to the block size of the block cipher used to perform the encryption, will the protocol still be secure when the CBC mode is used ? How about counter mode?


texts: Are checksums essentially non-secure versions of cryptographic hashes?

texts:
Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable attacker's meticulous engineering feature?

So, essentially they are non-secure versions of cryptographic hashes, one could say? Thus for the same reason, these checksums are "cheaper" to compute than cryptographic hashes? (e.g. CRC32 vs SHA-256)

Sorry for my poor english and potentially trivial question. I just need to get the concepts straightened out.


texts: Why is a nonce used to initialize Hash_DRBG, HMAC_DRBG, and CTR_DRBG?

texts:
In NIST 800-90A, Hash_DRBG, HMAC_DRBG and CTR_DRBG (with derivation function) all require a nonce for instantiation.

I understand the usual application for a nonce to prevent replay attacks. However, I don't understand the security benefit a nonce provides for a CSPRNG. Additionally, I am wondering why CTR_DRBG without a derivation function does not require a nonce.

What am I missing here?


texts: What are advantages of using a HMAC over RSA with SHA-1 hashes?

texts:
I am currently studying for an exam and this was a previous question:

  Give one advantage of using HMACs over using RSA to sign SHA-1 hashes.

My thoughts are that it has something to do with the fact that HMAC assumes a private key has already been shared so there is no need to use public-private keys.  But wouldn't it be possible for this key to be compromised?


texts: What security differences are there between E(p',"well-known-plaintext") vs. hash(p') where p'=KDF(p)

texts:
I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived key.

Bruce Schneier's PasswordSafe format V3 has

  H(P') is SHA-256(P'), and is used to verify that the user has the correct passphrase.

I understand that bcrypt uses the derived key with Blowfish to encrypt "OrpheanBeholderScryDoubt" 64 times to create a password hash. (edit: I am not concerned specifically about Blowfish, but about any block cipher used in this manner. Bcrypt is just an example.)

Question:

Is there any difference in the security of these two approaches to verifying a password?

Context:

I want to be able to authenticate a user before giving him access to his account.  Most of the account metadata are also encrypted with p' to protect them from disclosure to third parties.

Edit: Further research

The SHA-2 functions are based on the Merkle–Damgård construction, which is a method of creating a hash from a block cipher. Merkle–Damgård is popular because it provably preserves specific security properties of the underlying block cipher. It does have well-known weaknesses, with some known "strengthening" strategies (used in SHA-2). The main focus of the SHA-3 competition was to find a different construction without these weaknesses.

I have not been able to find any similar security proofs of the construction of bcrypt, but I also have not been able to find any attacks against it. No one seems to be using bcrypt for any purpose other than hashing/verifying passwords.

For the purpose of a password vault, as used by the PasswordSafe V3 format, the verification of the derived key is not strictly necessary. In the V1 and V2 formats was necessary because the data had no MAC.  Of course, current best practice suggests that all encryption be authenticated. Colin Percival (author of scrypt) suggests verifying the MAC before passing attacker-controlled data to ANY complicated piece of code, such as an encryption or compression function, even when such protection does not provide any cryptographic security benefit.


texts: Generating S boxes that satisfy Coppersmith's criteria?

texts:
I'd like to generate all possible 6-bit to 4-bit S-Boxes that satisfy the criteria for S-Box design given by Coppersmith, but I have a few doubts:

How many such S-Boxes are possible?
Is there any existing implementation of said boxes?
What would be the most efficient way to implement them?

Any help is appreciated, thanks!


texts: How many JWT tokens may be securely generated with one secret?

texts:
I can remember from my crypto classes, that there is a limit on how many blocks can be securely encrypted with the same key. Before we reach the limit, we should rotate the key. Does it also hold true to JWT tokens? Is there a limit of token count, after which we should rotate the secret? If yes, what might be the limit for common signing algorithms like:

HMAC + SHA256
RSASSA-PKCS1-v1_5 + SHA256
ECDSA + P-256 + SHA256


texts: Better understanding what big O is referring to

texts:
I thought I understood big-O notation relatively well, but now I'm not sure. In particular, I've seen several posts like this discussing how the discrete logarithm problem is (probably) hard since our best algorithms are exponential in terms of number of bits.

If I understand correctly, to find an $x$ given an integer $y$, generator $g$ and prime $p$ s.t
$$g^x \equiv y\ \mod{p}$$
would require at most $O(p)$ trials. But if $p$ is $k$ bits then the run time is actually $O(2^k)$.

I'm struggling to understand why we decided to express the runtime in number of bits. For example, sorting can be done in $O(n\log n)$ time where $n$ is the number of elements in an array-like structure. Well $n$ also has $k$ bits, so that means the runtime is $O(k*2^k)$; sorting is exponential? I'm clearly missing something, so any help would be appreciated.


texts:
By "hand cipher", I mean a symmetric cipher for which encryption and decryption can can both be performed with a pencil on graph paper, consuming about 10-20 seconds per character by a proficient user. Additional simple tools, e.g. a deck of cards or a multiplication table, may be used to expedite the process. No mathematical proficiency is required other than mental addition, subtraction, and maybe multiplication.

Basically, it should be a cipher that someone of average mathematical abilities can master, and it should require no digital technology or cryptographic tools that cannot be constructed out of paper.

For example, four-square in CBC mode seems secure to me because CBC is a well established mode of operation and four-square seems to be a good block cipher as it accommodates large keys and seems to produce a random-looking output. However, the fact that four-square in CBC was never widely adopted before digital encryption became a consumer technology leads me to believe that someone broke the cipher and thus discouraged people from using it.

So is there any hand cipher that the best supercomputers would take years to cryptanalyze? If not, then for which hand cipher is the best known attack the most complex?


texts: period of the lfsr sequence after some manipulations

texts:
Here is the question I am dealing with. I have some sort of a solution but I need more specific results. If someone can help I'd appreciate:
Given 3  maximum length (max period) LFSR's of lengths L1,L2,L3 which are clocked simultaneously and L1,L2,L3 are  pairwise relatively prime. The output sequence is the output of the 1st or 3rd one depending on the output of the second one being 0 or 1, respectively.
1) If we pick only every fourth bit of the output sequence how does linear complexity(LC) and period change? What would they be in terms of the previous LC and Period?
2) What is the weightt of the sequence in one period?
Now here is my solution in short: First of all this is Geffe Generator and combining function is  f(x1,x2,x3)=x2.x1+x2.x3 +x3$.
-Linear Complexity= LC= f(L1,L2,L3)=L2.L1+L2.L3 +L3. (since lengths are all relatively prime)
- Period = P = (2^L1 -1).(2^L2 -1).(2^L3 -1) (since they are of max period   and relatively prime lengths i.e. Li's)
Now let's say the output sequence of the system is {a_n} = {a0,a1,a2,a3,...}
1)  Picking up every fourth bit of the output sequence is the 4-decimation of the sequence starting from a3. Therefore 3 terms need to truncated before the decimation is taken into account. Decimation does not increase the LC but truncation makes LC at most  LC+3. I solved this by considering the denominator of the generating function which is the connection polynomial whose degree gives the LC after all simplifications are done.
i.e. if new LC is L then:
L <= LC+3
But I don't know how to find the period in terms of the period of the unmodified  system P. I could only say that, if the new period is T, then:
T<= (2^{L+3}-1)
Can anyone give a more specific bound for the new period which is in terms of the unmodified period P of the system?
2) for the weight of the function in a period :  I checked the Truth Table of the function f. And it is balanced, thus weight must be:  (2^{3-1})= 4.  But how can I find the weight of the sequence in a period?
My idea is: in one period function takes all possible input values (x1,x2,x3) that is possible. ( as many as integer multiples of lengths.) Thus it must be the weight of the function multiplied by some integer?  I am not sure of that one?  Does anyone have an idea?


texts: Shamir SS: To associate shares to the public values $x_i$, when the shares are permuted

texts:
Suppose we use $(t,n)$ Shamir secret sharing as follows:

We share the secret $\beta$ as $S=[s_1,..., s_n]$, where $X=[x_1,...,x_n]$ are the public values. For the sake of simplicity, lets assume that $n>100$ and $t=2$.
We permute the elements in the vector $S$.

Question 1: Given the permuted vector, can an adversary associate each share to the corresponding $x_i$ values? if yes/no why?

Edit:

Question 2: What if we mix the shares with some dummy values and then we permute all, and give them to the adversary?


texts: Is there any asymmetric encryption algorithm for eliptic curve(secp256k1) without AES?

texts: I am looking for asymmetric encryption using SECP256K1. But all over the internet, I see that it also requires AES encryption. Instead of generating an AES secret key, is it possible to encrypt using the public key alone?


texts: RIBE Scheme Implementation - How to encrypt message

texts:
This question is regarding "A Fully Secure Revocable ID-Based Encryption
in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU

The encryption method specifies part of the encryption process to be $\hat e(g_1, g_2)^r \cdot M$ where $g_1$ and $g_2$ are public parameters in cyclic group $G_1$, $\hat e$ is the pairing function and $M$ is the actual message.

My question is what this $\cdot$ operator actually implies for an implementation - is it taking chunks of the $M$ equal to the bit length of the result of $\hat e(g_1, g_2)^r$ and then adding* them together?

*My understanding, perhaps wrongly, is that the multiply operation for elliptic curve groups is  addition based on this


texts: Automatic generation of secure passwords with the least inconvenience for a user

texts:
I'm working on a web site for a private company that should allow them to upload files, which will be later retrieved by their affiliates. The site will be available from a public Internet using private URLs for each uploaded file. All files uploaded will be encrypted-and-MAC'ed using AES-256 encryption. Files could be retrieved by a recipient only if they know the password for each file.

Since humans are pretty bad at picking secure passwords I decided to generate passwords for such encryption automatically and display them for a user after the file is uploaded & encrypted.

Another detail that I need to mention is that after each file is uploaded an employee of the company may transmit its password to a recipient (via a phone call or a fax.) Thus a requirement for this password to be something that can be both "secure" and "manageable" by a non-cryptographer.

So my strategy was to come up with a set of unambiguous characters and numbers that will be easy for a human being to relay over the phone.

I came up with the following 20 characters:

  efghkpqrsuwxy2345679

But my question is, how many of those characters shall I include in the password to make it secure, and at the same time make it not too hard for a sender/receiver to work with?


texts: Point addition in NaCl/libsodium (Curve25519)

texts:
In NaCl and libsodium, the crypto_scalarmult function implements the operation $Q = kP$ (scalar/point multiplication). There doesn't seem to be a function for point addition $K = P + Q$ though.

Something like point addition must be implemented somewhere I think, as part of the implementation of scalar multiplication. It would be useful to be able to access this for developing some protocols on top of Curve25519.

Is it deliberate that point addition isn't mentioned anywhere in the API or documentation? (Don't the authors want people implementing research-level protocols using their library?)
crypto_scalarmult delegates to crypto_scalarmult_curve25519 declared (in libsodium) in crypto_scalarmult_curve25519.h but I can't seem to find the definition in a .c file anywhere (in the latest version on GitHub)?
Is there a safe way to implement, or reuse an internal implementation, of point addition in libsodium?


texts: Maximum strength of an authenticated encryption scheme like this

texts: Assume that we have a authentication-capable block cipher with key size $k$ and block size $n$ where $n = 2 \times m$. The function used to encrypt blocks takes the block index $i$ as an additional input and returns an $m$-bit intermediate authentication tag $\phi_{i}$. At the end of the encryption process, the authentication tag $\Phi$ is produced. $\Phi$, unlike $\phi_{i}$, is $n$ bits in size. It is derived from all $\phi_{i}$ and the encryption key. Assuming the the length of the key is equal to $n$, would the strength of the security tag be at most half of that given that each block encryption produces an $m$-bit intermediate tag?


texts: Cracking RSA ciphertext without a public key

texts:
I'm looking for some clarification on whether or not I'm correct in how I'm thinking about this.

From my understanding of RSA, the public key gives you the value $n$ (large prime $p$ times large prime $q$) and the value $e$ (a value less than $n$ which is not a factor of $(p-1)(q-1)$).

The way to try to crack a ciphertext according to the RSA problem is by using the values given to you in the public key (demonstrated in this answer). However, if an attacker only has an encrypted message without the private key (an example would be getting into a system and obtaining an encrypted file but the keys were in "Cold Storage"), he/she wouldn't be able to perform this attack.

While it's possible to recover the public key if you know the ciphertext and the plaintext, given only the ciphertext, it is likely much more difficult (if not almost impossible) to find the correct prime numbers, the value $e$, and the value $d$.

Am I correct in this assumption?

Side note: I know that the public key is named "public" for a reason, but for the sake of this scenario, just assume some situation like the one presented above.


texts:
I'm trying to find a proof-of-work algorithm with the following properties:

If A(1) is a proof of work with Difficulty(A(1))=n (requires n basic operations on average), then one can find a proof of work A(2)=F(A(1)) with Difficulty(A(2))=Difficulty(A(1))+n by performing approximately n operations.
The size of A(i) is be bounded by the logarithm of Difficulty(A(i)) (the accumulated difficulty).

One way to achieve this is to choose a problem which allows approximating the solution that also has a fast method to find out the approximation error. Then performing the proof of work consist of refining the best previous solution.

For example, approximating the real square root of 2 may satisfy property 1, but it does not satisfy property 2. In some finite groups finding a non-trivial root is hard, and the proof is bounded in size, but property 1 is not satisfied.

I was also thinking that maybe a variant of Very smooth hash may work, or a group-theoretic hash function, buy I haven't figure out how.

The idea is that if such function is used for PoW of a block-chain, then comparing the difficulty of two competing chains is reduced to comparing the difficulties of two blocks.

There is a solution in Bitcoin involving using Merkle trees of previous blocks and SPV proofs, but I'm looking for a proof whose size is strictly bounded.


texts: Using the a multiple of the x coordinate as a private key

texts: ECDSA specs require private key ($d$) to be a random integer ($r$) in the range $[1, N-1]$, where $N$ is the order of the base point ($G$). What if the private key instead is set to the x-coordinate of the EC point $r \cdot G$ (i.e., $G$ added $r$ times)?


texts: Seeking key stream as way to reuse a key

texts:
In order to reduce the amount of key exchanges, I propose to encrypt messages using the same key stream, by selecting subsequent positions in the keystream for the separate messages.

I.e., message $M_1$ gets encrypted with the first $|M_1|$ bits of the key stream, message $M_i$ with bits $|M_1| + |M_2| + \dots + |M_{i-1}|$ to $|M_1| + |M_2| + \dots + |M_{i}|$ bits of the same key stream.

Observation: This way, I see it as if I encrypt a long message $M_1+M_2 \dots + M_i$ using said stream cipher.

Question: is this observation correct, for

all stream ciphers;
any specific stream cipher in particular, let's say Salsa20, and ChaCha20;

given that the time interval between messages is "large", and new messages might depend on different transmissions (possibly by an attacker)?


texts:
Wikipedia defines ANSI X.923 padding as follows:

  In ANSI X.923 bytes filled with zeros are padded and the last byte
  defines the padding boundaries or the number of padded bytes.

  Example: In the following example the block size is 8 bytes, and
  padding is required for 4 bytes (in hexadecimal format)

  ... | DD DD DD DD DD DD DD DD | DD DD DD DD 00 00 00 04 |

So far so good.

Java Bouncycastle provider supports X932Padding, but it does it differently; instead of filling the unused bytes with zeros it fills them with random bytes.

I've got interested and started to search for ANSI X.923 official standard in internet and did not find it; instead I've found ANSI X9.23 description, and it says The standard defines that any other added bytes, or pad characters, be random.

So Bouncycastle implementation follows ANSI X9.23.

The question is : does the ANSI X.923 standard as it is defined in Wikipedia really exist?


texts: Probability of collision when we use a particular part of sha 256 hashed value

texts:
So I was supposed to use hash some co-ordinates and I was supposed to use k 3-wise independent hash functions in order for the mathematical explanations behind that algorithm to be hold. But after using k 3 wise independent hash functions, I got kinda bad accuracy(I used tabulation hashing which I myself wrote for this. Then I decided to use some cryptographic hash function for collision resistance and ended up using sha256 in this way

As I have to generate k different hash functions for my purpose, I generated k different seeds and wrote this snippet -

hex_num = hashlib.sha256((str(self.seed[i])+str(d)).encode('utf-8')).hexdigest()
                int_hex = int(hex_num[:5],16)
                index = int_hex % self.width

where I want to get the hashed values in the range of 0 to self.width-1.
Now I had a few questions-

The probability of two different items hashed to the same slot by the same hash function.
After going this SHA256 output to 0-99 number range? , Can we assume that a hash function with high collision resistance also means a highly uniform distribution? I was still wondering what can be the probability mentioned above.
Any help will be appreciated!
Cheers !