texts: Looking for a secure PRNG that I can implement in hardware

texts:
I'm trying to implement a (sort of) simple PRNG in hardware for fun. My idea would be to allow a user to enter a key using a keypad (or some dip switch settings that can be set and hidden) and to obtain a seed using photo, gyro and audio sensors feedback.

I understand I'll probably have to implement some form of modulo arithmetic in hardware. However, I thought up of a hardware-simple algorithm that would only need to use XOR gates. What are your opinions on it?

key = k bits taken from keypad entry
seed = k bits taken from environment sensors
while (true):
    seed << seed[3]             // rotate the seed if seed[3] is 1
    newSeed <- key XOR seed     // the new seed is XORed with the key
    output <- lsb(newSeed)      // output the lsb of the seed
    seed <- newSeed

It outputs the lsb of the newly calculated seed. I have no experience in algorithm design so I'm sure this is riddled with attacks. If the above is not sufficient for a PRNG, which should I use? Is there one which is known to be simpler for low-bit hardware?


texts: Understanding the linear cipher decryption process

texts:
Being new to Cryptography, I'm having a hard time understanding the basic concepts.

I understand all parts except why 4 power -1 has become to 7.

Can anyone explain why this is?


texts:
I've written a BouncyCastle style threaded seeder and was wondering about the predictability of the data the program generates.

The reason I'm not simply using BouncyCastle is because security isn't a concern, I don't want to use a whole library just for one function, and this code is MUCH faster.

The idea is to make several threads which operate on a circular buffer (a simple array), where each thread performs a different operation on the data in the buffer. The randomness comes from thread scheduling irregularities in the OS.

How much randomness can I expect from a mechanism like this?

C# code:

using System;
using System.Threading;

class ThreadedSeeder
{
    static public ulong[] buffer = new ulong[1024];
    static public bool doThread = true;

    public ThreadedSeeder()
    {
        MakeThread(Add);
        MakeThread(Multiply);
        MakeThread(Xorshift);

        Thread.Sleep(10);

        doThread = false;
    }

    static private void MakeThread(ThreadStart a)
    {
        Thread b = new Thread(a)
        {
            Priority = ThreadPriority.Lowest
        };

        b.Start();
    }

    static private void Add()
    {
        int i = 0;

        while (doThread)
        {
            buffer[i & 1023] += (ulong)DateTime.UtcNow.Ticks;
            i++;
        }
    }

    static private void Multiply()
    {
        int i = 0;

        while (doThread)
        {
            buffer[i & 1023] *= 6364136223846793005;
            i++;
        }
    }

    static private void Xorshift()
    {
        int i = 0;

        while (doThread)
        {
            ulong y = buffer[i & 1023];

            y ^= (y << 13);
            y ^= (y >> 17);
            y ^= (y << 5);
            buffer[i & 1023] = y;

            i++;
        }
    }
}


texts:
In 2001, Catalano et. al defined Decisional Small $e$-Residue Assumption as follows:

Let $N$ be a random chosen $\ell$-bit long RSA modulus and $e>2$ a random integer such that $\text{gcd}(e, \lambda(N^2))=1$. For every probabilistic polynomial time algorithm $\mathcal{A}$, define the following probabilities:
\begin{equation*}
P_{random}=\Pr\left[\begin{array}{r|c}
\mathcal{A}(N,x)=1 & x \leftarrow\mathbb{Z}_{N^2}^*\end{array}\right]
\end{equation*}
and
\begin{equation*}
P_{residue}=\Pr\left[\begin{array}{r|c}
\mathcal{A}(N,y)=1 & x \leftarrow\mathbb{Z}_{N}; y\leftarrow x^e\bmod N^2\end{array}\right]
\end{equation*}
then, there exists a negligible function $\mathsf{negl}()$ such that $|P_{random}-P_{residue}|<\mathsf{negl}(\ell)$.

Can I state the assumption as follows:
For every PPT algorithm $\mathcal{A}$, there exists a negligible function $\mathsf{negl}()$ such that
\begin{equation*}
\Pr \left[\begin{array}{r|c}
\mathcal{A}(N,e, y_b)=b & p, q \leftarrow \mathcal{PRIMES}(\ell/2);N=pq\\
& e\leftarrow \mathbb{Z}_N^* (e>2)\; \text{s.t. gcd}(e, \lambda(N^2))=1 \\
& x\leftarrow \mathbb{Z}_N; y_0=x^e\bmod N^2\\
&y_1 \leftarrow \mathbb{Z}_{N^2}^*; b \leftarrow \lbrace 0, 1 \rbrace\end{array}\right]-\frac{1}{2}<\mathsf{negl}(\ell)
 \end{equation*}


texts: RSA encryption with private key and decryption with a public key

texts: When using the RSA cryptosystem, does it still work if you instead encrypt with the private key and decrypt with the public key? What about in the case of using RSA for sender authentication?


texts: How to implement automorphisms technique in SEAL?

texts: In the SEAL homomorphic encryption library, no automorphisms technique to move values between the different slots in a given plaintext vector is provided. How could this technique be implemented in SEAL?


texts: What are some different cryptography methods?

texts: Some of the most effective cryptography methods and algorithms are based of factoring large prime numbers (e.g. RSA). I'm curious whether there are some other cryptography methods. Somethings that is very mathematical or physical based. Of course, I know about quantum cryptography, but I'm interested in other things also. For example, braid groups which have connection to knot theory can have application in cryptography. What I am asking is for a similar thing. I mean, is there any branch or equations in mathematics or physics that can lead to a cryptography methods.


texts: Can RSA be securely used for "blind decryption"?

texts:
Assume we have the following setup:

A client with trusted storage and computing capabilities (e.g. a smartcard)
A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, possibly with something like Intel SGX). The server has no trusted large-scale long-term storage capabilities and may only store small amounts of data confidential and integrity protected (like the HTTPS private key).

The problem is: The server should be able to be shut-down and started-up, no passwords should be involved and the server has no HSM, yet the server should be able to provide somewhat secure access to some data without the clients needing to decrypt it themselves (for complexity reasons). So the storage need to be encrypted and the transfer (-> TLS) as well.

The solution is now (what I call it): blinded decryption.

The server uses some homomorphic encryption scheme (e.g. EC-ElGamal or RSA) with the message space $\mathcal M$. He chooses a random $k\in \mathcal M$ and uses $H(k)$ ($H:\mathcal M \rightarrow \{0,1\}^{256}$) as the key for the authenticated encryption of the data. The server now either stores the (asymmetric) encryption of $k$, called $\mathcal E(k)$ in his trusted area of the drive(s) or may store it in an untrusted section (with back-ups) if server authentication is required and the private key for this authentication is already stored in the trusted area.

For the temporary unlock of the encrypted data, the server loads $\mathcal E(k)$. Then he blinds it using some operation $f(\cdot,\cdot)$ (multiplication for ElGamal and RSA, addition for EC-ElGamal) using some random $r\in \mathcal M$ as $c=f(\mathcal E(k),\mathcal E(r))=\mathcal E(g(k,r))$ with $g(\cdot,\cdot)$ being the "inner homomorphism" (same as $f$ in many cases). The $r$ is kept available in trusted short-term memory and the $c$ is sent to the client.

The client decrypts $c$ using his trusted device and returns $c'=g(k,r)$ to the server. Finally the server unblinds $c'$ using his $r$ and uses the obtained $k$ to derive $H(k)$ and allow access to the data.

Now (finally) the question:
Given the above and standard assumptions (RSA-assumption, DDH-assumption in ECC and $\mathbb Z_p^*$,$H$ is a random oracle, the symmetric encryption is secure and authenticated,...) is it safe to instantiate $\mathcal E$ with textbook RSA?

As pointed out in the comments, every good question about "is this secure?" requires a threat model, so here's mine:
The security of the whole protocol is broken if an attacker is able to learn the secret symmetric key $H(k)$ while it's valid. The attacker may not compromise the server (i.e. he can't control/spy on RAM / CPU and may not learn the stored $\mathcal E(k)$). An attacker not breaking into the server may have successfully attacked the client (except for the trusted device) and he may be able to completely modify and read the network traffic. I think an attacker without having broken into the server may be computationally unbounded.

If not clear until now, the instantiation of $\mathcal E(k)$ is $\mathcal E(k):=k^e \bmod N$ with $e,N$ being standard RSA parameters.


texts: Send a symmetric key generated by one user to other users (more than two) using a server

texts:
I am developing a software in which I am using AES for encrypting messages shared in a group.  The key is generated by one user, the admin of the group and needs to be shared with other members. How can I share this key with all other members of the group securely?

Are protocols like Needham-Schroeder, Diffie-Hellman applicable in my case? (I don't know much about cryptography)

PS: Can I encrypt the 'group key' generated by admin using AES, and save it on a server? The other users can request the server for the  encrypted key and then decrypt it. The key used for encrypting and decrypting the 'group key' will be pre-shared (embedded in the software).


texts: What is the chance of a collision when using SHA-3?

texts:
I currently am writing a web app and am using two random hashes that are before and after the string and are both 50 char long (alphabet, numbers, and special chars).

strlen($hash1) = 50;
strlen($hash2) = 50;
$sha3pw = sha3($hash1+$password+$hash2);

What are the chances that someone will be able to find a collision from only the hashes? Is there any chance or is it a theoretical chance?


texts:
I got this question in a local hacking event, but I couldn't solve it.

  Problem Statement ----

  Continuing their snooping habit, NSA kept bugging Alice's communication. Resorting to the age old RSA encryption, Alice used 128-bit RSA encryption to exchange messages. Alice shares her public key as 0xffffffa95256a837568a41c265f4fe27110814aae19f144762d5cc0bcb931807 and her public key exponent $e$ (derived from $\phi(n)$) as 0x11 with Warden.

  However, NSA, with its enormous resource, cracked this 128 bit encryption super easily. Seeing your work on the previous ciphers, NSA decided to offer you a job in their Cryptography group. As a final test, NSA shared this public key which they intercepted from Alice and Warden's conversation. They also gave away the private key that they computed from their message exchange.

Public Key:
    0xffffffa95256a837568a41c265f4fe27110814aae19f144762d5cc0bcb931807
    0x11

Private Key:
    0xffffffa95256a837568a41c265f4fe27110814aae19f144762d5cc0bcb931807
    0xc3c3c3817b3335577e69b9d0e48e2bc1fdf71f1f4f73a38a7d628d39739bbaf1

  What are the values of $p$ and $q$? (the prime numbers used in key generation)

How can I find the prime numbers used in RSA?


texts:
I use GPG symmetric, to encrypt text file.
Is it possible to use GPG symmetric, to encrypt a text file, and at the same time, add additional setting to the encrypted file, to give us 2 conditions:

correct password will decrypt it.

incorrect password will give fake decryption result, instead of indicator "decryption failed, bad session key"


texts: Partially-known-plaintext attack of a stream cipher based on modular arithmetic

texts:
I have a function called $F$, using modular arithmetic as does RSA, defined as $$x\mapsto F(x) = g^x\bmod p$$ where $p$ is a 1024-bit prime and $g$ is a generator of $\mathbb Z_p^*$. A secret key $r$ is chosen randomly from all distinct exponents (ie $\mathbb \{0,\dots ,p-1\}$). The encrypted message is computed using a one-time pad stream cipher, with the keystream computed as $$K=F(r)||F(2\cdot r)\dots$$

How do I decrypt the entire message after obtaining $g$, $p$, and the first 1024 bits of plaintext-ciphertext pair?


texts:
I have some trouble finding valid information about IOTA. Actually I would be nice if there would be a good source.

So my question is:
Bitcoin uses the SHA-256 twice and some "target bits" for hashing it's blocks.

What PoW does IOTA use? Some sort of Hashcash Lite - but how does this work in detail?
Is there also a header with a timestamp and some previous block hash?


texts: I was wondering why some groups provide more security to cryptosystems relying on DL-Problem.


texts: Why is it said that AES is unbreakable? Brute force attacks would take years to crack it, so is it possible to crack it if the computational speed of machines increase in the following decade?


texts: About DH-EKE and ECDHE_PSK (PSK versus Pasword)

texts:
I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange :
Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf
I understand the use of the password to authenticate a DH handshake.

The question is :

Is TLS DH ciphersuite based on PSK authenticated in the same way as the DH exchange authenticated with password ?
Is entropy a matter for PSK considering weak password ?


texts: How does the UE communicate its ephemeral public key to the HN in 5G networks?

texts:
I have been taking a look at ETSI TS 133 501 V16.3.0 to see how exactly does a User Equipment actually authenticates itself to the Home Network.
This is supposed to be done during the AKA procedure, but when I look at it, the HN is able to retrieve the SUPI from the SUCI without the UE having sent its ephemeral public key (section 6.1.2). Has the UE already sent its ephemeral public key before AKA takes place?
Also what seems odd to me is that in section 6.12.5, which talks about how to obtain the SUPI from the SUCI, nothing is said about the UE's ephemeral public key. However in annexe C, all protocols (except for the null one) are ECIES based and therefore HN needs to know UE's ephemeral public key.


texts: I was wondering how we can get a secret sharing of $a+b$ from the sharing of secrets $a$ and $b$ themselves by using an XOR secret sharing scheme, where $a_1,...,a_n$ and $b_1,...,b_n$ are the shares for $a$ and $b$ respectively. Can anyone give me any suggestion?


texts: How can I get the message which was encrypted before (when decrypting a product cipher) ?

texts:
I want to make a product cipher containing s box and p box.
where message
$m = \{m_1, m_2, m_3, m_4\}$ where $m_i \in \{0, 1, \dots 25\}$ for $i=1,2,3,4$.
p-box: $P(x_1, x_2, x_3, x_4) = (x_1, x_3, x_2, x_4)$
S-box: $\mathbb{Z}^2 \rightarrow \mathbb{Z}^2$ where $\mathbb{Z} \in \{0, 1, \dots, 25\}$
$S(x,y)=(x+k_1 y \bmod 26, k_2 x + y \bmod 26)$
$K = (k_1, k_2)$ where $k_1, k_2 \in \{1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25\}$

Encryption:

let key k = (k1, k2) = (3, 5)
Let M = {4, 8, 12, 13}
P - box: p(M) = {4, 12, 8, 13}
s - box: S(4, 12) = (4 + 12 × 3(mod 26), 5 × 12 + 12 (mod26)) = (14, 6)
         S(8, 13) = (8 + 13 × 3(mod 26), 5 × 8 + 13 (mod26)) = (21, 1)
cipher Text = {14, 6, 21, 1}

Decryption using S - box:

S(14, 6)
a + 3b(mod26) = 14
5a + b(mod26) = 6

and

S(21, 1)
a + 3b(mod26) = 21
5a + b(mod26) = 1

I am however unable to solve these equations.

Where I'm stuck

Solving for S(14, 6).

5a + b(mod26) = 6 multiplying this equation with 3 and then subtracting a + 3b(mod26) = 14.

We get 14a(mod26) = 4

To solve this I guess we need multiplicative inverse of 14 in Modulo 26 which does not exists. So we get multiple values for a and b.

So the message gets decrypted with multiple solutions. The original message plus some random messages.

How can I get exactly the message which was encrypted before?


texts: Forcing participants to be honest in Secure Multiparty Communication

texts: Alice and Bob engage to compute a secure function f(a,b) where a and b must be present in a set U. Although both Alice and Bob know f(a,b), how can Alice confirm that b is present in U and Bob confirm that a is present in U?


texts: side channel attacks against TDES (compared to AES)

texts:
We all know AES has some pretty strong side channel attacks, some where (with a couple of hundred know plain- and ciphertext combinations) a key can be derived in a matter of minutes. Others may take a bit longer but they are out there if people have full access to the hardware and control over the algorithm.

Does TDES also have those devastating side channel attacks? I'm delving into the security of both TDES and AES and am a bit biased when it comes to TDES since well.. it's stitched together to give DES a longer life span, and to me that's not proper security. But I cannot find as many (good) attacks against TDES as i can find them for AES.

my question is:
Does TDES have the same vulnerabilities as AES, especially when it comes to side channel attacks?

P.S.
I do realize there are more attacks and papers published for AES since AES is more of a popular topic then TDES.


texts: WPA/WPA2 Handshake -- Why are Nonces not encrypted?

texts: During the WPA/WPA2 handshake, the client and AP compute a 256-bit Pre-shared Master Key (PMK) before exchanging Nonces that are used to compute the eventual key. Given that the hosts already have a shared key (the PMK); why dont they use it to encrypt the Nonces? The attacker exploits these nonces to do a dictionary attack -- it seems like the attack would be much more difficult if the nonces were encrypted.


texts: How is CipherCloud doing homomorphic encryption?

texts:
Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet.

How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not provide much information about how their system works.


texts: How you find the unpadded short plaintext using RSA?

texts: I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.


texts: Is the firewall decrypted my session? There is an error "Certificate Not Trusted" (Server Certificate changed to Firewall Cyberoam Certificate). Which public Key I got? Is Main server Public Key or Cyberoam Public Key? Is SSL traffic inspection is same for Authenticated Encryption "GCM" ?


texts: Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?

texts:
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by a higher layer of software, so its impossible to tamper with the ciphertext, IV or additional data. The encryption key is widely known also by malicious parties, except by one server. The encryption is only used for plausible deniability for this server, so a malicious party is allowed to read everything. The server should be able to group equal messages blindly hence the deterministic encryption.
Since the message size is small, I want to minimize overhead next to the ciphertext. I've read a key check value can be used to detect if the correct key is applied for decryption. This can be done by adding one block of zeros or another constant in front of the message before encrypting with AES.
I was wondering if I can use a 128 bit CBC-MAC of the plaintext as this constant, and use it simultaneously as IV for the encryption of the message. This to prevent only equal first bytes of the messages to result in equal first bytes in the ciphertext.
Basically the idea boils down to concatenating twice the plaintext, apply AES-CBC with an IV of zero. Using the output of the last AES block of the first half as IV and the whole second half as ciphertext. After decryption the receiver can CBC-MAC the decrypted plaintext to see if it matches the used IV and thus the correct key was used.
Note that the CBC-MAC is only used for creating a deterministic IV. Its not needed for all the properties a MAC is intended for.
Am I thinking correctly and will an malicious user (which has access to encryption keys) not (or very hard) be able to generate a collision in my IV-ciphertext combination so that the server is grouping unequal messages together?


texts: Why is this hash function (based on a block cipher) insecure?

texts:
I am new to hash functions and blockciphers and try to do some exercises to get a better understanding.

Considering the following block cipher if K is predefined value IV and the last ciphertext is the hash. I don’t really see how this hash function would be not secure but from what I heard block ciphers are only good hash functions if they use some sort of feed forward/backward with xor.

$C_1 = E_K(P_1)$
$C_i = E_{C_{i-1}}(P_i)$ for $i > 1$

Why is this hash function – which is based on a block cipher – insecure?


texts: If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?

texts:
The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would this cause? Would it be easier to find collisions, preimages, etc? Would it be possible to insert backdoors?

So far, I've only found one example, as specified here (Using SHA-256 with different initial hash value):

  However, allowing an arbitrary IV renders ineffective one of the two redundant safeguards built into SHA-2's padding scheme. If the message length was removed from the above padding scheme, then an adversary having the ability to decide the different IV could do so nefariously; in particular, such that he knows a secret backdoor block $B$ that can be inserted at the beginning of any message, leaving the hash invariant. Proof: one round of SHA-2 transforms the state $S$ according to $S_{j+1}=F(M_j,S_j)\hat+S_j$, where $F$ is a cipher with the (padded) message block $M_j$ used as key, $\hat+$ is addition with some carries suppressed, and $S_0$ is the IV we are discussing. One able to choose the IV could choose it as $F^{-1}(B,0)$, thus such that $F(B,\mathtt{IV})=0$, thus such that $M_0=B\implies S_1=S_0$.

Are there any other examples of potential weaknesses/attacks that would ensue if I allow the attacker to choose arbitrary IVs for the SHA256 hash function?


texts: Probability of guessing random 128-bit AES key

texts:
Consider the following five events:

Correctly guessing a random 128-bit AES key on the first try
Winning a lottery with 1 million contestants
Winning a lottery with 1 million contestants 5 times in a row.
Winning a lottery with 1 million contestants 6 times in a row
Winning a lottery with 1 million contestants 7 times in a row

What is the order of these events from most likely to least likely?


texts: What's the difference between non-interactive zero knowledge proof of knowledge and proof of membership?

texts: I'm trying to study the difference between non-interactive zero knowledge (NIZK) proof of knowledge and proof of membership. I have known that in NIZK proof of knowledge the prover wants to convince the verifier that he knows the proof of a given theorem without revealing any additional information about the witness. In NIZK proof of membership the prover just convinces the verifier only of the veridicity of the statement. However, I cannot find good materials describing a formal definition of NIZK proof of membership. I have known that there exists an PPT extractor for NIZK proof of knowledge that can extract the witness, but what about proof of membership? What properties should it satisfy?


texts:
I'm implementing different applications that will use UDP to exchange real-time data, thus a low impact on performance is very important. This system will not be connected to the Internet so I just need a symmetric encryption mechanism and one option would be AES-128. I am googling a lot but I am not finding a lot of material about the combination of AES, UDP and C++, is it not used much? Any resources would be really appreciated!

Would DTLS be an appropriate choice for this case in this private LAN far away from the internet?

I've posted a similar question on Information Security SE with more details (after the answers here came in).


texts: Can I compute “SHA256(secret||data)” when having “SHA256(secret)” and “data”?

texts:
I need to find the SHA256 hash of s string like this: part1-part2. I know the SHA256(part1), length of part1 and I know part2, but I don't know what is the contents of part1.

Is there any chance I can compute the hash of the whole string using only these three parts of information?


texts: Can double-encrypting be easier to break then either algorithm on its own?

texts:
As was pointed out in Martin Bonner's comment I cannot prove this, but it seems intuitively impossible.

An encryption function is supposed to obscure the plaintext to the point where no information can be obtained about it. If the underlying encryption algorithm can even be determined, that goal has not been achieved.

Is this correct? Can double-encrypting (with either the same or separate algorithms) weaken security?


texts:
In Professor Boneh's online Cryptography course at Coursera, I am a little puzzled by his definition of a statistical test where he writes:

  A(x)  = iff |#0(x) - #1(x)| <= 10.√n

Now, if – as an example – we were to perform this test on a string of $100$ bits, then $10$ multiplied by the square root of $100$ is… $100$. But if we had a hundred $0$s in this string and no $1$s then A would output $1$, i.e. would judge the string as random.

Am I perhaps misunderstanding something?


texts: Questions about using PRF to construct PRG

texts:
Let F be a secure pseudorandom function with 128-bit key and 256-bit block length. Which are the following functions G are secure pseudorandom generators? (Select all that apply.)
A.  $G(x)=F_x(0...0)$, where $x$ is a $128$-bit input.
B. $G(x)=F_x(0...0)|| F_x(0...0)$, where $x$ is a $128$-bit input.
C. $G(x)=F_x(0...0)||F_x(1...1)$, where $x$ is a $128$-bit input.
D. $G(x)=F_{0...0}(x)|| F_{1...1}(x)$, where $x$ is a $256$-bit input.
The answer our teacher gave is $A,D$. But I don't understand. And Why C is wrong?


texts: Why do the messages in IND-CPA have to be of same length

texts: I understand the general idea of IND-CPA, however I fail to understand why the messages the adversary chooses have to be of same length. I guess that with variable length messages there would always exist a successful attack and therefore CPA security would not exist. Can anyone guide me into a direction on how such an attack would look like?


texts: What is / How would I calculate the number of bits(?) I need to make the probability of a collision very small?

texts:
If I wanted to create a TOTP-esque algorithm that generated a string n characters long, with each character being a base64 character, generated from a user secret r Base64 characters long, every s seconds, for each of u number of users, where the probability of collision is very small, how would I calculate the length of the string that was needed?

In case my wording is bad (I'm new to this), here's an example: Say it's generated every 30 seconds from the user's secret, I have 100,000,000 users, the algorithm output is 8 characters long, and the secret for each user is a 32 character Base64 string randomly generated when the user signed up. What would the probability be that two users got the same algorithm output as each other in any one 30s* period? How would I figure out how many characters I would need to make it a one in a million chance?

* Like TOTP, for all users, the 30s period would be the same, i.e. between seconds 0-29 or 30-59 on the clock.


texts: Why is it that most messages seem to be expanded?

texts: Whenever I have seen a more secure version of a message, the message seems to be expanded by some factor. One example is RSA encryption, but whenever a message does not appear to be expanded it is very easy to crack. Such as the Caesar Shift Cipher, or a Substitution Cipher, or even the Vingere Cipher. Is there a reason that expanded messages are much more difficult to crack?


texts: Simulation based proofs: Simple examples

texts:
I am aware that,(in theory) in order to proof that a scheme is secure using simulation based proof we replace an adversary in real world with a simulator in ideal world. Then we try to show that their view are (computationally) indistinguishable (if the scheme is secure).

What I need is some simple examples (in zero knowledge or secure multi party computation) that use this idea to proof. So how the simulator is constructed, why sometime we use an adversary to interact with the simulator are not clear to me.
Any reference to a paper or explanations would be much appreciated.


texts: Does AES encryption of a NTRU pivate key reduce security?

texts:
The NTRU crypto system requires quite long keys. For example with parameters N=439 and q=2048 the security is 128 bits and the key_size is 4829 bits.
When the private key is encrypted with AES-256 and the ciphertext is made public, can an attacker learn something from that? Or is the 128 bit security of NTRU reduced by doing this?


texts: How does Random Oracle and Standard Model differ?

texts: I am new to Crypto field. Many papers are boasting of not using Random Oracle model. Instead, those prove security in Standard Model. I am surprised how do these models differ. Can anyone please clarify me? Does using Hash function mean that the paper makes use of Random Oracle?


texts: Determine encryption method with input and output

texts:
A website stores username and password in a session cookie. In the cookie the

password is "encrypted" or modified in some way. Given that the "encrypted"

version is always the same, I do not believe there is a time sensitive factor.

I could create multiple sets of this data, but it's time consuming.

Knowing this how difficult would it be, and what methods

would be used, to determine what the calculation used is?

To phrase it differently, could one determine how to create a new pair for given plain text?

What does it change if I can determine the hexMD5 value of a known concatenation

of this value and two more.  This would be such that I the password, a username,

the "encrypted" password, and a hexMD5 of the username + "encrypted" password

+ a known constant "secret" string. Which makes me think the method is symmetric.


texts:
Long question but I am starting to lose sight of all the HASH algo's there are.

I know SHAKE128 and 256 are part of the SHA-3 standard but is the SHA3 standard officially released yet? i can only find a draft of the publication, does this mean it's not official and therefor not proven to be secure?

I have not found a proper SHAKE128 or 256 c implementation which is why i'm wondering if they should be used yet, because if they were good I'd think there'd be a lot of example code for them.

I know SHA-1 has a theoretical attack which comes close to being practical and obviously MD5 is broken which is why i would like to keep away from those.

Then SHA-2 remains but SHA-2 contains sha 224, 256, 386 and 512. I've tested these (and whirlpool and Tiger) on my test device and this was the speed:

HMAC        bytes   speed μs
Sha1        64      746
            128     857
Sha224      64      918
            128     1066
Sha256      64      918
            128     1066
Sha384      64      2395
            128     2840
Sha512      64      2400
            128     2840
Sha512_224  64      2390
            128     2835
Sha512_356  64      2390
            128     2835
MD5         64      308
            128     345
Whirlpool   64      5630
            128     6420
Tiger       64      832
            128     952

So MD5 is fastest followed by SHA-1 but those i would like to evade. Now Tiger is the 3th fastest followed by SHA 224 and 256.

I do know that having an insecure HASH does not necessarily mean your HMAC is insecure but still, I always lock my car even though no one has the key.

So the question: what is the best hash to use, obviously it needs to be relatively fast and by my standards sha-512 isn't fast (enough).


texts: Simple explanation of weak one way function

texts:
I find difficult to understand what a weak one way function is. From textbooks:

$\exists$ poly $Q$, $\forall$ PPT  $\mathcal{A}$ such that: $$\Pr[x\leftarrow\{0,1\}^n; y=f(x); \mathcal{A}(1^n, f(x))=x' : f(x')=y] \leq 1 - 1/Q(n)$$

What does this mean in practice?
The part that I find confusing is: $1-1/Q(n)$, does this mean that we can invert all except a polynomial part which we cannot invert?


texts: What is the difference between probabilistic and deterministic prime-factor recovery function in NIST 800-56B?

texts:
In the previous standard, the deterministic was not included. It is already in the current standard.
What is the reason for this?
Can I use both function?


texts: Preserving Confidentiality and Integrity in a Public channel

texts:
Let's say I've got two people that are trying to talk in a public channel $A$ and $B$ and they want to preserve their confidentiality and integrity.

Which cryptographic algorithm would they want to use? Symmetric, or public key based? Also, what type of algorithm suites best and in what key size?

In my understanding, given the fact that the channel is public – and therefore considered unprotected – they will have to use public key first and send a symmetric key after that, thus securing the channel. Regarding key exchange they could use Diffie Hellman or RSA, and on symmetric key MAC.

Is this correct? Could they do it easier? Is there a safer way?


texts: Security of a cipher with some imperfection in round function

texts:
I got specific problem with round function in my symmetric cipher. It works on $128$-bit blocks. Every round got two $128$-bit keys. Block is xored with $k_{1}$ on the beggining of the round. Then it goes into round function (which is using the same $k_{1}$ and $k_{2}$ keys, both $128$-bit long). And then it is xored with $k_{2}$ in the end.
Problem is with round function. Let's asssume that it transom every $128$-bit block into $128$-bit block indistinguishable from random, if you don't have $k_{1}$ and $k_{2}$. But there is one exception. All zeros block is always encrypted into all zeros block (with every key). So only xoring makes it different from all zeros block before it goes into round function.
If we will consider let's say $10$ rounds - is it secure cipher? Is it possible to broke it because of that problem with all zeros block?
EDIT:
I clarified my question, specifically when xoring is performed:
$INPUT \oplus k_{1}$ $\to$ $F_{roundfunction}$ $\to$ $OUTPUT \oplus k_{2}$


texts: Does knowing that the exponent is in a certain range help solving discrete log?

texts:
given:
$c=g^i \bmod P$
$g$ generator for group with group size $\varphi(P)$
$g,P,\varphi(P)$,c is known by the attacker
He wants to know $i$.

Now the attacker also knows $j,k$ with $j<i<k$
$k-j$ is too big to compute them all but it is much smaller than group size.

Does this knowledge about $i$ help the attacker?


texts: What is security of stream cipher against chosen plaintext attack?

texts:
I have been looking for image encryption after compression using Ax+e, where A is a random matrix, x is plaintext and b is a bitstream generated using a stream cipher. Suppose choosing plaintext as all zeroes (dark image), will reveal many keystream bits. With the sufficiently large amount of known keystream bits, it is possible to obtain the original key. Is there any upper bound on the number of known keystream bits for a stream ciphers that can guarantee a sufficient resistance against attacks? For example, if the sequence has been generated by an LFSR of length n, then the Berlekamp-Massey algorithm is guaranteed to find this LFSR after examining no more than 2n bits of the sequence.

Is it possible to make above system cryptographically secure against chosen plaintext attack?

Is changing the initiation vector frequently so that attacker can get the limited amount of keystream bits only solution?

How to use initialization vector in such scenario?

Is one-time permutation after obtaining keystream bits proper solution?


texts:
I have generated a prime number with a 1024-bit size.

Now, when I create an RSA key - how many bits does the key have?


texts: Understanding WannaCrypt's hybrid encryption scheme

texts:
I'm confused about how WannaCrypt's hybrid encryption scheme works after watching Computerphile's "How WannaCrypt Encrypt's Your Files" video a number times. Below is my thought process to make it easier to pinpoint my misunderstanding.

A public and private key pair is generated for the client, Cpub and Cpriv. These are generated whenever the malware is installed on someone's machine and is unique to the infected to ensure that the ransom be paid in each instance.
In the ransomware's executable is a server's public key, which has a private key, but is kept secret in an off-site location. I'll refer to these as Spub and Spriv.
Cpriv is encrypted with Spub. Cpriv cannot be decrypted without Spriv.
An AES symmetric key, Kf, is used to rapidly encrypt a machine's files.
Kf is then encrypted with Cpub.
In order to get to Kf, we need Cpriv, but we can't get to Cpriv because it has been encrypted with Spub. To get to Cpriv, we need Spriv.

The chain of encryption:

Encrypt files with Kf
Encrypt Kf with Cpub
Encrypt Cpriv with Spub

The chain of decryption:

Pay the ransom (but don't IRL)
The server gives the client Spriv
Spriv decrypts Spub, giving the client Cpriv
Cpriv decrypts Cpub, giving the client Kf
Kf, a symmetric key, is used to decrypt the files

All keys with the exception of Spriv are on the client's machine, but are encrypted. Buying Spriv starts a decryption chain giving access to one's files again.

Is my understanding of WannaCrypt's encryption method correct? Are there any important steps or pieces of information that I'm missing here?


texts: Under what conditions is broadcast possible? (Cryptographically, and in the model of Maurer 2006)

texts:
In this paper, Ueli Maurer uses a very cool model to generalize a number of results about broadcast, secret sharing and secure multiparty computation. Rather than talking about an adversary being either active (malicious) or passive (semi-honest) and having a threshold on the number of parties it controls, instead there are sets of sets of nodes $\Delta$ and $\Sigma$  such that the adversary may have active control of any set $A \in \Delta$ and passive control of any set $B$ such that $A \cup B \in \Sigma$.

Maurer states (Theorem 1) that:

"The simulation of a broadcast channel is secure against a $(\Sigma,\Delta)$-adversary is possible if and only if $P \notin \Delta \sqcup \Delta \sqcup \Delta$."

Here $P$ is the set of all nodes and $X\sqcup Y = \{x \in X, y\in Y : x \cup y\}$.

A corollary of this is that for a fixed threshold, we require $t < |P|/3$, where $t$ is the maximum number of nodes that may be actively controlled by the adversary.

Is Maurer just referring to the information theoretic case? Because I seem to remember reading somewhere that assuming cryptographic signatures you can have broadcast with up to $t < |P|/2$ malicious parties.

If so what is the tight limit for broadcast using Maurer's notation in the case of a polynomially-bound adversary, secure signatures and some public key infrastructure?


texts: Question about Gentry's "Computing Arbitrary Functions of Encrypted Data"

texts:
I am working through the "Computing Arbitrary Functions of Encrypted Data" by Gentry, trying to understand more about Fully Homomorphic Encryption. I'm stuck trying to understand why his "Somewhat Homomorphic Scheme" presented in section 3 is correct.  Ignoring the homomorphic aspects of his scheme, I'm struggling just to prove that $\text{decrypt}(p, \text{encrypt}(p,m)) \stackrel{?}{=} m$.

Gentry defines $N = \lambda, P = \lambda^2, Q = \lambda^5$ and

$\operatorname{KeyGen}(\lambda)$: A random $P$-bit, odd integer

$\operatorname{Encrypt}(p,m)$: Let $m'$ be an $N$-bit number s.t. $m' \equiv m \pmod 2$. Output $c = m' + pq$, where $q$ is a random $Q$-bit number

$\operatorname{Decrypt}(p,c):$ Output $(c \mod p)\mod 2)$, where $(c \mod p)$ is the integer $c'$ in $(-p/2, p/2)$ s.t. $p$ divides $c - c'$

I think there's a counterexample when $p = 1$ (you can force this by setting $\lambda = 1$, because $(c\mod 1) = 0$. Thus, it seems that $p \in \{3,5,\ldots 2^{P}\}$.  I'm wondering if there are other restrictions on the domain of $p$, for example, if we knew that $p > m'$, it would be nearly trivial to show that decrypt works: $(c \mod p) \mod 2 = (m' + pq \mod p) \mod 2 = (m' \mod 2) = m$.


texts: Why is Rabin encryption equivalent to factoring?

texts:
I don't understand the proof of equivalence I've read everywhere (e.g., in Rabin's paper or on Wikipedia).

Here's my objection: let's say you have a Rabin decryption oracle that takes n and c and returns one of the square roots of c mod n. It always returns the same square root for a given n and c, but the choice of output root is otherwise random over combinations of n and c. In this case, the oracle would decrypt the ciphertext somewhere between 25 and 50% of the time (depending on the number of roots of the ciphertext), but it's unclear to me how you could factor n on this basis.

I agree that an oracle that pops out both s and r allows one to easily factor n, but it's not necessary to do that to break Rabin at least 25% of the time.


texts:
I'm confused with the technologies that OpenVPN uses. The official site mentions it uses SSL/TLS in-place of IKEv1/IKEv2, and uses IPSec ESP to secure the data, and yet that it isn't compatible with IPSec.

OpenVPN's security model is based on using SSL/TLS for session authentication and the IPSec ESP protocol for secure tunnel transport over UDP. OpenVPN supports the X509 PKI (public key infrastructure) for session authentication, the TLS protocol for key exchange, the OpenSSL cipher-independent EVP interface for encrypting tunnel data, and the HMAC-SHA1 algorithm for authenticating tunnel data.
Use all of the encryption, authentication, and certification features of the OpenSSL library to protect your private network traffic as it transits the internet
OpenVPN is not compatible with IPSec, IKE, PPTP, or L2TP.

Source: https://openvpn.net/index.php/component/content/article/55.html
Also wikipedia info:

It uses a custom security protocol[9] that utilizes SSL/TLS for key exchange
OpenVPN uses the OpenSSL library to provide encryption of both the data and control channels

Source: https://en.wikipedia.org/wiki/OpenVPN


texts:
Wikipedia lists the following conditions for a prime to be strong:

$p-1$ has large prime factors. That is, $p = a_1 q_1 + 1$ for some integer $a_1$ and large prime $q_1$.

$q_1-1$ has large prime factors. That is, $q_1 = a_2 q_2 + 1$ for some integer $a_2$ and large prime $q_2$.

$p+1$ has large prime factors. That is, $p = a_3 q_3 - 1$ for some integer $a_3$ and large prime $q_3$.

This seems pretty vague to me. What does "large prime" mean? How large should $p_1$ be compared to $p$?

And, most important, what is the standard way to generate large strong primes, or to check if a large prime is strong? Also, is using safe primes (of the form $p = 2*q + 1$, where $q$ is a prime) safe and/or efficient?


texts: In AES Keyschedule : Infer all round keys and cipher key from last round key

texts:
I am given the last round key in AES and I want to infer all round keys and the first round key which is the cipherkey.

Can anyone provide an algorithm to do that?


texts:
While Provable Data Possession seems to be a very useful and interesting tool for ensuring integrity of data outsourced into Cloud providers, I have never seen a reputed Cloud provider talk about this in their products.
Is this tech purely academic or what are restrictions which cause the lack of adoption of PDP ?


texts: Can "nothing-up-my-sleeve" computations be obtained from other cryptosystems?

texts:
So, in cryptography, it is sometimes the case that in order to set up a cryptosystem, one needs some output $f(x)$ for randomly generated $x$ where $f$ is a one-way function but where the input $x$ can be used to break the cryptosystem (i.e. the input $x$ is toxic waste that needs to be destroyed or the output $f(x)$ needs to be computed using some sort of secure multi-party computation).

Does there exist an efficient (by efficient I mean polynomial time) deterministic algorithm that given a one-way function $f$, returns a circuit $C_{f}$ such that for all inputs $x$, there is some $c$ where $C_{f}(x)=f(c)$ but where there is no efficient algorithm that given $x$ returns some $d$ with $f(d)=C_{f}(x)$ (preferably where the function $C_{f}$ is collision resistant)? Or does there exist some impossibility result for such a cryptosystem? If there is no impossibility result, then what is the weakest cryptosystem that ensures an algorithm $f\mapsto C_{f}$ exists?


texts:
I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm.
I think that firstly, Monty would be slightly faster than DoubleAndAdd. But I'm not too sure about side-channel security.

I'm asking this in the context of RSA's modular exponentiation and ECC's Elliptic Curve Scalar Multiplication.


texts:
I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. This was done for the PlayStation 3 hack. I'm now trying to reproduce it in Python, using this library: https://github.com/warner/python-ecdsa

My problem is that the hack only works in some cases (at least I think so). I've not been able to reproduce it, so I hoped you could help me.

Initially we have two equations:

$s1 = k^-1 * (z1 + y) \space\%\space n$

$s2 = k^-1 * (z2 + y) \space\%\space n$

(where $y = r*privkey$)

We want to get rid of $y$ and figure out $k$. In all explanations I've seen so far, they'll do something like this:

$s1 - s2 = k^{-1} * (z1 + y) - k^{-1} * (z2 + y)$

$s1 - s2 = k^{-1} * (z1 - z2)$

$(s1 - s2) / (z1 - z2) = k^{-1}$

$k = (z1 - z2) / (s1 - s2)$

This doesn't work in my code, because the modulo operation here is just ignored. It actually should look something like this:

$i*n + s1 = k^{-1} * (z1 + y)$

$j*n + s2 = k^{-1} * (z2 + y)$

I got rid of the modulo by adding $x*$n to the left side, where $x$ is unknown. Now I'll just do the same thing as above but keep the $+ x*n$:

$i*n + s1 - j*n - s2 = k^{-1} * (z1 - z2)$

$(s1 - s2) + n*(i-j) / (z1 - z2) = k^{-1}$

$k = (z1 - z2) / ((s1 - s2) + n*(i-j))$

Obviously we do not know $i$ and $j$. We can ignore them if $i == j$ (as we did in the first calculation), which is only the case when $z1$ and $z2$ are close together or $k^{-1}$ is very small (so that it pulls the result down and therefore prevents $z1-2$ from making too much difference).

In theory $k^{-1}$ is pretty small and therfore the exploit works. But in practice I've seen that $k^{-1}$ is not used, but instead the smallest inverse modulo of k%n that is a whole number is used. This number can be really huge, which actually amplifies the difference between $z1$ and $z2$, making $i-j$ pretty large. With this implementation, I can't use the exploit as explained in theory.

My questions are:

Why is it that many implementations use the inverse modulo instead of $1/k$? (I've seen it in two so far)
Wy doesn't it work when I change the implementation to use $1/k$?
Is there another way to retrieve $k$, even if the $k^{-1}$ part is really large?

Since this is part of an assignment for Uni, it has to work somehow. But I already spent too much time on it without any results.
Any gurus out there that can help me? :)

best regards


texts: Is this pairing scheme for establishing trust between two devices with self-signed TLS certs secure from MITM?

texts:
Assume two devices (A and B) with self-signed TLS certificates (this part can't change). We want these devices to trust each other.

One way to do this is to simply copy A's cert over to B's allowed cert list and vice versa, but this is a little cumbersome usability-wise.

Instead, what about this scheme:

Device A generates a key K that it remembers for a short period of time
The user copies K and enters it in, along with device A's hostname, on device B
Device B makes a TLS connection to device A and includes its client cert
Device B sends message m1 = HMAC(K, "request" + its client cert + observed server cert)
Device A checks that m1 looks like what it expects, if not, it closes the connection
Device A responds with m2 = HMAC(K, "response" + observed client cert + its server cert) and adds device B's cert to its trusted list
Device B checks that m2 looks correct, and if so, adds device A's cert to its trusted list.

Is this secure, and if so, how short can K be?


texts: Explanation of the generalisation of multiset properties to a concatenation of a block

texts:
I am trying to learn about SASAS cryptanalysis. I am reading the paper related to this where the authors use multisets are used within the cryptanalysis of this cipher. I did not understand the part where they generalized the multisets properties to a concatenation of a block. More specifically the last paragraph of the 4th page of this paper.

To understand the context of the question you just need to study the 4th page of the paper.


texts: Robust authentication and integrity for short OTP message

texts:
Using any of the wonders of modern cryptographic technology, how is it possible to package a tweet-sized plaintext, which is to be encrypted with a proper one-time pad, to ensure its integrity and give it authentication? For these last two services we aim for at least a 128-bit level of assurance. We also want to indicate message order, with a tag, at the same level of protection.

Here are some ways to do it:

1.) One method would be to use a Carter-Wegman MAC.

2.) Another would be to use NaCl / Libsodium with the ChaCha20 stream cipher and the Poly1305 authenticator.

3.) Use an HMAC such as HMAC-SHA-256.

Is there another way that is reliable?

Thank you very much.


texts:
Imagine you have a string of plaintext (a), IV (ai) and the MAC (am) for the plaintext (a).

How can you generate a MAC (bm) for a different string of plaintext (b) - using an IV (ib) of your choice, using the same key - which you don't know and can't retrieve.

You can also assume both plaintexts are the same length.

  Edit: I have found this question which I think provides a clue: CBC-MAC insecure with random IV

  But I'm not sure if I understand correctly. You can also assume your
  plaintexts are one-block plaintexts.

This should prove that cbc-mac with random IV is insecure.

Thank you.


texts: How to create the ciphertext that generates a desired plaintext in CBC (previous cipher- and plaintext are known)

texts:
I'm struggling with understanding this part of the literature:
It can be assumed that the entire ciphertext AND plaintext is known.

Considering the encryption method is $C_i =  enc_k ( P_i \oplus C_{i-1})$ with a key k, and the decryption method is $P_i = dec_k(C_i)  \oplus C_{i-1}$.
Why does it say in equation (2) say that we can generate the desired ciphertext of the previous block this way?
Also shouldn't the equation (3) formula be: $P'_{i-1} = ...$ instead of $P_{i-1} = ...$
I don't really get equation (4) and why is it different from equation (2)?
Any help appreciated.


texts: Join Datasets While Protecting Anonymity

texts:
I've run into this issue a couple of times in my career. I'll see if I can explain with an example (please ignore the fact that this is implausible in the real-world).

Suppose I sell computers, and I have account data on the person that purchased every computer I sell. I also install tracking software on every computer I sell, so that it sends me detailed information about which websites are being visited on that computer.

I would like to set up some sort of system that would allow me to merge account data with usage data in aggregate, but NOT for individual users.

In other words, I don't want to be able to know that John Doe watches cat videos and surfs porn 7 hours a day. I would think that's a violation of his privacy. However, I do want to be able to know that men are 20% more likely than women to visit news sites. This would still require the merging of account data and usage data - I just don't want to be able to see merge results for individual users, only aggregates.

Is there any way to accomplish this? Simply encrypting the key that links the account and usage data is not enough, obviously. The join could still happen. It seems like you need to encrypt usage data in such a way that it can only be decrypted when more than 1 value is aggregated. Is such a thing possible?


texts: Smallest possible certificate for IoT device

texts:
I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT.
All messages are encrypted using ChaCha20+Poly with a dynamic key obtained using DiffieHellman algorithm. But first association is only protected with a shared key so anyone that have that key may join the network.
I'd like to use mutual certificate authentication between nodes and gateway while keeping the number of messages during association as small as possible.
What is the minimum, secure enough, certificate that you can build? How could I generate it using OpenSSL?
There is a prior question similar to this but I guess my case is less constrained. Certificate validation on an IoT device using few bytes
Maybe here there is another solution
Thank you


texts: Using a non-secure random generator for IV or salt generation

texts:
I was just looking at a post on Code Review when I noticed the other answer to the post. While I would agree mostly with the answer, I do however doubt if having a Cryptographically Secure PRNG is really an issue for generating IV's and salt values (where the salt is used for password based key derivation).

What would be the requirements on the random number generator to be used for IV and salt generation? Would a uniquely seeded, well distributed, non-secure RNG suffice?


texts:
Can I use something like Shannon entropy to determine the suitability of a symmetric key? I found a symmetric key which wasn't generated using a CSPRNG and it had a very low Shannon entropy.
I ran an experiment on 1 million keys from a CSPRNG having a Shannon entropy of at least x where all the weak symmetric keys I found had a Shannon entropy of less than x. I don't think the value of x here particular important here but I was wondering if it would be reasonable to reject symmetric keys that don't meet this requirement. Basically as a countermeasure for bad configuration.


texts: Exploiting XOR one-time-pads with alphabet size that isn't a power of 2

texts:
I realized that if the key is chosen randomly from a range that isn't a power of $2$, the one-time-pad leaks information about the plaintext.

For example, if the alphabet was the first 20 naturals, then if you see a 6 in the ciphertext, the plaintext letter must have been within [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 20, 21, 22, 23], so it couldn't have been 16, for example (it couldn't have been 20-23 either, but that's assumed since the alphabet is just the first 20 naturals). However, encrypting and decrypting will work fine.

How can this be exploited in general? If the alphabet is small you can line up all possibilities and try to come up with English words (like coming up with words from phone numbers, possibly?) What about if $n$ is larger?

Unrelated question, given this limitation, why do people use XOR instead of modular addition? Is it just because XOR is faster?


texts: Is there a term for cryptographic attacks where you can verify decryption without assuming any known structure on the plaintext?

texts:
The questions https://security.stackexchange.com/questions/1696/if-someone-breaks-encryption-how-do-they-know-theyre-successful and https://security.stackexchange.com/questions/119887/how-to-know-if-a-file-is-decrypted-or-not on Information Security SE both ask how someone can verify whether they've successfully decrypted a ciphertext. The answers to both questions (as well as this old article by Bruce Schneier) all give the following complementary answers:

In the overwhelming majority of practical cases where someone's bothering to use encryption, the plaintext has some known structure and recognizing it is easy in practice.
If for some reason you encrypt truly random data, then the ciphertext can't be cracked, because the plaintext can't be recognized.

However, both of these answers seem wrong to me. (I think) a simple counterexample to both is given by one of the single most common cryptography protocols in the world today: the key encapsulation part of hybrid cryptosystems, which are extremely common. For example, a common cryptosystem uses RSA to encrypt an AES symmetric key and publicly transmit the encrypted key, which is then decrypted and subsequently used to encrypt and decrypt the data itself.

In this case, the "message" in the first stage (the key encapsulation using RSA) is an AES symmetric key, which is indeed a completely random bitstring. Contrary to claim 1 above, people encrypt completely random plaintext all the time.
Fortunately for the attacker, claim 2 above is wrong as well. If you manage to factor the RSA public key and then decrypt the message, then you can easily tell that you've obtained the correct plaintext without even looking at it, let alone verifying that it's structured. All you have to do is multiply the two numbers in the private key together and verify that their product is the public key.

My question is twofold:

Is my understanding correct? Is there something that I'm missing that makes these answers correct?
If my understanding is correct, is there a term for a cryptographic attack (like factoring an RSA public key, but unlike guessing a one-time pad) where there exists some method of checking the attack's success without assuming any known structure on the plaintext?


texts: Probability distribution function in Regev Cryptosystem

texts:
In Regev - On Lattices, Learning with Errors, Random Linear Codes, and Cryptography, chapter 5, Public Key Crypto System, it is stated that

  The probability distribution function $\chi$ is taken to be $\Psi_{\alpha(n)}$ ... we can choose $\alpha(n)=1/(\sqrt n\  log^2n)$

The document states in §1 that the standard deviation is $p\alpha$

How does $\Psi_{\alpha(n)}$ look like ?

Should I take $\Psi_{\alpha(n)}(x)=\frac{1}{p\alpha(n)\sqrt{2\pi}}e^{-\frac{1}{2}(\frac{x}{p\alpha(n)})^2}$ or $e^{-\pi(\frac{x}{p\alpha(n)})^2}$?

EDIT

The document also states that the curve is centered around 0 and that the probability of zero is roughly $\frac{1}{p\alpha(n)}$.

So starting from the generic probability density function
$$
f(x|\mu,\sigma2)=\frac{1}{\sqrt{2\pi\sigma^2}}e^{\frac{-1}{2}(\frac{x-\mu}{\sigma})^2}
$$
My best guess is that

$$
\Psi_{\alpha(n)}(x)=\frac{1}{p\alpha(n)}e^{-\frac{\pi x^2}{(p\alpha(n))^2}}
$$

A confirmation would be much appreciated.


texts: Plaintext message space in Somewhat Homormorphic Encryption scheme?

texts:
Question 1: In which Somewhat Homomorphic Encryption schemes the plaintext space is defined over $\mathbb{F}_p$, where $p$ is a prime number.

It is said, in Somewhat homomorphic encryption the noise increases when homomorphic multiplication is used.

Question 2: Does this include multiplying a ciphertext by a plaintext? or just multiplying two ciphertexts?


texts: Is it safe to reuse the salt for generating symmetric keys for a chat application?

texts:
I'm writing a program that allows two users to communicate over E2E encrypted chat with a secret they have agreed upon in the past.

The process works as follows:

A key is derived from the secret using Argon2id, where the salt is hardcoded in the application.
The key is used to encrypt the user's message using crypto_secretbox from NaCl.
The message is sent to the server and downloaded by the other user.
The user on the receiving end decrypts the message using the same key derived in the same way.

As I understand it, in a password hashing system, a unique salt per password prevents attacks where the bad guys have pre-computed the hashes for a ton of different passwords.

Would there be any advantage for my application to use a different salt for each user (possibly generated by the server)?


texts: Re-encrypt modified file section with AES-CTR

texts:
I am trying to encrypt a file using AES/CTR/NoPadding. The goal is to re-encrypt the new/changed blocks and leave the old ones unchanged then generate a new MAC.
My thinking is that when the file changes I’d identify the blocks that changed and encrypt the updated blocks while all unchanged blocks would reuse their existing nonce as to not change their encrypted result.
I understand that reusing nonce’s is not ideal, is there a better alternative to achieve what I’m trying to do?
Forgive my lack of experience in cryptography. I tried searching but couldn’t find an answer that addressed my use case.


texts: Number of pairs needed to attack Double DES?

texts:
I'm having trouble understanding why,in order to do a brute force attack on a double DES (2 keys), one needs to have at least 2 pairs of known plain text?

Same with 3DES (3 keys) one needs to have 3 pairs?

Can anyone help me understand how to figure out the number of pairs needed to do an attack?


texts: AES key length greater than 256 bits - is it dangerous to do an implementation outside of the standard?

texts:
I'm making a digital-asset manager written in ActionScript 3, it will be used to manage highly sensitive information.  I'm using the AS3Crypto library (which has quite a good reputation) to implement AES encryption.

When I encrypt data using the AS3Crypto library, using AES-CBC, and a 256-bit key, I'm able to successfully decrypt it with php/mcrypt using the same key/iv.  That is to say, the AS3Crypto implementation seems fine.

When I use a key longer than 256-bits, I'm able to successfully encrypt it and decrypt it with the AS3Crypto library.  Changing just 1 character in key causes the decryption to fail, indicating that the full key is indeed being used, and not truncated to 256-bit.  However, when I try to decrypt the cipher with mcrypt, it fails (unsurprisingly, as the specification for AES states a maximum key-size of 256-bits).

My questions are, taking the below assumptions into consideration, will using a key longer than 256-bits introduce some sort of vulnerability into the encryption?  And if not, will using a longer key theoretically increase resistance from brute-force attacks?

Assumptions:

I understand that a 256-bit key is sufficiently strong
encryption will only take place client-side with the AS3Crypto library, and hence doesn't necessarily need to be compatible with other implementations
the key is a string containing random alpha-numeric characters, and is not derived from a PBKDF
even if using a key longer than 256-bit is overkill, the extra security that it might offer would be appreciated


texts:
I want to present the basics of how RSA works to an audience of beginners in cryptography. The problem is that I am lightyears from being an expert.

After reading about how RSA works in wikipedia, this is the "toy" demonstration I created:

We shall assume that Bob has a secret natural number that he wants to tell Alice.
We shall assume that they will be speaking to each other, and there are lots of people around (including cryptographers!) that can hear them.
This is how the talk will proceed:

Bob says out loud: "Hey Alice, I want to tell you a secret natural number!"
Alice replies out loud: "Ok, wait a second, let me create the encryption keys."

Now Alice secretly chooses two distinct prime numbers, $p$ and $q$, and calculates two things: $n = pq$ and $\lambda = \text{lcm}(p-1, q-1)$.
Then Alice secretly chooses any number $e$ which satisfies $e < n$ and $\text{gcd}(e,λ) = 1$
Then Alice says out loud the values of $n$ and $e$.

Alice says out loud: "Very well, the public key is $(n=391, e=75)$!"
Bob replies out loud: "Understood, give me a second!"

Then bob takes his secret number $m$ and calculates $c = m^e \text{ mod } n$ and says it out loud

Bob says out loud: "Okay, after encrypting my secret number I got 240"
Alice replies: "Great! I've got your secret number!"

She did it by first calculating $d = e^{-1} \text{ mod } \lambda$ and then calculating $m = c^d \text{ mod } n$.

Then I will choose two people in the audience and let them do it, with everyone else listening, and claim that this is basically what happens with RSA encryption. The rest of the audience will not be able to find out the message efficiently, even though they heard absolutely everything.

The above is what I plan on presenting.

QUESTION: I don't want to be a Dave. I think I'm not a Dave because I am following RSA. Are there any big problems with the above? Does it present the idea of RSA correctly? What gotchas should I mention, if any?

Bonus points for anyone who figures out Bob's secret number above. Of course I know it can be done by brute force because  I chose ridiculously small prime numbers...


texts: Effect of tail cutting and precision of discrete Gaussian sampling on LWE / Ring-LWE security

texts:
How does tail cutting and precision of discrete Gaussian sampling implementations affect LWE / Ring-LWE security? Is there a rule of thumb or guideline for choosing the tail cut and the precision for a given standard deviation?

Tail cutting refers to chopping off the “tail” portion of the distribution ($|x| > \beta \sigma$) which has negligible total mass.

In this paper from 2015, the author recommends tail-cut at $|x| > 9.2\sigma$ and 64-bit precision for 128-bit security. However, it seems too conservative, since many of the NIST PQCrypto submissions are using smaller tail-cuts and much lower precision. For example, FrodoKEM uses tail-cut at $\approx 4\sigma$ and 16-bit precision. Also, FrodoKEM is using the Renyi divergence, instead of the statistical distance, between the theoretical and the quantized distributions, as a measure of accuracy of sampling.


texts: What's that property called when a scheme is secure even if you encrypt the decryption key? Some schemes have problems when your plaintext is the decryption key (or just the key if symmetric).


texts: 128 bit hash with least chance of collision?

texts:
I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON documents can have within them private information, so I want to avoid any issues where two documents have the same hash and the wrong one is served.

Should I use MD5, which I know is vulnerable to collision attacks, or go for one of the SHA functions and use the first 128 bits?


texts: Verifying signature owner (without verifying the actual document)

texts:
Programming in Java.

I have an RSA key-pair, a document, and a signature created with the Java Signature class, using SHA512WithRSA. In order to verify the signature, of course, I need to provide the

public key,
signature,
document.

Is it possible to verify the owner of the signature, using only:

public key
signature


texts: ZK Proof that a blinded message (for a blind signature) contains a certain value

texts:
I am toying with eCash systems and blind signatures, and I started with Chaum's original formulation.
In particular, I'm using this formulation from this link:

User U chooses blinder r and blinds message m with

m' = r^e H(m) mod n

and submits m' to the server. He receives a signature s for H(m).

Now, my original m should have two delimited fields, a serial number S and a value V, and although S should remain unknown to the bank, the bank wants to know for sure that it is encrypting V and not some other value. It is important that the user shows S at the time of spending the key, but that this cannot be linked back to the request for the blind signature.

For the V part, I'm thinking of using a ZK proof, specifically a Sigma-protocol, to prove V is encoded in the hash. To do this, I'm planning to use a Pedersen hash, on a group G with known generators g,h such that their relative discrete log is not known.

Then,

H(m) = H(S, V) = g^S h^V

The User would send to the Signer a blinded value

m' = r^e H(S,V) mod n

where the group element H(m) is serialized and interpreted as an integer.

The user would also send a ZK Proof for these statements:

Private Inputs: r, S, A
Public Inputs: m', e, V, g, h, n

Statement:
m' = r^e * A
A  = serialized version of g^S h^V

The signer does not really care about the format of S, as long as there is something in there. What it wants to be certain of is that the value it is signing, V, is what has been publicly revealed (so that it can deduct the owner's account by the correct balance).

If the proof is correct, the Signer signs the message m' and the User unblinds it to become s = H(m)^d.

When the user spends the note, he will present the values (S, V, s). A merchant can verify the signature by checking

VerifySig(s, H(S, V)) == True

and checking if that S has already been seen before (to prevent double-spend).
Importantly, neither S nor H(S,V) have been revealed previously, so this spending is not linkable to the note creation.

I can see there is a frail point in bringing a group element in a proof of multiplication in an RSA-like group. And I haven't written the details of Sigma-proof yet. But does it look like this is a feasible approach, or would there be easier ways to do this?

I want something secure, of course, but my main concern at the moment is performance and as low interactivity as possible. Therefore, I would not like to use a cut-and-choose model.

Any help would be appreciated. Thanks.


texts:
After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds, I was left wondering why AES's key schedule is invertible.
In the paper, the authors use a related-key-attack to recover the round keys, bit by bit, making some guesses, but they are eventually able to recover the original key by simply putting the round keys through the inverse key schedule.
If the round keys were derived from some one-way function of the key, then this attack would not be possible. Why make the key schedule invertible? Doesn't this reduce the strength of the cipher?


texts: Which bitwise operations are used in SHA-256?

texts:
From the wikipedia entry on SHA-256 I'm a bit confused about which operations actually go into the algorithm. From the pseudo code it appears the operations are $\texttt{xor}$, $\texttt{and}$, rotate, shift, and addition. But further down it says that $\texttt{or}$ also goes into the algorithm. This description (p 5-6) makes no mention of $\texttt{or}$.

So, which is it?


texts: Is Paillier a stream or block encryption

texts:
Does Paillier follow a stream encryption or block encryption technique.
If it’s a block encryption then what is the size of the block in bits or bytes.


texts: Is this a good entropy collector and whitening technique?

texts:
I'm just reviewing a program someone wrote to provide high quality random data using an entropy collector and a hash based whitening technique. I'll try summarize the process:

Collect entropy from sources into separate arrays e.g.

milliseconds between key presses
milliseconds between mouse clicks
mouse movements x + y concatenated together

All the separate numbers are joined into a single array of values (a + b + c).
The array is mixed using a Knuth shuffle using random numbers from the programming language's psuedo random source. I believe a Knuth shuffle works its way through an array in reverse order swapping the current item in the array into a random position in the array.
The items in the mixed array are concatenated together and converted to a single string.
Each 512 bits of the string is iteratively run through SHA2 to give a uniformly distributed 256 bits of output per 512 bits of input. For example if a total of 8192 bits of entropy was collected, the total output would be 4096 bits.

The quality of randomness probably depends on how random the input is, e.g. how randomly the user moved their mouse. It would seem difficult for a person to repeat the same mouse movement path in the same way twice. Let's assume for now the user moved it very randomly and not in a repeatable fashion.

My questions:

Does this give high quality random data compared a PRNG?
What problems are there with this design?
Would "Von Neumann"-whitening work better than hash based?
How could it be improved?


texts:
In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this scheme the sender gets offline in order to compute his real last balance to accept or to refuse the transaction. This is to prevent an offline multi-spend of the value of the balance, and making an overdraft.

Has someone ever build a scheme to make a signature, like ECDSA, linkable?

I know that it exists for ring signatures, but I need it for simple ECC signature.


texts:
I've been suggested to ask here instead of stackoverflow, so here I am.

I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols but I just want to do a basic encryption. The following code is C++, please ask me if you need any help to understand it.

My protocol is something like:

template<uint16_t thePayloadLength>
struct MyProtocolHeader{
uint16_t startOfFrame = 0xFFFF; // Protocol signature
uint16_t version;
uint8_t src;
uint8_t dst;
uint16_t payloadLength = thePayloadLength;
uint8_t payload[thePayloadLength];
}; // the template part probably is going to disappear (too much code bloat)

My idea is to create two functions like:

template<uint16_t thePayloadLength
 /*EncryptedData*/ encrypt(const MyProtocolHeader<thePayloadLength>& plain);

 template<uint16_t thePayloadLength
MyProtocolHeader<thePayloadLength> decrypt(const /*EncryptedData*/& encryptedData);

that basically just do an encryption / decryption of my protocol struct. Then I can send the "EncryptedData" as a payload of an header like the following:

struct EncryptedProtocol{
uint16_t startOfFrame = 0xAAAA;
uint16_t version;
uint16_t sequenceNumber; // can be useful for UDP
uint16_t length; // lenght of the encrypted payload
};
// Encrypted payload here

I was thinking to use AES-GCM as encryption algorithm with the shared key already known by all the applications.

What do you think about it?

[EDIT] all the applications are outside Internet and they all know the public keys of all the other applications.

[EDIT2]

  would you only feed the plaintext part to AES-GCM?

Yes. An alternative would be to add random bytes but I'd like to do something not complicated to implement that guarantees some kind of protection.

  Would you make use of the Associated Data input?

Yes, if I recall correctly AES-GCM should provide that

  Is the shared key static / negotiated for a "connection"?

The first version will make use of pre-shared keys, so no need to negotiate the key. For a future version I was thinking to get the RSA shared key creating a new protocol that will use RSA. All the applications will be configured by an administrator that will "install" the public keys of all the other applications.

Just to clarify, TLS seems too general-purpose and bulky to implement (OpenSSL seems really messy for instance), and I just wanted to add a basic encryption scheme to my application. What I'd like to know is if this design can satisfy that requisite and how good can be considered from a security point's of view.

[edit3]
Totally open to suggestions if something similar already exists.


texts:
I have faced a problem to understand MD5 algorithm.My question is weather the original input message is converted to binary value in MD5 before using the input message as parameter in four Feistel permutations FF,GG,HH and KK?

In order to understand my question here is an example.
If the original input message is 'amrasobaiatel' my question is that weather the message is converted to binary value such as '00010000000000' before padding and appending the 64-representation of the length of the input message?

If the answer of my question is 'yes' then my another question is that how can we convert the original input message into binary value?


texts: Proof in RSA encryption over multiplicative group

texts:
I everyone,

I am considering an RSA encryption over the multiplicative group $G = (Z/nZ)$
of the ring $Z/nZ$, where $n = pq$, and $p$ and $q$ are distinct odd primes.

First, I want to prove that $H=\{x^4|x\in G\}$ actually is a subgroup of $G$.

Next, I am assuming that there comes a probabilistic polynomial-time algorithm $A$ that recovers a correct plaintext $m$ from any given ciphertext $c$ which belongs to the subgroup $H$ with nonnegligible probability. What kind of impact would the algorithm $A$ have on the security of the RSA encryption scheme over the group $G$, where $G$ is the same group as before?

I have tried the following for the first task:

Letting $x,y \in H$, then set $x=a^4$ and $y=b^4$ for $a,b\in G$. And then I have looked at $xy=a^4b^4$. But how to go from here?


texts: Why is encrypting a key under itself dangerous?

texts:
I'm currently self-studying to try and understand more about cryptography for work. I'm on question 2.16 on A Graduate Course in Applied Cryptography
.

For part a), we're given a cipher $E$ that's semantically secure and asked to create $\hat{E}$ where $\hat{E}$ becomes insecure when the adversary is given $\hat{E}(k, k)$. Since I can't control the details of $E$, I figure $\hat{E}(k, k)$ must somehow reveal the key or some key generation algorithm to the adversary, since anything else should be public already (and yet still semantically secure).

At the same time, any $k$ seems like it should be a valid message, so we have to explicitly know the answer to $\hat{E}(k, k)$ (and can't just stumble upon it when trying $\hat{E}(k, m)$).

To me, this seems to contradict and thus I'm stuck. What am I missing?

Update:
I've thought this a little more through and may have some further ideas.

The definition I'm using to verify "semantic security" is that where an adversary submits $m_1, m_2$ and receives $c_x$. At this point, they should have no advantage in guessing which message was encrypted. However, when given $E'(k,k)$, they gain an advantage.
To me, this says that $E'(k,k)$ must somehow reveal information about k, since the scheme should be public by default (Kirchoff's Principle).
Suppose $E'(k, m) = E(k \oplus m, m)$
Therefore, $E'(k,k) = E(0, k)$. Since the decryption alg D should be public, I can decrypt $D(0, E(0, k)) = k$, and thus by giving the adversary $E'(k, k)$ I have given the key.
The adversary submits $m_1, m_2$. Upon receiving $c_1$, they know $k$, and trivially calculates which message was encrypted.
To adjust for the keyspace being smaller than the message space, allow for any excess bits in $k \oplus m$ to be truncated to $|k|$.

Thoughts? Does this work?


texts: Deterministic Rand function for Winternitz One Time Signatures

texts:
Suppose you are implementing a Generalized Merkle Signature Scheme, using the Winternitz One-Time Signature Scheme for the node signatures. Furthermore, suppose the implementation is to be stateless (i.e. you don't keep track of which signatures have already been generated), meaning that you use a deterministic $Rand$ function for generating all private keys, so that any path through the tree might be re-generated on the fly.

Also suppose that the path is selected as a (public) function of the digest to be signed.

The question is, would choosing a $Rand$ function that is not a $PRF$ significantly weaken the GMSS scheme if it is attacked by a quantum computing capable adversary?

For instance, suppose you are using SHA-256/250 for the Message Digest and SHA-256 as the iterated One Way Function. Would choosing the $Rand$ function below be a bad idea? The input value is the binary representation of the path of the private key in the tree.

Let $k_0, k_1$ be two 256-bit AES-256 keys. These keys are the private key for GMSS.

Define function $Rand_{k_0,k_1}:\{0,1\}^{128\times2}\to\{0,1\}^{128\times2}$ as:

$INPUT: x_0,x_1$ (two 128-bit blocks)
$c_0 = E_{k_0}(x_1) \oplus x_0$
$c_1 = E_{k_1}(c_0) \oplus x_1$
$OUTPUT: c_0,c_1$ (two 128-bit blocks)

This $Rand$ function is not a $PRF$ in the random oracle model, because it might be distinguished from a random function with only two selected inputs. But is it good enough to prevent existential forgeries (or other attacks) against GMSS?

The security claim is 250 bit security against classical adversaries and 125 bit security against quantum computing capable adversaries (presuming the adversary can't choose the input message digest to be signed).

Conjecture:
An existential forgery against GMSS is possible iff,

The adversary is able to recreate the Merkle tree(s) above some W-OTS public key $Y_{i,j}$, either because an authentic W-OTS $\sigma_{i,j}$ is part of a GMSS signature that has already been published, or because the adversary has knowledge of a sufficient number of other W-OTS private keys except the one at position $i,j$, and
The adversary either knows the entire W-OTS private key $X_{i,j}$, or the authentic digest signed by the authentic W-OTS $\sigma_{i,j}$ contains at least one zero bit and the adversary knows some of the (at least two) last elements of the private key $X_{i,j}$, corresponding to the checksum part of $\sigma_{i,j}$.

The most probable scenario (in which an existential forgery is possible) seems to be when the adversary knows some part of the W-OTS private key $X_{i,j}$ used for encoding the checksum part of $\sigma_{i,j}$.

Clearly, if the adversary knows one half of $(c_0,c_1) = Rand_{k_0,k_1}(x_0,x_1)$, the other half might be guessed with probability $2^{-128}$. The adversary will know one half of $(c_0,c_1)$ if there exists at least one known W-OTS signature $\sigma^{\prime}$ that signs a digest that contains at least one $b^{\prime}=0$ at a position for which $x_1=x_1^{\prime}$. In such case $c_0 = c_0^{\prime}\oplus x_0^{\prime}\oplus x_0$. Presumably, this will happen with a probability equal to the collision rate $Pr[\exists(x_1,x_1^{\prime})(x_1=x_1^{\prime})] = 2^{-64}$ times $Pr[b^{\prime}=0]=2^{-w}$.

This appears to indicate a security bound that is significantly less than the claim (presuming $w \ll 250-128-64$), but perhaps I am missing something. Or, is it even worse?


texts: Can we sign and encrypt with RSA keys of both sender and receiver?

texts:
By using RSA encryption, it is possible to "encrypt" sign with sender's private key and then with receiver's public key, and decrypt with receiver's private key and then with sender's public key?
Like this:

Sender keys

private: $(n_s,d_s)$
public: $(n,s,e_s)$

Receiver keys

private: $(n_r,d_r)$
public: $(n_r,e_r)$

(Signature then) Encryption of message $m$

$c_1\gets m^{d_s}\bmod n_s$
$c_2\gets {c_1}^{e_r}\bmod n_r$

and then decryption with

$\widetilde{c_1}\gets {c_2}^{d_r}\bmod n_r$
$\widetilde{c_2}\gets {\widetilde{c_1}}^{e_s}\bmod n_s$

Mathematically speaking it should work, right?
EDIT: code with the methods to generate keys, encrypt and decrypt.
    import java.io.*;
    import java.math.BigInteger;
    import java.util.*;

public class ChatRSA {

        //inizializzazione di un oggetto BigInteger con valore intero randomico
    public static BigInteger Rand(){

            Random ra=new Random();

            int bits=1024;
            BigInteger bigran;
            do{
                //Numero che è probabilmente primo(la possibilità che non lo sia è di 1 ogni 100 miliardi di anni approssimativamente)
               bigran=BigInteger.probablePrime(bits, ra);
               //Eseguo un doppio controllo per aumentare la possibilità che sia primo
            }while(!bigran.isProbablePrime(100));// Più è grande il parametro, più aumenta la possibilità che sia primo

            return bigran;
        }
        //Calcolo primo numero delle 2 chiavi
        public static BigInteger N(BigInteger p, BigInteger q){

            BigInteger n=p.multiply(q);
            return n;
        }
        //Funzione Toziente(Conta in base a un numero n i numeri coprimi rispetto a n)
        public static BigInteger V(BigInteger p, BigInteger q){
            BigInteger v=p.subtract(BigInteger.ONE).multiply(q.subtract(BigInteger.ONE));
            return v;
        }
        //Secondo numero della chiave pubblica, che deve essere coprimo di V
        public static BigInteger Npub(BigInteger v){

            BigInteger npub;

            do{
               npub=ChatRSA.Rand();
               // gcd, il massimo comune divisore deve essere 1
            }while(!npub.gcd(v).equals(BigInteger.ONE)&&npub.compareTo(v)==-1);

            return npub;
        }
        //Secondo numero della chiave privata
        public static BigInteger Npri(BigInteger v, BigInteger npub){

            BigInteger npri;

            do{
                //(Npri * Npub)mod(v)Deve risultare = 1
                //quindi questo metodo opera npri^-1 mod(v)
                npri=npub.modInverse(v);

                //System.out.println((npri.multiply(npub)).mod(v).toString());
            }while(!(npri.multiply(npub)).mod(v).equals(BigInteger.ONE));

            return npri;
        }
        //Metodo per convertire la Stringa del messaggio in cifre
        public static BigInteger StringToCipher(String msg){

            //Array di byte, tipo di dato intero più piccolo. Viene usato e gestito in array
            //Recupera in array di bytes la stringa e la assegna
            byte [] bar=msg.getBytes();
            //Il valore dell'array di bytes convertito nel corrispondete grande intero
            BigInteger cmsg=new BigInteger(bar);
            return cmsg;
        }
        //Metodo per convertire il messaggio cifrato in stringa
        public static String CipherToString(BigInteger msg){

            byte [] bar=msg.toByteArray();
            String dcmsg=new String(bar);
            return dcmsg;
        }
        //Metodi per criptare e decriptare il messaggio
        public static BigInteger Encryption(BigInteger cmsg, BigInteger npub, BigInteger n){

            //Il metodo modPow utilizza la formula per criptare il messaggio nell RSA: cmsg^npub mod(n)
            BigInteger c=cmsg.modPow(npub, n);
            return c;
        }
        public static BigInteger Decryption(BigInteger c, BigInteger npri, BigInteger n){

            BigInteger m=c.modPow(npri, n);
            return m;

        }

}


texts: Is the following symmetric design secure?

texts:
Assume:

$O$ be a reversible random permutation oracle on a finite set and $O^{-1}$ the inverse permutation (pretty much equivalent to a random permutation: What is the difference between a bijective random oracle and a random permutation?). Here, the attacker can call both $O$ and $O^{-1}$ on any input
$M$ be a fixed-length message to encrypt
$R$ some fixed-length random data. A new $R$ is generated every time you want to send a message
$K$ the secret key ($|K|=|M|+|R|$)
$C$ the encrypted message
$||$ the concatenation operator

Design:

Encryption:

Generate $R$
Apply $O$ to $M||R$
Xor the result with $K$
Send the output $C=O(M||R)\oplus K$. $R$ is not sent.

Decryption:

Xor $C$ with $K$
Apply $O^{-1}$ on the result
Remove $R$ (easy since $R$ has a fixed length)
Enjoy $M=MSB_{|M|}[O^{-1}(K\oplus C)]$

As long as $R$ is long enough, is this design secure? Why?

I think that any attack that requires more than $2^{|R|}$ queries of the Oracle should be viewed as infeasible.


texts:
How long should a block cipher key length should be?
what key length from below numbers can be treated as safe, keeping in view the current/ future brute force capabilities.

64 bit
80 bit
96 bit
120 bit
128 bit
192 bit
256 bit


texts: How many reversible gates would DES require?

texts:
How many reversible gates (said counting Toffoli and Controlled NOT, with free NOT) would be required to reversibly implement $(K,P)\mapsto(G,C)$ for the block cipher DES?

$P$ is the plaintext, $C$ the ciphertext, both 64-bit; $K$ is the 56-bit key; $G$ is any 56-bit "garbage".

For any block cipher, the function $(K,P)\mapsto(G,C)$ with $G$ the same width as $K$ can be implemented reversibly (rigorous proof and/or straightening welcome).

For AES, this was studied:

Kamalika Datta, Vishal Shrivastav, Indranil Sengupta, Hafizur Rahaman's Reversible Logic Implementation of AES Algorithm, in proceedings of DTIS 2013. My reading is that it reports implementing $(K,P)\mapsto(G,C)$ using less than $2^{17}$ Toffoli gates.
Markus Grassl, Brandon Langenberg, Martin Roetteler, Rainer Steinwandt's Applying Grover’s Algorithm to AES: Quantum Resource Estimates, in proceedings of PQCrypto 2016, seem just over $2^{20}$ Toffoli gates using a different approach.

Towards an answer: an expression of DES's $(K,P)\mapsto(G,C)$ using reversible operations is

a sequence of 16 rounds, each

repeating, for each of 8 S-boxes

temporarily XORing 6 keys bits with 6 bits of the 64-bit block
for each of 4 other bits of the 64-bit block

XORing that bit with some function of the 6 (modified) key bits

restore the 6 key bits by XORing with the same 6 bits

The center operation is executed 512 times, and certainly represents most of the gates. There are 1480 C-NOT for the rest (accounting for the fact that the last restore of each key bit can be skipped). The 4 functions of the same 6 bits in the center loop are neither quite independent nor arbitrary. I know several minimization attempts for these, but none using reversible gates.


texts: How to compute certificates using Diffie-Hellman key exchange with certificates and Elgamal signature scheme

texts:
We consider the Diffie–Hellman key exchange scheme with certificates. We have a system with the three users Alice, Bob and Charley. The Diffie–Hellman algorithm uses p = 61 and α = 18. The three secret keys are a = 11, b = 22 and c = 33. The three IDs are ID(A)=1, ID(B)=2 and ID(C)=3.

For signature generation, the Elgamal signature scheme is used. We apply the system parameters p= 467, d= 127, α= 2 and β. The CA uses the ephemeral keys kE = 213, 215 and 217 for Alice’s, Bob’s and Charley’s signatures, respectively.

To obtain the certificates, the CA computes xi = 4*bi +ID(i) and uses this value as input for the signature algorithm. (Given xi, ID(i) follows then from ID(i) ≡ xi mod 4.)

Compute three certificates CertA, CertB and CertC.
Verify all three certificates.
Compute the three session keys kAB, kAC and kBC.

I am confused on how to solve for this problem. The book does not really clarify how to do it well.
In particular I have no idea what the 'bi' used to solve for xi in the signature is.

For Example: to get certificate A I know that I need to find CertA = [(kA,IDA),sig(kA,IDA)]

To find kA(the public key), I do α^a mod p (which I found to be 10)

To find the signature, I do Sa = (x-d*r)*kE^(-1) mod p-1, where r=  α^(ke)mod p
The question says that xi = 4*bi +ID(i), which would be the x, but I don't know what the bi is referring to, so I don't know how to solve for the signature.

And for the verification step, it says ver_subK_subpub,CA(CertB), but it does not say what the verification function is anywhere. How do I verify if it does not say how to?


texts:
I'm trying to generate a signature for DSA with the following parameters:

$p = 23$ , $q = 11$ , $g = 3$ , $H(m) = 8$ , $x = 5$

for the life of me, I cannot choose a random $k$ ($0 > k > q$) that will give me $r$ , $s$ that 'add up' when calculating $w$, $u1$, $u2$, and verifying.

I don't know if I'm just doing my maths wrong, but I've tried every possible $k$ between $0$ and $11$ and I just can't get $v = r$ at the end of verification.

can someone please please help and show your working out if possible?


texts: Does keeping a public key private or using multiple encryption help?

texts:
I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here.

My friend said that when he used public key cryptography in the past, he used to keep his public key private too. Only giving it out to people that really needed it (i.e. don't post it on the internet, but giving it out personal to a select group of people). He said that this made it harder for third parties to break the encryption that do not have the public key. I argued that he could have better used a symmetric cipher instead of this scheme, as it is a lot faster and with sufficient key size just as secure. So two questions arise here:

Does keeping your public key private give you any more security?
Does this scheme have any advantages over a symmetric scheme?

Also he said that he used to combine different ciphers and run them a random amount of times. Only the other party knows how many times and what cipher combination. He said that it not only makes the encryption stronger by enlarging the effective calculation time, but it also introduces a human factor, that is someone has to think this out and make the decision to try different ciphers different amounts of times. I argued that this is true, but unnecessarily complicated, because choosing a large enough key size for a single cipher will be just fine (can cost thousands of years), even for military security. So:

Are there any REAL benefits of running different ciphers for random amount of times to try to confuse the attacker? Or is this just unnecessarily complicated?

To clarify:

With military security I mean that, at the current moment, it is impossible to break the encryption, even for governments institutions (like the NSA).
To better illustrate my question: instead of giving out your public key to a select group of people, you give it out to one individual. Furthermore, you can be sure that he knows how to handle a key ring and that he has no benefit from leaking your public key (i.e. he has no benefit from leaking the clear text you messaged to him)


texts: Dictionary attack on pass-phrases on common algorithms?

texts:
I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords can take longer, right?

But it's not necessarily true depending how unaware users can be, and that's where dictionaries shine.

So as the recent XKCD demonstrated, pass phrases are much more secure not because of their bit entropy, but because of their bit length, and even if a pass phrase is done with common words which also are in a dictionary, a dictionary attack of a pass phrase is still "infeasible" if it is at least 3 or 4 words, which makes it still very easy to memorize.

So would it be a good design choice to force users to choose at least 3 words in the dictionary to have a long enough password, for example with some auto-complete feature? What do you think?

PS: I'm asking this not in the context of expensive information requiring design efforts, I'm more thinking into good privacy for public use, considering the attacker has access to the cipher-text (which is not necessarily true on the web).


texts: what is the difference of Pretty Good Privacy and Gnu Privacy Guard

texts: i want to know about the difference. of this two. because as far as i know  many cryptocurrency users.  use this for  more secure  transactions specially when the amount is huge.. to prevent identity while having a discussion about the transaction.


texts: Does perfect secrecy imply uniform ciphertext distribution?

texts:
I suspect the answer is no, but I am not able to either prove it, or provide an example. In Katz and Lindell's book, it is only said that with a perfectly secret encryption scheme, the plain and ciphertext distributions are independent. But when I try to construct an example with a non-uniform ciphertext distribution, (using say, 4 plaintexts as a message space), I cannot devise a plaintext and key distribution such that the resulting ciphertext distribution is not uniform.

What I am getting wrong? (or can anyone provide such an example?)


texts: How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?

texts:
Suppose I have two arrays :

A = a single byte, being zero.
B = two bytes, both being zero.

B = A||0 (i.e. B starts with A, and differs only by appending a zero byte)

BLAKE2(A) != BLAKE2(B)

Yet, according to the scant documentation I can find, BLAKE2 pads with zero bytes.

Given that both an array with just one byte, and an array with two bytes, are well within the size of a single block, theoretically their full-block-length zero-padded equivalents are identical.

So, if it isn't padding the inputs with a length indicator, and if the finalization flag mentioned in the scant documentation is either all binary 1s or else all binary 0s as the scant documentation clearly states (thus providing no indication of which bytes in the final input block are padding), how is BLAKE2 able to make a different hash for these two inputs?

Note: It does make different hashes from these two inputs, and that's a very good thing, and I'm in the process of writing some software that relies on this property of BLAKE2, but I would feel more confident if I understood why/how this is happening.  Thanks!

P.S. I tried tagging this BLAKE2 but the system wouldn't let me - apparently the tag doesn't exist yet.


texts: Why are the outputs of the md5sum tool and Crypto++'s MD5 different?

texts:
Could you please tell me what is the difference of coreutils' md5sum and sha*sum tools (sha1sum, sha224sum, etc.) compared to Crypto++'s digest functions?

I've written a piece of code using Crypto++ hash functions but the result is different from the corresponding Unix tools'.

For example if I write in command line:

 echo test123 | md5sum

I get:

4a251a2ef9bbf4ccc35f97aba2c9cbda

but the Crypto++ MD5 function results with:

cc03e747a6afbbcbf8be7668acfebee5

Similar things happens when I use another digest functions (as mentioned earlier).

Both Unix and Crypto++ manuals says it simply calculates digest, but says nothing about output format.

I can see both have the same length, both seem to be in hexadecimal form (0-f) and moreover when I type the hashes into Google, in both cases it says that it is an MD5 hash of test123.

Do you have any ideas about it?