texts: What is the meaning for a vector mod a matrix in a lattice?

texts:
I'm reading about the lattice recently.In the paper, it gives a method of a vector mod a matrix:

⃗c mod B as ⃗c−⌊⃗c×B^(−1)⌉×B = [⃗c×B^(−1)]×B.

I know that a integer A mod the other integer B is A+-kB, to make A in the defined field B.

Can anyone tell me what is the meaning of a vector mod a matrix and the mid term ⌊⃗c×B^(−1)⌉ means?:(

Tks.


texts: How do you represent a compressed point on an elliptical curve over F2m?

texts:
I understand for prime curves it is just

bytes(0x02 + flag) + bytes(x)

where flag is the LSB of y. For the F2m curves I cannot make out how to do it.

IEEE P1363 section 5.6.6.1.2 appears to say flag is '1 if y of point > y of inverse point else 0' which I think just means if y > x.
These slides (slide 15) by Julio Lopez and Ricardo Dahab appear to suggest my interpretation of the IEEE method is off (I think).
And this PDF - which I think is the standard reference - has yet another notation in section 2.3.3 part 2.2.2 that I do not understand.

Which of the above references represents the "standard" to handle this? And can someone please explain the proper/correct way to handle things; preferably from a programmer's perspective?


texts:
I want to send out short messages to the world which listeners could verify to be send from me.

The way this is usually done is to encrypt the message with a private key where the readers decrypt it with my public key. My problem is that I need small messages, smaller than 64 bytes in base64, plain RSA won't work since the algorithm makes the encrypted message around 128 bytes.

Can someone suggest the name of an algorithm to me that may work?


texts: Can I use a Friedman test when decrypting a playfair cipher

texts:
I have a playfair cipher I’d like to decrypt however I need to find the key word first. Is it possible to use the Friedman test here to find the length of the key word?
My cipher has no J’s in it would this mean my Ni for J would be 0 or would I just leave the J column out?


texts:
I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key.

Here is the full recipe:

Compute a HMAC on the data to encrypt, and append it to the data.
Encrypt the data with AES_CTR_256.
Compute another HMAC, this time on the encrypted message+HMAC combo, and append it the the ciphertext.

Would using the same key, eg. thisisareallyinsecurekey, on both the HMAC's be cryptographically secure? Or would I need to use different keys for each HMAC?


texts: In S/MIME, are the same certificates always used to sign and encrypt messages?

texts:
My assumption is that S/MIME almost always utilizes certificates as follows:

My certificate can be used to allow people to encrypt messages and send them to me.
My certificate (the same certificate) is used by me to sign messages and send them.

Is there an RFC reference that specifies this is a requirement for S/MIME?
I'm scanning through RFC 5751 and not seeing anything jump out at me...


texts:
I've got a homework problem that I'm having a hard time understanding. It's for the Three-Pass Protocol, and we are given p, the three messages, and are told that the original plain text is one of two values.

The professor says we can use number theory to look at any of the three messages and determine which of the two original plain texts is correct, but I'm not seeing how. We covered the intruder in the middle attack, but since we can't send our own message that can't be the right action to take.

Could anybody point me in the right direction?


texts: Question about Enigmas involutional property and its reduction of possible ciphers

texts:
I'm currently learning cryptography at a university. I can't wrap my mind around how the involutional property of Engima reduces its possible ciphers while being poly-alphabetic. Can someone please explain this?

The German Wikipedia link says that if the plaintext is ABCD, then the ciphertext CADB is impossible.

We're looking at all possible permutations of ABCD and apparently the only possible permutations are:

BADC
CDAB
DCBA


texts: Encrypt with K1, K2 and decrypt in opposite with K2, K1

texts:
When using symmetric cipher, does the following statement holds:

E(x, k) means encrypting x with key k in ECB mode

E(E(x, k1), k2) = E(E(x, k2), k1) ?

Then the decryption could go in opposite way round and the message x would be the same.


texts: If you happen happen to have a message $m ∈ Z_n \backslash Z^*_n$, RSA works but not secure. How likely is it going to happen? $|n|=1024$ bits $|p| = 512$ bits $|q| = 512$ bits.


texts: Where can I find information on the speed of basic hand-operated ciphers?

texts: I have a science fair project coming along, and I'd like to focus on a basic cipher (something simple, like a substitution cipher) and how I could make a similar system that would be about equally secure but would be faster to decode. Is there anywhere I could find information beforehand on deciphering speeds or would I have to try get my own results?


texts: If DDH is hard then CCA-secure PKES exist?

texts:
My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following:

  If decisional Diffie-Hellman problem is hard then there exists a CCA-secure public key encryption scheme.

How is this justified?


texts:
I am trying to optimize GCM multiplication. This PDF explains GCM:
The  Galois/Counter  Mode  of  Operation  (GCM)
The algorithms are in section 4.1

In algorithm 3 I have to multiply table M [128] with the element P that represents the
polynomial α.
Formulas (3) and (4) appear on page 9. From what I can understand, this would be:

**if V127 =0 then V ← rightshift(V )

else
V ← rightshift(V ) ⊕ R**
The polynomial f would be 0xe1, no?
But in algorithm 3 I do not understand this: M[i] ← M[2i] · P. What would be the value of the element P if it corresponds to the polynomial α?
Hopefully, someone knows some code of the implementation of the tables that I can read. I have not found any code that can help me understand all of this.


texts: Privacy of Multiplication of Shamir Shared Secrets with an Active Adversary Where Final Result is Revealed to a Third Party Over a Secure Channel

texts:
I have the following question related to the privacy of multiplication of Shamir Shared Secrets:

Suppose we have two secrets, a and b, shared by a Shamir Secret Sharing Scheme in a (k,n) configuration.  We would like to perform a number of secure addition, scalar multiplication, and multiplication operations on the shares e.g. compute a+b * 2ab and reveal the final output of those operations to a third party over a secure channel.  We can assume the holders of the shares have no visibility into the reveal process (i.e. they simply reveal their own shares and do not see the other shares).

We have a static, active adversary who has compromised fewer than k shares.  The adversary can:
a. view the values of the compromised shares
b. view the values of the multiplication results sent by the other shares to the compromised shares i.e. the sharings of αβ in the multiplication protocol of Gennaro, Rabin, and Rabin.
c. manipulate the multiplication results sent by the compromised shares to the non-compromised shares
d. manipulate the share values revealed to the third party by the compromised shares over the secure channel

We don’t care whether or not the final result is correct or even being able to detect if it isn’t  (I realize it this may sound contrived by I don’t want to cloud the question with the reasoning behind this).

What I’d like to know is if the adversary is able to gain any information about a or b in the course of participating in an arbitrary sequence of the above operations on a and b?  I guess my concern is that by manipulating the αβ sharings, the adversary can somehow coerce the honest players into revealing data about their shares in subsequent multiplication operations.  Sorry if this simply doesn’t make sense, I’m an engineer and not a mathemetician :-)  If it doesn’t, some sort of intuitive explanation why this can’t happen would be greatly appreciated.  The same goes if it is possible.

BTW, I don’t believe the findings of Tompa and Woll related to the general security of linear secret sharing schemes apply because their attack, as I understand it, assumes that the adversary sees the honest shares in the reveal process which is not the case here.


texts: In ISO/IEC 9796-2 (signature with message recovery), why are some message representatives bigger than the modulus?

texts:
I have implemented signature scheme 2 from ISO/IEC 9796-2 in C using OpenSSL for the underlying crypto operations.

To generate the message representative (F in the standard), I just call PKCS1_MGF1() (defined here), and then XOR that to the data to be signed, excluding the hash and the trailer, as the standard says.

Then, I get that blob and run it through RSA_private_encrypt(), setting the padding flag to RSA_NO_PADDING (docs here).

It turns out that, for some inputs, the resulting message representative is bigger than the modulus when converted to a number, which causes RSA_private_encrypt() to fail.

NOTE: the message representative is computed according to the standard, it is always 128 bytes in length (just like the modulus), and it matches the samples provided in Appendix E, so I presume there are no bugs in the way I generate F.

My key is a 1024-bit RSA private key generated with openssl genrsa, with e = 65537, which is an odd number. To the best of my understanding, given that e is odd (which the standard calls v, but they're otherwise the same thing) I can use the "alternative signature production function" (defined in Appendix B.6), which is, well, basically textbook RSA.

Is there anything I have misunderstood that is causing this issue?

If my implementation is correct, then how could I deal with these Fs that are bigger than the modulus?


texts: Lifting a congruence $f(X) \equiv gh (\textrm{mod} \ p)$ to a higher power moduli

texts:
I have the polynomial ring $R = \mathbb{Z}[X]/(X^N - 1)$ with $N = 11$ and $h \in R$ with
\begin{equation*}
h = 7 -11X - 7X^2 -12X^3 + 8X^4 - 11X^5 + -8X^6 + 11X^7 - 4X^8 + 2X^9 + 3X^{10}
\end{equation*}
Now I want to find the polynomial $u$ such that
\begin{equation*}
u\cdot h + v\cdot (X^N - 1) \equiv X - 1 \ (\textrm{mod} \ 32)
\end{equation*}
where we assume $\gcd(h, X^N - 1) = X - 1$ reducing coefficients $\textrm{mod} \  32$. If we also let $*$ denote the multiplication in $R$, I can easily find $u$ such that $u*h \equiv X - 1 \ (\textrm{mod} \ 2)$ using the extended Euclidean algorithm, and it's $u = 1+X+X^{4}+X^{5}+X^{9}$, but I'm having issues using this to construct the solution such that $u' * h \equiv X - 1 \ (\textrm{mod} \ 32)$. Can someone outline an algorithm or link me some reading material on how to do this?


texts:
As described in another question How to get exact number of slots in HElib?, get the exact number of slots with relative small parameters m and q is not easy. In fact, in HElib, we cannot decide the exact slots in the ciphertext, the function findM() can only help us find the smallest m to satisfy the security level.
Due to this concern, I have a question:
When given a ctxt with 16 slots, (1, 2, 3, ..., 16). The expected rotation rotate(ctxt, -2) should be (3, ..., 16, 1, 2). But if we get a ctxt with 20 slots (as described above, we usually get the ciphertext with more slots). Rotate it directly, we get (3, ..., 16, 0, 0, 0, 0, 1, 2), how can I get such expected format (3, ..., 16, 1, 2, 0, 0, 0, 0)?
Similar, for right rotation, we should get (15, 16, 1, 2, ..., 14, 0, 0, 0, 0) instead of (0, 0, 1, 2, 3, ..., 16, 0, 0) which definitely result in wrong results in the following computations.
We have to do some additional rotations, shifts and additions to implement this?
BTW, I focus on this format of rotation because I need to implement matrix multiplication. With those extra slots, it would result in bad results.


texts:
The IND-CPA game has two challenge-response phases

A key is generated by running $Gen(1^n)$ and challenger selects a bit
b {0,1} uniformly at random.
Adversary gets input $1^n$.
Can query the oracle a polynomial number of times with messages and gets $E_k(m)$ back.
Attacker sends messages $m_0$, $m_1$, challenger returns $E_k(m_b)$.
Can query the oracle a polynomial number of times with messages and gets $E_k(m)$ back.

Why are these two challenge-response phases (3,5) necessary? I understand why at least one phase is necessary (ex: to ensure that deterministic algorithms are not IND-CPA secure), but why both?


texts: Convert numeric value of RSA key to a .key file

texts:
After reading about RSA encryption in wikipedia I managed to create two number, a number d which is the private number, and a number n which is the public number.

But when I tried to use these keys to encrypt and decrypt php seems to prefer functions such as openssl_public_encrypt and libraries like phpseclib which seem to need a .key file or a .pem file or a .cem file... Which when I views them looked nothing like a number.

I'm a beginner and I do this kind of stuff because it fascinates me a lot.

So why don't they look like numbers?And how can I convert my numeric value a key to such a value?


texts: What are the consequences if someone finds the accessible 1600-bit block $X$ and $R$-bit block $V$ such that $\text{Keccak-}f[1600](X \oplus V) = X$?

texts:
Let $H$ denote any hash function based on the sponge construction. Let $F$ denote its underlying function that transforms the $L$-bit state (for SHA-3, $F = \text{Keccak-}f[1600]$ ). Let $R$ denote the bitrate.

Note that the padded message $M$ has the following form:

$$\text{pad}(M) = B_1 \mathbin\Vert B_2 \mathbin\Vert \ldots \mathbin\Vert B_{N-1} \mathbin\Vert B_N,$$

where $B_i$ denote $R$-bit blocks.

Consider the possibility that there exists some $L$-bit block $X$ and $R$-bit block $V$ such that $F(X \oplus V) = X$ (obviously, assuming that the xoring takes place in the same position where the padded message blocks are xored into the state). Moreover, there exists some sequence of $R$-bit blocks $$S = B_1 \mathbin\Vert B_2 \mathbin\Vert \ldots B_{Y-1} \mathbin\Vert B_Y$$ that lead to the state $X$. Doesn’t this mean that if someone knows $S$ and $V$, it would be very easy to choose any suitable sequence of $nR$ bits (where $n$ is any natural number greater than 0), denote it by $T$ and generate arbitrarily many different messages such that
$$\begin{array}{l}
{\text{pad}(M_1)} = S\mathbin\Vert T,\\
{\text{pad}(M_2)} = S \mathbin\Vert V \mathbin\Vert T,\\
{\text{pad}(M_3)} = S \mathbin\Vert V \mathbin\Vert V \mathbin\Vert T,\\
{\text{pad}(M_4)} = S \mathbin\Vert V \mathbin\Vert V \mathbin\Vert V \mathbin\Vert T,\\
\ldots?
\end{array}$$

But this means that $H(\text{pad}(M_i))$ is always the same for any $i$. What are practical consequences for $H$ if someone manages to find such a combination of $S$ and $V$, and then publishes it immediately (so that this combination is in open access for everyone)? That is, what practical applications (use cases) of $H$ will be impacted?


texts: Random oracle model proofs and programmability

texts:
Proving the security of a scheme with the random oracle model (ROM) involves two steps: first you prove that the scheme is secure in an idealized world where a random oracle exists, and then you implement this scheme in the real world by replacing the random oracle with a hash function. Why wouldn't you prove the security of the scheme with the hash function that you end up implementing the world with? Is it because no proof has been found or are there any other reasons? Could you give me some examples?
Could you explain to me the "programmability" feature of the random oracle model? In my book (Katz-Lindell) it says: The reduction may choose values for the output of H as it likes (as long as these values are correctly distributed, i.e. uniformly random).
If I understand correctly, the function $H$ that will act as a random oracle can be fixed beforehand or it can be generated "on the fly", by generating a table of inputs and outputs and when there is a new input the function generates a new output and enters it into the table. What is the theoretical difference between the two?


texts: How to compute a challenge c using Fiat Shamir?

texts: I have a prover and verifier. They are engaged in a zero-knowledge proof protocol. A verifier sends a challenge $c$ to the prover so he can compute a proof using the value $c$. How to use Fiat Shamir so that a prover can compute that challenge $c$ from some public parameters without interacting with the verifier?


texts: Are there any symmetric authentication systems based on the hardness of an NP-complete problem? I understand that it doesn't really matter, since NP-completeness is about the worst case, and in crypto we care about the average case, but I still feel it's somewhat interesting...


texts: Break El-Gamal Algorithm by knowing the value of the random k

texts:
In El-Gamal Algorithm, the public key is $(p, g, A)$, and the secret key is $(a)$, in order to encrypt some data, the sender generate a random $k$, where:
$(C_1, C_2) = (m.A^{k} \pmod{p}, g^{k} \pmod{p})$
If a hacker know the value of $k$, should this break the algorithm security ?


texts:
Could someone explain the main differences between Key Policy Attribute Based Encryption (KP-ABE) and Ciphertext Policy Attribute Based Encryption using an example?

I know that KP-ABE depends on the private keys associated with the person trying to decrypt the message while the CP-ABE depends more on the attributes used in encryption. I would like to see an example that explains this part more to get a better idea.


texts:
Am trying to understand Garbled Circuit based approach for Secure Two party Computation. There isn't much leakage in the classic millionaire's problem where the comparison circuit is used.

But imagine they want to do some arithmetic operation (like addition or multiplication) without revealing their individual wealth.

Then although each of them need not reveal their individual wealth using Garbled Circuits approach (by running the protocol with an addition circuit),  the sum total of their wealth would easily reveal the other millionaire's wealth (By doing simple difference of the total wealth and self wealth)

So is secure two party computation recommended only for a class of circuits ?


texts: Sage Vs C++(with NTL) for implementing cryptosystems

texts:
Is Sage a better alternative to C++(with NTL), for programming that involves math objects like polynomial rings in cryptosystems? I hear that Sage is an open source alternative to Magma. I have used Magma before for such programming and it was easier than using C++ because it had built in keywords for defining such structures and to work with them.

I also found that I can make use of the NTL lib in Sage. Is there any advantage to using C++ in terms of efficiency?


texts: How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶

texts:
I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint.

Given is a block cipher $F$ with key length $n$. It looks like this:
$$c = ENC_{k1}(DEC_{k2}(ENC_{k1}(m)))$$
with key length $2n$. I have to figure out a key recovery attack with $O(2^n)$. There is an additional information that a few plaintext/ciphertext are enough to verify the found keys.

I’ve already been reading some papers like On the security of 2-key triple DES, which describes the van Oorschot-Wiener attack and a generalized method. But even after reading the paper, it seems that the complexity is still larger than $O(2^n)$.

I even had a look for questions which are similar to mine and which might have described better attacks than the van Oorschot-Wiener attack I’m currently fiddling with, but none of them offers a usable answer to what I’m trying to find. For example, in the Q&A “Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?” they are doing a meet-on-the-middle which costs $2^{112}$ operations, which would be $2*keylength$.

The van Oorschot-Wiener attack I’m trying obviously has a lower attack cost. Here it seems that the cost can be reduced to $2^{56}$ but I have no clue how; meaning: even when I use the van Oorschot-Wiener attack and calculate the attack costs for 3DES, I get $2^{57}$ and not $2^{56}$ as expected.

Am I simply missing something somewhere (like: is the $2^{57}$ I’m getting actually correct)? How can the cost of the attack be reduced to $2^{56}$? Or does something better than van Oorschot-Wiener’s attack exist, which enanbles us to attack this scheme with an attack cost $\le 2^{56}$?

What I did so far:

I have a couple plaintext/ciphertext pairs. I put them into
table 1 and sorted it by the plaintext.
For $k1 = 1, ... , 2^{56}-1$ :
$P_{k1} = DEC_{k1}(A)$ where $A$ is a fixed value.
Lookup $P_{k1}$ in table 1 and if it is in, take the corresponding C and  compute $B=DEC_{k1}(C)$.
Store $B$ with $k1$ in table 2.
For $k2 = 1, ... , 2^{56}-1$ :
$B_{k2} = DEC_{k2}(A)$
Lookup $B_{k2}$ in table 2. If it is in, $k2$ and $k1$ are possible candidates.

Step 2 and 3 need each $2^{56}$ computations and if I am not mistaken, this would be $O(2^{57})$. This does not consider the search in the table.

Here is the answer to this question. There is an attack based on the following paper: http://cs.jhu.edu/~sdoshi/crypto/papers/p465-merkle.pdf

Here is a visualization on what happens:

Here is the algorithm:

Two things happen in step 1 (a). The decrypted value of 0 is interpreted once a M2 with the key $k_{2}$ and once as $P_{0}$ for the key $k_{1}$. This means with just one operation we get 2 values!

In step 1 (b) the value gets saved in a table with $i$ which represents the key $k_2$, and a label middle. This table will be used for a table look up (TLU) later on.

In step 1 (c) you see there is an $ENC(S^{-1}_{i}(0))$ where $S^{-1}_{i}(0) = M2$ from step 1 (a). This is a CPA request. We ask the algorithm to encrypt the value from the first step. This goes into another decryption $S^{-1}_{i}$, where $i$ represents $k_{1}$.

The value from the previous step is saved in the table with $i$ ($i$ = $k_{1}$) and a label ends.

The last steps should be self explanatory.

The question is: Why is it working?
Let's have a look at step 1 (c) again:

$S^{-1}_{i}(Enc(S^{-1}_i(0))) = S^{-1}_{i}(S_{k1}(S^{-1}_{k2}(S_{k1}(S^{-1}_i(0)))))$

You see, that if $i = k1$ we get the following:

$S^{-1}_{i}(Enc(S^{-1}_i(0))) = S^{-1}_{k2}(0)$

This is saved in the table and that is the reason why we look for adjacent entries in the table with the labels.

Complexity:

The for loop goes from 1 to n: $O(2^n)$
Within the loop we have $2^n$ CPA requests
Space: When I am not mistaken: $O(2^{2n})$

I hope it helps some people :)


texts:
Suppose I have a message in the form of:

$m = \text{prefix} \mathbin\| \text{secret} \mathbin\| \text{padding}$

We have:

$e=3$
$n$
$n_\text{padding}$ (length of the random padding, <$1/4$ of $m$)
$\text{prefix}$, which is small, only 5 bytes

Is there a way to recover the message with these parameters? I thought about using a variant of Coppersmith but didn't come across anything satisfactory that seemed to work using what I have.


texts: What is the main difference between Anonymous HIBE and Anonymous Predicate Encryption? In my opinion, both work for the same concept in different ways.


texts:
WEP is now considered as insecure. But how about the 256-bit WEP?
Could someone explain why a 256-bit encryption isn't enough?

'A 256-bit WEP system is available from some vendors. As with the other WEP-variants 24 bits of that is for the IV, leaving 232 bits for actual protection. These 232 bits are typically entered as 58 hexadecimal characters. ((58 × 4 bits =) 232 bits) + 24 IV bits = 256-bit WEP key'


texts: Obfuscate an "I'll reveal if you do" function

texts:
Is there any cryptographic obfuscation scheme that will let me obfuscate a program that reveals my secret, if you reveal yours?

Formalization.  Let $C(\cdot),V(\cdot)$ be a secure commitment scheme.  In other words, $C(x,r)$ is a commitment to $x$ under randomness $r$, and $V(\cdot)$ is the corresponding verification function, so that $V(C(x,r),x,r)=1$ and $V(C(x,r),x',r')=0$ if $x\ne x'$.

For instance, one example commitment scheme is $C(x,r) = H(x \;||\; r)$ and $V(c,x,r)=1$ if $H(x \;||\; r)=c$, $0$ otherwise; where $H$ is a cryptographic hash function.

Suppose Alice has a secret $x$, and she publishes a commitment $c=C(x,r)$ to her secret.  Suppose Bob has a secret $y$ of his own.  Can Bob build a obfuscated program $P$ so that, when you run $P$ on input $x,r$, it outputs Bob's secret $y$, but the source code of $P$ doesn't reveal anything about Bob's secret to someone who doesn't know Alice's secret?

To make this precise, we can define the function $f$ by $f(w,q) = y$ if $V(c,w,q)=1$ and $f(w,q)=0$ otherwise (in fact I don't really care what the output is, in the latter case, as long as it doesn't reveal anything about $y$).

My question. Can Bob obfuscate $f$ to get a program $P$ that computes the same functionality as $f$ (so $P(w,q)=f(w,q)$ for all $w,q$), but where the source code of $P$ reveals nothing about $y$?

Can this be done in a way that is efficient enough to be practical?  I am fine with a solution for any commitment scheme of your choice: you can co-design the commitment scheme and the obfuscation method.  I am fine with the random oracle model and any plausible cryptographic hardness assumptions you might want to make.

Motivation. This would help with the construction of cryptographic fair exchange protocols, where intuitively we want Bob's secret to be revealed if Alice's is (except there are many more details I'm omitting that are out of scope for purposes of this question).

One thing that makes me think it might be doable is that this is a lot like a point function, which we do know how to obfuscate.  The difference here is that the obfuscator (Bob) does not know Alice's secret $x$ -- he only knows the commitment $c$ -- whereas the standard methods for obfuscating a point function would require Bob to know the secret value $x$.  So, the standard methods for obfuscating point functions do not immediately solve this problem... but can they be adjusted or extended somehow?  Alternatively, I know there have been recent breakthroughts in indistinguishability obfuscation; might those help with this obfuscation task?


texts: How to know when decryption fails in Yao's Garbled Circuits

texts:
I'm reading A Gentle Introduction to Yao's Garbled Circuits, and I came across this passage:

  Note that in order for this to work, Evan needs to know when
  decryption succeeds, and when it doesn’t. Otherwise, there’s no way
  for him to know which ciphertext yields the correct answer. So, simply
  XOR-ing the key with the encrypted value will not work here.

Essentially, Alice sent 4 values, each encrypted using different keys using symmetric-key encryption. Bob has one of the 4 keys and needs to know for which of the 4 values decryption succeeds. How does Bob accomplish this?

I figure since the unencrypted values are all either 0 or 1, the encryption could somehow be set up so that a failed decryption produces a non-0/1 value with really high probability, but I don't know if this is right.

How is failed symmetric key decryption detected in Yao's Garbled Circuits?


texts: Can i generate a SHA512 hash if i know the SHA256 hash of some unknown data?

texts:
if the SHA256 Hash of some unknown data is known !
Can i find the SHA512 of that unknown data ?


texts: Why the basis is reduced in nearest plane algorithm in solving CVP

texts: In Babai nearest plane algorithm(solve approximate version of CVP), given the basis as input first step is to find the reduced basis(using LLL reduction algorithm). Why the reduced basis is used for further steps?


texts: Should I bother implementing DH + AES, or leave it to a library like Crypto++

texts:
I'm making a C++ back end for an application that'll heavily rely on AES-256 and DH. Should I trust third party libraries, or spend (lots of) time to learn about cryptographic implementation and write my own? Is there any reliable authority that can audit the security of a library (like Crypto++ in this case)? I hope this question doesn't come off as opinion based, but it's quite hard to find reputable data on this. I have no idea where to even start.

TL;DR: What's worse: risking vulnerabilities in a third party library, or risking novice mistakes in a custom implementation?


texts: Key Scheduling of International Data Encryption Algorithm (IDEA)

texts:
How to perform the key scheduling in International Data Encryption Algorithm (IDEA),
I took a research but I can't understand how to perform it,

"further groups of eight keys are created by rotating the main key left 25 bits between each group of eight.", this is the part where I cannot understand the key scheduling of IDEA


texts: Is hashing data with dynamic keys still worth effort?

texts:
some years ago it took long time to "decrypt" hashes because they took slow cpu to brute force. Nowadays they use graphic cards for stuff like this and can do this most time in less than 20 Minutes without problems.

So: Even if they don't take that long to decrypt hashes, would it still be worth time in developing, debugging and troubleshooting(, ...) or would they still take only minutes to crack a hash when using dynamic keys (never the same two) ...

Is there any kind of formula to calculate how much time they'd need like there is with normal hashes?


texts: Partial hash code protocol for security tokens providing signatures

texts:
I've read the following two sentences within a beta protocol specification, which references ISO/IEC 7816-8 for PSO:HASH which already contains notions of a "partial hash".

  The off-card entity is responsible of computing the intermediate hash over the first part of the data to be signed. The intermediate hash-code is transferred to the token by the PSO:HASH command together with the remaining part of the data, the token performs the last round hash computation.

As far as I know, there is no standard that describes how a "partial hash-code" or "intermediate hash-code" values can be transferred. Does anybody know of a standard way to represent a partial hash code as octet string?

Note that in the protocol specification a "bit counter" is also send after the "intermediate hash-code", plus some last bytes of the message itself.


texts: MD5 hash different between sources - different hash for the same string

texts:
I've implemented the md5 source from a crypt lib from http://sourceforge.net/projects/libcrypt/

The string I'm passing to md5 is ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890.

From the md5 provided by my system I receive this hash 26756d7b34ff23859568262596dc159d but from what I've implemented I'm getting, consistently, 11e16a7373051c77c51798c45611581c.

I'm sure both follow the standards for md5 but just use a different "starting point" to calculate the hashes?  Should I continue using the methods I found over on sourceforge?

I'm very unfamiliar with terms in general; when I say "starting point" I'm imagining just this method in md5.c from libcrypt :

void md5_init(union hash_state * md)
{
 md->md5.state[0] = 0x67452301; // are these values standard to begin with?
 md->md5.state[1] = 0xefcdab89;
 md->md5.state[2] = 0x98badcfe;
 md->md5.state[3] = 0x10325476;
 md->md5.curlen = md->md5.length = 0;
}


texts: What's the difference between single key-pair public key encryption and proxy re-encryption?

texts:
Proxy Re-Encryption provides the ability to transform a ciphertext encrypted under some key to the one under another key.
This seems interesting. But, something seems strange.

Suppose Alice has a key pair (sk_a, pk_a) and Bob also has a key pair (sk_b, pk_b). If Alice and Bob generates a proxy re-encryption key to transform a ciphertext under pk_a to the one under pk_b and vice versa, they can send message without revealing their secret keys.

At this point, what about the following scenario?
Bob securely transmits his public key pk_b to Alice. Then, Alice encrypts her message vy using pk_b. There is no need to transform the ciphertext.
Also, Alice can send Bob her public key pk_a when she wants to receive the message from Bob.

What is the advantage of proxy re-encryption?
I think there is no potential difference between standard public key encryption scheme and proxy re-encryption.


texts:
I'm implementing an encryption algorithm that requires me to use a random number to mix up the values. However I'm caught in between if I should use quasi-random or pseudorandom.

These are the things I'm thinking about:

quasi-random isn't really a random number generator by definition but it's a good substitute for a uniform random  number generator, especially in the area of sampling across a plane and mathematically speaking it's more uniform compared to a uniform number generator.
pseudorandom on the other hand by definition is random. But if the attacker knows the seed its clearly not random also. And because it is less uniform compared to quasi-random it presents a certain bias towards a certain group of numbers.

So is randomness or the uniform distribution more valued when generating a random number? Should I choose a PRNG or a quasi-random number generator?


texts:
I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I wrote is located at https://github.com/Rami114/Personal/blob/master/Simon/Simon.rb

I've based this on the spec available at http://eprint.iacr.org/2013/404.pdf

Currently my encryption does not work (at all I'd say) which may be due to code issues or do to math failure on my behalf. Could someone please help me validate if the decryption is correct. Most notably the inversion of the rounds:

# f(x) ((LCS(x,1) & LCS(x,8)) ^ LCS(x,2))

def self.f (x, block_size)
  ((lcs(x, block_size, 1) & lcs(x, block_size, 8)) ^ lcs(x, block_size, 2))
end

def self.round_inv (x, y, k1, k2)
  x ^= k2
  x ^= f(y, N)
  y ^= k1
  y ^= f(x, N)
  return x, y
end

And the decryption function which I won't fully paste here as it's defined in the link above (the whole thing is only 200 lines long total so not a monster to read).

I have a stackoverflow question up at the moment which is specific to the way I'm currently converting strings to bignums and back (to accommodate the circular shift) but I didn't think that would be appropriate to this SE site.

Are there any glaring errors in my implementation? I'm by no means an expert in this.

E: the stackoverflow question I have up for code concerns: https://stackoverflow.com/questions/17785691/string-to-bignum-and-back-again-in-ruby-to-allow-circular-shift


texts: Proving/verifying keys for zero knowledge proof (zkSNARK) in a simple case (possession of a string whose hash is x)

texts:
I'm studying simple examples to understand how ZK-Snarks work.

Following this great introduction, I'm trying to elaborate a generator function giving a prover and verifier keys:

pk, vk = G (C, lambda)

that would work on the simple case

C (x, w) { return (sha256 (w) == x); }

i.e. how to build a zero knowledge proof scheme for the simple use case:

I know a string s whose hash is x. I can prove it to you, without revealing s.

How to actually build a zk proof algorithm for this simple use case? (following the article's notations, how to get proving/verifying keys and functions, given a lambda "waste" that will be discarded after generation?)


texts: Third-party security issues with Shamir's secret sharing scheme

texts:
In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial.

How can we ensure security here when we are involving a third party?


texts:
I am working on a project and I'm noticing a peculiar behavior that I was hoping someone could tell me if it is correct or not.

I have a program that is trying to generate some random numbers using BN_rand().  Snippet of code follows:

BIGNUM *test = NULL;
unsigned char buffer[2048];
int fd = open("/dev/urandom", O_RDWR);
read(fd, buffer, 2048);
close(fd);

test = BN_new();
if (RAND_status() != 1)
    goto error3;

RAND_seed(buffer, 2048);

if (!BN_rand(test,2048,0,1))
    goto error3;

do_bn_print_name(stdout, "test", test);

Every time I run this program though, it gives me the same random number.  I was expecting the number to be changing after every run.  Am I doing this right or is this expected behavior?

Thanks for any assistance!


texts: Can one efficiently iterate valid bcrypt hash output values?

texts:
bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password.

An efficient attack on this would be an ability to iterate all bcrypt hashes (or only these from passwords in a dictionary, maybe $2^{12}$ ones) without actually bcrypting the passwords.

The output of bcrypt consists of the security parameter (an integer), the used salt (128 bits), and the actual hash (192 bits), which is the result of 64 iterated Blowfish ECB encryptions of the ASCII string "OrpheanBeholderScryDoubt", where the key and s-boxes were expensively created by the (costly) EksBlowfishSetup instead of the normal BlowfishSetup.

Assume we have a quite high security parameter, like 12 (meaning $2^{12}$ iterations in the setup phase).

To make it easier, assume that either the salt is fixed, or we want to enumerate all valid actual hashes for all salts (without paying attention to which salt is used for which hash).

Is there any method of enumerating all the hashes without actually running the bcrypt algorithm, or enumerating the whole 192-bit output space?

What I could see is simply enumerating all possible blowfish states (e.g. subkeys + S-boxes) before doing the 64-times encryption with each such state. But if I understand right, this state consists of a $576$ bit P-array (the subkeys), and $4·265·32=32768$ bits of S-boxes. This is a much larger space than the hash output space ($192$ bits), thus we then simply could assume that every possible hash occurs at least for one such state, and simply enumerate the whole $192$ bit space. Not really a win.


texts:
In the book Information Security Principles and Practice, the author explains why HMAC should be used for integrity with a symmetric key with the message, to prevent a MiTM to replace both the message and its MAC.

He explains why it is not secure to prepend the key to the message, with notation h(K, M). I don't understand how the attack works. Here's the paragraph:

  Suppose  we  choose  to  compute  an  HMAC  as  h(K,M).        Most
  cryptographic  hashes  hash  the  message  in blocks—for  MD5, SHA-1,
  and  Tiger,  the  block  size  is  512 bits.   As a result,  if M  =
  {B1,  B2),  where  each  Bi  is  512 bits, then  h(M)  =  F(F(A, B1),
  B2) = F(h(B1), B2)                        (5.2)
  for  some  function  F,   where  A  is  a  fixed  initial  constant.
  For  example,  in  the  Tiger  hash,  the  function   F  consists  of
  the  outer  rounds  illustrated  in  Figure  5.2,   with  each  Bi
  corresponding  to  a  512-bit  block  of  input  and   A
  corresponding  to  the  192-bit  initial  value   (a,b,c).

  If  Trudy  chooses  M'   so that  M' =
  (M, X),     Trudy  might  be  able to use  equation (5.2)  to  find
  h(K, M') from h(K, M)  without knowing  K since, for  K,  M,  and  X
  of the  appropriate  size,   h(K,  M')  =  h(K,  M, X) = F(h(K, M),X),
  where  the  function  F  is  known.

The last paragraph is the attack.

I don't understand, how does the attack work? How can Trudy find h(K, M') from h(K, M) without knowing K?


texts: What is an example of elgamal homomorphic double encryption?

texts:
I am looking for such an cipher algorithm that is based on assymetric cryptography where the order of encrypting is irrelevant.

For example:
There is a message "x", Bob encrypt that message with his key and passes result "zz" to Alice. Alice encrypt that message with her key and receives: "xyz".
There is a message "x". Alice encrypt that message with her key and passes result "ui" to Bob. Bob encrypts with his key and receives "xyz".

What is the most important, is that resulting encrypted text is the same.

I have heard that maybe homomorfic ciphers have such properties and have tried with elgamal but no results were ok.

I would be glad if someone could help me with some example that matches my problem.


texts: What is the best deterministic authenticated encryption algorithm to date?

texts:
We have a main database where certain properties are PII and want to setup a read-only replica so other parts of the business can able to access (e.g. analytics)
We'd like those PII properties to be encrypted, so those with access to the read-only replica of the database would not be able to make sense of any PII. We've decided that we're be OK with runtime en/decrypting those attributes when needed.
We also would like to enable queries that would correlate data, for example: encrypting the same email address would yield the same output.
I shall mention that I know little to nothing when it comes to cryptography… so please bear with me. I've looked around and eventually stumbled upon "nonce-misuse resistant" options that would produce the same output for the same input. But it feels wrong to "abuse" that by deliberatelly misusing nonce to produce the desired output. After some more digging, it seems we're after a deterministic encryption algorithm (hence the title – please correct me if I'm wrong).
I'm seeking for advice on what would be, or how to pick, the most appropriate algorithm, given what we're trying to achieve.
Thank you in advance!


texts: What happens if five messages are generated in IND-CPA security?

texts: I am wondering why in IND-CPA security game, the adversary generates two random messages. What happens if for example 5 messages are generated? What would be the advantage for the adversary?


texts: Why are the factors p and q (for n) secret in Fiat-Shamir Authentication?

texts:
I am studying about this authentication and I don't understand why the factors of $n$ are kept secret as I can't see how they would give the prover or verifier anymore information.

My professor said that the verifier could learn the secret of the prover with the factors, but I don't understand how he would come about that mathematically. An explanation would be great to learn and understand this: Why are the factors $p$ and $q$ (for $n$) secret in Fiat-Shamir Authentication?


texts:
We have to implement a way to securely transfer data from a POS to a mobile app using QR codes.

The mobile app gets the payment parameters (amount, description, purchase_id, store_id) to create the payment intent by scanning a QR code generated from the POS,
the app passes the info to a trusted server through an API and
if the payment succeeds, it generates a QR code for the POS, including some parameters the store needs to match the payment back in the POS system.

We need to make sure that the system is secure so is not possible for an attacker to fake these QR codes.

Would this ensure the system security?

The trusted server generates a key pair and a shared secret
The commerce (POS) generates a key pair
The trusted server and the POS exchange their public keys and the shared secret
The QR code contains 2 parts: an encrypted body + signature
The encrypted body is a JSON string encrypted using the server’s / POS’s public key. The only way to decipher the body is using the private key so the structure of the message remains unknown.
The signature is a HMAC-SHA256(body, shared-key). So we can verify the integrity of the body once decrypted in the server or POS.

Does this make sense?


texts: Why is RSA preferred over Diffie-Hellman if they're both used to establish shared key?

texts:
I've read that the RSA algorithm is preferred over Diffie-Hellman key exchange as it makes key management easier. In the context of online banking, before the RSA algorithm they would have to maintain a different shared key with every single one of their customers, instead of just having one public key and a private key.

But then I've also read that RSA is primarily used for exchanging a shared key for use in symmetric ciphers like AES. So surely no matter if the bank were to use DH or RSA they would still establish a shared key and key management would be just as much a problem as it was before?


texts: How much safer is RSA-OAEP compared to RSA with PKCS#1 v1.5 padding?

texts: Is there a way to calculate how much safer RSA-OAEP is compared to RSA with PKCS#1 v1.5 compliant padding? Or is there a good rule of thumb?


texts: Depth of the SHA-256 collision search knowing partial input and final hashes

texts:
So I have a partial input data (string) PART1+UNKNOWN+PART2, length of UNKNOWN is self-describing.
I have a bunch of valid hashes (about 8 or so) that are compatible.
My question is then: will bruteforce search for full collision given the data at hand be as long?


texts: I don't understand RSA encryption (specific questions)?

texts:
So I've been studying RSA for a class and I'm having a hard time understanding how it works.
Why do we choose the value of e such that e is relatively prime to the totient (as opposed to just being relatively prime to n?) How does e being relatively prime ensure that there is only one possible value for d? And are the calculations based on the totient of n just an arbitrary way of encrypting or is there significance to them?

Also, if both e and n are public then how is that secure at all (or is this article wrong about e being public?) I guess I'm confused because if everyone is receiving the same public key then isn't the inverse operation going to be the same for everyone and thus not secure? And since we know that ed mod totient(n) = 1, and we know both n and e can't d easily be calculated?

Thank you for your help and patience :)


texts:
What is the definition of textbook or "raw" RSA?

What are some of the properties of textbook RSA?

How does it differ from other schemes based on RSA?


texts: Can A PRNG Be Used To Generate Multiple Private Keys for ECDSA?

texts:
Suppose Alice seeds a cryptographically strong Pseudo Random Number Generator with a truly random number, and keeps it secret. Alice then uses the output of the PRNG to generate several 256-bit numbers in sequence. Each of those 256-bit numbers is then used as an ECDSA private key, public keys are generated from them, and those public keys are sent out in the open. The private keys are either kept secret, or destroyed.

An attacker, Mallory, collects a bunch of public keys, some of which belong to Alice. Two questions:

If not told explicitly, can Mallory figure out which keys belong to Alice?
If Mallory does know which keys belong to Alice, can he figure out any of the private keys (or the initial seed)?

My concern is that, since the private keys are mathematically related, information about their relation may be leaked through the ECDSA public key generation (Q = kG). Most implementations of ECDSA I have seen use a PRNG that is frequently re-seeded, like OpenSSL. Presumably, though, one could generate multiple keys sequentially without a re-seed occurring. That being the case, I assume the above is safe. I am, however, having a hard time coming up with a proof for it.


texts: Why doesn't this factoring to order-finding reduction work?

texts:
Scott Aaronson likes to motivate the factoring-to-period-finding algorithm used inside Shor's algorithm as follows.

Now, I want you to step back and think about what this means. It means that, if we can find the period of the sequence
$$x \bmod N,\quad x^2 \bmod N, \quad x^3 \bmod N, \quad x^4 \bmod N, \quad \dots $$
then we can learn something about the prime factors of $N$! In particular, we can learn a divisor of $(p-1)(q-1)$. Now, I’ll admit that’s not as good as learning $p$ and $q$ themselves, but grant me that it’s something. Indeed, it’s more than something: it turns out that if we could learn several random divisors of $(p-1)(q-1)$ (for example, by trying different random values of $x$), then with high probability we could put those divisors together to learn $(p-1)(q-1)$ itself. And once we knew $(p-1)(q-1)$, we could then use some more little tricks to recover $p$ and $q$, the prime factors we wanted.

See also Section 19.2 (pp 156) of his Lecture notes where he expounds upon on the same idea. However, in both expositions he ends with a dismissal of the idea:

Unfortunately, this doesn’t quite  work  with  Shor’s  algorithm,  because  the  period  of $f \colon r \mapsto x^r \bmod N$ might  not  equal $\phi(N)$, the most we can say is that the period divides $\phi(N)$.

But why doesn't it work?
As Aaronson himself noted, by repeating the algorithm with different values of $x$ wouldn't there be a chance of finding all the factors of $\phi(N)$ (or at least sufficiently many to figure out the remaining factors somehow)?


texts: Does hashing a PRNG by a cryptographically secure hashing algorithm result in a CSPRNG?

texts: Or specifically, does ChaCha20 hashing of the xoroshiro128+ random number generator result in a cryptographically secure random number generator?


texts: Hash function from narrower block cipher operated in CBC-encryption mode?

texts:
I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ bits, and output the hash $H(M)$ of fixed size $|H(M)|=h\cdot b$ bits, using as the single primitive a $b$-bit block cipher with key of $k\cdot b$ bits, operated in CBC-encryption mode.

One of the motivation of the construction is to maintain the confidentiality of the message under DPA attacks, assuming that the implementation of the cipher in CBC-encryption mode is DPA-protected. I thus require that all message-dependent data is manipulated using the $P$ and $K$ inputs of that trusted primitive:
$$F(K,IV,s,P)\to C\text{ with }|K|=k\cdot b,|IV|=b,s>0,|P|=|C|=s\cdot b,$$
$$C[0]=\text{ENC}_K(P[0]\oplus IV), C[j]=\text{ENC}_K(P[j]\oplus C_{j-1})\mathsf{\text{  if }}1\le j<s.$$

I would like security beyond that of the underlying block cipher by a security parameter $q$, with an argument that any attack requires $2^{b\cdot q}$ queries to an encryption or decryption oracle implementing $\text{ENC}$ and the corresponding decryption, for some suitable definition of security/attack which, uh, is part of the question (in particular it seems necessary to restrict the amount of memory usable by the attacker, including but not limited to as a cache for the oracle). Performance is secondary (one envisioned application is a slow KDF), a security argument (or better proof) is a must, simplicity matters.

Assume there is enough memory for the whole message, and then some. Assume at least $\min(b,k\cdot\lceil b/2\rceil)$ bits of the block cipher's key are effective (which rules out simple-DES). A typical setup could be 3DES thus $b=64$, $k=3$, and $m=64$ ($4096$-bit input), $h=8$ ($512$-bit output), $q=4$ (security of $2^{256}$ block cipher queries or memory accesses). Assume $m\ge h>1$, and if that helps assume $m\gg h$ or/and $h\gg k$ or/and $k=1$ (e.g. AES-128, ignoring attacks marginally reducing its effective key size).

What appropriate definition(s) of security are applicable?
I apologize for late realization that this is an issue, and corresponding introduction of security parameter $q$. I now think I want a collision-resistant Universal One-Way Hash Function family per this terminology.

Is there some standard construction that fits?My review of the existing found a few hashes made from block ciphers, but suitable for $h\le2$ only, not neatly constructible from my primitive when $h>1$, and aiming at efficiency rather than a strong security argument.

If nothing standard exists, my simplest candidate is the following CBC-HASH:

assume an arbitrary public parameter $P$ of $p\ge k$ blocks which right $k$ blocks are suitable as an initial key for the cipher ($P$ parameterize the UOWHF family; in the simplest/original setup, $p=k$);
append $P$ to message $M$ forming $X_0$ of $m+p$ blocks $X_0[j]$, that is $M[j]\to X_0[j]\mathsf{\text{  if }}0\le j<m, K[j]\to X_0[m+j]\mathsf{\text{  if }}0\le j<p$;
repeat for $n$ rounds, numbered $r$ from $0$ to $n-1$:

set $K_r$ as the right $k$ blocks of $X_r$, that is $X_r[m+p-k+j]\to K_r[j]\mathsf{\text{  if }}0\le j<k$;
CBC-encipher $X_r$ using key $K_r$ and the $b$-bit big-endian representation of $r$ as $IV$, giving $X_{r+1}$, that is $F(K_r,(r)_b,m+p,X_r)\to X_{r+1}$;

set output $H=H(M)$ as the right $h$ blocks of the left $m$ blocks of $X_n$, that is $X_r[m-h+j]\to H[j]\mathsf{\text{  if }}0\le j<h$.

Now I am wondering how the number of rounds $n$ and the size $p$ of the initial padding shall be chosen from $q$, $h$, $m$, $k$ (perhaps $b$), and the limits on parameters for a security argument.

Can you justify, prove, improve, break, or fix CBC-HASH?The scheme now incorporates parameter $p$ controlling the size of the UOWHF family. I retract an earlier guess on $n$ made without even a clear security definition. I hereby vow to stop modifying this question except for fixing obvious typos; any addition will be an answer.


texts: Does applying a "PushEntropy"-function increase security of a private key?

texts:
I was just reviewing the source-code of the NBitcoin-package. As far as i can see when you create a new bitcoin-keypair
Key privateKey = new Key();
(without passing some random data to be used as private key generated by yourself) then the library generates a private key using a random-number-generator for you. Very usual. But then i stumbled across the fact that the output of the random-number-generator will not directly be used as private key: NBitcoin also applies a PushEntropy-function on this byte-array:
private static void PushEntropy(byte[] data)
{
    if (!UseAdditionalEntropy || additionalEntropy == null || data.Length == 0)
        return;
    int pos = entropyIndex;
    var entropy = additionalEntropy;
    for (int i = 0; i < data.Length; i++)
    {
        data[i] ^= entropy[pos % 32];
        pos++;
    }
    entropy = Hashes.SHA256(data);
    for (int i = 0; i < data.Length; i++)
    {
        data[i] ^= entropy[pos % 32];
        pos++;
    }
    entropyIndex = pos % 32;
}

I understand what this function does, but I do not understand why we need this function to generate a private-key.
Why is a cryptographically secure random-number-generator (to generate the private key aka data-bytearray) not enough?
Does this function increase security in any kind?


texts: Changing password hash and iv on (successful) user login

texts:
I've implemented a system for my login page (with php) that will update the password hash and initialization vector (for openssl) on each login. So essentially, every time the user successfully logs in, the initialization vector for openssl is re-created in the following way:

1. generate 16 random bytes.
2. Hash the bytes with SHA256.
3. Store the hash in the database.

For encrypting the passwords:

1. Grab the newly created IV.
2. Cut the IV to a 16-byte-long string using a secret algorithm.
3. Use the shortened IV in the openssl_encrypt function,
   along with the secret key and plaintext password.

Overall, the password is stored as a SHA256 hash of the openssl output, and the IV is stored as a SHA256 hash.

How strong is this method? Does updating the database user credentials increase or decrease the chances of a decryption in any event?


texts: symmetric AES encryption with php produces different result than openssl MacOX

texts:
I need to make a simple very basic encryption with AES 128 ECB mode.

The idea is to generate a cryptogram, code it in base64 and then decipher that text from a web service in php to process its content. Later we will increase the robustness of the encryption with a 256 key and CBC mode.

The problem is that the encrypted text generated from the openssl tool (installed by default in MacOX) generates a completely different result than the one generated by the openssl_encrypt function in php 7.

echo -n 'Sergio Sánchez' | openssl12n enc -aes-128-ecb  -a

Result

U2FsdGVkX1+wrLjaCTSM9T3WMV1YcD9Cwzj0mKBoa7M=

No Salt

echo -n 'Sergio Sánchez' | openssl12n enc -aes-128-ecb -nosalt -a

Result

stpJKCaUQ/Q1GLzDvqaYRg==

PHP 7

echo base64_encode(openssl_encrypt('Sergio Sánchez', 'AES-128-ECB', 'password', OPENSSL_RAW_DATA));

Result

dum7MBJOzIi9jvMTvEYnug==

How can I generate a compatible cryptogram between both tools?

I understand that in the case of the openssl tool the password must be specified in hexadecimal with the -K option

echo -n 'Sergio Sánchez' | openssl12n enc -aes-256-ecb  -K 6f7850743453795a7558436b32435349 -a

The generated result will be the following:

F7O/3OIi120ReItAJIk0oQ==

In the case of php I specify the key in text:

echo openssl_encrypt('Sergio Sánchez', 'AES-128-ECB', 'oxPt4SyZuXCk2CSI');

The generated result will be the following

dum7MBJOzIi9jvMTvEYnug==


texts: Modified version of a CPA-secure encryption scheme

texts: The following encryption scheme: choose a random string $r \leftarrow \{0,1\}^n$ and compute the ciphertext $c= \thinspace <c_0, c_1>= \thinspace <r, F_k(r) \oplus m>$, assuming $F$ a PRF; is CPA-secure, as we have a randomized/non-deterministic encryption process. Why, if applying a modified encryption process, i.e. computing the ciphertext $c'= \thinspace <c_0, c_1'>= \thinspace <r, F_r(k) \oplus m>$, this  is no more CPA-secure? I mean, this modified encryption process is also non-deterministic. Could it be because on each encryption invocation the input to the PRF $F$ is the fixed value $k$? I'm not sure if this makes sense.


texts: Do I need to know the curve for ECIES decryption?

texts:
Let's assume that I have key pair generated using the following curves: brainpoolP256r1, brainpoolP320r1, brainpoolP384r1 or brainpoolP512r1.
Do I need information which curve was used to decrypt message? Can I infer which curve was used based on the private key?


texts: Why is AES-128 considered secure while RSA needs a 1024-bit size to be considered secure

texts:
I got asked this question today and I didn't know the answer,
AES-128 is considered secure, the key size is 2^128, so you would need in average 2^127 tries to break the key.
Why does RSA need at least a 1024-bit modulus to be considered secure, If we consider a bruteforce attack on the private exponent, it would take 2^1019 tries (lets consider the private exponent is 1020-bit in length). Is the difference because of a much less complex attack that exists on RSA but doesn't exist in AES?


texts: Research for video game: Novice cryptography concepts

texts:
I'm making a video game which has some basic cryptography as a main base for puzzle design. I'm hoping players will get great puzzle challenge and learn a few cryptography concepts through playing the game.

Can you suggest some of interesting areas of cryptography that would be interesting/fun/easy to learn and understand that I could use as a game mechanic?
Are there any instances of a single thing that are fun/interesting/unique and could be used as a puzzle?

All of these concept are masked, so that player with no experience in cryptography will ever make a connection.
Some areas that are already included are basics in substitution and transposition (Caesar, Pigpen, Rail Fence, Grille...).
For example of puzzle design: Grid Grille puzzle was modified in such a way that other shapes are used instead of a square, most notably 4 triangles in 1 triangle.


texts: RFC 4493 (AES-CMAC) algorithm with 256 bit key

texts:
I apologize for the newbie question. If I were to use a 256-bit key and AES256 (assuming I had the function instead of AES128, the length of the for loops in the functions xor_128, leftshift_bit, generate_subkey, etc would remain as 16 correct? Since AES256 also returns a 128-bit result

example xor_128 function

void xor_128(unsigned char *a, unsigned char *b, unsigned char *out)
 {
      int i;
      for (i=0;i<16; i++)
      {
          out[i] = a[i] ^ b[i];
      }
  }

The AES-CMAC Algorithm in rfc4493


texts: Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security?

texts:
In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, an adversary $\mathcal{A}$ (can/have) access to the public key. So, $\mathcal{A}$ can encrypt any message of its choice. Which is the scenario in the CPA attack model. Now, my question is that is it necessary, or does it sound, to study the KPA security of an asymmetric encryption algorithm? I believe it does not sound, but as far as I search, I've found nothing related.

Regards


texts:
Oblivious RAM has been around in theory for about 30 years at this point.
Is anyone using it in practice? Has it made its way into industry? (Including any variants such as MPC ORAM or ORAM that uses trusted hardware for the client.)


texts: Has anyone heard of matrix-based "Russian Doll" encryption techniques?

texts:
I've been told that prime-number factoring is based on a "russian-doll" sequence of matrices, where a seed matrix of height Y and width X exists consisting of all zeros except for a single 1 at row Y column X.  For every x columns added, the matrix grows by y, and two closely related formulas sum the column vectors and the row vectors.

Put another way, given a matrix of height $Y+ny$ and width $X+nx$, the matrix consists of all zeros and ones such that the sum across the rows is less than $f((Y+ny)/j,Y+ny)$, and the sum across the columns is less than $g(X+nx,(X+nx)/k)$. $j$ and $k$ provide the noise or entropy of the encryption algorithm.

The distribution of products of numbers is an example of one method of filling out such a matrix.  Has anyone ever studied the relationship between $f$ and $g$ to come up with a family of "roman-doll" encryption techniques with difficulty related to prime-number factoring, but security closer to a "one-time pad" method of encryption?

Reference

I don't have a good online reference for this, but the methods are readily understandable by anyone with a junior high education level.  A similar approach is described at http://www.gbbservices.com/math/squarediff.html#Cracking_RSA

Postscript

The algorithm I'm familiar with has the following theorems:

$$
\begin{eqnarray}
\forall j \in \mathcal{N}\cdot h_{0,j}&=&1\\
\sum_{i\in \mathcal{N}} h_{i,0}&=&1\\
\forall J\times k \in \mathcal{N}^2 &\cdot& (\exists s\cdot (s^2=2*J+1)) \vee \sum_{j\in \mathcal{N}}{h_{2^k(2J+1),j}}=(k+1)\sum_{i\in \mathcal{N}} h_{i,J}\\
\forall J \times k \in \mathcal{N}^2 &\cdot& \exists s\cdot (s^2=2*J+1) \implies \sum_{j\in \mathcal{N}}{h_{2^k(2J+1),j}}=(k+1)\sum_{i\in \mathcal{N}} h_{i,J}-\lceil\frac{k+1}{2}\rceil
\end{eqnarray}
$$

An additional constraint that results in the "russian doll" effect are:
$$
\forall I \in \mathcal{N} \cdot I\ge X\implies \sum_{j\in \mathcal{N}} h_{I,j}=\sum_{j=Y+(y/x-m)(I-X)}^{Y+y(I-X)/x} h_{I,j}
$$

where x, y, X, and Y are as introduced in the original question.

Private keys are those rows whose sum is one.  Public keys are those whose sum is 2. The higher rows are more cryptographically secure.

Also, if the matrix is populated according to standard number system, then:

$$
\forall I \in \mathcal{N} \cdot \sum_{j\in \mathcal{N}}\sum_{i=1}^{I} h_{i,j}=\sum_{n=1}^{\lfloor\sqrt{I}\rfloor} (\lfloor\frac{I}{n}\rfloor-n)=(D(x)-u)/2
$$

where D(x) is the Divisor Summatory Function

Examples

Matrix 0:

1    (1)

Matrix 1:

1   0   1   (9)
1   0   0   (7)
1   0   0   (5)
1   0   0   (3)
1   0   0   (1)

Matrix 2:

1   0   0   0   0   0   1   ?   ?    (33)
1   0   0   0   0   0   0   ?   0    (31)
1   0   0   0   0   0   0   ?        (29)
1   0   0   0   0   1   0   0        (27)
1   0   0   0   0   0   1   (25)
1   0   0   0   0   0   0   (23)
1   0   0   0   1   0   0   (21)
1   0   0   0   0   0   0   (19)
1   0   0   0   0   0   0   (17)
1   0   0   1   0   0   0   (15)
1   0   0   0   0   0   0   (13)
1   0   0   0   0   0   0   (11)
1   0   1   0   0   0   0   (9)
1   0   0   0   0   0   0   (7)
1   0   0   0   0   0   0   (5)
1   0   0   0   0   0   0   (3)
1   0   0   0   0   0   0   (1)


texts: How does the security of Elliptic curve compare to normal discrete logarithm?

texts:
Intro:
EC are often compared with RSA but how about a more safe version of the discrete logarithm?
All 3 can be reduced to the problem:
$$b = g^a \mod{P}$$
In RSA $P$ is a product of two primes. To solve the discrete logarithm 'just' a factorization of $P$ is required. Different to the two other cases $a,b$ is known and $g$ is searched.
But if $P$ is a prime the problem can get much harder. It depends at the factorization of $P-1$ because $P-1$ is also equal to the number of different elements.
As far as I know the best choice is a 'safe prime' with $P = 2 q +1$ with $q$ a prime as well.
This discrete logarithm can be solved in $\mathcal{O}(\sqrt{q}) $ with $q$ the biggest prime factor (with Pollard's algorithm).
At EC $P$ is a prime as well but the number of elements can be different (but still $\approx P$). It can e.g. be determined with Schoof's algorithm.
A number of safe elliptic curves can be found at safecurves.cr.yp.to .
Tested safe curves had all $2^3 \cdot q$ elemnts (with $q$ a big prime). Afak solving those will also take $\mathcal{O}(\sqrt{q}) $ time.

Question:
Given the discrete logarithm solving problem for normal numbers and elliptic curves (mod a prime $P_i, P_e$). Given a valid generator $g_i, g_e$ and a possible result $b_i, b_e$.
$$\text{normal: } b_i = g_i^{a_i} \mod P_i $$
$$\text{elliptic curve: } b_e = g_e^{a_e} \mod P_e $$
Let the elliptic curve have $N_e = 2^3 \cdot q$ different elements with $q$ a big prime (other variables chosen in that way).
Let $$P_i = 2 \cdot q +1$$
Do both problems have the same solving time of  $\mathcal{O}(\sqrt{q}) $ ?
(we ignore the linear factor of computation time for each single step due to different multiplication time)

Bonus questions:
Which other factor have impact into the solving speed?
BQ1.) The number of elements of some curves from safecurves.cr.yp.to had also the property: $N_e -1 = 3 \cdot r$ with $r$ a big prime. Does this have any impact?
BQ2.) Has the factorization of $P_e -1$ any impact at the security?
BQ3.) Has the factorization of $q-1$ any impact at the security? (for normal and EC)

Edit: Update

It looks like 'number filed sieve' can do better than Pollard's algorithm ($\mathcal{O}(\sqrt{q}) $). To use it on EC the embedding need to be small -> chose a big one
besides the safe prime property $P_i$ should als be not close to $p^n$ with $p$ a small prime like $2,3,..$

$\rightarrow$ assumption: so there is a difference?


texts: Where is the S-Box generated in Rijandel/AES?

texts:
It's rather kind of lame questions, and I can't find good and clear explanation:

In which step of Rijandel is S-box generated?
Is the S-box reused in every round of cipher or is generated in every iteration?
In a course-ware movie where they explained AES (class.coursera.org/crypto-preview/lecture/16) the speaker says that the S-box could be precomputed. Does that mean that the S-box could be constant?


texts: Anonymity problem after voting with blind signatures

texts:
In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having:

$d$, $e$, $N$ — registrar key params
$m$ — msg
$r$ — random blinding factor
$m'$ — blinded msg
$sm'$ — signed blinded msg
$sm$ — signed msg

When person received $sm'$ from the registrar, and unblinds it — he receives $sm$. He then sends it to the system anonymously for counting.

So, at the end registrar will have $sm$, and can read $m$.

Finally the problem

Registrar can in cycle try to do $sm'_i \cdot sm_j^{-1} \pmod N$ to find some $r_k$.
Then compare $m \cdot r_k^e \pmod N$ with with every $m'$.
If values match — person which sent $m'$ can be deanonimized as it is not hard for registrar to keep information about all $m'$ and linked persons.

It will take some time to process all the combination and depends of number of voters, but it works (tested simplest scenario).

Is there any mistake, or is it possible to overcome this problem with some trick?


texts: Is there a cipher that encrypts words into different words?

texts:
I've been looking at the various types of ciphers and I can't seem to find something I want or if it's even possible.

For example the text is "London2234", when run through the cipher, it encrypts into something like "Marble2234" where a person who doesn't have the cipher doesn't see it as garbage but sees it as another word where they can't make any context of.

Like a dictionary cipher of some sort? Is it possible?


texts:
I recently saw an article at phys org that did some sort of "quantum simulation" on a conventional computer to calculate prime probabilities, the article (and paper associated) does mention shor's as well.

What threat does this model pose to current cryptography?

https://phys.org/news/2018-04-quantum-simulator-faster-route-prime.html

https://arxiv.org/abs/1704.03174


texts: Are there cryptographic hash functions with homomorphic properties?

texts:
Are there cryptographic hash functions that have homomorphism-like properties?

E.g. satisfying following relation $h(a || b) = h(a) · h(b)$, where $h(x)$ is hash function itself, $x || y$ is concatenation and $x · y$ is some hash-specific combination function making single hash given two of them. If that makes any difference, it can be also assumed $a$ and $b$ are of equal length, and $h(x)$ is expected to produce hash sums of same length regardless of $x$.

I can think of basic, non-cryptographic example — $h(x)$ can be plain arithmetic sum of character codes modulo 256, and $x · y := (x + y) \bmod 256$, so

$$ h(\texttt{"foo"}) = (102 + 111 + 111) \bmod 256 = 68 $$
 $$ h(\texttt{"bar"}) = (98 + 97 + 114) \bmod 256 = 53 $$
 $$ h(\texttt{"foobar"}) = (102 + 111 + 111 + 98 + 97 + 114) \bmod 256 = 121 $$
 $$ h(\texttt{"foo"}) · h(\texttt{"bar"}) = (68 + 53) \bmod 256 = 121 $$

So, is there something similar, but with high collision resistance?


texts:
Hey crypto SE, i'm having a bit of trouble with this question. Can anyone help me to understand how to go about solving this problem? Any help is appreciated :)

Show G is insecure against adaptive adversaries by designing an adaptive adversary?

Is it possible that a comparable advantage could be achieved by a non-adaptive adversary.


texts:
Consider the following simple cipher:
$$c_1 = S(m_1 \oplus k_1) \oplus k_2$$
Where $S$ is S-box, $m_1$ - 16-bit plain text, $k_1$ and $k_2$ is two parts of 16-bit key.

If S-box is standard then this cipher is quite easy to hack by differential analysis. But consider $m_1$ as two-dimensional array 4x4 bits and S-box as combination of two same 4-bit S-boxes. In the first S-box input is 4 rows of plain-text, in the second S-box input is 4 columns of output of first S-box:
$$c_1 = S''(S'(m_1 \oplus k_1)) \oplus k_2$$

Can you help me analyze this algorithm against the following problems:

Are there any advantages and disadvantages of this algorithm to the following:
$$c_1 = S(m_1 \oplus k_1) \oplus k_2$$
where $S$ is a 16-bit S-box.
How resistant is this algorithm to differential analysis.
Is this "two-dimensional s-box" is used somewhere?


texts: Finding product of two unknown numbers each raised to a known power

texts:
Let $G$ be a group, and let $a, b\in G$, and let $[3] = \{0,1,2\}$. Let $(x_i,y_i)$ for $i\in[3]$ be known constants. Assume that I know the elements:
$$c_i = a^{x_i}b^{y_i},\quad i\in[3]$$
Then, given $(x', y')$, is there a way to efficiently compute $a^{x'}b^{y'}$?


texts: Would it be better to use SHAKE-128/256 or SHA3-256/512? In what situation should I chose one over the other?


texts:
In RSA, $C=M^e \bmod N$ and $d=e^{-1} \bmod φ(N)$ are used for encryption and signatures.
What is the exact definition of $x^u \bmod k$?
Also, what is the difference between $$x^u = y \bmod k$$ and $$x^u \equiv   y\bmod k$$


texts: Why not put MAC in fixed position and cover padding for MAC-then-encrypt?

texts:
The biggest problem with using MtE with a mode where it's known to be secure (CBC) is with the padding, where you can't retrieve the authentication until you know where it is by looking at the padding bytes.

Instead, why not just place the MAC at the very end of the last block, and include the padding bytes in the calculation of the MAC?  Verify the MAC before even looking at the padding or anything else in the message (other than to calculate the MAC, of course).

The padding algorithm would simply have an argument telling it how much space to reserve after the padding for a MAC, either 0 if using EtM, or the space for the tag if using MtE.

Then process the MAC over the message plus added padding, and store it in the reserved area.  Are there any padding schemes which do this?


texts:
Does encrypting a pseudorandom message need the same requirements from a block cipher?

For instance, can we decrease the number of rounds of AES if we want to cipher a random block, without any security loss?

Thank you


texts: Reverse Java random seed using 81 calls to nextInt with a bound of 4?

texts:
I'm trying to reverse the Java random seed using 81 calls to nextInt(bound) with a bound of 4. I am wondering if it is at all possible to reverse the random seed.

In this situation Java's random number generator is called 81 times, and for each call I know if the returned value is either 0 or not 0. Looking at the int nextInt(int bound) method, here is the relevant code:

int r = next(31);
if ((bound & (bound-1)) == 0)  // i.e., bound is a power of 2
    r = (int)((bound * (long)r) >> 31);

where r is the returned value, and next(31) is the next pseudo-random value using 31 bits. Here is that next method:

protected int next(int bits) {
    long oldseed, nextseed;
    AtomicLong seed = this.seed;
    do {
        oldseed = seed.get();
        nextseed = (oldseed * multiplier + addend) & mask;
    } while (!seed.compareAndSet(oldseed, nextseed));
    return (int)(nextseed >>> (48 - bits));
}

where the multiplier is a constant 0x5DEECE66DL, addend is 0xBL, mask is (1L << 48) - 1. Here, 0x indicates a hexadecimal value, and the L is there to make the literal value a Java long (64-bit).

In Java, int is always 32 bits in size. Furthermore AtomicLong is a multi-threading related construct that simply represents a 64 bit long in this code. The mask makes sure that the value never exceeds 48 bits. The loop construct and !compareAndSet can be entirely replaced by a simple seed = nextSeed.

Basically then, the seed $s$ is updated using:

$$s \gets (\mathtt{5DEECE66D}_{16} \cdot s + \mathtt{B}_{16}) \bmod {2^{48}}$$

after which the two most significant bits of the 48 bit value $s$ are returned.

I don't know if this is possible, since so many bits are dropped, but I have seen this done with calls to nextInt(10).

Sorry if there is anything I left out or if this is too vague, this is my first cryptography post.


texts: Password hashing alogirthm simple enough to implement myself?

texts:
I'm doing a password manager for a school project and I need to hash the master password for verification but I also need to write the hashing algorithm myself. However, most the algorithms I've come across are very complicated (except for MD5 but that's overly insecure).
Are there any slightly simpler hashing alogorithms which won't take too long to write and implement without libraries? (I'm using c#).


texts: Searchable Symmetric Encryption VS Deterministic encryption?

texts: I am a beginner learning about encryption. The Searchable Symmetric Encryption is better than Deterministic encryption? When I say better I mean smaller leakage.


texts: JOSE: JWE CEK Initialization Vector Position or Reuse

texts:
So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content.

My issue however is that NaCl needs an IV (nonce in NaCl) for both the asymmetric encryption of the key and the symmetric encryption of the content.

Looking at other examples such as the ietf-jose cookbook, (X25519, A128GCM), they only have the one "top level" IV.

Is it ok to use the same IV for both the x25519 and the A256GCM?

If not, where does the IV for the x25519 get placed in the JWE?

Or is there something else I am missing entirely?

{
  header: {
    enc: "A256GCM",
    alg: "ECDH-ES",
    epk: {
      crv: "X25519",
      kty: "OKP",
      x: ephemPublicKey
      iv: "Perhaps we stuff the X25519 iv here?",
    },
    iv: "Perhaps we stuff the X25519 iv here?",
    encrypted_key,
  },
  ciphertext,
  tag,
  iv: "iv for the A256GCM only or both?",
}


texts: Finding a pair of exponents so that $c^a \bmod N = c^b \bmod N$

texts:
I am not very familiar with RSA, so this question may appear to be stupid.

Suppose that in RSA encryption, we are given $c$ (the ciphertext) and $N$ (the semi-prime modulus), can we find a pair of exponents such that $c^a \bmod N = c^b \bmod N$?

This has nothing to do with decrypting RSA; I’m just curious whether it is possible to find a pair of exponents that can produce this result? Would this be feasible if the exponents are really large numbers (for example, 300 decimal digits or more)? If so, is there any computer algorithm that I can use to do this?


texts: AES CBC Initialization vector - Security issues

texts:
I have 2 questions regarding security issues related to initialization vectors used in AES CBC

Consider that I'm using a sequence number (which increments with every encryption) as an initialization vector. Would this be a security issue? Is there some way that an attacker who knows the sequence numbers and in turn knows the IV, be able to decrypt even some part of the data, if not the whole?

I'm asking this question because some of the comments on the 1st answer in the following link seem to suggest that using a counter for an IV would not be a good choice.
https://security.stackexchange.com/questions/17044/when-using-aes-and-cbc-is-it-necessary-to-keep-the-iv-secret

If it is possible to perform such an attack, can you provide an explanation of how this would be possible?
I tried searching. But, none of the sources I found seem to answer why the IV cannot take values from a counter. They only talk about safety in terms of storage.

The other question is related to transmission of IVs. I searched quite a bit and everyone says that the IV need not be secret. But, if IV is exposed, isn't it possible for a man in the middle to change the IV so that the end result at the decryption end will fail?


texts: How to decrypt a PGP message with only the two primes and the public exponent?

texts:
I'm trying to decrypt a PGP Message that is encrypted with an RSA key, but I only have this information:

Public exponent:
65537

Prime 1: c447376fcf2a4d4f03840c83f68b23202f081f8561a1f0295703df258a96b8fd6cc8cb307558d60cbd692a45ed2414370349e28badf0f180419fc1df2cd87e99

Prime 2:
d876bd7c4963b8c06f148da504d1f7c7b9b20a719a0d3788eacc7effa7acb9cc200ef3a18a29fb5c733d45e04104ef3e7fc77f3ec847526b0c5d50506a2f471b

It seems when generating a key, the primes are automatically generated so I can't find any tools online that will help me any.

Here's where I'm currently at:

  ~$ gpg -d green.gpg.asc
  gpg: encrypted with RSA key, ID 00000000
  gpg: decryption failed: secret key not available

The end goal is I'd like to create a key that can be imported which would then allow the above command to decrypt the message.

Here's the file I'm trying to decrypt for context:

green.gpg.asc (492k)


texts:
With RSA PKCS#1 v1.5 it is possible to verify that the signature was generated by the correct private key without actually having access to the data. You just perform the modular exponentiation with the public key to retrieve the padded hash. Then it is possible to verify that the message was padded correctly. Moreover, you retrieve the hash value which can be used to try and guess the input (Internet search, DB lookup, guessing using dictionaries, brute force etc.).

Is there something similar possible with ECDSA? Is it at least possible to verify that the signature was created with a particular private key? Personally I don't see it because the value of $r$ is just random, and I don't see any way to reverse $s = k^{-1} (z + rd_A) \bmod n$ without the hash as input. Is there a way to do that or is it possible to prove mathematically that it infeasible to do so?


texts:
I've seen answers here and elsewhere discussing how well the WWII Enigma could hold up to modern cryptanalysis, however, those answers always seem to assume the WWII conditions where the Germans had a limited number of rotor constructions, repeated patterns of plain text, and the Allies had access to a lot of the info about the rotors, their wirings and the limited combinations in use.

What if a software based enigma were executed with the following conditions:

38 characters (versus 26)
ten rotors
the rotor settings, stecker settings, and rotor permutations themselves change with each message, all pre-planned using a cryptographically secure PRNG (i.e., the operator no longer chooses and transmits settings in a preamble)
assume (for sake of argument) no cribs and physical security - i.e., the attacker might have access to the encryptor, but not to any keys

How well would this hold up to modern cryptanalysis using super computers or networks? How long might it take to brute force it?


texts: Diffie-Hellman: Does the size of the prime modulus depend on the potential size of the secret?

texts:
I'm writing my own cryptosystem that uses One Time Pad and Diffie-Hellman to generate keys for the OTP.  I am using Rails on the server side and Javascript for the client side.

Please don't tell me this is insecure and I shouldn't do it.  I'm doing this purely for educational purposes and in no way will this be deployed in a non-experimental sense.

Since this is OTP, I need a keystream that is at least as long as the message being encrypted.  From what I have read, it seems like DH needs a ridiculously large safe prime modulus.  Or does it?

Every character needs a different random key, so for a string that is 10 characters long the DH key exchange needs to happen 10 times to create an array of common secret keys for that string.

However, I seem to be getting what may be integers that are way larger than necessary.

Let's say that the user makes an array of private keys:

var userPrivateKeys = [9,12,0,23,7,8,4,7,15,24]

And a 2048-bit safe prime modulus with 2 as the generator:

var prime = 32317006071311007300338913926423828248817941241140239112842009751400741706634354222619689417363569347117901737909704191754605873209195028853758986185622153212175412514901774520270235796078236248884246189477587641105928646099411723245426622522193230540919037680524235519125679715870117001058055877651038861847280257976054903569732561526167081339361799541336476559160368317896729073178384589680639671900977202194168647225871031411336429319536193471636533209717077448227988588565369208645296636077250268955505928362751121174096972998068410554359584866583291642136218231078990999448652468262416972035911852507045361090559

var generator = 2

The array of shared keys for the user ends up looking like this:

var userPublicKeys = [512,4096,1,8388608,128,256,16,128,32768,16777216]

After the user and the server exchange their public keys, we get this as the common key:

var commonKeys = [134217728,2.2300745198530623e+43,1,1.725436586697641e+69,72057594037927940,16777216,17592186044416,1.78405961588245e+44,6.216540455122333e+85,1]

Holy....

Those integers are way way larger than the modulus of the alphabet, or even the modulus of ASCII.

I [think I] understand that the prime modulus must be huge in the context of creating keys to be used in ciphers like AES, but what about in the context of having different random keys for each character in OTP?

For example, let's say that my messages only feature letters a through z, and I have a smaller modulus:

p = 27
g = 3

userPrivateKeys = [9,12,0,23,7,8,4,7,15,24]

Our algorithm would be:

2^a mod 27

or in Javascript...

Math.pow(2, a) % 27

And we'll have generated a list of public keys:

userPublicKeys = [26,19,1,5,20,13,16,20,17,10]

That's way more manageable.

So in this context, is there a problem with the prime modulus being so small?

As far as I can tell, the only way to break this is through exhaustive search; since OTP cryptext contains no information about the original message, exhaustive search would be infeasible.  I have read of other possible ways of breaking this and DH in general, but usually I don't understand them or they either depend on one of the secrets being known.

So is there something I'm missing?


texts: Lightweight encrypting for BLE advertising packets

texts: I'm new to encryption and this is my first time working with it. I'm currently working on a home project which consists of the equipment in my garage to be attached with a BLE device which sends advertising packets to my TI Launchpad for keeping inventory. My question is how/what can I do to encrypt the advertisment packets so that when a third party sees these data, woudln't know whats happening. Clearly I'm not working with sensitive information but just a lightweight encryption is all I need as I know im working iwht limited space and power. Two things that I've found during research is Tiny-AES and BLAKE2 hash functions. For a beginner, what would you recommend I do in order to create a top layer security for my project. Any help/thoughts are welcome, Thanks!


texts: Why is cryptographic model not considered formal methods?

texts:
I have just started looking at different methods for analyzing the security of cryptographic protocols. According to my reading, there are two main approaches in this area. The first approach is so-called Dolev-Yao (or formal) model, where cryptographic messages are represented as symbolic terms in term algebras. The second one is closer to real implementations of cryptographic protocols, where primitives are seen as probabilistic algorithms and the attacker is a polynomial-time probabilistic Turing machine. The security of cryptographic in the latter approach is often defined as security games.

My confusion is that the former approach is referred as formal methods in the literature, but not the second one. Looking at the definition of formal methods in Wikipedia, it says "formal methods are a particular kind of mathematically based techniques for the specification, development and verification of software and hardware systems". According to this definition, I do not see why the second approach cannot be seen as formal methods. In fact, the first one is just one abstract level higher than the second one and provides weaker security guarantees. So to my understanding, they are both formal verification techniques for security protocols, and therefore should be both seen as formal methods. Could anyone help me to clarify this?


texts: Key exchange protocol and digital signatures

texts:
I am a beginner to coding and encryption standards... I have this task assigned in a course I am following:

Design and implement a key exchange protocol. Include digital signatures in the protocol for authentication.

Does implementing the Diffie-Hellman algorithm covers both parts as in key exchange and digital signature or only the key exchange part? If so what should I do?

Is there any other approach on covering both parts?


texts: Is it safe to combine System.Random with cryptographically secure pseudo-random number generators?

texts:
Have a look at the following codesample written in C#:

private static byte[] GetRandomBytes(int size)
{
    byte[] buff = new byte[size];
    // Create an array of crypto-secure random numbers
    using (RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider())
    {
        rng.GetBytes(buff);
    }

    // Gets a random byte from a non-crypto-secure RNG and xors each element with it
    // Alternatively, xor each element with a new random number
    int unsafeRand = (byte)_random.Next(0, 255);
    for (int i = 0; i < size; i++)
        buff[i] ^= unsafeRand;

    return buff;
}

Is it safe to combine the .NET cryptographically secure random number generators with an imperfect random number generator, for example via XOR?


texts: Is AES (or DES) provably secure? What is the hardness assumption underlying these cryptosystems?

texts:
I have taken a course in applied Cryptography. I do not understand the hardness problem underlying AES (or DES).

As in RSA is based on the RSA assumption. ElGamal is based on the hardness of descrete logarithm problem. Most of the lattice crypto is based on the LWE assumption which itself is based on the hardness of BDD problem. What is the hardness problem that guaranties the security of AES? (Or DES)

In other words if there is an oracle R that can break AES. Can I use this oracle as a subroutine to solve some really hard problem? If yes, what is the reduction?


texts: How was the 5 digit random number in the VIC cipher generated?

texts: Knowing that VIC was a "spy cipher" it is unlikely that the agents used a cryptographic device to genreate the 5 digit number but how did they do it?


texts:
I'm studying SHA-3 and I dont understand quite a bit how the padding 10*1 works. Can someone explain me step by step how is it work? Also I know that on SHA3-512 r is 576. On the sponge construction what you need to XOR the first padded message P0 with the r vector. What is the r vector in any situation?
(Please be nice with me Im just studying crypto for the first time also Im not an english native speaker)


texts: Security of the Goldreich–Goldwasser– Halevi (GGH) Scheme

texts:
There is a statement in the article of "Public-Key Cryptosystems from Lattice Reduction Problems" that presents GGH encryption scheme:
"The cryptanalytic problem underlying our scheme is to approximate the closest vector problem (CVP) in a lattice, given a "non-reduced" basis for that lattice"
On the other hand, in his survey Peikert says:
" Unlike the works of Ajtai and Ajtai-Dwork [AD97], the GGH proposals did not come with any worst-case security guarantees; their conjectured security was merely heuristic. "
Also he says "Because no cryptosystem has yet been proved secure based on CVPγ, we do not formally define that problem here"
Which one is true?


texts: Why is Diffie-Hellman considered in the context of public key cryptography?

texts:
In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography".

As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, so it falls very naturally in the area of symmetric key cryptography.

So where does DH stand in the split between symmetric and public key algorithms?


texts: How many recursive md5 hashes are needed to always get same string

texts:
If we start with a set of possible input values, and apply the md5 algorithm to all elements of this set and then filter out the unique results (a.k.a. filter out collision), we are left with a smaller set. Consider this small piece of pseudo code:

Set<String> inputs = ALL_UNIQUE_INPUTS;
while (inputs.length > 1) {
    Set<String> newInputs;
    foreach (String input : inputs) {
        newInputs.add(md5(input));
    }
    inputs = newInputs;
}

I believe that most iterations of the while loop will decrease the size of inputs, untill it reaches 1. Is this true?

Furthermore, can we somehow determine how many iterations this would take for a given input space?

Note: I am aware that you should not attempt to increase the computational complexity of password hashing in this manner, but use salts, reapply those and other neat tricks to make the process more computationally complex whilst not increasing the chance of collisions.


texts:
TAHOE-LAFS uses a form of "key-dependent encryption", in that a private key SK is encrypted with the truncated hash of the private key:

ENC(Htrunc(SK), SK)

Where Htrunc(X) is the result of SHA256(SHA256(X)), truncated to 16 bytes.

The TAHOE-LAFS paper states:

  This somewhat unusual arrangement means that the RSA signing key is encrypted with the truncation of the secure hash of itself. This is an instance key-dependent encryption, which is not as well-studied as we would like. However, we think that it would be surprising if there were a weakness in this construction which did not imply a weakness in the underlying standard primitives – RSA, AES-128, and SHA256.

What are the practical consequences of the use of this construction? Is the paper right in saying that if the underlying primitives are secure, this scheme should be secure as well?


texts: Is there an existing cryptography algorithm / method that both encrypts AND compresses text?

texts:
So I'm trying to find a method of encryption that not only obfuscates text, but also compresses the result.

For example, if I encrypted ninechars, the ideal result would be less than nine characters.

Otherwise, if this is not possible, is there a method where I can set a limit on the amount of characters in the result? In other words, no matter how long the input is, the result will always be 50 characters long.

The closest results that I have found are Caesar Encrypt and XOR Encrypt, but they seem to simply result in the same amount of characters as the original input. The others I have found increase the size.

TL;DR I pretty much need a "hash function" that is reversible.


texts: Any speed up methods for finding the index of a random value produced by the Inversive congruential generator?

texts:
The Inversive congruential generator produces random values with:
$$x_{n+1} = a\cdot x_{n}^{-1} + b \mod P$$

(special case if $x_n=0$ -> $x_{n+1}=b$)
starting with an initial value $x_0$

With well choosen $a,b,P$ it produces all values in $\mathbb{F}_P $ (which are $[0..P-1]$)
That's the case if there is no r with $r^2 \equiv 4 a + b^2 \mod P$ with $P$ a prime.

Question: Is there any way to compute the index $n$ for a given value $v \in \mathbb{F}_P$ with $x_n=v$ ? (with $a,b,P$ well chosen and known)
Or is there any way to compute it faster than brute force?

For the $n$'th random value a equation exists with:
$$x_n=(q_{n+1}\cdot  x_0 + a\cdot q_n)(q_{n}\cdot  x_0 + a\cdot  q_{n-1})^{-1} \mod P$$
with $q$ a sequence again:
$$q_0=0$$
$$q_1=1$$
$$q_{n}=a\cdot q_{n-2}+b\cdot q_{n-1} (\mod P)$$

q is similar to the Fibonacci sequence. Without modulo there is an equation for the $n$'th element as well:
$$q_n=  \frac{ (\frac{b +\sqrt{4 a + b^2} }{2})^n - (\frac{b - \sqrt{4 a + b^2}}{2})^n}{\sqrt{4 a + b^2}}$$
(I don't know if there also exists a form modulo $P$)

Update:  $q_n$ equation modulo P
with:
$r^2 \equiv 4 \cdot a+b^2 \mod P$
$1 \equiv t \cdot 2 \mod P$

$$q_n = ((b+r)^n-(b-r)^n)\cdot t^n \cdot r^{-1} \mod P$$
This equation also works in $\mathbb{F}_P$

However for the target values $a,b$ there exists no such root $r$.
  (For other $a,b$ which can not produce all values it does work)

Update 2: simplification
For simplification we can assume $x_0=0$.  With this the equation for $x_n$ would be:
$$x_n=(a\cdot q_n)(a\cdot  q_{n-1})^{-1} \mod P$$
$$x_n=q_n\cdot  q_{n-1}^{-1} \mod P$$

Any way to compute index $n$ for given value $v=x_n$?

Update 3: some test in wolframalpa
wolfram alpha has a solution for the non-modulo version (with $x0=0$):
https://www.wolframalpha.com/input/?i=solve+(((b%2Br)%2F2)^n-((b-r)%2F2)^n)%2F(((b%2Br)%2F2)^(n-1)-((b-r)%2F2)^(n-1))%3Dv+for+n?

$$n = \frac{  \log(\frac{(b - r) (b + r - 2 v)} {(b + r) (b - r - 2 v)}) + 2 i \pi c_1}{\log(b - r) - \log(b + r)} $$

Using this I get a complex number for $n$ with real and imaginary part $\not\in \mathbb{N}$. If I compute $x_n=q_n/q_{n-1}$ and with this $v$ in $\mathbb{R}$ for an example it does work.
Any idea how to transform this to $\mod P$ (for values $a,b$ which don't have a root $r$)?
Or how to transform a $v\in \mathbb{F}_P$ to $\mathbb{R}$?

Update 4: Get rid of $r$ in $q_n$ equation
$q_n$ can be multiplied at top and bottom with $r$ to get $r^2$ only. With $x0=0$ the equation for $x_n$ would be (for $n>2$):
$$x_n=q_n q_{n-1}^{-1}= \frac{2 \cdot \sum_{k=1}^{\lfloor n/2\rfloor}   {n-1\choose 2k-1}  b^{n-2k}(r^2)^{k} }{4\cdot \sum_{k=1}^{\lfloor (n-1)/2 \rfloor} {n-2  \choose 2k- 1} b^{n-2k-1} (r^2)^{k } } \mod P$$

The lower part need to be the inverse and not a divisor for $\mod P$.
  However I don't see any way to extract a formula for $n$ out of this. Do I miss something?


texts:
My professor has posted a couple of practice questions that so far I haven't been able to find the answer for and I was hoping you could help.

DES  would  remain  invertible—it  would  still  be  ablockcipher—even if its S-boxes were arbitrarily changed (the number of input and outputbits remaining the same).
AES  would  remain  invertible—it  would  still  be  ablockcipher—even if its S-boxes were arbitrarily changed (the number of input and outputbits remaining the same).

I've been trying to figure out the "how" and "why", mostly.


texts: Operation which needs much computing power to be created, but just a little to be solved?

texts: Does somebody know a cryptographic/mathematic operation, that needs much computing power to be "encrypted"/"created" but doesn't need much power to be "decrypted"/"solved"?