texts: o(1) in time complexity of number field sieve

texts:
It is well known that the time complexity of the number field sieve can be calculated by the formula
$$\exp\big((C+o(1)) (\log n)^{1/3}(\log \log n)^{2/3}\big)$$

The constant C is known for the special and general number field sieve variants.
My question is, how can the value $o(1)$ be approximated for cryptographic reasonable values of n (e.g. $2^{1024} \le n \le 2^{4096}$)?
Do there exist known upper and lower bounds?

The reason for this question is as follows. By the definition of o(1) one can only conclude that asymptotically this value vanishes. But for any bounded value of n, the value can be anything. Therefore, in a strong mathematical sense, this formula is useless to conclude anything about real-size factorization problems.


texts:
I should start by saying this question has little to no practical application. It is purely recreational. I am not trying to solve a specific problem, beyond "I wonder…"

If I had an initial input (say 64 bytes long, all in hex) and I had a desired output, is there an efficient way (read: not brute force) to find IV values that would give the desired output, after 64 rounds?

In other words, accepting that SHA-256 has no backdoor, how would I find IVs that did create a backdoor?


texts: Examples of Weak Cryptography being exploited in the wild by cybercriminals?

texts:
As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course true if "this did not exist" means that we are in Minicrypt (or some weaker "world"), but I also sometimes use this to motivate switching off of particular weak cryptographic primitives.
In this setting, it seems like social/legal conventions would mitigate the potential harm to the user --- for example, simple ways to attempt to leverage the total break of a cryptographic primitive (say transferring a ton of money into your personal bank account) would easily be undone through legal avenues.
In truth, I suspect that most of the hypotheticals that I can think of for how to nefariously exploit a broken cryptographic primitive in the wild would be easily reversed by law enforcement (perhaps I am just a bad cybercriminal though).
That, coupled with my perception that "most" cybercrime does not rely on breaking the "actual" cryptographic primitives that are used (and rather implementation errors/social engineering), makes me curious if cybercriminals have ever attacked underlying cryptographic primitives as part of their criminal enterprise.
I would be most interested in novel attacks / attacks against primitives that were thought to be strong beforehand, but as I suspect these do not exist I would also be interested in attacks against primitives that are known to be weak, provided they were against some notable company (where "notable" essentially means "something an average person may have heard of").
I want to exclude attacks by governments in this question, as these (especially via the NSA) tend to be fairly well-documented already, and seem to mostly sidestep the "law enforcement could/would undo the damage" argument.


texts: Battleship game state save so players can't look up each others' states but server can

texts:
1. Summarize the problem
I want to encrypt save game data for 2 players game - you can think of it as classic "Battleship" game:

Player A knows his game state, does not know Player B's game state.
Player B knows his game state, does not know Player A's game state.

To create a save game, both states are combined to encrypted format.
This way, both players can download a save game without looking into it what is an opponent game state.
The server can know both game states and has to decrypt both players' game states to know them.
Inputs to create crypto keys can be:

players names (known only to player A and B)
game ID (known only to player A and B)
players' passwords (each password is known only to the respective player and is always typed into the Frontend - the server does not need to know it)

2. Provide details and any research
I figured out I want to use asymmetric encryption and public key cryptography.
But when looking at my solution, I realized it might seem simple and easy, but I remember rule 1 of crypto: never do it yourself so I seek advice here.
3. When appropriate, describe what you’ve tried
Players type in frontend their name, password & game ID.
If a match found for name A, name B, password A, password B & game ID we have a "decryption key" that successfully is going to decrypt both players' game states for the server.
The problem is I have "too many" inputs (public keys) and too few private keys. I do not know how to mix them up.
A model I found only works on 1 public and private key https://docs.huihoo.com/globus/gt4-tutorial/ch09s03.html - I have times 2 complexity than this. Many different inputs to combine for a 1 key... How do I mix them together I have no idea.
PS
I do not know how to describe the problem better to find a surly already existing solution. Can you recommend a primer course focused on multiplayer games?


texts: Can you give me a summary of cryptographic hardness assumptions?

texts:
Until recently, I had a link to a website which summarizes up-to-date cryptographic hardness assumptions.
But, unfortunately I cannot find it.

The webpage is categorized well problems such as, DL problem, Factorization, Finite field, DH problems.
More importantly, such problems are very well organized.
For example, DH problem and most of its variants are listed with problem definition, introduced source (authors, paper name, etc.), and its applications.

What I had was not pdf file nor book chapter, just a webpage.
As I remember, its web structure is similar to http://hyperelliptic.org/ECRYPTII/vampire/

I think such a summary would be very helpful.


texts: Encipher the following plaintext message using the Vignere method using the key K = [4,2,3]

texts:
Encipher the following plaintext message, Exotic, using the Vignere method using the
key K = [4,2,3]

Can anyone help me get the answer and  why, can't find anything that matches this question online.


texts: Is AES key length a size of the key or entropy?

texts:
While educating my self I'm having hard time to understand what an 128 bit AES key actually means?
Is it a key length or entropy?
Please explain to me trough following example (assuming AES):

Password length in characters (L) = 20 (characters)
Symbols used (N) = 95 (ASCII set)
Entropy = log2 (N^L) = 128 (is this what is called 128bit AES key?)
OR
Key length = L * 8bits = 160 bit key length ? (is this supposed to
be 160bit AES key?)

When somebody says that he's using 128bit AES key, I want to know to what is he referring to, a key length or entropy?


texts: Is it meaningful to allow parties to use a non-uniform random tape in 2-party computation?

texts:
Consider a trivial example where two semi-honest parties want to flip a biased coin. Since the sender is semi-honest, the sender can locally flip a biased coin and send it to the receiver. A natural question is: What does the sender's random tape look like in the above trivial real protocol?
I know that, in the 2-party computation literature, the random tape is assumed to be uniformly random. I am curious about the convention of such an assumption. Is it a mandatory requirement? Many thanks for your comments.


texts: trying to get calculator and RSA calculatin does not make sense

texts:
got two question, I am novice in the area of crypto and currently in big learning curve.

From crypto book I am going over with, I see the RSA algorithm example as follows:

it chose two rand #-s:
p=47
q=71
n=pq=3337
and (p-1)(q-1) =3220
Now it chose e - encryption key as randomly for 79
but when it calculates the d the answers simply does not match:

From the book notation I understood the formula as:
d = 79^(-1) mod 3220 = 1019

So I am wondering is it really 79 to the power of minus 1? 79^(-1)
Then no matter what i do, I can not get 1019 as answer.

Second one, this is not directly related to cryptography but will ask here, I was trying to find a good android calculator to do a number crunching to checkout some of the crypto algorithms but so far did not find a decent one. I tried several of them from google store but all of them has some issue. Since i am doing algorithms related to crypto, looking for the one with MOD (%) and number E (exp(1)) but so far can not find one. I even found the virtual replica of good old TI 83+ and learned that one even has not have mod function (although it is possible to program the mod). So I thought may be one of you guys are using suitable calc?


texts:
I'm currently developing a AES implementation in a graduation project at university.
As far as I know, AES uses a 128 bit block length as input .
if the entered string to encrypt is not 128 bits such as 32 bits .
what should be done for data that is less than 128 bits ? What's the best solution ?


texts: What is the Peer Signing digest on an OpenSSL s_client connection?

texts:
For a little background, I am trying resolve an issue with an ISAM (reverse proxy) appliance not being able to connect to a server due to it failing to complete a TLS connection.

A server that is connecting just fine is using ECDHE-RSA-AES256-GCM-SHA384, with peer signing digest of SHA512. This is on a tomcat server.

The on that's having trouble is using ECDHE-RSA-AES256-SHA384, with a peer signing digest of SHA1. This is on Microsoft IIS.

Based on my research, Windows doesn't support ECDHE-RSA-AES256-GCM-SHA384 as a cipher suite (which is fine), but what I don't understand is what the peer signing digest is and why, even with SHA1 hashes disabled on windows, is SHA1 being used.

This may not solve my server issue, but I would like to understand what the peer signing digest is.


texts: Does a padding oracle have the encryption key? Where in real life do I see such an oracle?

texts:
So after some searching, I kinda know the attack procedure of altering bit by bit. But I'm still confused how this is possible. If I understand it correctly, the attacker never has the key, or tries to iterate keys. So since the oracle can check the padding, I guess itself has the encryption key?

What is a real life oracle example I can see? I know this should be well patched nowadays, but what were affected before patching? I read that some kinds of web servers were impacted most, but what part of the server has this kind of oracle?


texts: Homogenous vs heterogeneous unbalanced Feistel networks?

texts:
Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round).
The advantage of heterogeneous UFNs is, that their internal properties change each round, making it more difficult to find specific characteristics which propagate through the different rounds.
On the other hand, homogenous UFNs seem to be cheaper (from a “resource-friendly” point of view) to implement in hardware, and related software implementations tend to be smaller.
Questions:

Is there any way to generally define how much “security” we trade in when choosing a homogenous UFN over a heterogeneous UFN, or does that strongly depend on the individual implementations?
I’m assuming the later to be true, but it would be comforting to have a confirmation on that.

Except for the “cheaper” and “smaller” arguments, are there any other reasons why one would (or maybe even should) choose to use a homogenous UFN instead of a heterogeneous UFN?
Differently asked: Does the choice between homogenous UFN and heterogeneous UFN merely depend on the available resources, or does any situation/scenario/protocol exist which would imply that one should prefer to use a homogenous UFN due to some specific reason?


texts:
Disclaimer: I have no background in cryptography, and everything I'm asking about is what I've learnt from last couple of days of frantic reading on this topic. Any help is much appreciated.

Q: What does the computational complexity of generating a zkSNARK proof and verifying it scale with?

Specifically, how many bilinear pairings, curve point additions and scalar multiplications are involved in generating and verifying a proof? Are these linear in the number of constraints in the system?

Here, I can see that there each verification requires the verifier to compute $11$ curve pairings, $3*m$ scalar multiplications, and $3(m+1)$ curve point additions. First of all, is my understanding correct? Second, what is $m$? Is that the number of constraints? Third, how can I similarly calculate the number of pairings, additions and multiplications that the prover has to compute if I know the number of constraints?


texts:
Let say in a simple Java program, Considering all the facts, like security and performance, Which is the best way to follow. I tried searching for a answer but proper answer is not out there.

Which is better: “serialize and then encrypt” or “encrypt and then serialize”?


texts: In symmetric searchable encryption are the algorithms public?

texts: If a user (other than the data owner) possesses the secret key in symmetric searchable encryption scheme are they able to run the trapdoor algorithm, or is this not publicly available?


texts: Using the same private key for two ECC key pairs

texts:
Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private keys were generated randomly, it is infeasible to find $d_1$ from $Q_1$ (or $d_2$ from $Q_2$).

Now, say we know $d_1=d_2$. That is, we do not know the private key (it was generated randomly) but we do know it is the same for both public keys.

Does this situation compromises the security of the ECC key pairs?
i.e.

Is it now possible (or even easier than before) to find the (shared) private key?


texts: What are some approaches to attack an triple key polyalphabetic cipher when the IV key and PT key are known?

texts:
The cipher is an triple key polyalphabetic cipher also known as an Quagmire IV by the ACA. An example would be here: Quagmire IV example and info (pardon the ads)
I posses the IV key and the PT key. The IV key runs vertically and sets the shifts of the lookup alphabets for the ciphertext. The IV key is the length of the PT and is an plain English phrase. The PT key sets the shifts of the plaintext lookup alphabet. The length of the PT is ~120 characters, is in plain English and I possess an crib consisting of 4 letters and it's location in the ciphertext.
I have read and tried to adapt this method of solving a Quagmire IV but it deals with recovering the PT without the PT key but it does give insight. E.g. if we know the CT key and the IV key, the PT can be reduced to an simple substitution cipher.
I have attempted to attack the cipher using other methods used to solve polyalphabetic ciphers like Kerckhoff's principle and Kaliski but these and other methods I have used to solve simpler polyalphabetic ciphers have not yielded anything.
The question is what is the best manner of attack for this sort of cipher? Even the smallest bit of info about the CT key would be useful. E.g. if I found that the CT key length was 6, I could brute force it. I am not looking for solutions but more techniques/attacks that have some validity to them.
Edited for cipher details (below)
CT

JOZIPMTOHWBFAZPACLRKOHOYSVHLKKRCQTUKJGBGKLCPRFOOACGCFTTDSIQPQRAFKDPMTRXSFOGTKMJRIJGNUTUCVAZNGNNMKAAAMXPLTQCXNQPDJPOKPFA

IV Key

THERESAVOICETHATKEEPSONCALLINGMEDOWNTHEROADTHATSWHEREALWAYSBEEVERYSTOPIMAKEIMAKEANEWFRIENDCANTSTAYFORLONGJUSTTURNAROUND

PT Key

UPSTAIR

Crib

RXSF == THEY


texts: How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

texts:
I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do this, but I don't fully understand this.

At the middle of the last paragraph of 3.3 (page 11 of the document) it is mentioned that the condition $0 \leq p \leq b$ is implied by the conjuction of the following conditions:

$b = \sum_{j}^{} b_{j}2^j $
$ b_{l-1}, ... , b_{0}$ and $ p_{l-1}, ... , p_{0}$ are all bits.
$p \leq b$,  where p and b have been sent by the Buyer to the Vendor in encryptions of separate bits and the Vendor has composed p and b using the homomorphism of the ecnryption scheme used.

I don't understand how they solve 3. $p \leq b$.

How can the vendor make a comparison of these encrypted numbers and be sure that indeed $p \leq b$ ? They say that  $p \leq b$ can be represented as a monotone formula with leaves that are equalities, but I cannot see how does that solve the problem.


texts:
The problem of finding private key from public key is typically studied in the one-key setup: what's the expected cost of breaking one key (e.g. by factoring a public modulus, or solving a discrete logarithm in some group).

There is much less work on simultaneously attacking $k>1$ keys. One notable exception is Daniel J. Bernstein and Tanja Lange's Batch NFS, in proceedings of SAC 2014. They conclude that increasing $k$ allows asymptotic savings on the expected cost per factorization.

A different problem is attacking any one in $k>1$ keys. It seems understudied too, although it is of practical concern, especially in setups where there can't be a revocation list. For example, there are deployed systems such that an attacker could gather many thousands public keys of devices that can write in Smart Cards after authentication, and does not care which one is broken: whatever one allows falsifying records made in the Smart Cards. Also, from a public relations perspective, it's hard to convey that indeed, a hacker demonstrated breaking one key in your system, but it is still safe enough since there's no positive evidence that the adversary could attack a particular key.

We can trivially state that the expected difficulty of attacking any one in $k$ public keys is at most that of attacking one key. I conjecture that it is at least $1/k$ that, at least in the case of factorization.

Can we be more precise, in general, or in the special cases of factorization (RSA…), discrete logarithm in $\Bbb Z_p^*$ (DSA…) or elliptic curve group groups (ECDSA, EdDSA…)?

Update: Poncho quickly pointed that the problem is settled for the discrete logarithm with shared parameters like public prime modulus or curve, which is customary. The question remains in general, for factorization, and DL with per-key parameters.


texts: Is There any Risk to Using Meaningful Text as One Time Pad Key?

texts:
Let's say two people have the same edition of the same magazine. The knowledge that the magazine will be used as a one time pad is secret.

Is there any risk to using this as opposed to randomly generated numbers?

It does not seem to me that any additional risk is introduced, besides running a brute force with real phrases from common books, but that could also lead to a number of inaccurate "descriptions".

So, then, from a cryptographic perspective, are "real sentences" less secure?


texts:
I am using HKDF with an IKM and salt, the OKM is used as the key for an HMAC operation. The HMAC algorithm is authenticating messages in a communications system

The salt is the concatenation of 2 nonces, 1 drawn drawn by each of the communicating nodes and can be found by any one observing the communications system

Messages are sent as:

message || sequence number || HMAC(key, sequence number || message)

My question is this: Is it safe to use the OKM directly as the key for the message HMAC or should I perform some other operation on the OKM before using it?


texts: Does concatenation of two pair computational indistinguishable distributions still indistinguishable?

texts:
Let $X,X',Y,Y'$ be some distribution ensembles such that $X\sim X'$ and $Y\sim Y'$, where $\sim$ means computational indistinguishable. Define $(X,Y)$ be the distribution ensemble over $\{0,1\}^{2n}$ for each $n$ such that $P[(X,Y)=(x,y)]=P[X=x]*P[Y=y]$ and $(X',Y')$ similarly.

  My question is: Does $(X,Y)\sim (X', Y')$?

I can prove this if all the distributions are polynomial sampleable by a hybrid argument, that is we can show that $(X,Y)\sim (X,Y')$ since if there exist distinguisher $D$ to these ensembles then for a given $y$ we can first sample a $x$ from $X$ and feed $(x,y)$ to $D$, but what if $X$ is not polynomial sampleable?

(I'm new to cryptography, so I'm sorry if this is trivial)


texts: Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

texts:
Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate 128-bit-equivalent-secure keys in milliseconds), so I'd like to implement some of them into some software I'm writing here.

Question: Is there or do you know some PFS-providing standards material that could serve me as a guideline that is written using only asymmetric ciphers, not using DH/eDH exchange?

Question variant: Given an asymmetric cipher with fast key generator, would implementing PFS be (roughly) as simple as this? --

both sides generate asymmetric keypars
each side sends its public key to the other side
communication session happens using the private/public keys (probably with some rekeying to some faster (symmetric) cipher and authentication if we already weren't in authenticated channel, but we don't care about that now)
all keys get erased

Bonus: If the above worked, would there be any security difference if each side could re-use its keypair several times (for efficiency or whatever) and made sure that the private gets deleted? Ofcourse supposing that the cipher is secure and ignoring the extended time window for key-stealing attack.

Thanks for guidelines/opinions! :]

EDIT: summary of what I'm trying to solve: I only have a very fast, CCA2-IND asymmetric encryption algorithm and want to build PFS with it. Is there a guide for that, so I don't need to make the obvious error by implementing my own crypto?


texts: Can you rely on the permutation of a ciphertext for secrecy?

texts:
Say you have a message and you run it through an all-or-nothing transform. A transform that requires every single block in the correct order in order to recover any data. Each block is indistinguishable from random noise. Now shuffle them using a seeded crypto RNG.

Say the transform gives you at least 34 blocks (which can be arranged in ~2^128 permutations). Can this structure be considered safe? There's no actual key involved, unless you count the RNG seed.


texts: How does the polynomial module impact the security of ring/lattices-based SIS problem?

texts:
Consider the following SIS problem: for a function $f_A(s)$=$As$, where $A$ is a fixed, randomly-chosen matrix in $(R_q)^{r \times n}$=$\left(\mathbb{Z}_q[X]/(X^N+1)\right)^{r \times n}$ and $q$ a prime, it is hard to find a short element $s$ with some bounded norm $||s||\leq B$ s.t. $f_A(s)$=0. Is SIS still hard to solve when the polynomial modulus is a factor of $X^N+1$ instead of $X^N+1$ itself? Can you recommend any paper on this topic?

Consider the following hard problem: $f_{a,A}(s)$=$aAs$, where $a \in R_q$ is NON-invertible and public. The adversary is asked to find a short $a$ for a random $A$ as in the original SIS problem. It seems obvious if $a$ is invertible, then the hardness of this variant is equal to that of SIS, since if we can find a short $s$ such that $aAs$=0, then $s$ is the solution to $As$=0 when $a^{−1}$ is left-multiplied with both sides of this equation.

It seems $a$ is non-invertible implies that $gcd(a, X^N+1)$ is not 1 since $q$ is a prime. Assuming $gcd(a, X^N+1)$=$d$, then we have $\frac{a}{d}As=0\bmod(\frac{X^N+1}{d})$. Finding a $s$ for this equation is equal to solving the SIS problem with a polynomial modulus $\frac{X^N+1}{d}$. This is why I ask the above question. Thank you so much in advance.


texts: The difference in size between ECDSA output and hash size

texts:
So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit.
Why is there a difference between the hash size and the EC size. In other words, why isn't SHA512 used instead to provide bigger entropy?

I'm not too familiar with the actual ECDSA algorithm so I'm probably missing something.

Thanks!


texts: What is encrypted with the key to give the keystream in CTR mode exactly?

texts: I'm learning how CTR mode and there is something I have trouble understanding. If I understood correctly, two components are encrypted with the key, a nonce and a counter concatenated, and it looks like for example a5b1fe9ac36701ba0000000000000003 : 8 bytes of nonce and 8 bytes of the counter padded with zeros. However, I also read that reusing the nonce produce the same keystream and must be avoided. Why is that, since the counter will differ each time ?


texts: Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?

texts:
I have a couple of questions pertaining to a RSA problem. I need to decipher some ciphertext and find out what the original plaintext was.

Modulus: $n = 2537$ and exponent: $a = 11$

Encrypting function: $E(x) = x^{11} \mod 2537$

Using Fermat's Little Theorem to start, I have successfully encrypted some plaintext and decrypted it, so I do know what the other required numbers in this particular RSA system are, however if initially I am only given $n$ and $a$ can I:

Mathematically work out some plaintext, if the ciphertext, $n$, and $a$ are known? If so would I basically step through the encryption process in reverse?
If not, what is the best/most effective cryptanalysis method to work out what the original plaintext is, if $n$ is relatively small (2537) and $a$ is relatively small (11)?

Note: This is needs to be calculated using the 'maths' behind the system and not a specific computer function.


texts: Weak Boneh-Boyen Signature in Composite order group

texts: In the paper Ring Signatures of Sub-linear Size Without Random Oracles, authors have remarked that the scheme is instantiable in composite order setting, too. I am attaching the following reference below. Can anyone please help me in understanding the argument I have highlighted?


texts:
I'm writing a one-time pad encryption program because I got really interested in the idea of "encryption which has been proven to be impossible to crack if used correctly".

I'm writing the program just for fun, as programming and cryptography are my hobbies. Therefore, I don't expect the program to be used for highly vulnerable data.
I just wonder how secure my program is, and what I can improve (considering that the hacker won't have any access to the key file).

The program starts off by:

Making a list of 50 numbers from the mouse movement coordinates at the
    start of the program.
That number list is then the seed to the ISAAC
    Random Number Generator (More info here).
A key file is generated based on the size of the file to be encrypted. The key file is generated from random numbers from the ISAAC Random Number Generator.
The file-to-be-encrypted and the generated Key file are XOR'ed and saved to a new file--the ciphertext file.
(deciphering) Happens by XOR'ing the key file and ciphertext file, and you get the plaintext file.


texts: Can AES be broken by factorization (using Quantum Period Finding)?

texts: I am trying to understand the paper "Breaking Symmetric Cryptosystems using Quantum Period Finding", and I reckoned the paper is roughly implying to break secret-key cryptographic system by finding the factors of the secret key. Is that correct?


texts:
Two of the CAESAR finalists use XEX and EME mode of operations (COLM uses EME, OCB uses XEX).

I did literature to summarize the main advantages / disadvantages but I could not find much. My question is the following:
What are the main advantages/ limitations of both?


texts: Simply put, what does “perfect secrecy” mean?

texts:
I would like to ask for a clear (but maybe not so deep) explanation of what the term "perfect secrecy" means.

As far as I have researched and understood, it has to do with probabilities of assuming that a certain variable will be the key for a certain cipher text. And unless I'm confusing some concepts, the one-time pad is the only cipher known to have perfect secrecy, since no amount of resources would be enough to break it.

My notions of probability are kind of weak, which is why I don't understand most documents that speak of it.


texts: Encryption with Web Crypto API (SubtleCrypto)

texts:
I want to end-to-end encrypt items in a stateless environment. These items have an identifier (random string). Now I want to add encryption by adding a random key. The URL could be https://server.tld/item#key which users can share with each other.
I want to only use Web Crypto API (SubtleCrypto) without any additional libraries.
My idea so far:

Generate random key: window.crypto.getRandomValues() window.crypto.subtle.generateKey()
Base64 encode/decode for URI fragment: btoa()/atob()
Create key object: window.crypto.subtle.importKey()
Encrypt/Decrypt using AES-CBC: window.crypto.subtle.encrypt()

Now I need an iv. I thought about using the hash of the item identifier via window.crypto.subtle.digest(). However AES-CBC needs 16 bytes.
Is it a good idea to use the first 16 bytes of SHA-1 (20 bytes long) as IV?


texts: Simple question. I have a source file and I have encrypted it with a certain public key. If I take this exact same source file, encrypt it with the exact same key a few hours later would the file hash of the two encrypted files be the same?


texts: MuSig/Schnorr key aggregation: How get the combined private key

texts: Given all parties' private keys in MuSig, is it possible to get a combined private key corresponding to the combined public key? I know it's possible to sign a message, but how to get the combined private key?


texts: Quadratic Sieve Bottleneck, Multiple Polynomials an option?

texts:
After my failed attempt at trying to implement the ECM, I started working on the quadratic sieve. It works, but the bottleneck is finding smooth values over the factor base.

The way I implemented it now, it generates 250,000 values of X, then calculates Y as:

Y = (X + ceil(sqrt(n)))^2 - n

Where n is the number to be factored. I then iterate through the 250,000 values for Y, and look for the first divisible by a factor in the factor base (p), then divide every p'th element by p. I repeat this for each factor in the factor base.

Then I search for the values of Y which equal 1, and add them to an array, then repeat the above until I have as many as in the factor base + 1.

This process is really slow, I was hoping for suggestions of ways to speed this up, or an explanation on how to generate polynomials so I can try and implement the MPQS. I've read some explanations, but they focus more on the mathematics rather than the 'mechanics' of generating them.


texts:
It fairly simple to measure the strength of a key space, largely it's just the number of possible keys.

But how might I measure other properties, namely, a ciphers reliance to attacks such as:

Frequency analysis
Differential Analysis
Linear cryptanalysis

I was hoping for examples with DES or DES contrasted with something simple like Caesar Cipher.


texts: How does Intel TXT prevent spoofing of PCR values?

texts:
I have read some content on trusted execution environment, and I like to ask exactly how it improves hashing. What I read at  Wikipedia’s “Trusted Execution Technology” article states:

  ...PCRs) which hold various measurements in a shielded location in a manner that prevents spoofing.

Does this mean one does not have visibility into the result of the hash?

I’m asking since the process which is described further down on the above mentioned site describes a repeated process of hashing the content with what is in PCRs and storing the result in PCR.

While one does not see the previous results, the state of PCRs is visible to someone who built the prototype or perhaps has access to the platform. I’ld really appreciate some clarification on this.

How does TPM prevent spoofing, and why was such a measure put in place?

Was it to protect against someone who would claim a hash belongs to a content, which it really does not? If that‘s correct, then I am definitely missing something.


texts: Operation modes of block ciphers how are used?

texts:
I am studying about different operation modes of block ciphers my question isn't something specific to that, but is how these operation modes are used in cryptography?

I have this picture here (OFB-mode):

(source)

I would like to know how these operations are combined with a block cipher algorithm? For example we have the DES encryption, while the DES has it's own encryption method where does these operations intersect with the algorithm? I mean when these operations are used in the actual DES algorithm? And why we need them if we know that the DES itself is an encryption method?


texts: Elliptic curve discrete logarithm problem

texts: I'd like to know what is the maximum bits of the finite field that we can solve the ECDLP in a "regular" computer in trivial time. Is there any recent data about this?


texts: How to provide encryption of user's data that can be performed by multiple (specific) users?

texts:
Let me explain my dilemma. I'm a software developer and I'm writing a Windows application that should provide encryption of user's data. There could be multiple users in the database, each having their own username and password.

I currently encrypt data as such:

When a user logs in, I use PBKDF2 to authenticate their user name & password.
If login succeeds I keep the hash part from PBKDF2 in RAM & use it later as a key to encrypt and decrypt that user's data using AES-256 algorithm.

This seems to work, except that I now have a new set of requirements that don't work with my scheme above:

There are two types of users: employees and administrators.
Employees can access only their own accounts.
Administrators can access accounts of any other non-admin users.
When new administrators are added, they too should be able to access data of existing non-admin users.

So I was trying to devise a plan for encryption but I can't seem to figure it out.

Any suggestions?


texts:
What do they mean when saying that a certain value should be “super-logarithmic”?

I've found the Wikipedia definition of a “super-logarithm”, but I'm having trouble understanding how a given value can be super-logarithmic (in some security parameter).

As for an example of the use of the terminology, see http://research.microsoft.com/en-us/um/people/yael/publications/2010-Symmetric_Encryption.pdf. It appears right in the abstract.


texts: Formal proof of theorem concerning the Random Oracle Model

texts:
Reading a book on cryptography by Douglas R. Stinson I've met the following theorem, which is stated without proof (see here).

Thereby, $\mathcal{F^{X,Y}}$ denotes the set of all functions from $\mathcal{X}$ to $\mathcal{Y}$ and $|\mathcal{Y}|=M$.

Is no proof given because it is hard, or because the proof is obvious ? Nothing is said about whether the message space $\mathcal X$ is finite or infinite. I guess, I could see informally that the probability must be constant if this space is finite.

Could someone show the formal proof or lead the way ?


texts: Is there a relation between security of rounds of DES and Luby Rackoff rounds?

texts:
DES uses 16 rounds of feistel networks but not considered secure . Where Luby Rackoff constructions which are inspired by DES its proven by Patarin that 7 rounds is secure .

Is there a relation between number of rounds in DES and patarin's results ?


texts: What is the difference between =, ←, and := in crypto?

texts:
I have seen all of the following notations used to denote the encryption of a message $m$ with the key $k$ to produce the ciphertext $c$:

$c = E(k,m)$
$c \leftarrow E(k,m)$
$c := E(k,m)$

Is there any difference between them?


texts:
could you please explain what is the problem here?:

I'm trying to simulate sign/verify scenario with RSA keys. For simplicity I use 64bits keys:

PK = {BE1EE24B5ACD9DE5, 10001}
SK = {BE1EE24B5ACD9DE5, 15D231A2C5B605C1}

and do the calculations using http://extranet.cryptomathic.com/rsacalc/index

scenario 1 - Ok:

m = 0123456789ABCDEF

using Decrypt method (SIGN) I'm getting signature: 43437cd86b6a2cce

then using Encrypt method (VERIFY) on signature I'm getting back original message (m): 0123456789abcdef

scenario 2 - something goes wrong:

m = FEDCBA9876543210

SIGN = b3baca40fe26f5a1

VERIFY = 40bdd84d1b86942b

why VERIFY method doesn't produce original message here?

Thank you,


texts:
I'm writing an assignment about the Enigma machine, and i'm trying to calculate the amount of settings the enigma machine has. I have found several sites regarding this topic, but it seems like there are to answers to my question. The first answer is 158,962,555,217,826,360,000 and the second is 107,458,687,327,250,619,360,000. Where the difference is that in the second answer, it has been taken into account that the notched rings on the enigma could be set as well, giving 26 * 26 = 676 more settings than the first answer.

But which answer is the right one, and why?


texts:
Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic.
In RFC 8032 one can find a number of test vectors for Ed488 - for example:
SECRET KEY:
   c4eab05d357007c632f3dbb48489924d
   552b08fe0c353a0d4a1f00acda2c463a
   fbea67c5e8d2877c5e3bc397a659949e
   f8021e954e0a12274e

   PUBLIC KEY:
   43ba28f430cdff456ae531545f7ecd0a
   c834a55d9358c0372bfa0c6c6798c086
   6aea01eb00742802b8438ea4cb82169c
   235160627b4c3a9480

   MESSAGE (length 1 byte):
   03

   SIGNATURE:
   26b8f91727bd62897af15e41eb43c377
   efb9c610d48f2335cb0bd0087810f435
   2541b143c4b981b7e18f62de8ccdf633
   fc1bf037ab7cd779805e0dbcc0aae1cb
   cee1afb2e027df36bc04dcecbf154336
   c19f0af7e0a6472905e799f1953d2a0f
   f3348ab21aa4adafd1d234441cf807c0
   3a00

The public key, in the encoded format, is 57 bytes in size. Now my understanding is that the public key is obtained by computing the scalar product of the private key (encoded as described in RFC 8032) times the base point. The operations are to be carried out mod the prime p = 2^448 - 2^224 - 1, which is 56 bytes long.
How can the public key be 57 bytes long, if all the operations are mod a 56 bytes long quantity? It is true that the public key is not directly the scalar product above, for this product has to be encoded as described in RFC 8032. However, this encoding is very straightforward, and can't add an extra byte.
I must be missing something very obvious here - but I can't see what it is.


texts: What other one-way functions are used in cryptosystems?

texts:
For RSA and El Gamal (and most other public key cryptosystems), one of the key ideas is that factoring and finding discrete logarithms are hard. There are other systems that rely on certain properties of lattices.

What are the other one-way-ish functions that have cryptosystems designed around them?


texts: What security risks does exposing the size of the plaintext entail?

texts:
For this question my focus is exclusively on symmetric block ciphers (with a particular interest in AES256 in CBC mode).

I have read much discussion on various ways to pad the plaintext so that the length of the input to the encryption algorithm is a multiple of the blocksize.

The real problem here is not padding to a suitable size (which, by itself, is trivial), but rather undoing such padding after decryption.

One very simple scheme for undoing the padding is to store the length of the (unpadded) plaintext in a header section, unencrypted.  Then, after the ciphertext is decrypted, the raw result is truncated to this saved length.

Since this simple solution is never mentioned in discussions of padding (I've consulted several textbooks), I have to assume that there are some very serious problems with it, but these problems are never spelled out, and they are not obvious to me.  What are they?


texts: Why SHA-256 (or any other) is too fast for passwords but "slow" for collisions to be found?

texts:
Normally, the standard answers of why passwords shouldn't be stored using a groups of hash algorithms, including SHA-256 or higher, even if salted, are "because they are 'fast' hashes", "the attacker has access to specific hardware", and so on.

Why SHA-256 (or some other hashes) is too fast for passwords but "slow" for collisions to be found?  Other ways of asking the same question are: When SHA is "slow" enough for being useful? Why can't that special hardware that the attacker used to crack passwords can't be used to find SHA collisions too?

I suspect the answer is related to the fact that passwords are, in general, small.  If so, the question gets more accurate: What's the size of the message where it starts being worthy using SHA-256 (for example)?


texts: Lightweight Cryptography and Gate Equivalents

texts: If I design a lightweight cryptographic algorithm, how do I calculate gate equivalents (GE)?


texts:
It should be true that classical LOR(Left or Right)-indistinguishability of some mode of operation implies unpredictability. However I've got stuck with the proof of this fact.

LOR-indistinguishability of some mode of operation E means the following:
an adversary has access to the oracle, she can query pairs (m1, m2) to the oracle;
the oracle would respond by encrypting either left message (m1) or the right one (m2).
The mode E is LOR-indistinguishable iff the adversary has hard time to guess whether the left message of the pair was encrypted or the right one.

By unpredictability I mean the following. The adversary is allowed to ask queries of the type M and to obtain the response E(M). The goal is to find a message M*, which was never queried, with the corresponding ciphertext E(M*).

The intuition is that if the adversary A can predict the output of the oracle with "high" probability, then the mode leaks some information, and this adversary can be used to construct LOR-adversary B.

The idea is simple: if we have some oracle (left/right), then we take M (which was asked by A) and we take completely random r with the same length as M, and give this pair (M,r) to our (LOR) oracle. The answer is then goes to A directly.

If A will successively predict the new message, then we bet that the oracle is LEFT, otherwise that it is RIGHT.

In the LEFT universe the probability to predict correctly is the probability of success of A in real-world.

However, I was stuck how to bound the probability of "false positive" in the RIGHT world.
The adversary A have some "trash" values E(r) instead of E(M) he was asked for. How much does it helps him to predict E(M*) correctly for some M*?


texts: Why do we focus on polynomial time, rather than other kinds of time?

texts:
Polynomial time seems to be mentioned quite frequently on this site. It often forms a threshold between two possible outcomes like being secure or an attack's validity.  I know what $\mathcal{O}(n^c)$ means mathematically, but why do cryptographers not use other kinds of time for so many thresholds?

I don't think that I'm asking quite the same thing as What does "running in polynomial time" really mean?


texts: In the paper "Efficient Encryption from Random Quasi-Cyclic Codes" of Gaborit et al. p.14, I read "Encrypt$(pk=(G,Q,s),\mu,\theta)$: uses randomness $\theta$ to generate $\epsilon \xleftarrow{\\\$}V,r=(r_1,r_2) \xleftarrow{\\\$}V^2$...". Does it mean exactly "uses randomness $\theta$"? Where Can I find a descryption of a PKE in this terms?


texts:
it might be a silly question but i need help please

given RSA system , where $n=pq , p\ and \ q \ are \ primes $ , $ v_0,v_1,v_2, v_3 \ are \ known $

  $p^p \equiv v_0 \mod q$

  $q^q \equiv v_1 \mod p$

  $q^p + p^q \equiv v_2 \mod pq$

  $(p+q)^{p+q}  \equiv v_3 \mod pq$

  Mathmatical facts:

  $p^{q-1} \equiv 1 \mod q$

  is obtained using $\phi(q)=q-1$ , Fermat: $p^{\phi(q)} \equiv 1 \mod q$

  $q^{p-1} \equiv 1 \mod p$

  $q^p + p^q \equiv p+q \mod pq$

  is obtained using $(p^{q} \equiv p \mod pq) + (q^{p} \equiv q \mod pq)$

  $(p+q)^{p+q}  \equiv p^{p+q}+ q^{p+q}  \mod pq$

Edit : The solution from https://ctf-wiki.github.io/ctf-wiki/crypto/asymmetric/rsa/rsa_theory/#2018-national-security-week-pure-math

is $q=\frac{v_3-v_0*v2}{v_1-v_0}$ where you can rewrite as

$q=\frac{p^{p+q}+ q^{p+q} -p^p*(q^p + p^q)}{q^q-p^p}= \frac{p^{p+q}+ q^{p+q} -p^{p+q}-(pq)^p }{q^q-p^p}= \frac{q^{p}*(q^q-p^p) }{q^q-p^p} = q^p = q $

I can prove this backward how is calculated but what is the fundamental idea that used to bring the above equation?


texts: What is the difference between calculators and reality

texts: I am looking to mining ZCASH and using a calculator online, I've found it to be 9k per day is this true or am I missing something?


texts:
I have a secret message which I want to encrypt such that any of several different keys can open it independently.  The keys can't know about each other and it has to be able to work completely locally without a network. In short I want two functions

encrypt(message, key1, key2, key3, ...) -> code
decrypt(code, keyX) -> message                   for keyX in (key1, key2, key3...)
decrypt(code, keyY) -> random                    for keyY not (key1, key2, key3...)

Ideally these functions would also have the property that

encrypt(message, key1) -> code1   decrypt(code1, key1) -> message
encrypt(code1, key2) -> code2     decrypt(code2, key1) -> message, decrypt(code2, key2) -> message

This seems like it should be relatively possible to do but I can't figure out how to do it yet. In my research I came across similar problems which many people were calling broadcast encryption but when I read up on it, it seems like for most broadcast encryption schemes require that you broadcast some information about what set of people are allowed to unlock the content and this is used by everyone to calculate their new keys.  This isn't want I want. I need that the "locks" can't change and that adding a new lock doesn't invalidate the old ones.

A physical metaphor would be if you were locking a box lid to bottom using some number of padlocks.  The system I am looking for would be like a chain of padlocks so that opening any of them separates the top from the bottom of the box.  Furthermore, if you add another new padlock on the end of the chain somehow, any of the original keys are still just as useful at opening the whole box.  Anyone have some ideas or links to read up on? Thanks.


texts: How would Private-key Cryptography be if we use quadratic polynomials as OWF's?

texts:
I am aware that one-way functions (OWF's) are the core of many of the primitives in symmetric crypto, in the sense that many cryptographic primitives in the private-key setting can be constructed from these.

On the other hand, in Multivariate Public-key Cryptography the goal is to find trapdoor functions of the form $F = (f_1(x_1,\ldots,x_n),\ldots,f_m(x_1,\ldots,x_n))$ where each $f_i$ is a quadratic multivariate polynomial over a finite field (say $\mathbb F_2$). However, the main assumption and motivation for this is that

  A uniform function of the form $F = (f_1(x_1,\ldots,x_n),\ldots,f_m(x_1,\ldots,x_n))$ where each $f_i$ is a quadratic multivariate polynomial over a finite field is a one-way function.

Given this and the initial discussion, we would have already a symmetric world from multivariate polynomials, without additional effort. Have someone looked at these primitives? how would they be? evaluating at polynomials is extremely efficient but, would these primitives be efficient as well? If so, why aren't these already deployed?


texts:
After reading a lot of articles on ramping up the security of my web accounts, I started using aWallet Password Manager for Android to backup my passwords. I like it for following reasons:

I'm able to have fairly good-entropy passwords: I'm able to throw in a mixup of lowercase & UPPERCASE alphabets, digits, special characters (including spaces) and have reasonably long passwords (10+ characters)
Saving my passwords securely allows me to have distinct passwords for each web account which would otherwise be impossible. This would avert a cascading effect (giving away credentials of all accounts) that would be created if one of my accounts, whose login credentials I share with several accounts, gets compromised.

Needless to say, that 2nd point is debatable because having all credentials stored at a single place introduces a single-point of failure and poses an equal risk of the chain-reaction mentioned earlier.

Given my limited knowledge of Cryptography and doubts around privacy (given recent incidents of online thefts), I want to testify the security of aWallet Password Manager before storing my Banking / Card details in it. Here's what they claim on their Google PlayStore page:

  SECURITY FEATURES

  • All data is encrypted, including Entry names, Category definitions
  and the data itself.

  • Encrypts data using AES and Blowfish algorithms with key sizes of 256, 192 and 128 bits.

  • When the data file is decrypted, up to all combinations of algorithm, key size and cipher mode of operation (CBC, CFB, OFB and ECB) are tried with the Master password to unlock the data file. This makes brute force attacks longer. The app itself does not store any hint to the actual cipher, key size or cipher mode of operation.

  • Uses a randomly generated 'salt' combined with the Master password. Salt helps to protect from off-line dictionary attacks.

  • The key to open the data file is created by combining your master password with the 512-bit 'salt'. The result is hashed 1000 times by SHA-256. Repetitive hashing makes a brute force attack more difficult.

While none of these points make a lot of sense to me, the little bit that I know about Cryptography tells me that repeating a Cipher multiple times doesn't Mathematically improve the security ; it may only give one a false impression of added security. And because of this inconsistency, I started doubting the validity of their other claims.

Could you elaborate their claims / point me to some source where I can get an overview of the concepts to eradicate my suspicion; so as to prove or disprove the level of security offered by aWallet Password Manager?

EDIT-1: As per suggestions by @SEJPM, I've edited the question to remove it's off-topic sub-parts. The remaining part of the original question can be found here.


texts: How to find collisions in a hash function knowing its coefficent?

texts:
Say I have a simple hash function where $x$ is a sequence of integers:

$$h(x)=(a_1\cdot x_1+...+ a_n\cdot x_n) \bmod N=\sum_i a_i\cdot x_i \bmod N$$

where $a_1,a_2,a_3,...,a_n$ is the coefficient known to the attacker,
size of $x$ can be anything smaller than $N$.

How to find 2 different inputs that hashes to the same value, i.e $0$?

I feel like this has something to do with linear combination / euclid algorithm but I'm not sure how to proceed.


texts: Difference Between Gravity-SPHINCS and SPHINCS+?

texts: What are the differences between Gravity-SPHINCS and SPHINCS+ from security and practicality standpoints?  Are they just different implementations of the underlying SPHINCS algorithms or are they functional variations on the underlying algorithms?


texts: How does the secret key in an HMAC prevent modification of the HMAC?

texts:
Just as a preface: I'm not implementing a HMAC - I just want to understand it, as it is part of of my Computer Science course.

When using Hash-based message authentication codes, I understand that you need to protect the front and back of the MAC to prevent an adversary from modifying the HMAC while in transit.

HMAC (K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m))

As such, a HMAC is constructed by hashing the XOR of the secret key K with the outer padding opad concatentated with the hash of the secret key K XORed with the inner padding ipad concatenated with the message.

Can someone explain how these “secret keys XORed with padding” protect the HMAC from modification by an adversary (such as appending data to the end of the MAC)?


texts:
I came across a DL that I need to solve...

5^k = 6361196924231058595008858273263807320 (mod 15860584089531798358308118294328202587)

The modulus is a 124 bit number, so generic Baby Step - Giant Step would take some $2^{62}$ operations, which is unfeasible on a home PC.

Is there any weakness to it? The modulus is 2 * another huge prime + 1, so definitely not smooth (and susceptible to Pohlig - Hellman).

Apparently, some people solved it on their home PCs in a matter of hours... how? It seems impossible to me.


texts: Inclusion and Exclusion proofs in RSA accumulators

texts: I am reading about RSA accumulators from this video and few other sources. I had a confusion whether the complete set is needed to construct a proof of inclusion/exclusion in an RSA accumulator or is it possible to create the proof of inclusion/exclusion just by knowing the accumulator root and the value for which membership/non-membership proof has to be provided. Can someone please clarify this?


texts: Clarification of Advantage vs Probability/Success of an Adversary

texts:
In cryptography, for a polynomial time-bounded adversary $\mathcal{A}$, given a scheme $\Pi$, the success or probability of succeeding $\mathcal{A}$ is the likelihood for $\mathcal{A}$ to break $\Pi$, and its advantage is the absolute value of the difference between its success and a set in stone knowledge. For instance:

If the objective is to prove that $\Pi$ satisfies IND-CPA (indistinguishable chosen-plaintext) security, one would design a game where the objective of $\mathcal{A}$ is to differentiate the result produce by $\Pi$ and a truly random function and outputs its answer as a bit $b^\prime$. The success of $\mathcal{A}$ is $\mathrm{Pr}(b^\prime = b)$, and it advantage is $\mathrm{Adv}_{\mathcal{A},\Pi} =|\mathrm{Pr}(b^\prime = b)-\frac{1}{2}|$. Where $b$ is the bit chosen by the challenge. Here, the advantage is given by subtracting the success with $\frac{1}{2}$, which is the probability of a random guess between $0$ and $1$, the distribution of $b$.

How do you establish the advantage when you have to output the actual result?
For instance, if the game is to compute the discrete logarithm in a group $(\mathbb{G},g,p)$, and we assume that the success for $\mathcal{A}$ is $\mathrm{Pr}(x\in \mathbb{Z}^*_p, y=g^x: x \leftarrow \mathcal{A}(y)) = \lambda$, what is its advantage?

is it simply equal to its success, i.e., $\mathrm{Adv}_{\mathcal{A}} = \mathrm{Pr}(x\in \mathbb{Z}^*_p, y=g^x: x \leftarrow \mathcal{A}(y)) = \lambda$?

or is the advantage the difference between its success and the probability of a successful random guess in the distribution of the output, i.e., $\mathrm{Adv}_{\mathcal{A}} = |\lambda-\frac{1}{\mathrm{order}(\mathbb{G})}|$?

Finally, which concept is better in security proof? computing the advantage or computing the success?
PS: I read the answers to these questions:

What is adversary's advantage in cryptography and why we use it?
Advantage of attacker in CPA secure IBE

But I was not able to get a clear answer. Hence, this new question.


texts: How to build a difference distribution table?

texts: i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in this link, this is is the table of sobox s1 of des, how do I build the table for AES sbox for example?


texts: EdDSA Signature Algorithm - hash of secret key

texts: Why does EdDSA use the (SHA-512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient, and I can't see how it adds any extra security.


texts: Algorithm complexity: $\mathcal O(n\cdot m)$ vs. $\mathcal O(max(n,m)^2)$

texts:
Suppose $A(n,m,k)$ computes

for 1 < i < n do {
  for 1 < j < m do {
    /* some efficient cryptographic operation */
  }
}

where $k$ is a security parameter and integers $n$ and $m$ are upper-bound by a polynomial in that parameter.

  Algorithm $A$ has complexity $\mathcal O(n\cdot m)$, which is quadratic when $n=m$.

Complexity nevertheless seems better than $\mathcal O(max(n,m)^2)$, but we've just seen it isn't.

Can we better compare algorithms with complexity $\mathcal O(n\cdot m)$ and $\mathcal O(max(n,m)^2)$?

The above captures the core aspects of my question. The details are as follows: Algorithm $A$ is part of a voting protocol. Integer $n$ represents the number of candidates and integer $m$ represents the number of cast ballots. So, in practice, $n$ is small and $m$ is large, which gives meaning to $\mathcal O(n\cdot m)$ being seemingly better than $\mathcal O(max(n,m)^2)$, but Big O notation looses that meaning. Is there a way to express it? I suppose we could say "the complexity of algorithm $A$ is linear in the number of cast ballots for small values of $n$", but that seems rather informal. Can we be more precise with regards to "small values of $n$"? Perhaps we just say "the complexity of algorithm $A$ is linear in $n\cdot m$"?


texts: Complexity: Taylor series and security proofs

texts:
Taylor Series

For some functions entered into Wolfram, a Taylor series expansion is represented in Big-O notation.  E.g. $\sin x, x = \frac \pi4$ produces:

$\frac {1} {\sqrt[]{2}} +\frac{x-\frac{\pi}{4}}{\sqrt[]{2}}+\frac{(x-\frac{\pi}{4})^2}{2{\sqrt[]{2}}}+\frac{(x-\frac{\pi}{4})^3}{6{\sqrt[]{2}}}+\frac{(x-\frac{\pi}{4})^4}{24{\sqrt[]{2}}}+\frac{(x-\frac{\pi}{4})^5}{120{\sqrt[]{2}}}+O(({x}-{\frac{\pi}{4})^6})$

Taylor series represent an approximation of a function, and also give a quantitative estimate on the error introduced by the approximation of the function.  $O\left(({x}-{\frac{\pi}{4})^6}\right)$ symbolizes the asymptotic behavior associated with the error introduced by this series at the point $x=\frac{\pi}{4}$ for the function $\sin x$.  Taylor series apply to real and complex variables, and lattice schemes use both real and complex functions in their construction.

$\alpha$-BDD

$\alpha$-BDD, or alpha bounded distance decoding, is a formulation of the LWE problem, such that given a lattice $\frak L$ and vector $y$, find a lattice point $x\in\frak L$ within distance $\alpha \cdot \lambda _1(\frak L)$.  The paper on $\alpha$-BDD states:

  "... a function $f(x)$ which approximates the distance of a target
  point $x$ from a lattice within a factor of $O\left(\sqrt{\frac{n}{\log n}}\right)$."

One Way Functions

Drawing from Micciancio speaking at the PQCrypto '14 Summer School, you can represent the noise of a lattice vector by looking at a specific point in that lattice.  Drawing from what Micciancio said about the one-way function, there is a method of studying lattice cryptography using analytic geometry.

Micciancio covers the different forms of functions associated with the CVP:

Injective
Surjective

The following mathematical expressions are taken from the video lecture of Miccancio:

Let $\beta \gg \mu:g_{\frak L}(\overrightarrow{x}) $ be nearly uniform.  The vector $\overrightarrow{x} \in \beta$ denotes error for an arbitrary hard lattice $\frak L$, with input $\overrightarrow{x}$, and $\| \overrightarrow{x} \| \leq \beta$.

Then:

$\beta < \frac{\lambda_1}{2}:f(\frak L)$ is injective.

$\beta > \frac{\lambda_1}{2}:f(\frak L)$ is not injective.

$\beta \geq{\mu}:g_\frak L$ is surjective.

All three of these functions can be associated with how error is mapped to a specific point in the lattice.

For example, Micciancio shows in the video that the three inequalities are a OWF relying on the CVP.  The error is what creates the "noise," which in turn makes the CVP computationally difficult.  The inequalities are the bounds associated with the error, or another way of defining an $\alpha$ bound as discussed.

The Taylor series also evaluates an approximate function at a specific point.  So in the function from the Taylor series example, for argument's sake, assume that $\sin x$ is the Gaussian distribution with basis vectors $b_1 \dots b_n \in \beta$ for a lattice $\frak L$ generated by the Taylor series.

Question

My question assumes that 1 is true, while 2 may or may not be true.

My understanding is that the approximate functions used to calculate the error in lattice cryptography helps established the security in that proof.  So we can compare this to the boundary conditions to determine if $\sin x$ is injective or surjective, correct?
Can't we just drop most of the terms from the Taylor series to derive $O(({x}-{\frac{\pi}{4})^6})$?  This would become $O(({n}-{\frac{k}{4})^6})$ for some $n$ and constant $k$, right?

  If both Big-O terms from the Taylor series and $\alpha$-BDD examples
  are error associated with their approximate functions, is it possible
  to use a Taylor series as a way to evaluate error associated with a point to determine if the scheme is an instance of LWE or SIVP?


texts: Can MFA codes be predicted if you know what their values were at a previous time?

texts:
I use an app on my phone that, after scanning a QR code on a website, gives me 6-digit codes which change every 30 seconds. These codes can be used for Multi-Factor Authentication (MFA) on some websites, often in lieu of SMS codes or in-app login confirmations.

Presumably these codes are generated based on the shared secret that only I and the website provider both know - that QR code I initially scanned when setting up the MFA. The idea, as I understand it, is that without that original code you are unable to calculate the 6-digit MFA code that is valid during any given 30 second time period.

I am curious, however. What if an attacker has gained keylogger access to a device I use and is able to regularly capture the value of these 6-digit codes; is it possible over time for the attacker to use this history of codes, along with the time they were used, to derive the original QR code I was given when I set up the MFA in the first place?

Essentially, do I need to occasionally rotate my MFA accounts?


texts: Byte location of plaintext vs ciphertext when using a block cipher or stream cipher

texts: I know that when you use a stream cipher you are just XOR'ing the plain text with the PRNG stream,  such that you know if a specific byte is in position 3 of the plain text it will still be in position 3 of the cipher text.  I know that this is not true for block ciphers in ECB/CBC/other modes except OFB.   But why?  What is happening behind the scenes?


texts: Why initialize values and array SHA256 with specific buffer?


texts: Protocol or procedure for storing a secret on a mobile device

texts:
I have the following problem: I would like to develop a local application on a device, e.g. a smartphone or a laptop computer. This application needs to store a high-entropy secret (e.g. an AES key or a private key), which is used to protect the user data the application stores. My question is how to securely store the secret on the device (or somewhere else) under the following conditions:

The user may want to store the secret protected with a PIN or password (which is usually low entropy). Most users will probably choose a short PIN (e.g. 6 digit) instead of a complex high-entropy password, because of convenience: They don't want to enter a long password every time they start the application.
The user's device might be stolen or lost and in this case an attacker who could access the device should not be able to easily recover the protected data by performing a brute-force attack on the PIN or short password. Even if a method to derive a key from a salted PIN, e.g. PBKDF2 or Argon2, is used, an attacker with several high performance computers and access to the lost device could read the salt and try e.g. all 1,000,000 combinations of a 6-digit PIN. If a high "difficulty" in Argon2 or PBKDF2 is used, the brute-force attack takes longer, but too much difficulty compromises user experience: The user has to wait several seconds or more after entering their PIN correctly to unlock the data, which is not acceptable.
The solution should be as platform-independent as possible.

An idea on how to tackle this problem is to store the secret encrypted on a remote server and not on the device itself. If the user can prove to the server that they know the PIN, the server will grant access to the encrypted secret, otherwise it implements some rate limiting, or deletes the encrypted secret.
If a remote server is used, the server should not be able to know or derive either the secret or PIN of the user.
Is there any existing protocol or cryptographic procedure that could solve this problem?
If this could be solved without a remote server or any third party, any solution in that direction is also welcome.
Thanks.


texts: Is there any alternative for extended euclidean algorithm to perform modulo division?

texts:
I'm implementing point addition and point doubling operations for elliptic curve cryptography. I have implemented extended euclidean algorithm to perform modulo division.

It appears the that extended euclidean algorithm takes almost 90% of the computation time for the whole operation. It is slowing down the entire operation.

Can anybody suggest me an alternative approach?.. Or if someone have already implemented it, tell me how did you manage to reduce the time taken??


texts: Is battery usage an important parameter for mobile based key exchange protocol?

texts:
I am studying a key exchange protocol based on public key cryptography technique specifically designed for mobile devices.

I noticed there is no importance given to battery usage by these protocols. I want to ask how important is this criteria? And if it is important, why is it ignored by certain researchers?

Here are some examples where it is ignored:
https://www.researchgate.net/profile/Srinivasan_Bala/publication/266161322_A_PRACTICAL_FRAMEWORK_FOR_MOBILE_SET_PAYMENT/links/54b649650cf26833efd36dc2.pdf

http://ieeexplore.ieee.org/document/6158876/?arnumber=6158876&tag=1 (Symmetric key technique)


texts: What is the difference between discrete-then-gaussian and gaussian-then-discrete?

texts:
In lattice cryptography, we always face the probem of discrete gaussian sampling. To the beginners, it is a bit complex. However, gaussian sampling from a continous space is much easier to understand, and a lot of tools are available. Say, we can use MATLAB to do gaussian sampling very efficiently. So, I want to know what is the difference between the following to process:

(1) discrete-then-gaussian: Just as required is many lattice cryptography papers.

(2) gaussian-then-discrete: At first, get continous gaussian samples, say by using MATLAB, and then perform nearest rounding operations, i.e., discrete to the nearest integers.


texts:
Considering a symmetric cipher (i.e : AES in counter mode), is it possible for any given key to be randomly decomposed into other keys without knowing the message or the ciphertext, such as :

100 = 45+55 (or) 30+70 (or) 25*4 (or)...

Key1 = Key2|Key3 (or) Key4|Key5 (or)...

For any message, applying Key1 or Key2|Key3 would have the same encryption/decryption result.

One-time pad would be an option but it is not very practical because it would take the same length as the message. I am open to all suggestion. Thanks !


texts: Number of keystreams generated in Kreyvium for a single key/IV pair

texts: Kreyvium employs 128-bit key and 128-bit IV. By a single initialization procedure using a key/IV pair, how many keystreams can be generated?


texts: How to create a shared secret S from a subset of existing secrets n, such that k out of n secrets can recreate S?

texts:
In traditional secret sharing schemes, like Shamir's Secret Sharing, first a secret S is generated. Then it is divided into n parts, such that a subset k of the n parts are sufficient to reconstruct S.

My problem is that I already have n individual and independent secrets. Is there a way to come up with a shared secret S from these pre-existing n secrets, such that a subset k of the n parts are sufficient to reconstruct S?


texts: Can you show how that RSA does/doesn't provide anonymity?

texts:
Considering a CPA-secure version of RSA where the ciphertext is just a rundom element from $Z^*_N$. Does that meet the anonymity requirement in which an cpa adversary cannot distinguish between a message encrypted using Alice's public key and a message encrypted using Bob's public key?

EDIT:

My question is related to the experiment in which the adversary is given Alice's public key $pk_A$ and bob's public key $pk_B$ and choose a message $m$ from $Z^*_N$. Then the adversary given the ciphertext created by encryption using $pk_A$ or $pk_B$. The adversary task is to tell what public key has been used.


texts: Security of Shamir secret sharing with regards to the threshold

texts:
Consider Shamir Secret Sharing Scheme (SSSS). This is completely unfounded, but my intuition tells me that the threshold k we set (AKA the number of shares required to construct the original secret) with regards to the total number of shares distributed (n)  has a profound relation with the security of the whole system.

There are two scenarios I'm imagining where the threshold that would affect the security.

  1) When k = n.

  2) When k is dramatically lower than n.

Is any of this true?


texts:
What does modular protocol design mean?
Why does TLS not have modular protocol design?

What protocols have modular design? (IPSec, SSH)


texts: Cryptographic algorithms comparison, AES vs Camellia

texts: Which parameters should be used to compare AES vs Camellia? Their runtime ? The size of the encrypted data output?


texts:
I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix $K$ of size $n\times n$, one can retrieve the key with as little as $n^2$ plaintext/cipher text couples.

All examples found on the Internet assume an alphabet where $A=0, B=1 \dots Z=25$, but how could we break the Hill cipher using a know-plaintext attack without any clue over the alphabet permutation nor the key matrix ?

I've tried several things such as linearizing the whole set of equations together, however it requires several divisions in $\bf{Z}_{26}$ which aren't possible (i.e. division by even numbers or 13)


texts: I think CrypTool is great software. And what I find most useful in it is visualization of algorithms such as Caesar, Vigenere, AES, DES. And my question is: does anyone know other tools which are intended for visual explanation of basic cryptography and related topics such as prime numbers, elliptic curves, finite fields, factorization etc? I am looking for short videos, games, animation, comics, presentations, popular science films. I am lecturer at University, and my goal is to awake students' interest in cryptography and convince them that it's one of the most exciting disciplines. What would you recommend me?


texts:
I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no party can access the information without the other's help.

I actually have an idea about how to solve this but cryptography is not my strong suit and I would like to ask you if there is a better way to do it.

Scenario

Alice and Bob each have written their favorite movies on cards (one movie per card). I need a way for them to address each card in a way that neither of them knows what movie is on the card.

Edit: It is totally acceptable to know to whom a card belongs. As for being honest about the reveal, that's what my other question was about. Each party would have to pass a commitment token along with the random number.

Proposed Solution

Both parties assign random numbers to each of their movies.
They write cards with those numbers, shuffle them and hand it to the other party.
The other party assigns new random numbers to each of the received numbers.
They write cards with those new numbers, shuffle them and place it openly in the middle.

Now if I'm right, neither of them should know which numbered card corresponds to which movie, yet each card uniquely represents one of those movies.

Extension for more parties

Option A: The cards go through all parties, each assigning a new number. All parties are required to determine the movie.
Option B: Each party distributes his number cards equally among the other parties but no further iterations is performed. Only two parties are required to determine a movie but not always the same...


texts:
Google made the headlines with its new Adiantum encryption method, and i read (TechCrunch) that:

  In the meantime don’t expect any instant gains, but future low-power
  devices may offer better security without having to use more expensive
  components — you won’t have to do a thing, either.

So mobile phone which does not have any hardware dedicated to crypto will still be able to encryption as perhaps an equal speed.

My question: can we use this technology in some other places which does not have such hardware? does it makes sense? (e.g in a web browser, having an implementation in WASM of Adiantum).


texts: What is the attack complexity if two stream ciphers are connected in cascade?

texts: What is the attack complexity when Grain-128 and Trivium are cascaded? Is it 2^(256 + 128) since internal state of Grain is 256 bits and assuming that  IV is unknown before encryption?


texts: How to shuffle a number between a range in a reversible manner

texts:
I have to generate identification number plates from a database ID. These ID are composed of three letters and three numbers e.g. BAC 212, I already have a function that convert the internal ID to the plate number:

plate_encode(0) -> 'AAA-000'
plate_encode(1) -> 'AAA-001' ... plate_decode('AAA-001') -> 1

To have a more uniform range for my plate numbers, I would like to shuffle these numbers before encoding them. This fonction act as the enigma machine, it is reversible:

seed = 32912
tumble(1, seed) -> 4839281
tumble(4839281, seed) -> 1

I could use the Enigma algorithm, but my corresponding table does not fit my plate range which is about ~2'800'000 values.

So the function I am looking for should take this additional parameter:

tumble(number, seed, max)

What kind of algorithm could I use?


texts: Why is Curve25519 mostly used for key exchange?

texts:
When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema.
I know, that Curve25519 has a pretty fast arithmetic, so my first idea was, that it is used to decrease the server load. Am i right with my idea? Can someone give me a better answer?

Edit:
I understand that my question may be not clear enough: Why is it not used for encryption/decryption of messages, when used in messenger like Threema?


texts: Transparent Voting and Advance Secret Code

texts:
In the book "Introduction to the Theory of Computation", Michael Sipser writes

The field of cryptography, as this area is known, now extends well beyond secret codes for private communication and addresses a broad range of issues concerning the security of information. For example, (1) to allow electronic elections whereby participants can vote over a network and the results can be publicly tallied without revealing any individual’s vote, while preventing multiple voting and other violations; and (2) to construct new kinds of secret codes that do not require the communicators to agree in advance on the encryption and decryption algorithms.

(Chapter: Advance Topics in Complexity Theory,  section: Cryptography)
I am assuming that the example (1) refers to Blockchain technology. Are there any other ways of achieving the same?
For the example (2), I am not sure which technology is he trying to refer. Any idea?


texts: Difference between computational and statistical indistinguishabilities

texts: What is the difference between the two notions of computational and statistical indistinguishability?


texts: What's the functional difference between fountain codes and polynomial secret sharing?

texts:
Fountain codes, as I understand it, allow for the reconstruction of a set of data (e.g. a 64-bit word), by sending (without corruption or failure) chunks of data generated using a probabilistic function, with the benefit that due to an unlimited supply of chunks being sent over an unreliable channel, as long as the threshold of successfully send chunks are received (e.g. more than 64-bits of encoded data), the client can reconstruct the data without having knowledge of packet loss.

Polynomial secret sharing splits a piece of data into multiple shares, such that if the minimum threshold of shares is provided, the data can be reconstructed. An unlimited amount of shares can be generated. This could be used, for example, to split a secret to multiple locations to provide redundancy and/or security.

The actual implementations of these algorithms are different, but how are they functionally different? Why can't one be interchanged for another?


texts: Prevent double-spending with decentralized digital currencies without all transactions being public?

texts:
A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without double spending or counterfeiting. Their approach is to have all the nodes in the network try to verify a transaction by doing a proof-of-work computation and then the transactions with the most verification are considered official. If an attacker wants to forge the official record (to reverse their first spending and use the coin again), then they must have the majority of the computing power in the network. The biggest downside is that in this scheme, the record of all transactions must be public, which the author of the Bitcoin paper assumes is a must:

The only way to confirm the absence of a transaction is to be aware of all transactions. In the mint based model, the mint was aware of all transactions and decided which arrived first.  To accomplish this without a trusted party, transactions must be publicly announced.

Is it obvious that all transactions must be publicly known in any such scheme?
It is known that schemes without a public-transcript can be implemented when you have a central authority/mint, but I am only interested if it is possible for a decentralized approach.
Notes
I originally asked this question on cstheory. Also, I am not familiar with the tagging on crypto.SE, so any help is appreciated!


texts:
I have a question about random number generators.

I have read from a real random number generator, based on a webcam ("randcam"). My problem is, that I do not really understand how the generation of the random numbers works. Has anyone heard of this principle before and can give some hints how it could be implemented? And how randomly is this method, I've read it should give real random numbers, but is this true? I've found an implementation in C++, but I did not really understand how this implementation works, I am not that familiar with C++.


texts:
Consider a known plaintext attack on AES — just so we have an actual system of equalities that we can feed to a SAT solver.

Is AES solvable in this way? In other words, will the algorithm eventually complete, producing the correct key?

After reading through these set of slides, I assume the answer is yes, but that it is computationally even more costly than brute force, making it impractical.


texts: PyCrypto and AES: can i use a longer key than the block size (16byte)?

texts: I see that in many scripts are used keys of 16 characters for a block of 16 byte, but can I use key of 40 (for example)? And then why in some scripts with aes module the block size is set to 32 byte if aes can handle a fixed size block of 128 bit? Is it correct?


texts:
Consider the following hybrid encryption scheme (B3||4 is for concatenated IV and AES-CBC encrypted message):

-------------------------------------------------------------------
|     Encrypted with RSA     | HMAC  |    |                       |
|     HMAC_KEY || AES_KEY    |  of   | IV | AES-CBC Encrypted MSG |
|   (using PK of recipient)  | B3||4 |    |                       |
-------------------------------------------------------------------

Let's say some message was encrypted with AES-128-CBC with a randomly generated secret key and IV. Then the HMAC was calculated for blocks 3-4 concatenated together. And then the HMAC key and AES encryption key was encrypted with RSA using a public key of a recipient (B).

My question is do I need to include HMAC or even any other digest in such a packet that would be transmitted over reliable connection (let's say TCP) from sender (A) to receiver (B)?

Is the following simplified scheme is worse in terms of security?

-----------------------------------------------------------
|     Encrypted with RSA     |    |                       |
|           AES_KEY          | IV | AES-CBC Encrypted MSG |
|   (using PK of recipient)  |    |                       |
-----------------------------------------------------------

My thoughts:

As message will be 100% delivered to a receiver there is not way it can be damaged during the transmission
With MITM attack there is no way to alter the encrypted message in a meaningful way so it would be still decryptable with the key from a block 1.
There is no better way to manipulate transmitted data then to substitute the whole packet to other one which would hold other message and AES encryption key.
In order to prevent altering in the way described above it's enough to sign the AES key in the block 1 with secret key of a sender (and add the signature to the first block). In such a way the receiver can verify that the key was indeed send by the original sender.
If with the above tweak MITM would alter 3rd or 2nd block of a packet the decryption would not be possible at all - so there is no way to spoof the message leaving the signed key in the first block as is.

The only thing I can think about is some way to alter the block 3 so it would be still decryptable. Is it possible to accomplish for an attacker?


texts: Authentication on top of Bluetooth JUSTWORKS encrypted channel

texts:
I have an embedded device with which I need to establish a secure Bluetooth LE connection. Unfortunately, the device does not have a display. However, the device will have a private key whose corresponding public key is signed by me. The client connecting to the device also has a private key whose public counterpart is signed by me. Anyone in possession of a private key with a public key signed by me can be considered authorized.

Thus, a two-way authenticated secure channel can certainly be established, but I was wondering if it could be done by merely implementing authentication on top of JUSTWORKS Bluetooth LE encryption.

Does JUSTWORKS use Diffie-Hellman or a similar algorithm to generate a shared secret that cannot be known to an attacker?

I think if JUSTWORKS uses Diffie-Hellman or similar, then generating random challenges on the embedded device and client, mutually authenticating the other and making sure to also use the secure channel shared secret as an input to generating the response from the challenge should be sufficient and the existing Bluetooth LE encrypted channel can be used afterwards. Is this correct?
Using signatures seems the most straightforward way to do this, i.e. signing (a hash of) the challenge concatenated with the shared secret and responding with the signature (and the node's public key (signed by me), in case the other node doesn't have it).

I read something along the lines of anyone eavesdropping the first connection establishment of the JUSTWORKS secure channel can deduce the shared secret, and thus recreate the channel and pose as a man-in-the-middle. Sadly, I don't remember where I read that, but if that were true, am I correct in assuming that the above authentication scheme can't work because linking the authentication process to the channel is useless because the attacker can recreate the exact same channel?


texts:
I am using AES/CCM/NoPadding in Java, and it produces a 8-byte MAC when encrypting data. However, the data I receive, produced by a Bluetooth module, produces a 4-byte MIC.

Both the Bluetooth module and my Java/android app, using AES/CCM, produce the exact same output, but have the differences of the MIC and MAC.

Is there a solution to this when trying to decrypt?


texts: Is there an existing AEAD scheme with minimal IV requirements?

texts:
Is there an existing AEAD scheme such that, for inputs with the same AD and IV

ciphertexts are allowed to leak whether or not their plaintexts are equal,
if the scheme can process the plaintext in a streaming manner, then it is allowed to leak where different plaintexts have their first difference, and
is otherwise secure against an adversary that can choose the IVs used for encryption?


texts: Security consequences of HMAC(m, K) instead of the correct way HMAC(K, m)

texts:
I am wondering what is the security loss or consequences of accidentally misusing an HMAC API library in this context:

Regular, correct HMAC:

HMAC(K, m) = H((K' ⊕ opad) || H((K' ⊕ ipad) || m))

Misused HMAC (the inputs to HMAC were accidentally swapped):

HMAC(m, K) = H((m ⊕ opad) || H((m ⊕ ipad) || K))

In this context the 'm' is actually some encrypted random data (used in the standard "Encrypt then MAC" scheme) and could be considered public from an attacker's perspective. The key is 256 bits. The HMAC is HMAC-SHA-256.

Does this swapping of the inputs to HMAC mean that there is now a complete break or complete loss in security or the MAC? Is there now a length extension attack applicable? Or is it not so easily exploitable, seeing that the data is still hashed together by the outer hash?


texts: How would I go about breaking Playfair cipher with the alphabet and the encrypted message?

texts: I was wondering how I could crack a Playfair cipher with only the alphabet and the ciphered message. Ive tried looking for tools online, but still no luck.


texts: Discrete Log with regard to a random base

texts:
Suppose DL is hard in $G=\langle g \rangle$. For a uniformly random group element $r \in G$ (suppose $r=g^a$), is it hard to find $s$ given $r^s$ and $r$? Does the computational assumption have a well established name?

I can show it at least as hard as DDH, because if $\mathcal{A}$ can find $x$ given $g^y$ and $g^{xy}$, she can distinguish $(g^x,g^y,g^{xy})$ from $(g^x,g^y,z)$ where $z$ is a random group element.


texts: What is the key size and security level of attribute-based encryption schemes?

texts:
I am studying the ABE for my masters theses however I want to calculate the key and it's strength. I have done a research about the KP-ABE and I want to know the size of the key and how to determine it's strength because I want to decrease the key size yet keep a good security as well.

What is the key size of attribute-based encryption?  How do you calculate its strength? A math example would be very helpful.


texts: Does SipHash have 64 bit (second) preimage security?

texts:
I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere.

I think it should be 64 bits, but I'd feel safer if somebody who has more experience with such hash functions could confirm this?

PS: I am aware that 64 bits can be broken, but I only need short term protection and I want to keep my packets small.


texts: What steps are needed for fully homomorphic encryption?

texts:
In my project work, I want to encrypt the keywords extracted from certain documents by using fully homomorphic encryption.
What are the algorithmic steps to perform fully homomorphic encryption on plaintext?


texts: Why is it not ideal to rely on interactive assumption to build PRF?

texts:
I understood the meaning of interactive assumption from
What is the notion of an interactive assumption?
.
However, I am not sure why there exists a research field of constructing PRF
 from standard assumption.

What is the advantage of standard assumption over interactive model in general and especially for PRF?


texts: SHA256 creates a unique hash for two *.wim that have identical content - are there better methods for verifying *.wim contents?

texts:
I'm trying to verify that the contents of a Windows Image are identical for two WIM files; however, I think the timestamps for the file modifications are affecting the final checksums--even though the contents of the archives are identical.

Are there other methods to verify that the contents are identical?

At the moment I am using (Get-FileHash -Path IMAGE.wim).hash to find the SHA256 value.

Would a query for image content, and then a comparison of the results, be adequate? The problem with this method is that it doesn't check file size.

Get-WindowsImageContent -ImagePath *IMAGE*.wim -Index 1 | Out-File ImageHash.txt | Get-FileHash -Path ImageHash.txt


texts: How does the birthday paradox apply to random keys?

texts:
I'm developing a web app where I wish to use pseudorandom keys for items, perhaps akin to Imgur. I was thinking about how many combinations I need to reduce the chance of someone guessing any random item in the database (by checking the associated URL) to x. On the performance side, it would seem to be the same (similar?) problem when I'm generating new keys randomly to avoid an excessive hit from repeated collisions.

From the birthday attack article, roughly, the number of options there needs to be (H) for a 50% chance of collision is sqrt(H). So, even if I have 10 billion (1010) possible keys, someone only needs to guess 100 thousand (105) to get a collision...

Something seems severely off with my understanding of the math: if I only have a couple thousand keys used (or lets say 1) out of billions possible, it seems like the chance to randomly find it would be one in a billion.

What's relevant for me I suppose is given the number of entries I expect, and some tolerance for a possible attacker to randomly find one of said entries, how many choices do I need? Naively I'd just say it's

  num_possible_key_values >= expected_entries / max_probability_to_randomly_find_one

So if I plan to accommodate in the ballpark of 10,000 entries, and want it to take a million random guesses to get lucky and find one, I should only need 10,000 * 1,000,000 keys.


texts: What is SHA-512's input space, taking into account variable message size?

texts:
The SHA-512 hash function accepts any message from a single bit to $2^{128}$ bits. Because the function takes into account the message length, I can't just represent every message as a $2^{128}$-bit integer. I'm sure this is a very basic question, but my math background is limited so this isn't coming easily to me.
How do I calculate the number of distinct inputs?


texts: Customizable Crypto Algorithms in Hardware

texts:
Several companies offer customized cryptographic algorithms, for example Crypto AG (www.crypto.ch/en/company):

  The individually created customer algorithms are unknown to anyone
  else and are not used by anyone else. A cryptographic attack is not
  possible, even from an identical unit.

Only the customers know the algorithms:

  Autonomous profiling of algorithms: you are the only one who knows the
  algorithm. Not even Crypto AG has access to it. Moreover, you can use
  a second additional algorithm when collaborating with other
  organisations.

These algorithms are hardware-based:

  Hardware-based encryption is the foundation for maximum cryptographic
  diversity – for speed reasons on the one hand and for its immunity to
  tampering on the other (no readout of data). This approach also
  ensures that the encryption processes remain cryptographically
  separated from the network. No common operating system is needed
  (viral resistance).

Thales offers something similar and calls it Programmable Cryptography
(www.thales-esecurity.com/solutions/by-technology-focus/programmable-cryptography)

A company called Mils offers customized algorithms as well
(www.mils.com/en/technology/customized-algorithms/)

How does this work?
How can they offer a cryptographic algorithm that can be customized by non-specialist customers without support and not run the risk of creating an insecure algorithm? (Ignoring the assumption that this might be the goal)

Note that Crypto AG states that the algorithms runs on hardware. Depending on what they mean by hardware (I understand it as a non-programmable logic circuit with fixed gate connectivity), this severely narrows the available algorithms.


texts: Cipher text only attacks on deterministic fully homomorphic encryption schemes

texts:
If we have encryptions of additive and multiplicative identities in the corpus of cipher text of a deterministic fully homomorphic encryption (FHE) scheme, I guess we can break it.

If the FHE scheme is deterministic and works over integers and if the corpus of cipher text has $enc(1),enc(0)$ where $1$ being multiplicative identity and $0$ is additive identity for integers, I am thinking it is easy to break such scheme.

First we can verify if there any below inferences in the cipher text

if $eval(enc(x) + enc(y)) = enc(x)$ this means $enc(y)$ is encryption of $0$.

if $eval(enc(x) * enc(z)) = enc(z)$ this means $enc(z)$ is encryption of $1$.

if $eval(enc(x) + enc(a)) = enc(0)$ this means $a$ is additive inverse i.e $-x$.

if $eval(enc(x) * enc(b)) = enc(1)$ this means $b$ is multiplicative inverse i.e $1/x$.

if $eval(enc(x) + enc(c)) = enc(1)$ this means $x+c = 1$

Now it is easy to identify all the numbers without decrypting them.

if $eval(enc(w)+ n\times (enc(1)) = enc(0)$ this means $w= -n$.

Is this understanding correct ?


texts: Digital signatures with one-way function, can messages be longer than the signature?

texts: Ethereum and Bitcoin both use 512 bit signatures, can the message that is being signed be longer than 512 bit?


texts: Is this cascading encryption, and is my security weakened as a result?

texts:
I'm trying to understand what is, and what is not, considered cascading encryption. All of the posts and conversations I've read over the past few days discourage the practice, including this article. Unfortunately, I don't really understand the variables in the equations. So, I haven't found anything that appears to address the setup, scenarios, and concerns I have in mind.

What I think I know:

AES is a cipher, and there are no known weaknesses in the cipher.
GPG is a crypto suite (a.k.a., "the implementation"?), and there are no known backdoors or weaknesses
OS X Disk Utility is (or could be considered) a crypto suite (a.k.a., "the implementation"?), and I ASSUME there are no known backdoors or weaknesses
OS X Filevault 2 is (or could be considered) a crypto suite (a.k.a., "the implementation"?), and I ASSUME there are no known backdoors or weaknesses

Initial Assumptions and Questions:

Assumptions:

No known backdoors or weaknesses in the ciphers or crypto suites
AES (at least 128) is used exclusively
Each encrypted "thing" (file, disk image, disk) is encrypted with a UNIQUE, random passphrase of sufficient length
Passphrases will not be leaked (by accident, rubber-hose, etc.)
Computer is not currently compromised (no monitoring, keyloggers, etc.)

Questions:

Any single "thing" (file, disk image, disk)

encrypted with AES,
via any of the crypto suites above,
using a sufficiently long and random passphrase,
provides "good" security, yes?

A GPG-encrypted file exists inside a Disk Utility-encrypted disk image. The disk image is not decrypted (not mounted). A copy of the disk image is stolen by someone who is equally knowledgeable as you in security matters. Is the file less secure inside the disk image than if it existed outside the disk image? Is it more secure? Why?
A GPG-encrypted file exists inside a Disk Utility-encrypted disk image. The disk image is not decrypted (not mounted). The disk image exists on an FileVault 2-encrypted disk. The computer is turned off and so the disk is not mounted. The computer is stolen by someone who is equally knowledgeable as you in security matters. Is the file less secure inside the disk image, on that encrypted disk, than if it existed outside the disk image and on an unencrypted disk? Is it more secure? Why?

I will likely ask follow up questions.


texts: What kind of data is appended to the message encrypted in AES128-CBC?

texts:
I'm currently using wireshark to analyse TLSv1 traffic. I generate the traffic to an Apache (OpenSSL) using the following java (jdk 6) code :

        URL url = new URL(strUrl);
        HttpURLConnection httpc = (HttpURLConnection) url.openConnection();
        httpc.setRequestMethod("POST");
        httpc.setDoOutput(true);
        httpc.setFixedLengthStreamingMode(32);
        OutputStream out = httpc.getOutputStream();

        String request = "A";
        byte[] bytesRequest = new byte[1];
        bytesRequest[0] = Character.toString((char)Integer.parseInt(partsRequest[0])).getBytes("UTF-8")[0];
        out.write(bytesRequest);
        out.flush();
        out.close();

The chosen algorithm in the handshake is AES128_CBC_SHA.

So if I understand things correctly, the POST request is encrypted and sent, then we use the last cipherblock of this request as an IV for the message "A" to be encrypted.

However, when sniffing the traffic with Wireshark I noticed that the size of the encrypted data is of 32 bytes even if Wireshark decrypt it only as 1 byte :

So my question is : what is the nature of the appended data, padding, or info about the length of the message, or both ?

Also, I encrypted both 16 and 32 bytes and I respectively end up with 48 and 64 encrypted bytes, even though padding is not necessary (I'm using messages of the block size).