texts: if a hash function has no known preimage attacks, does that mean there are no known attacks against using it in signatures?

texts:
Suppose a hash function like SHA-1 has known collision attacks (including chosen-prefix collision attacks) but no known preimage attacks.
Does that mean there are no known attacks against using it in a signature scheme, under these assumptions:

I'm signing data by taking the SHA-1 hash and then using a public-key signing scheme to sign the hash (and assume the public-key signing scheme is not broken)
I salt the data before taking the hash, and then sign the salt along with the hash (so if the attacker tries a "chosen-prefix collision attack", where they have a 'good' document and an 'evil' document with the same SHA-1 hash value and they want me to sign the 'good' document, the salt will prevent that attack from working)

I don't understand why that would be considered unsafe if the only known attacks against SHA-1 are collision attacks.
Is it just because of the general inference that if a hash is vulnerable to collision attacks, it is more likely to be vulnerable to preimage attacks, even if none are known currently?


texts: Which is/are the strongest known Fully Homomorphic Encryption scheme(s)?

texts: As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out of many schemes mentioned here (or otherwise) which of them are IND-CCA1 secure ? (not necessarily practical though)


texts: Why the $IV$ used in Merkle–Damgård has to be fixed to a specific value?

texts: I just can't figure out why on earth the $IV$ in Merkle–Damgård has to be fixed (that's what the Katz-Lindell book says)? Because even if you choose it randomly from say $\{{0,1}\}^n$ then the resulting construction still remains collision-resistant, or not?


texts: Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?

texts:
I'm implementing ECDSA for NIST P-256 curve. I just want to know if the same implementation will also work for SECP curves? If it doesn't, can you point me to one or more references of algorithms for SECP 256?

To clarify: I specifically want to know if there are any differences in algorithms for point addition and point scalar multiplication. For the current NIST implementation I'm using projective coordinates for point addition and multiplication.


texts: How does Diffie–Hellman differ from elliptic curve Diffie–Hellman?

texts:
I didn't understand how ECDH actually works. Disclaimer: I know very little about elliptic curves.

Here is how DH works:

Alice and Bob agree on a prime number $P$ and a generator $G$. (They use one from RFC 3526)
Alice generates a long-enough (how long?) secret $S$ and
calculates $R = G^S \pmod{P}$ and sends the result $R$ to Bob
Bob does the same that Alice does in 2.
Alice and Bob exchange the values of $R$
They both calculate $R^S \pmod{P}$ with the value send by the other party, and find the same value $SS$.

$SS$ is the Shared Secret.

How do points 1..4 differ when using elliptic curves?

What are the "equivalent" values of RFC 3526 for EC?


texts: Why Kerberos isn't using Diffie-Hellman key exchange?

texts:
Kerberos transforms the user password to obtain a secret key, which is also stored in the kerberos database. That way what travels through the network is the derived key, not the password itself, which defends against network eavesdropping attacks. After authentication a session key is obtained.

However, what's the reason for the Kerberos protocol not to include a Diffie-Hellman key exchange to exchange a session key rather than using the password for that, and instead pass the password after encrypting it with the session key once both sides have it? A possible issue with having all keys stored in the Kerberos database is that it can leak and then an attacker can impersonate any user, even though they won't be able to geuss their password (and possibly attack other services where the user reuses that password)

Diffie-Hellman key exchange has been published in 1976, so it has been around for a sufficient amount of time before Kerberos (especially version 5) was defined. So what's the reason to rely on password-derived shared keys for secure exchange?


texts: Is there a difference between private key cryptography and symmetric encryption?

texts: I have often seen these terms being used interchangably, but is that correct? Are there Private Key Algorithms that do not use Symmetric Encryption?


texts: Why FHE only needs support for addition and multiplication

texts:
For example, given $E(m_1)$ and $E(m_2)$ to the cloud. How does it calculate $E(m{_1}^{m_2})$?

Is it related to the claim that any computable function can be represented as a circuit containing or xor (additive) and and (multiplicative) gates?

If so, what's the approach?


texts: Will repeated rounds of SHA-512 provide random numbers?

texts: If I hash a keyword with SHA-512 and then feed the output as the key for the next round ....and keep repeating this process, will I gather a stream of random numbers?


texts: Why use symmetric encryption in a protocol like UPORT?

texts:
Reading the whitepaper
UPORT: A PLATFORM FOR SELF-SOVEREIGN IDENTITY ~ DRAFT VERSION (2016-10-20)
I noticed it states :

Let A be an attestation. Suppose we wish to share this attestation with only identities X, Y and Z. We first generate a random symmetric key k, and encrypt A symmetrically. We denote this ciphertext sym(k, A).
Now we assume that X, Y and Z each have a public encryption key. Let asym(U,V,d) denote the asymmetric encryption between identities U and V of some data d. Specifically asym(U,V,d) = sym(DH(U,V),d)
Where DH(U,V) is a symmetric key generated from the public key of U and the private key of V using a Diffie-Hellman key exchange.
Create a random and ephemeral public/private key pair R, and create the data blob made up of ( sym(k,A), asym(X,R,k), asym(Y,R,k), asym(Z,R,k) )

Why is A encrypted symmetrically?
Reading the Security.SE questions “Why is symmetric encryption still used? [duplicate]” and “Asymmetric vs Symmetric Encryption” a potential reason for using symmetric encryption is speed but I don't see the context reasoning for using it in this specific case?


texts: AES-encrypted 128-bit null block: lookup table?

texts:
Let's say a 1MB file has many many consecutive null-bytes 128-bit blocks. Then, as AES works with blocks, the encrypted file will also have recurrent 128-bit-long patterns of aes_encrypt(000...0) (where 000...0 is a 128-bit long null block).

How isn't this a weakness?

As null-bytes blocks is very frequent in files, we could easily recognize "oh this recurrent pattern in cipher is certainly the result of the encryption of 128 null bits".

Then a lookup table:

Key                          Cipher of null 128-bits
----------------------------------------------------
Hello                        a8ff00ac..ff6b
easypassword                 b20fa312..ae27

could help to find the key, isn't it possible?

Is the fact it "works in blocks" not a weakness?


texts: In which cases should the IV be kept secret?

texts:
When must an IV be kept secret?

There is an ambiguity in the way that the lack of need for secrecy of the IV is described in multiple places.  Does this ambiguity suggest that there are, in fact, situations in which the IV must be kept secret?  Or is it a quirk of language that has persisted across several popular sources?

The (ISC)2 Guide to the CISSP states (emphasis mine):

  There is no need for the IV to be secret, in most cases, but it is
  important that it is never reused with the same key.

Crypto.StackExchange:

  IV usually does not need to be secret, However, in most cases, it is important that an initialization vector is never reused under the same key.

Wikipedia:

  An initialization vector has different security requirements than a key, so the IV usually does not need to be secret.

I understand the role the IV plays and the reasons that is is generally considered to be non-secret information.  I am curious if there are situations in which it must be treated as secret information, or if this is merely a linguistic no-op that has gotten repeated.


texts: How to optimize the parameters of extended merkle signature scheme?

texts:
Given the parameters which include: tree height, Winternitz parameter, security parameter, SHA-512 or SHA-256, tree level, how do I optimize the scheme to output a small signature?
The idea is to reduce latency of Extended Merkle Signature Scheme to be use in bitcoin cryptosystem.


texts: PKCS#11: Which CKK_types are supported by CKM_PKCS5_PBKD2?

texts:
On Solaris there's a function pkcs11_PasswdToKey() which is a wrapper of C_GenerateKey(). I made a simple test and it turned out that pkcs11_PasswdToKey() only supports following CKK_types:

CKK_AES
CKK_BLOWFISH
CKK_DES
CKK_DES2
CKK_DES3
CKK_RC4

From my understanding, other symmetric ciphers (like CKK_IDEA) should also be supported. Can anyone make some clarification?


texts: Using the same RSA key for verifying a website and digital signature

texts: We have the (same) RSA key for verifying a website and for digital signature. A user would send a nonce encrypted using the public key, the websites returns the nonce by decrypting it using the private key. Now let's an attacker wants to have a hash to be encrypted with the website's private key. How could this work? I heard it is possible, but like technically how could this happen?


texts: Are there any paper/human strong crypto systems?

texts:
Are there any paper/human executed crypto systems that have reasonable strength?
I am aware of a few candidates so far

Solitare from Cryptonomicon https://en.wikipedia.org/wiki/Solitaire_(cipher) (54! unique keys)
Off the grid https://www.grc.com/offthegrid.htm (ridiculous amount of entropy, but having plaintext + ciphertext leaks information about the key) (technically seems more like a hash than encryption, because it doesn't seem reversible with the given method, but the grid could probably be used for some encryption method)
http://www.ciphergoth.org/crypto/mirdek/
One time pads (although answers I'm looking for are more like 1-3))


texts: NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol

texts:
I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track.
Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output:

reading 1000000 bytes of data
Read in file ../some_data_rec.bin, 1000000 bytes long.
Dataset: 1000000 8-bit symbols, 256 symbols in alphabet.
Output symbol values: min = 0, max = 255

Running entropic statistic estimates:
- Most Common Value Estimate: p(max) = 0.00424421, min-entropy = 7.88029
- Collision Estimate: p(max) = 0.0119504, min-entropy = 6.3868
- Markov Estimate (map 6 bits): p(max) = 9.06705e-222, min-entropy = 5.73662
- Compression Estimate: p(max) = 0.00790364, min-entropy = 6.98327
- t-Tuple Estimate: p(max) = 0.006, min-entropy = 7.38082
- LRS Estimate: p(max) = 0.00389867, min-entropy = 8.0028
....

What I am wondering is the output for the LRS Estimate which delivers a min-entropy of 8.0028.
The symbols in alphabet are defined at 256 i.e. one byte.
So how is it possible a single symbol at one byte/8 bit is able to deliver more entropy than it is able to describe?
I expected the maximum entropy value for one byte should be 8 bit?


texts: Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?

texts:
I am actually looking for available crypto libraries including a deterministic random generator for the purpose of a dedicated crypto key generator unit.
I have a simple question about the X9.31 based PRNG as proposed for instance in Botan library, since I noted that NIST SP800-131 document indicates that use of the X9.31 prng is disallowed from 2015:

Has a PRNG based on X9.31 (as Botan's one) some weaknesses that make that it is no more considered as sufficiently secure and so it is effectively preferable to use another (i.e. CS-PRNG) ?
or NIST recommendation is driven by other objectives (as to limit to CS-PRNG defined in NIST SP800-90A standard) ?


texts: What is the best practices for storing ed25519 private keys which is used by nodes of my application to communicate with each other?

texts:
I am developing some kind of a P2P network where the nodes communicate with each other via TCP and each message is signed by Ed25519 private key. I use libsodium for signing and signature verification.
I am currently developing a configuration of nodes and I had this question:
How to store public/private keys on a disk? Are there any common file formats and best practices for this?


texts: Collision-resistance of $H\Bigl(\bigl(H(m_1\mathbin\| 1)\oplus H(m_2\mathbin\|2)\oplus\dots\oplus H(m_n\mathbin\|n)\bigr)\mathbin\|n\Bigr)$?

texts:
In this answer and discussion, it is considered a distributable hash

$$\tilde H(m)\ =\ H\Bigl(\bigl(H(m_1\mathbin\| 1)\oplus H(m_2\mathbin\|2)\oplus\dots\oplus H(m_n\mathbin\|n)\bigr)\mathbin\|n\Bigr)$$

where the $m_i$ are $n$ segments (say of fixed size) of message $m$, and $H$ is a cryptographic hash (say of $b$-bit and assumed secure in the ROM).

What can we say about the collision-resistance of $\tilde H$ as a function of $b$ ?


texts: Trying to understand MixColumns with Hexadecimal matrix

texts:
I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook has a final answer and it does not clarify how it got the result. I am trying to workout the question but I am not successful. Any help would be appreciated.

Questions: Show the value of State after MixColumns:

$\begin{bmatrix}7C & 6B & 01 & D7\\F2 & 30 & FE & 63\\2B & 76 & 7B & C5\\AB & 77 & 6F &67\end{bmatrix}$

Answer: Final answer of textbook:

$\begin{bmatrix}75 & 87 & 0F & B2\\55 & E6 & 04 & 22\\3E & 2E & B8 & 8C\\10 & 15 & 58 & 0A\end{bmatrix}$

My answer:

I used the path that has been mentioned here to find $2\times 0x7C$ and $3\times 0xF2$.

$\begin{bmatrix} 2&3&1&1\\1&2&3&1\\1&1&2&3\\3&1&1&2\end{bmatrix} \times  \begin{bmatrix}7C \\ F2 \\ 2B \\ AB\end{bmatrix} = \begin{bmatrix} ?\\?\\?\\?\end{bmatrix}$

    7C = 0111 1100
2 * 7C = 1111 1000

    F2 = 1111 0010
2 * F2 = 1110 0100
3 * F2 = 0001 0110

    2B = 0010 1011
    AB = 1010 1011
-----------------------

Now find value for Cell (1,1)

    2 * 7C = 1111 1000
    3 * F2 = 0001 0110
        2B = 0010 1011
XOR     AB = 1010 1011
        --------------
             0110 1110 = 0x6E <-- is not equal to 0x75


texts: Is it possible to generate a 6-digit number using 256-bit encryption?

texts:
Reading through some documentation on a piece of software, it claims that a 4-6 digit number is created using a 256-bit encryption process for the purposes of access control. The whole process works as follows:

A 4-6 digit "start code" (key?) is chosen by the user and programmed into the client software and into the management software as a new "client software record".
Using the management software, a new access code that will open the client software can be generated by selecting the previously created client software record.

It is clear that the 4-6 digit start code is used to introduce some form of uniqueness to each instance of the client software, and that start code is used to generate the resulting access code which when entered into the start screen of the client software, will allow the software to open.

My question is how could that process be using 256-bit encryption?

One thing which is clear is that there are only 10^6 possible combinations to open the client software thus in theory it wouldn't make much difference whether encryption or hashing is used to generate an access code.

Why such as number only access control is used is beyond the scope of this question. I am aware that this is pretty poor access control for software. Am just intrigued by the claim of 256-bit encryption.


texts: Complexity to find an preimage of a hash function

texts:
Suppose a hash function based on Merkle-Damguard construction. Its compression function is given as $H_i=E_{m_i}(H_{i-1})$, where $E_{m_i}()$ denotes the encryption of an ideal block cipher with $n$-bit block size. What is the lowest complexity to find an preimage of this hash function?

Answer: By applying meet-in-the-middle attack, the complexity of finding an preimage is $2^{\frac{n}{2}}$.

The answer above is provided  by lecturer. I don't understand how to apply meet-in-the-middle attack in this question.


texts: Constructing scheme for indistinguishability test with variable length messages

texts:
Say $\Pi=[Gen,Enc,Dec]$ private key encryption scheme, such that for $k \in \text{{0,1}}^n$, $Enc_k$ is only defined for message of length at most $p(n)$. (for some polynomial)
I need to construct a scheme for eavesdrop indistinguishability test where the eavesdrop isn't restricted to output equal-length message.
I saw a paper (last question) where given plaintext $m$ of length at most $p(n)$, they first padded $m$ from the left side with $0^{p(n)-|m|-1}1$ to get a message of length $p(n)$, and then applied $Enc_k(.)$ on the result. For decryption, they first used $Dec_k(.)$ on the ciphertext, and then parsed $0^t1$ to leave only $m$.
But what if for example, I want to encrypt the messages $0^t10^{p(n)-t-1}$ and $0^{p(n)-t-1}$ for some $1 \leq t \lt p(n)-1$, won't they be encrypted to the same cipher text?


texts: Are named curve parameters always the same? I know this may be a stupid question however I think this is the case. For example the secp256r1 is defined in this documet http://www.secg.org/SEC2-Ver-1.0.pdf.


texts: Should text be hashed before being used as an encryption key?

texts:
Let's say I have an API that provides an encryption wrapper around another API. I give the consuming programmer the option of either passing a string or byte array as an encryption key.

The byte array must be the correct size, and is used directly as the encryption key.

However, if they pass a string, I hash it using SHA256/SHA192/SHA128 before passing it to the encryption function.

Is it correct to hash text of arbitrary length before using it as a key?

Or should it be accepted as is, even if it means the encryption key will either have a large amount of \0 bytes if it is too short, or be truncated if it too long?

The underlying cipher is AES/Rijndael


texts: A lot of good information on Kerbero's encryption methods discussed here, but I there is a second question that arises.  Does use of SHA-1 in the overall algorithm weaken Kerberos?  If so, will security scanners potentially block certain Kerberos tickets that use it?


texts:
I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by your counterparts (who also have their public keys in the same registry) to agree on a secret used to send you a message, even when you're not online. A user's public (EC)DH key is changed each time s/he goes online.

Is that system safe? Does reusing the same public key makes it more easy to solve its DLP?

EDIT : When I meant to use a public key in more than one key exchange, I meant it will be used with different counterparts.


texts: AES-CTR security if S-boxes substituion is omitted?

texts:
I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's still relatively secure if we omit S-boxes substitution step in these circumstances

using AES-CTR mode to make sure the same key with the same blocks will encrypt to different ciphertexts
if we select a total random key

I'm asking since this way it seems that it's like we encrypting in a similar manner(not exactly) to one-time pad encryption since the result of encryption(that will get x-ored with plaintext) will be random. I know that using S-boxes will increase the security but is this way fine for non-top-secret documents, so we can get some extra performance for like embedded devices, without sacrificing too much in terms of security, also what kind of attacks can be used.


texts: Problem with LLL reduction on truncated LCG schemes

texts:
I am struggling to apply Freize et al. paper to break a truncated LCG.

A truncated LCG is a pseudo random generator that outputs the $n$ leading bits $y_i$ of $x_i$, where $(x_i)$ is such that $x_{i+1} = \alpha \cdot x_i + \beta\mod M$, and $\alpha$ is an integer, coprime with $M$. The first state $x_1$ is unknown.

The objective is to break the LCG, ie, from one or several consecutive outputs, find the current state $x_i$. We suppose that $\alpha$ and $M$ are known, and $\beta = 0$ (and is known too).

The theory

The paper states (pages 5 and 6) that their method solves systems of modular equations of the form $\displaystyle\sum_{j=1}^k a_{ij}x_j \equiv c_i \mod M$, for all $i \in \{1, \dots, k\}$.

Deriving a lattice from the vectors $a_i$, the authors apply LLL to find a small basis, of vectors $w_1, \dots, w_k$.
By multiplying the matrix $\begin{pmatrix} w_1\\ \vdots\\ w_k \end{pmatrix}$ on the right by $x$, they derive a new set of equations: $\displaystyle\sum_{j=1}^k w_{ij}x_j \equiv c_i' \mod M$, for all $i \in \{1, \dots, k\}$.

Here, i guess that the $c_i'$ are just obtained from the $c_i$ by multiplying (on the left) by the same matrix that allowed us to go from our original basis to our reduced basis.

Now, if the $c_i'$ are small enough, the equalities actually hold on $\mathbb{Z}$ and we can solve them: we have effectively solved the system.

In practice

Now, the authors talk a bit more about their method for a LCG, part 3 (pages 11 and 12).

We have the relations $\alpha^{k-1} x_{1} - x_k = 0$ (edit: fixed typo), so I guess that it implies that all my $c_i$ are $0$.

Now, if I want to obtain my $c_i'$, I should multiply $c$ on the left by the same matrix as the one used to change the basis of the lattice. But, given that I have $c = 0$, I should have $c' = 0$ as well, so we don't need to compute this matrix.

Furthermore, my lattice is, as descibed by the paper,
$$L = \begin{pmatrix}
M & 0 && \dots & 0\\
\alpha & -1 &0& \dots & 0\\
\alpha^2 & 0 & -1 & \dots & 0\\
\vdots &&&\ddots & \vdots\\
\alpha^{k-1} & 0 & 0 & \dots & -1\\
\end{pmatrix}$$
which is trivially nonsingular, and as such, the only solution to $Lx = 0$ is $x = 0$, which is obviously wrong.

Even worse, this method does not use the $y_i$, but it obviously should at some point, so I guess I'm missing something.

My questions

(Most probably related)

In my case, what are the $c_i$, and do I really obtain the $c_i'$ from them by the basis change?
How are the $y_i$ supposed to take part in this method?


texts:
Lehman's method can be described as;
Let $N=pq$. If the ration of $p/q$ is near a ratio of two small numbers $r/s$, then $ps$ and $qr$ are close to $\sqrt{nrs}$. The Fermat's method can be easy applied to $nrs$, and $p=\gcd(ps,n)$, $q=n/p$.
Why doesn't any cryptographic library apply the Lehman's method?


texts: Self-expiring symmetric keys, or: cryptography in absence of secure deletion

texts:
I can encrypt some data D using a random symmetric key K, obtaining a ciphertext C, and then encrypt K with my public key Pub and obtain H. So far so good: I can only decrypt C if I have H and my private key Priv. My goal is to only bring around Priv, and keep both C and H on a public server. Assume C is too large to be re-uploaded, and we do not trust the server so secure deletion is not possible.

The question is: what if Priv gets compromised? In the above scenario, nothing good. C will be on the server forever, together with H, leaving to the attacker the time to read C and decrypt it.

This is bad in comparison with e.g. a mail server, where I have to log in to view my data: as soon as I notice that my password has been compromised, I can change it, and if the attacker did not download C yet, I'm safe.

So the real question is: are there any known, or standard, methods to create "self-expiring symmetric keys"? What I imagine is that I could avoid to store H on the server, but still be able to derive H from some smaller secret (kept on the server) and some external "aid" which should be as simple and less trusted as possible, e.g. a random stream of data, in such a way that it is possible to reconstruct H only for a limited amount of time.

After the key is expired, the data would be lost. Before, one should be able to refresh the key.


texts:
In a situation where it is required to generate n number of keys deterministically from a single piece of seed information can we assume that b breached number of keys, no matter what the quantity would not help an attacker discover the previous nor next key in the set without the original seed data?

My initial thought is that it wont be possible due to the generation of one provably secure key to another provably secure key wouldn't given an attacker leverage leverage. If someone can confirm my thoughts though (or how wrong I am) that would be brilliant. Thanks.


texts: Why was it easier to decode messages that you had several copies of?

texts:
During WW1 the German ambassador in Washington, von Bernstorff, blamed their numerous transmissions of the same messages as the cause for the successful decoding done by the British. I don't see the reasoning unless the same messages were sent in different codes, but why would the Germans do that? Bernstorff said:

  There is absolutely no cipher which they (the British) cannot
  decipher, provided they have before them a sufficient amount of
  telegrams. And this result, particularly in the case of the United
  States, was probably due to the fact that circumstances were such as
  to force us to make use of an extraordinarily large number of ciphered
  messages, and we often sent our reports and telegrams in double or
  triple form, in the hope that in some way they should reach Germany.
  Consequently, the British must have had an enormous amount of material
  in the way of cipher dispatches of ours, and in this way it was
  possible for them to break down our various ciphers.


texts:
I'm trying to crack an affine cipher, but when cracking I cannot find the inverse of a number because the GCD is not 1. This is my plaintext and this is my ciphertext:

PLAIN:  072097 108108
CIPHER: 024328 164193

This is my function:

E(x) = ax + b (MOD 256256)

Gives:

E(072097) = 072097a + b (MOD 256256) = 024328
E(108108) = 108108a + b (MOD 256256) = 164193

So if we subtract these we get this:

139865 = 36012a (MOD 256256)
a = 139865 / 36012 (MOD 256256)
a = 139865 * 36012^-1 (MOD 256256)

Now GCD(256256, 36012) = 4. So there's no inverse because the GCD is not one.

I'm sure it's possible to crack this text but I just don't know how to do it because there's no inverse of 36012 and 256256.

Does anybody know how to crack this or get the inverse of 36012?


texts: I'm interested in the property of involution in block ciphers and how one would go about constructing one. Creating a cipher where $E_K(E_K(M))=M$ for any $M$ and $K$ isn't an obvious task and the use of round keys makes it seem like this is an impossible task without undermining the security of the thing. What is my best approach for constructing a reciprocal block cipher? How do Anubis and Khazad do it?


texts: Does a public key absolutely need to be used to initiate an encrypted session?

texts:
I am a software developer working on an application with the .NET platform.  This application needs to provide a secure connection and encrypt all data between the client and the server.  It is a standaone app that does not use a web browser and will be using a symmetrical key for the vast majority of the messages for best perfomance.  Sessions can be expected to last between a few minutes to more than 24 hours.  I am somewhat of a beginner when it comes to cryptography, but I have done some research.

From the research I have done, it appears that the current thinking is to use a public/private pair of keys to initiate the session.  The first message sent by the client is encrypted with the public key, which is then decrypted by the server with a private key.  In the first message to the server, a random symmetric session key is also transmitted which is then used for the rest of the session and then discarded after use.  All this seems to be quite reasonable, but I do have some questions and concerns:

If public/private keys are to be used for the initial message, then should the same public client / server private key be used for all clients?  Or, should each user have a separate public / private key?  The application client would not need to maintain a private key for decrypting public key messages from the server since all further messages would be using symmetric encryption.  My concern is that if only one key pair is used and someone does somehow manage to figure out that private 2048-bit key, then all the users of the application would be vulnerable...
From research I have done, it looks like some are recommending that nothing less than 2048 bit RSA keys should be used.  If this application takes off, it could easily have 500,000 users within 5 years or so.  Generating public/private 2048 bit key pairs takes some time (if you know how much time it takes - please let me know along with the hardware) and with 500,000 users, could cause some serious time delays in the future.  Imagine a scenario where all of the 500,000 key pairs need to be regenerated.  How long woutd that take?  So, I'm wondering if there is another way of initiating the session that is just as good and circumvents the need to use public / private key pairs to initiate the session...
The application will have a website assocatiated with it that will allow users to register with a user id and password.  What I am thinking about doing is to apply the password to generate the initial symmetric key that would be used to encrypt the first message to the server.  The random session key would still be transmitted and used after the first message.  To identify the user, a unique user token would be supplied to the client installation upon registration that would be appended to the first encrypted message and the user token would not be encrypted.  Once the server receives the first message, it looks up the token and obtains the password.  The symmetric key for that password is then generated on the server exactly the same way as was done on the client.  The .NET platform provides a way to generate keys from a password with the PasswordDeriveBytes class.  So, this approach seems like it will work, but I am not an expert on this topic and would appreciate hearing from others who are more experienced and are in a position to point out anything that I might be missing...
I have also researched symmetric ciphers.  Since performance is an issue as well as security, I am thinking of going with CAST-128 instead of Rijndael which is now being used by just about everyone as the AES.  The reason for this is because according to some benchmarks, CAST-128 is faster on Windows systems.  Also, from a security point of view, I would much prefer to use a much less popular cipher than one that is being used by the US, other governments, and most companies.  There is much more interest in breaking Rijndael than CAST-128 which is only being used by the Canadian govt and PGP.


texts: Why are recomended RSA key lengths so high?

texts:
I was checking for authoritative sources to back up my recommendation of a minimum RSA key length of 1024 and was shocked to find that NIST 800-56Br1 and FIPS 186-4 both recommend at least 2048 bits with 3072 bits for TOP SECRET data.  I found that other sources have similarly high recommendations based on expected lifetime of the key.

These recommendations seem excessive in light of what I can find about attacks against RSA encryption.  As far as I can find, the most recent attempt to factor RSA numbers was the successful factoring of the 756 bit RSA number.  That was in 2009 and required, roughly, two years of effort with 100 computers and a team of mathematicians.  Those researchers noted that their methods would not scale to significantly larger RSA numbers, so other [and unknown] methods would need to be developed.

Given that each additional bit doubles the number of values, 1024 bits would have $2^{256}$ times as many possible values.  Even given very sparse utilization of that immense field, the effort required to attack a 1024 bit RSA key appears very far outside the reach of current capabilities.

Have I missed some more recent attacks?  I note that some of the recommendations I have found predate the 2009 paper.  Why would cryptanalysts believe that 1024 bit RSA keys would be insufficient when no one had even attacked the 756 bit key, which is vastly easier than 1024?

Can anyone point me to cryptanalytic work that demonstrates the risk to 1024 bit RSA?


texts: Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?

texts:
Could you choose the number of PBKDF2 iterations based upon the system time?

I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting with the recommended 1000 iterations in the year 2000 when PKCS #5 was released).

Theoretically at least, you could determine the ideal iterations through an equation based upon the current time. Perhaps something like:

year = <current time in years>
exponent = (year - 2000) / 2
iterations = 1000 x (2 ^ exponent)

Which would give a value of about 115,196 iterations at the time of writing.

Assuming that:

The system clock can be trusted.
The number of iterations is stored with the hash, so that hash verification is still possible.
Safeguards are in place to stop the system attempting to hash with a ludicrous number of iterations.
You continue to monitor the actual time taken to hash passwords on your specific hardware.
You regularly upgrade hardware to keep up with the increasing performance requirements.
You choose an appropriate underlying hash algorithm.

Would such a system be safe and practical?


texts: What makes SHA-2 and SHA-3 have security levels half their output hash length?

texts:
The tag wiki for sha-256 says, in part:

  SHA-256 ... processes the input in 512-bit block and has a 256-bit output, for a 128-bit security level.

I'm not a cryptographer, just an interested amateur, but how does it follow that SHA-256 has only a 128-bit security level? (More generally about the whole SHA-2 and SHA-3 families.) Also, against what type of attack is this considered?

I looked to Wikipedia which didn't really help my confusion. The cryptanalytic results listed (up to 2014) are all for reduced-rounds variants, and most for SHA-256 are on the order of $2^{250}$ complexity or more. The comparison of SHA functions gives the security of each SHA-2 and SHA-3 family function as half the output hash length, but provides no clarification of how this figure is derived.

Is the security level related to the relationship between the input processing block size and the output hash length?

Please go easy on me with the math; plain English explanations backed up with some math are preferred.


texts: Is using slow password hashing on the client side easier attackable than on the server side?

texts:
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that for every login we also need to run this slow password hashing algorithm, which for remote logins could be a considerate CPU load on the login server if many people try this at the same time.

This night, I had an idea on how to solve this (in a new protocol for password authentication):

The user types in his username
The client sends the username to the server.
The server sends a salt (and maybe other parameters) to the client
The user types in its password
The client calculates a slow hash (bcrypt-like) from this password, using the salt (and maybe the security parameter, e.g. iteration count) provided by the server
The client sends this hash value to the server
The server calculates another cheap salted hash (SHA-2-like) of the sent hash value, and compares it with the value stored in the database.
(Optional, to avoid remote brute-forcing and DOS: wait a small time before sending back the answer, and limit the number of parallel connections for each user/IP.)

The communication should be encrypted, of course (as the sent hash value is the effective password).

(Add the obvious way of generating and storing the passwords.)

I'm assuming this:

The output of the first hash is not really recognizable as such, e.g. there is
no cheap way to iterate only the possible outputs of the first hash instead of
all strings of this size. If I understand right, bcrypt has this property (if
we only look on the actual ctext part of the output, having length of 192 bits).

(A comment from ZoFreX seems to indicate that this is not the case.
Any details on this?)
The second hash is preimage-resistant, e.g. there is no significantly better
way of finding a preimage fitting to a given hash than brute-forcing the input space.

Then we have:

The first (slow) hash avoids (or rather slows down) brute-force/dictionary
attacks over the password space. (It is salted to avoid rainbow tables.)
The second (fast) hash avoids that an attacker which gets somehow read access to the
database can immediately use the data to login into the system: The attacker will
need to brute-force the (in the bcrypt example 192 bit large) output space of the
first hash to find a preimage (which then would be usable as a password).

If we think it is needed to slow this down even more, we could use a second (low-factor)
bcrypt here instead of a really fast hash.
Since the slow hash is done on the client-side, the server load is not as high
as for server-side slow hashing. (I'm assuming a quite high work factor for bcrypt.)

Here are my questions:

Is there already a protocol which works similar to this? (From the comments, this seems off-topic here. Feel free to mention it anyway if you happen to know one, but concentrate on the next question.)
Are there any weaknesses of this protocol idea compared to a usual server-side slow password hashing?


texts: linear computations over bilinear pairings

texts:
Does this hold in asymetric bilinear pairings?

$e(x_1,x_2)e(x_3,x_4) = e(x_1x_3,x_2x_4)$, where $x_1,x_3 \in \mathbb{G}_1$ and $x_2,x_4 \in \mathbb{G}_2$ for a bilinear pairing $e$


texts: Can XEX or XTS modes be used with only one tweak?

texts:
XEX Mode (with two tweaks) is the following scheme:

$X = E_{k}(I) \otimes \alpha^j \\
C = E_{K}(P \oplus X) \oplus X$

where $I$ and $j$ are both tweaks (sector number and block number respectively).  If I wanted to use only one tweak, $I$, is the following correct and safe?

$X = E_{k}(I) \\
C = E_{K}(P \oplus X) \oplus X$

Essentially $j$ is treated as $0$, which I believe eliminates it from the equation.

To clarify what I mean by "safe"; does the second scheme I show have the same security guarantees that the first scheme has, as outlined in Rogaway's paper?  I skimmed the paper, but remain unclear as to whether the second scheme is included in the XEX family as Rogaway defined it.


texts: Combating traffic analysis over request-response protocols

texts:
Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions:

Contribute a message to the chat, where the server responds verifying that the message was sent.
Request the chat contents, where the server responds with the chat contents.

All requests and responses have confidentiality, authenticity and integrity assurances. Requests and responses are of variable size.

In this protocol, a passive attacker can apply traffic analysis to estimate the size of a message sent, estimate the size of the conversation contents and distinguish between the two types of requests and responses.

The most obvious way to combat this type of traffic-analysis is to send and receive messages of fixed length at fixed intervals, however, due to the nature of the protocol, this is not possible.

How does one combat traffic analysis in such protocols without changing the nature of the protocol or wasting (a lot) bandwidth?

Update: Some of the information derived from traffic analysis of the protocol is of negligible importance for civilian purposes. I am mainly attempting to reduce the amount of information gained from the length of a request or response.

Suppose that the server supports multiple "chatrooms".

Here are two examples of how an attacker could utilize the length of server responses:

Given that different "chatrooms" do not have contents of equal size, the length of a server response to a "chat contents" request will differ for every "chatroom". This allows a passive attacker to distinguish between "chatrooms" that the user might be accessing.
In the same way as above, a passive attacker that can monitor the traffic of two users can detect if they participate in the same "chatroom".


texts: Does a stream cipher provide perfect secrecy?

texts:
From WAR10CK here:

  If I actually do create a machine using RC4 or AES-CTR and have a TRNG continually feed it a constant steady stream of random bits. Provided that the stream of bits is purged after every message, will it meet the perfect secrecy requirement for a OTP?


texts: Performing a cryptographically secure HMAC using multiple input parameters

texts:
I'm using an HMAC as a way to generate a deterministic challenge token for an authentication system.

I've effectively got three string inputs plus a key:

Client IP address (string, eg: "127.0.0.1")
Client nonce (string, eg: "2325363F")
Linux epoch (string, eg: "594077C6")

My key is 256 bit (32 bytes) array.

How should I be performing the HMAC, is it really just a simple case of using string concatenation?

  HMAC(key,input1|input2|input3)

I'm fairly confident the above is just as secure as a hash tree or doing multiple HMAC operations, but would like to confirm my suspicions.


texts: Is it possible to verify attributes of encrypted content?

texts:
Let's say that Alice has this information about her,

{ "name": "Alice", "age": 25, "eyes": "brown" }

which she encrypts with a key pair so that no one access this text.

Later she says Bob that her eyes are brown and Bob should be able to verify only that she has brown eyes, with other information remaining secret.

This mechanism would be similar to merkle tree partial info verification, except we have here the encrypted file not the tree.

Is it possible to partially verify that?


texts: How is padding oracle attack mitigated by encrypt-then-MAC?

texts:
Let us suppose Alice sends a message to Bob.

As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then encrypts plaintext+MAC by random one-time symmetric key, which is, in turn, encrypted by Bob's public key.

Padding oracle attack allows Eve to reconstruct the plaintext+MAC by sending modified versions of Alice's message to Bob and observing whether the modified version will trigger padding error or MAC verification error (when Bob will try to decrypt the encrypted message by symmetric key).

It is said (e.g. Should we MAC-then-encrypt or encrypt-then-MAC?) that switching to encrypt-then-MAC should mitigate the possibility of attack.
In that scenario, Alice first encrypts plaintext by random one-time symmetric key, which is, in turn, encrypted by Bob's public key, and sends both encrypted message and its HMAC computed using her private key.

I don't see how that prevents padding oracle attack, as long as Bob accepts messages from everyone (including Eve). Eve still could modify Alice's encrypted message, compute HMAC using Eve's private key, and send it to Bob.

Does encrypt-then-HMAC actually prevent padding oracle attack in this scenario?


texts: Is this the right way to implement one time pad?

texts:
I would like to know if this the right way to use the one time pad based on this table

Now, my idea is to use the same Ascii #2 to again if the message is longer, I know this is bad practice, what I found this is the only solution if the key is short.
Also, I read that better if I XOR the (#1 + #2), but I see it is useless, do you have a better way to enhance it?


texts: Extracting the hidden text off an image embedded with steganography

texts:
Is it possible for me to extract the hidden text off a stego-image without using the same application that the hidden text was hidden with.

I used 5 applications that do steganography such as, SteganographyX, QuickStego, Xiao Steganography, SSuitePiscel & OpenStego. I only inserted hidden text in a .BMP image and did not embed any type of encryption to make it more secure, just kept it basic.

The thing is that if i hid text using for example QuickStego, i cannot extract what i hid with another application mentioned above.

Is it possible to create such code and create my own application that does let me extract an image's hidden text created by any steganography tool? Like with python or something?


texts: Why aren't hash values for "nothing" (empty) defined as all zeros?

texts:
Any decent hash algorithm will produce basically "random like" values for any given input including the empty input.
For example MD5 produces d41d8cd98f00b204e9800998ecf8427e on an empty input.

I wonder, however, why the MD5 algorithm wasn't defined to have a final step where the output is XORed with d41d8cd98f00b204e9800998ecf8427e.
This should not affect the cryptographic strength of the hash algorithm, and it would have the convenient property that a hash of all zeros represented a zero input.

Would it simply just because adding that step would slow the hash down a bit?


texts:
I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like in ElGamal.
I know that ElGamal with elliptic curves should be possible (Since ElGamal is based on DH), but I have no idea how.
So, could anyone tell me how to implement ElGamal using elliptic curves.
I think I do not need to much background information,

What is the private, what is the public key?
How to encrypt messages? and
How to decrypt messages?

should be enough.


texts: DES generating the same ciphertext for different plaintexts and identical key

texts:
Is it possible to get the same output for DES while the inputs are different while using the same key? The key should not have to be a weak key.

If yes could you give me a hint how to show how to do this? Is there a specific S-BOX to work with? If this cannot be done, then why is it considered impossible?


texts: Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

texts:
In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent smooth group order which can then be factorized, and the discrete log problem can be solved by Pohlig-Hellman algorithm.

How can the same be accomplished for a group of points on an elliptic curve over finite field?

Make sure the group order is not smooth
Find an element of large prime order $q$.


texts: What requirements would lead to the development of a new security protocol?

texts:
I recently completed a semester studying some basic amount of cryptography. So my knowledge is not very broad/deep.

What I currently see is that we have a bunch of fairly secure encryption modes to encrypt data and fairly secure authentication protocols to authenticate/identify subjects.

Now security protocols are a broad domain. Sticking to encrypting data and authenticating users, are there any use cases (ability to process encrypted data or special authentication case, if any) that the current set of well known protocols  don't cover? Do industry researchers need to spend time coming up with their own protocols?


texts: Does encryption using PRP mean indistinguishable encryption against an eavesdropper?

texts:
I am a student studying cryptography by reading "Introduction to Modern Cryptography".
I have some confusion about encryption using PRP (e.g., AES).

Briefly speaking, a keyed deterministic permutation $F_{k}$ is a strong PRP if no efficient adversary (who is given oracle access to $F_k$ and $F_k^{-1}$) can distinguish whether it is interacting with $F_k$ (for uniform $k$) or $f$, where $f$ is chosen uniformly from the set of all permutations having the same domain and range.

I think the definition above says nothing about the relation between two ciphertexts which are generated by a PRP.

Now, I consider the following experiment $PrivK_{\mathcal{A},\Pi}^{eav}(n)$ for any encryption scheme $\Pi= (Gen,Enc,Dec)$.

The adversary $\mathcal{A}$ is given input $1^n$, and outputs a pair of messages $m_0$,$m_1$, with $|m_0| = |m_1|$.
A key $k$ is generated by running $Gen(1^n)$, and a uniform bit $b \in \{0,1\}^n$ is chosen. Ciphertext $c \gets Enc_k(m_b)$ is computed and given to $\mathcal{A}$.
$\mathcal{A}$ outputs a bit $b^{'}$.
The output of the experiment is defined to be 1 if $b^{'}=b$, and 0 otherwise.

A private-key encryption scheme has indistinguishable encryptions in the presence of an eavesdropper if for all PPT adversaries $\mathcal{A}$ there is a negligible function $negl$ such that, for all $n$,
$Pr[PrivK_{A,\Pi}^{eav}(n)] <= \frac{1}{2} + negl(n)$.

Does the encryption scheme has indistinguishable encryptions in the presence of an eavesdropper if $Enc = F_k$ and $Dec = F_k^{-1}$, where $F_k$ is a strong PRP?

In other word, when I encrypt two messages by using PRP, adversaries can be able to tell whether the two messages are identical since PRP is deterministic. However, can I ensure that it is infeasible for adversaries to learn any partial infomation about the plaintext from the cipertext?


texts:
I pretty recently understood the concept of zero-knowledge proof (on a purely logical level, not mathematically speaking, thanks to this article). Despite being a very counter-intuitive principle, it turned out to be an actual and applicable system.
I am now wondering if another counter intuitive problem is solvable: is it possible to prove that we don't (or are unable to) know an information? Or to rephrase it in a more formal way, is it possible to prove that such a system is impossible to create?
Regards


texts: Adversary to Any Collision Resistance Hash Function

texts:
I'm reading a notion Any Collision Resistance for Hash Functions. In the lecture define a collision finder CF.

  CF is said to $(t,\epsilon)$-break the family of hash functions $F_K$
  if the running time is at most $t$, and the probability that CF, on
  input K, outputs a collision $M,M'$ for $F_K$ is at least $\epsilon$. Here the probability is take over $K$ (key space) and CF's random coins.

My question is What does it means that the probability is take over $K$ and CF's random coins?


texts: Understanding elliptic curve point addition over a finite field

texts:
I am new to elliptic curve cryptography as well as finite field theory. I am trying to understand point addition in affine coordinates.

I understand, that for an elliptic curve $ y^{2}=x^{3}+ax+b $ over $\mathbb R$ the sum of two points $P=(x_{p},y_{p})$ and $Q=(x_{q},y_{q})$
is $R=(x_{r},y_{r})$:
$$x_{r}=\lambda^{2}-x_{p}-x_{q}$$
$$y_{r}=\lambda(x_{p}-x_{r})-y_{p}$$

with the slope $$\lambda=\frac{y_{q}-y_{p}}{x_{q}-x_{p}}$$

Excluding the cases: $P=Q$ (e.g. tangent slope), $P=0$ and $Q=0$ (e.g. $R=0$). If however the elliptic curve is defined over a finite field with prime size $n$:
$$y^{2}=x^{3}+ax+b\pmod n$$

Can I just compute the slope for the "standard case" as follows (source: Slide 6)?

$$\lambda=\frac{y_{q}-y_{p}}{x_{q}-x_{p}} \pmod n$$

I understand that for an element in a finite field (f.e. point $P=(x_{p},y_{p})$) amongst other things an multiplicative inverse has to exist. However the formula for the slope $\lambda$ does only include coordinates of the point, not the element itself.


texts: How can I use two different public keys with the same private key for fully homomorphic encryption?

texts:
I am pretty new to cryptography.
Recently I run into this question where I have two different public keys with the same private key, and I need them for fully homomorphic encryption.
Let's say messages from party $A$ and party $B$ are encrypted by two different keys and FHE operations are performed on the encrypted messages. Party $C$ has the one private key to decrypt it. The two different public keys are generated using Party $C$'s public key via Key Reencryption.
How do I perform the FHE operations on these two messages encrypted by different public keys?
P.S. I am using the Palisade library to implement my idea. A little suggestion on how to implement this on Palisade would also be really appreciated.


texts: Probability for success of exhaustive search on PRF keys

texts:
I saw this example for exhaustive search to break the security of a PRF $F_k:\{0,1\}^n\times\{0,1\}^n\rightarrow\{0,1\}$ where the key space is of size $|\mathcal{K}|=2^n$.

The claim is that there is an adversary $\mathcal{A}$ of size $2^n\cdot\text{poly}(n)$ that computes the values of $S_k = F_k([1]_2),F_k([2]_2),\dots,F_k([2n]_2)$ for all the keys.
Queries the oracle $\mathcal{O(\cdot)}$ (which might be either $\mathcal{R(\cdot)}$ or $F_k(\cdot)$) for the same queries, i.e. $S_{\mathcal{O}}=\mathcal{O}([1]_2),\mathcal{O}([2]_2),\dots,\mathcal{O}([2n]_2)$, and returns $1$ if there exists a key $k$ for which $S_{\mathcal{O}}=S_k$, otherwise returns 0.
It also mentioned that the probability to distinguish:

$\left|\Pr_{k\leftarrow\mathcal{K}}\left[\mathcal{A}^{F_k(\cdot)}=1\right]-\Pr_{k\leftarrow\mathcal{K}}\left[\mathcal{A}^{R(\cdot)}=1\right]\right|\geq1-2^{-n}$

(Where $[x]_2$ represents the binary representation in $n$ bits of $x$.)

I understand we must calculate the PRF for several messages in order to have significant number of bits and ensure $S_{\mathcal{O}}=S_k$ does not equal by chance. But I couldn't figure out why specificly choose $2n$?
(I thought maybe we want to have somthing which depends on $n$ bits to have inverse-exponantial probaility for identical strings, but why the factor of 2 is added?)

Also, I don't understand why the probability isn't $\geq1-2^{-2n}$ since the chance for collision in random should be $2^{-2n}$?

Finally, is bruteforce attacks and exhaustive search are basically the same method with different name?


texts: Digital Signature using symmetric key cryptography

texts:
Generally digital signature is a public key cryptography concept.But it needs high overhead.
So is there any publication or link available where 'digital signature using symmetric key' has been explained?
Can one generate an algorithm combining the public key and private key of RSA algorithm to make it a symmetric key?


texts: Top 10-2017 A8-Insecure Deserialization , why products does not implement encryption

texts:
On trying to understand Deserialization vulnerability, it was observed that serialization is the process of converting a complex object to a byte stream for sending it across networks and is deserialized on the receiver side.

On analysing OWASP TOP A8, it says the IT industry has an high prevalence of this feature being compromised for exploitation.

Question:

Why are products not encrypting the serialized data as discussed in the post below?

Which is better: “serialize and then encrypt” or “encrypt and then serialize”?


texts: Perfect secrecy with some considerartion

texts: According to eavesdropping indistinguishability experiment $PrivK_{A,\Pi}^{eav}$ from page 34 of this book, I define $\varepsilon$-perfect secrecy as this($\varepsilon>0)$: For every adversary $A$ We have: $Pr[PrivK_{A,\Pi}^{eav}=1]≤\frac12+\varepsilon$. I want to prove that $\varepsilon$-perfect secrecy holds, when $|K|<|M|$. Can anybody guide me? ($|K|$ and $|M|$ are the number of keys and messages in our schema respectively).


texts:
Why are AES keys increments of 64-bits? Rijndael, which subsequently became AES, allowed key increments in 32-bits (128, 160, 192, 224, and 256 bits).  However, AES made it 128, 192, or 256.

My guess would be that a 64-bit default increment may be good to increase the lifetime of a particular key size for a particular application.  For example, assume that an application is using 128-bits and then the application owners feel they have to increase key size because of threats.  An increase to 192-bits (cf. 160-bits) may give this upgrade a longer life before technology advancement catches up and the application owners have to change again.  Is this speculation in the right direction?


texts: Is unusual (non power-of-two) RSA key size more secure?

texts:
On this blog https://blog.josefsson.org/2014/06/23/offline-gnupg-master-key-and-subkeys-on-yubikey-neo-smartcard/ there is a following sentence

  Generate master key

  Below I will use a 3744 bit RSA key, where the key size is selected based on the assumption that people will focus efforts to crack RSA keys on the usual power-of-two key sizes.

But that leaves me to wonder: do unusual key sizes really pose a disadvantage to a potential attacker? After all, couldn't he just get a key size from a public key?


texts: Brute force against computational security

texts:
One-time pad is secure under brute force with respect to either of the definitions
\begin{align}
\Pr[M = m] &= \Pr[M = m | C = c]\\
\Pr[C = c | M = m_0] &= \Pr[C = c | M = m_1]
\end{align}

basically because the key and message spaces are the same, and $\oplus$ is closed under these spaces.

Given the argument above, I don't understand precisely how computationally secure schemes are compromised under brute force. In particular, how would any of the two equations above be violated given the scheme $$\mathsf{Enc}(m, k) = m \oplus G(k),$$ where $G$ is a pseudorandom generator.


texts: AES-XTS vs AES-CTR for Write Once Storage

texts:
I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be readable without authentication (achieved over a separate channel with the drive).

Since an attacker can never gather two ciphertexts for the same block, is there any advantage of using AES-XTS over AES-CTR? If not, should I still use AES-XTS, since it makes it clear that we are effectively dealing with FDE (although in a write-once fassion) and reviewers might (correctly) argue that CTR should not be used for FDE? Or should I use AES-CTR, because its security guarantees are proven better?

The goal is to make it possible to send the encrypted data to the manufacturer (who also holds the key) in case the password is lost to allow data recovery (which is a regulatory requirement). Each disk uses a unique key.

EDIT: this is not a duplicate of Why do we use XTS over CTR for disk encryption?, because I am concerned about write-once storage, not a regular disk drive that will be overwritten with different data regularly, thus the attack surface is very different.


texts: Turn a homomorphic encryption scheme into one that doesn't have the homomorphic property

texts:
Homomorphic encryption is a form of encryption that allows computation on cipher-texts, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext. The purpose of homomorphic encryption is to allow computation on encrypted data.

I understand about almost homomorphic and full homomorphic, but how can I turn a homomorphic encryption scheme into one that doesn't have the homomorphic property?


texts: Are short ElGamal keysizes acceptable (1024-bit or lower) in cases where security is only necessary in a short timeframe

texts:
I am working on an efficient mental poker framework. I have implemented a functional and secure commutative encryption scheme based on ElGamal as described in:

http://groups.csail.mit.edu/cis/theses/weis-phd-thesis.pdf

However, shuffling and dealing an entire deck is causing slowdown as the number of players involved in the game increases (more players means more commutative encryptions and decryptions). Even in initial, idealized tests things are pretty slow.

The system parameters currently used are an advisable 2048-bit safe prime (from RFC 5114) but I'm wondering if these key sizes are overkill in the case of something like mental poker where decryptions of relevant cards will happen within a few minutes and after the hand the security of the previous deck is irrelevant? This got me wondering in general if key sizes are flexible depending on "how long the encryption needs to last" - are there any guidelines here? Any pitfalls I'm not considering?


texts: how to use these hash functions in python?

texts:
In this article https://www.mdpi.com/2073-8994/12/10/1687/htm, specifically in the section 4.1 of the initialization phase,the following cryptographic hash functions have been chosen:
\begin{align}
h_1&:   \mathbb G\to\mathbb Z_q^*\\
h_2&:  \{0,1\}^*\times\{0,1\}^*\times\mathbb G\to\mathbb Z_q^*\\
h_3&:  \{0,1\}^*\to\mathbb Z_q^*
\end{align}
where G is an additive group with order q.
Can anyone explain to me what's the meaning of their notations and how to use them for example in SHA algortihm? Or maybe give me a simple example with real inputs?


texts: How many degrees of freedom up my sleeve?

texts:
Now that we know how the MD2 S-box was constructed, I find myself wondering how good a nothing up my sleeve number it really is. It is derived from $\pi$, but not in a very obvious way, even in retrospect.

How would you estimate the number of possible $\pi$-derived S-boxes that are no more complex or suspicious than the actual one is?

For example, "unique bytes of pi starting from the 96723th digit in base 256" is (arguably) simpler, but more suspicious. On the other hand, a longer description/algorithm would count as more complex.

Or more generally: how would you appraise how binding a nothing up my sleeve number is?


texts: Why should the factors $p,q$ of $n$ be half the bit length of $n$ in RSA?

texts:
Why do we want the factors $p,q$ of $n$ to be of size half the bit length of $n$ in RSA?

I know $p,q$ need to be large so that it is harder to factor $n$ and if one of $p,q$ is small, then it is more likely to find a factorization by brute force. But why half the bits of $n$ (i.e., $p,q$ must be in range $[2^{(n-1)/2} \dots 2^{n/2}]$)? Is it just that for $p,q$ to be the largest possible they both need to be of size half the bit length of $n$?


texts: Definition of perfect secrecy using ciphertext

texts:
This week my professor in class taught us the definition of perfect secrecy. He said that for any ciphertext the probability that it might have come from any message in the message space should be equal.

$\Pr_{k\leftarrow Gen}[Enc_k(m)=c]=\Pr_{k\leftarrow Gen}[Enc_k(m')=c]$

He then said to think of the possibility where we vary the ciphertext and not the message. I think what he said might be interpreted as that the probability that a message encrypts into a ciphertext should be equal for all ciphertexts.

$\Pr_{k\leftarrow Gen}[Enc_k(m)=c]=\Pr_{k\leftarrow Gen}[Enc_k(m)=c']$

I thought about this but haven't been able to relate it to the original definition. I wanted to prove the equivalence or get a better inference of what he said. I don't know if this is even true. So a counterexample might be more useful.

If I haven't written any detail please let me know.


texts: RSA incorrectly translates for small keys

texts:
I've been learning about RSA and wrote my own implementation. I don't pretend to have intuitive understanding of RSA or that I understand why it works, but I believe to have some basic understanding of how it works, and believe that my implementation is valid. Due to time penalty of key generation, I set extremely low key size and had it encrypt and decrypt random numbers to check that it works. Here are randomly chosen parameters:

public: (326142389, 498429991)
private: (402424365, 498429991))
original message: 2256094460

final result: 262374496

Decrypting and encrypting failed to provide the original message. I wasn't sure what went wrong so I wanted to gather a couple more results. I had it print out a dozen more attempt results. Half of them successfully translated the message. This had me even more confused, so I ran some more tests. Here's the probability for translation failure (based on a sample of 100000). Left side shows the range from which the primes were generated, the right one the percentage of times translation failed (decrypt(encrypt(message)) != message)

      Primes range | Failure chance (%)
-------------------+-------------------
             10-99 | 100.00
           100-999 | 100.00
         1000-9999 |  99.36
       10000-99999 |  46.75
     100000-999999 |   0.00
   1000000-9999999 |   0.00
 10000000-99999999 |   0.00

While all these primes and keys are much much smaller than what I intend to use for real, I am wondering why this is happening. Is it a fault in my code which only reveals itself for tiny keys or is it inherent within the actual RSA algorithm?


texts: Types of Cryptography for a 4-8 bit microcontroller

texts:
This is more of a research question.

I was wondering what types of crypto algorithms would work best on a small 4-8 bit micro controller.  I recently read a paper called Security Considerations for 802.15.4 Networks and was wondering if anyone out there can think of any other papers or has knowledge about what types of things to consider when implementing cryptography on a low-power, low-memory system.

I read a 2009 ieee paper on implementing RFID on a 4-bit micro controller, but I am looking for papers that will generally apply towards 802.11 or 802.15 standards.  I will propablly be trying to hook a bunch of these controllers together, so I am looking for more of asymmetric encryption.


texts: Prove that shares can reveal a seceret key. in a secret sharing scheme

texts:
I am trying to build a cryptographic system that has several components and ran into a problem with a secret sharing scheme.

Let $v$ be a value we are interested committing to.
I generate a commitment $P = aG + vH$ where $a\in \mathbb{Z}_q$ , $G$ and $H$ are generators of that group (Pedersen commitment scheme, if given $a$ someone can derive the value $v$).

Now lets assume I want to break $a$ (lets call it the blinding key) to $n$ shares using  shamir secret sharing scheme where $k$ shares can produce $a$ ($k,n$ sharing scheme).
so if $P$ is publicly known, is there a way where players who received a share can verify that the share they got actually produce $a$ without uncovering $a$? meaning that they know the combined shares can generate the blinding key.

I know that there exist a scheme for verifying that all shares are derived from the same polynomial (Paul Feldman's scheme) but what can prevent  the possibility of an adversary calculating and distributing shares derived from some randomly generated and unrelated polynomial (where the secret is $c\neq a$)?


texts: Does encrypting a double-length 3DES application key (that has an odd parity) under a double-length 3DES zone master key (also with an odd parity) affect the parity of the application key?


texts: Is RSA secure enough to protect bitcoin private keys?

texts:
Suppose my very trusting friend has a bitcoin private key with a large balance (let's say $1B USD worth of Bitcoin) and wishes to keep a backup copy with me as a trustee.
He doesn't want to transfer the raw key over an internet connection for obvious reasons, so he asks me to generate an RSA key and send him the public key so he can encrypt his bitcoin private key and then I can decrypt it on my end offline and store my backup of his bitcoin private key.
Is there a realistic risk that someone could brute force the encrypted key that we transferred plaintext over the internet?


texts:
I am trying to find two collisions in SHA1 for the 50 least significant bits.  I was wondering if there was a way to efficiently do this without having to brute force all of the possible hash outputs?

It seems like trying to look for two same hash outputs is easier than trying to find a message that hashes and matches to a hash output I already have.  (i.e. trying to break preimage resistance rather than second preimage resistance)  But this still seems like I would need to brute force all the possibilities


texts: Parallel authentication of encrypted data. What AE type to choose?

texts:
I've got a system with a slow data transfer channel. Transferring a message through several channels does increase the transfer speed significatnly.
 AES-CBC+HMAC is good except that verifying the MAC cannot be done in parallel.  Encryption can be parallel by using CTR, but MAC calculation still needs to be sequential.

I looked at some AE modes like GCM, CCM, EAX, OCB, etc (actually I'm reading this document: http://www.fi.muni.cz/~xsvenda/docs/AE_comparison_ipics04.pdf ), but still cannot find one that meets all my needs.
Here're the main requirements:

The decryption and verifying integrity must be parallelizable.
The encryption is not required to be parallelizable.
The Message can be of any size. Well, at least up to 100 TBytes.
When encrypting data, the message size may be unknown. So "online  processing" is required for encryption.
High performance is not required, because the data channel speed is the bottleneck.
No patents.

It seems that GCM mode is a way to go, except that it doesn't meet the requirement #3. According to NIST 800-38D GCM supports messages only up to 2^39-256 that is ~512 GB only. However the doc I referenced before states that GCM supports online message processing (without knowing the length of the whole message). Am I missing something? Because having length limitation seems to imply inability of online processing.


texts: Bilinear Map over group of unknown order

texts:
Is it possible to build a bilinear map where the underlying group is of unknown order?

To maintain context, the original question appears below.
As per poncho's excellent answer, my original idea is infeasible:
Is it possible to build a bilinear map where the underlying group is an RSA group?
I.e.
$e: \mathbb{Z}_N \times \mathbb{Z}_N \rightarrow \mathbb{Z}_N$ where N is an RSA modulo?
Alternatively, a bilinear map where the underlying group is of unknown order?


texts: advances in usability for cryptography/authentication

texts:
I'm wondering if there have been any recent advances (say, the past 5-10 years) in human usability for cryptography and/or authentication?

By that I mean something that makes it easier for an average person to make use of the benefits of cryptography. It strikes me that although we have all these great algorithms for encryption and hashing, and they have widespread use in machine-to-machine communication, it's still hard for us humans to use cryptography, because there's an impedance-mismatch between these methods and the way most people's brains work.

(The only one I can think of is OpenID or things like it, namely a way of decoupling the authentication process from the point-of-use without compromising security, so that one authentication method can be used for many end uses.)

Some examples in case this doesn't make sense:

I was just reading the O'Reilly book "Web Security, Privacy, and Commerce" (2002 edition), and was reading about PGP, and wondering why after 20 years, it or something like it is still not in widespread use.

I'm also wondering why the allegedly secure websites (financial/healthcare) that I use, still use password access and still have "security questions" in case I forget my password, where the security questions aren't very secure.


texts: Issues with Seeding Random Number Generator Using Password

texts:
I am looking into zero-knowledge proof-based security. I noticed that a server never needs to be sent the user's password to authenticate them - the password can be used to generate another value that is sent instead. The server has the password so it can generate that value on it's side. This way the user can prove they are who they say they are without sending the password. This shared secret value can be used to seed a random number generator, which can then be used to perform actions on their messages that make the data look random to a would-be-attacker but can be undone by the receiver (which has the seed and can recreate the scrambling process).

Such a system seems to have the following problems:

The attacker can now break the system by predicting the password. Since people tend to use passwords that are partially based on real words a attacker doesn't normally need to consider all 26^k possibilities for a k digit password
Even if you use a salt/nonce/timestamp to mutate the resulting key, it needs to either be sent to the server (allowing the attacker to use it) or the server must know it without being told, allowing the attacker to also know it without being told.
Even if you transform the password with something like HMAC the fact remains that the original password is not particularly secure. An attacker can simply pass their guesses at the password through whatever algorithm is used to transform the password.
If you want to have some counter or other data that mutates the password on a session by session basis (and you don't want to send the mutator but rather have user and server infer it from their past interactions e.g. number of logins) the user has to either remember the mutator (meaning they will be locked out of their account if they lose/forget/incorrectly remember the mutator) or have it stored on their machine (preventing them from logging in on different devices)

A possibility would be to only accept passwords with a minimum level of unpredictability (making salts, nonces and mutators less necessary) but users won't be keen to remember a soup of letters and numbers.

Is there any other issues with using the user password to generate the shared secret (the shared secret would be the seed of a random number generator) I would need to overcome?


texts: Playfair cipher - questions about inserting 'X'

texts:
I'm implementing the Playfair cipher as part of a programming project. I realize there are different versions of the cipher - I've been asked to implement the version which treats the letters 'I' and 'J' as the same letter, and which inserts the letter 'X' into the plaintext to ensure that every resulting bigram has unique letters ("TREESTUMP" becomes "TR EX ES TU MP"). It is also meant to append the letter 'X' if the length of the intermediate plaintext is not even ("SMOOCH" becomes "SM OX OC HX").

My first two questions have to do with the encryption process, the third has to do with the decryption process:

How are messages resolved which already end with an 'X', and have an
odd number of characters? For example, "REX" becomes "RE XX" -
surely that can't be right.
The Playfair Wikipedia article explains that 'X' is a good candidate
for insertions because it is an uncommon letter. However, it seems
to me that a cipher should be able to encrypt any message
irrespective of content - what if my plaintext contains two adjacent
'X's? For example, "REX XENOS" becomes "RE XX EN OS" - we can't be
expected to keep naively inserting 'X's between the two 'X's, no?
Finally, the Wikipedia article ends it's description of the cipher
by saying "drop[...] any extra "X"s or "Q"s that do not make sense
in the final message when finished", but it is not explained how
this is done. How can we know if an 'X' doesn't make sense in the
final message?


texts:
I'm trying to get a per-user encryption key scheme off the ground and need some validation from wiser crypto pros. Consider the following procedure:

User provides registration information to include a password.
Generate a random salt.
Hash the password+salt using bcrypt.
Generate a key to be used for data encryption (known as the DEK).
Generate a second key derived from the hashed password+salt.
Generate a 12-byte IV.
Encrypt the DEK using the AES-128-GCM cipher, the password-derived key, and the IV.
Store the encrypted DEK, the salt, and the IV in the database.

Any time I need to decrypt user data:

Ask for the user's password.
Pull the salt, IV, and encrypted DEK from the database.
Hash the password+salt.
Generate the key to decrypt the DEK using hashed password+salt.
Decrypt the DEK using the generated key and the IV.
Decrypt the user's data.

To my eye, this seems to be the correct procedure to manage encryption keys in a system where the data and keys are stored on the same system. But encryption is hard so I could be getting something wrong. So what say you? Any obvious omissions in this scheme?

Many thanks.

EDIT:
For clarity's sake, this is a web application storing PII in the database as well as on disk. There are no instances where one user should be able to access another user's sensitive data. The user has been warned that forgetting their password means losing access to their data.


texts: AES GCM encryption, authentication and PBKDF2

texts:
I'm developing a kind of secret vault server application. The basic principle is similar to DPAPI where each secret will have its own unique random KEY/IV pair and and that KEY/IV pair will be encrypted with a PBKDF2 derived key from user password.

I have doubts as to how properly handle key derivation and authentication.
This is what I came up with:

User registration:

User supplies username and password
Generate random salt using CPRNG. Store the salt with user record.
Derive a KEY and IV from password using PBKDF2
Generate a random master KEY/IV pair and encrypt this master pair with generated KEY/IV pair from step 3 using AES-GCM. Store encrypted KEY and encrypted IV separately in two records, store TAG in third record.

User verification:

User supplies username and password
Use stored salt and supplied password to derive a KEY and IV
Use derived KEY/IV pair to try to decrypt master key. If verification fails, authentication fails and user is not let in

All encryption is done on server side. Communication is secured with TLS but this is not the topic nor is the sizes of key, IV or salt. Let's assume I will choose the sizes correctly.
The scheme I choose to use must protect the data even if database is stolen.

My questions about this are:

Is it safe to generate IV along with KEY from PBKDF2 when using and storing salt for each user or should IV also be randomly generated and stored along with salt? When generating IV from PBKDF2 I'm basically choosing for it to be part of the key, ie a secret. Using a sufficiently large salt per user would guarantee that no two generated KEY/IV pairs exist even if users have same passwords.
Should randomly generated master KEY pair be stored with both KEY and IV encrypted or should IV be stored in plain text?
If you store both encrypted, it is safe to store them in two separate records or should they be encrypted together (concatenated) and stored in a single record? This is regarding IV reuse since two records are now encrypted with same KEY/IV pair.

Thank you!


texts: Let $ALG_2$ be an algorithm that solves the RSA problem, can it solve the generalized Diffie-Hellman problem?

texts:
Let $ALG_2$ be an algorithm that solves the RSA problem for all $e\in \mathbb{Z}_n^*$ i.e given $e,m^e,n$ then $ALG_2(e,m^e,n)=m$. Is it possible to use this algorithm to solve the generalized Diffie-Hellman problem?

By generalized Diffie-Hellman I mean that we choose $n=pq$ where $p,q$ are both primes (found something else online so wasn't sure if everyone will understand).

So at start, I thought it can but couldn't prove that. So I just thought maybe it can't because what it actually does is get 2 numbers- $e$ and $m^e$- and calculate root $e$ of $m^e$ i.e $m$. But at Diffie-Hellman we don't know anything about the ratios between $r_a,r_b$ or even $g^{r_a},g^{r_b}$ and all we know is $g,g^{r_a},g^{r_b},n$. The only thing I can think of is find $r_a$ and $r_b$ by guessing numbers and using $g$ but it doesn't use $ALG_2$.

Anyone got any ideas?


texts: Is it safe to store initial counter value for AES-CTR alongside with ciphertext?

texts: The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.


texts: To prove $r \cdot f_1 +f_2 \cdot (s+1)$ is secure

texts:
We define the polynomials $r, f_1,f_2,s \in R[x]$. Where $r$ is a random degree 1 polynomial and $s$ is a random polynomial such that: $degree(s)=degree(f_1)=degree(f_2)$, let $R$ be $\mathbb{Z}_p$ where $p$ is a large prime number.

My question: " How to To prove: Given $\ r\cdot f_1 +f_2 \cdot (s+1)$ one who knows only $f_2$ cannot learn anything about $f_1$."

Or even simpler: Given $\ f_1 +f_2 \cdot s$, one who knows $f_2$ can learn anything about $f_1$?

Thanks


texts:
I am trying to reverse engineer the Handshake wit a Smartwatch by sniffing the BLE traffic.
There is what I figured out and were able to reproduce:
The manufacturer-app requests a random number from the server and sends it to the watch. The watch appends its own random number and encrypts the result with some PSK. The app forwards the encrypted result to the server, which decrypts the numbers, swaps them, and encrypts them again. The app then sends the encrypted result to the watch, which then acknowledges the first steps of tht key exchange.
Not is where I am stuck:
AFAIK, the app then generates a KeyPair and sends the public key to the watch, which then responds with its public key.
So, having its own keypair, the apps random number and the watches public key both parties perform something Diffie Hellmanisch to derive a session key.
Questions:

Is the own keypair, random number and the partners public key sufficient to perform DH?
Considering a public keylength of 256bits, is DH even reasonable to assume?
Is the own random number even relevant for DH?


texts: Is there a client-side program to cryptography a HTML page and decode if correct password is writen?

texts:
I want to know if there is an easy way to do this:

create a complete HTML page
cryptography the text content (image is not important)
ask user some password
check the password with a cryptographed password if(hash(userPassword)==hasedPassword)) return true;
if the password is correct it will decode it and show the content.

All this in user-side, not server-side. Because this I will use javascript.

Is there any good implementation?


texts: Is it wise to use HOTP (raw bytes) as a key for HMAC?

texts:
Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared counter CTR initialized on the same value.

Is it wise to sign the data sent from the client to the server in a following way:

KEY_SIGN = HOTP(KEY_SECRET, CTR)
SIGNATURE = HMAC_SHA256(DATA, KEY_SIGN)

Client is technically able to compute the signature and server is able to validate it but I am wondering if this could have some hidden security / crypto / math side-effects.

Note: I assume "raw" HOTP format (4 bytes) here, not the decimalized version with the final "modulo D" that gives away the D-digit numeric code.

Note 2 (edit): As suggested in the comments below, using simply KEY_SIGN = HMAC_SHA1(KEY_SECRET, CTR) would gain much better key entropy.


texts: Suitable Symmetric Algorithm for Encryption

texts:
Please, I would like to encrypt word not more than 5 letters such as (GO, HI, APPLE, EYES) and my key length just (40 bits only), please I am looking for a suitable symmetric algorithm that it can be lightweight, fast as well as less processing required so it can suit my mechanism?

Please any suggestion and sorry for my weak English ):


texts: AES encryption using a Diffie-Hellman question

texts:
this is something that has always nagged at me and I've wanted to know the answer to.

Does AES create it's own shared secret symmetrical key after the DH process has completed?

I'm not as familiar with it as i am with know the process of say SSL (RSA,AES) where the public key encrypts the AES symmetrical key and then sends it across and host 2 decrypts with the private key and now knows the shared secret key.

With DH, I've always had conflicting answers, some say if you create a 1024 bit DH key then AES creates the 128 bit symmetrical key and passes it across, i don't feel like this is the case (i'm happy to be corrected either way). Some have also said that the key from DH is the key that AES uses for it's encryption. My question would be then isn't it just using a 1024 bit pub/pri key exchange to encrypt and decrypt data, or is it something in the middle?

Thanks for the help


texts: Suggestion on dynamically changing hash algorithms for blockchain

texts:
First of all excuse me for my inexperience on the topic (I am new to cryptography). I am currently studying for my Master thesis and am am looking for hash function on which I can modify them so thy can be dynamical (meaning the method on which the algorithm is processed is changing on different conditions) by using chaos theory.
I then looked into simple (not real life usable) hash algorithms on which I can do my prof-of-concept. I found the CHA-1 which in my previous post: Is there any code available online for CHA-1? users kindly explained that is a method that shall not be used.
Now I would like to be more descriptive on the topic so you can further understand. I am applying this method on the blockchain and I would like to create a proof-of-concept on which every time a new block is created then the hash algorithm changes as well.
My first thought is to modify the CHA-1 algorithm by making a new tree on which it will produce new values for logistic map's initial conditions from the previous block hash. As a result in order to calculate a new hash you will need the previous block hash, as a key, to calculate the new one, which changes every time a new block is created. I am confident that this method can be applied in mining.
I would like to ask your opinion on which hashing algorithm i can use for this method (that can support my study)?


texts: Hashing of variable-length chunked data leading to leakage of secret key from side channel?

texts:
Hypothetically, secret data could be hashed in some schemes in one way or another. Could chunking of the data lead to exposure of secret component through side channel?
Say converting a randomized signature scheme deterministic by hashing the message with the private key to yield one-time variable (e.g. $k$ in ECDSA); or a post-quantum public-key encryption algorithm achieves semantic security using Fujisaki-Okamoto (藤崎-冈本) transformation, the ciphertext is bound to be related to hash output of the secret seed to be encrypted. In such situation, could secret be leaked?
Is there other way secrets can leak through hashing?


texts:
Suppose in AES-128, there are $5$ tables, namely Te0, Te1, Te2, Te3, Te0 which help in fast encryption on $32$ bits CPU. Each table contains 256 numbers, where each number is $4$ bytes.

Te4's numbers are generated by repeating hexadecimal in S-box. So Te4 contains numbers $0x63636363U, 0x7c7c7c7cU, 0x77777777U, ...$.

Te0 contains numbers which is obtained through the degree-wise multiplication between $\{ab\} x^3+\{ab\} x^2+\{ab\}x+\{ab\}$ and $\{02\} x^3+\{01\} x^2+\{01\}x+\{03\}$. The first polynomial is the number in Te4. So the first number in Te0 is $0xc66363a5U$, which is obtained through $\{63\} x^3+\{63\} x^2+\{63\}x+\{63\}$ and $\{02\} x^3+\{01\} x^2+\{01\}x+\{03\}$.

Te1's numbers are obtained through $1$ byte right rotation on numbers in Te0. So Te1 contains $0xa5c66363U$. Te2 and Te3 are also obtained by $1$ byte right rotation.

The followings are the screenshot of the five tables:

Question: If only table Te0 is used in the program, explain how to perform encryption.

I think we have to perform computation on the numbers, but I don't know how to do it. Would appreciate if anyone can give some hints on it.


texts: Has SHA256 been broken by Treadwell Stanton DuPont?

texts:
In a recent press release issued by Treadwell Stanton DuPont, the claim is made that their research laboratories have successfully broken all 64 rounds of the SHA256 hashing algorithm. They further claim that they achieved this milestone a year ago (late 2018).

  "While we have successfully broken all 64 rounds of pre-image
  resistance," said Seiijiro Takamoto, Treadwell Stanton DuPont's
  director of newly formed Hardware Engineering Division, "it is not our
  intention to bring down Bitcoin, break SSL/TLS security or crack any
  financial sector security whatsoever."

How credible is this claim in the wider cryptographic community?


texts: Direct sum of Binary numbers In Mixcolumns

texts:
I have just started learning cryptography and I am trying to make sense of the direct sum on some binary numbers.

I am trying to find a column of a state space after a Mixcolumns operation has been performed.

For example, to find $c_0$, I have

$c_0=((02)\cdot10000100)\oplus((03)\cdot(10000001))\oplus10000001\oplus00100001$
$=(100001000\oplus100011011)\oplus(110000011\oplus100011011))\oplus10000001\oplus00100001$

So i understand exactly what is going on up until the next line:

$=00010011 ⊕ 10011000 ⊕ 10000001 ⊕ 00100001$

How does the direct sum of

$(100001000\oplus100011011)\oplus(110000011\oplus100011011)=00010011 ⊕ 10011000$?

I dont understand how the 9 digit binary numbers direct sum makes an 8 digit binary number??

the next line reads

$= 00101011$

Again, I do not understand how this answer has been obtained!

Could someone please explain/show how this is done as my notes do not say and I cannot find a method for this online although I am sure I am searching the wrong terms probably.

Help much appreciated. Only a few weeks into learning this! Thanks


texts: Challenge–response authentication which can be done in head?

texts:
Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number everytime you want to enter and you have to calculate the password in your head. E.g. you have to add 12 if the number is even and double it if the number is odd. Are there some good algorithms which are easy to use by most people and save. By save I mean that someone standing nearby would need to hear more than 100 valid combinations to conclude the algorithm.

Edit:
I changed the title. I found out that the correct name would be challenge–response authentication.


texts:
My scenario is as follows:

Two entities $A_1$, $A_2$ host same versions of replicated data $M$. An entity $A_1$ computes $h_1 = H_1(M)$ and another entity $A_2$ computes $h_2 = H_2(M)$.

Is there any set of functions $H$, $H_1$ and $H_2$ so that Alice, after receiving $h_1$ and $h_2$ can check $H(h_1) = h_2$, but $A_2$ cannot compute $h_2$ using $h_1$?

More precisely, there be two ways to compute $H_2$ with two different keys, a direct way and 2-step way. $A_2$ computes $h_2$ through direct way and Alice compute it through $h_2 = H(H_1(M))$.


texts: Question about why RSA is hard to attack

texts:
I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do.

Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we can listen to all of their messages to each other.  Assume we know they're attempting to communicate using RSA and that Alice has sent $n$ and $e$ to Bob and Bob has sent $c$ to Alice.  Because we know they're using RSA, we also know that $n$ is the product of some primes $p$ and $q$, that $e\in\mathbb{N}$ with $1<e<\phi\left(n\right)$ (notice that $\phi\left(n\right)$ is hard to calculate because we do not know $p$ and $q$, but this has no significance in terms of the bounds of $e$ since we know $e$ explicitely), and that $e$ is relatively prime (aka coprime) to n (i.e. $\text{gcd}\left(e,n\right)=1$).

We know that Bob's message to Alice can be expressed in terms of $n$, $e$, $c$, and Bob's intended message, $m$ given by $c\equiv m^{e}\bmod{n}$.  For the sake of thoroughness, we also know $m<n$.

I hope this is right so far.

Tactic 1

As an attacker, we want to find $m$, and since we have an equation including it, one way to go about finding it is to re-express said equation.

$c\equiv m^{e}\bmod{n}$

implies

$\exists k\in\mathbb{N}:m^{e}=c+kn$

implies

$\exists k\in\mathbb{N}:m=\left(c+kn\right)^{\frac{1}{e}}$

Now comes my question!  As the attacker, in order to find $m$, we'd have to try all $k$'s in the natural numbers until we found an $m$ that looked like a message--and even then, even if it's intelligible, it's possible what we've found is still actually not Bob's intended message.  Is this a correct assertion?  Is this a possible yet obviously futile attack?  (Further questions: Is it possible for the attacker to verify if the $m$ computed via the above method is equivalent to Bob's $m$ using the assumptions above?  If yes, if someone were to execute this attack, how long on average would it take to find the correct $m$ given $m$ is random?)

Tactic 2

Another tactic we might take would be to compute Alice's secret key, $d$, such that $ed\equiv1\bmod{\phi\left(n\right)}$ (i.e. $d$ is the multiplicative inverse of $e\bmod{\phi\left(n\right)}$).  We can, again, re-express this.

$ed\equiv1\bmod{\phi\left(n\right)}$

implies

$\exists j\in\mathbb{N}:1=ed+j\phi\left(n\right)$

implies

$\exists j\in\mathbb{N}:d=\frac{1-j\phi\left(n\right)}{e}$

Now the second question!  As the attacker, calculating $\phi\left(n\right)$ is hard. This is because there are two ways we could calculate this: 1) by the definition, i.e. the cardinality of the set of relatively prime numbers to $n$ (which would take at most $\sqrt{n}$ steps, right?) or 2) since we know $n$ is the product of 2 relatively prime numbers, attempt to find $p$ and $q$ and then $\phi\left(n\right)=\left(p-1\right)\left(q-1\right)$.  This is hard to do for large $n$.  Is this correct assertion?

Actually, wait, I've caught myself.  Because even after calculating $\phi\left(n\right)$, we'd still have to find $j$, no?

Could someone answer these questions and possibly answer succinctly way attacking RSA is hard?  I feel like I'm so close and just need a little help-nudge.


texts: Include TSA Certificate in Timestamp Request

texts:
I'm currently working on Timestamping and stumbled upon a parameter fRequestCerts/requestSignerCertificates/certReq that according to the documentation (1, 2) tells a TSA to include the certificate that was used to sign the timestamp token in its response.

When fiddling with this parameter I noticed that Windows behaves differently when validating self-signed TSA certificates. More specifically, when the parameter is set to true Windows apparently treats self-signed TSA certificates as trustworthy. When the parameter is set to false Windows treats them as non-trustworthy.

Unfortunately I couldn't find any more detailed information about this matter. So my questions are:

Why exactly would I use this parameter?
How does it influence trust?


texts: Performing a dictionary attack on RSA/ECB with no padding

texts:
I have the exponent $e=2^{16}+1$ and modulus $n$ (154 digit number) of an RSA public key along with the ciphertext (64 bytes) encrypted using the same key with RSA/ECB and no padding.

I am required to decrypt the ciphertext and have two options:-

Find the prime factors of $n$, $p$ and $q$, to determine the private key which can then be used for decryption, or
Use a dictionary attack (~135k words)

The first option does not seem feasible to me considering how big the modulus is and so I think the second option is more likely.

My question then is, where would I begin with a dictionary attack on the above cipher text? My initial idea is to iterate through every word in the dictionary, encrypt it using the public key above and check to see if the cipher text contains the result, but words in the dictionary have lengths up to 30 so this would definitely take a while.


texts: Crypto-shredding a file by erasing the IV instead of erasing the Key

texts:
Imagine an authenticated, encrypted file system, which uses AES-256-CTR to encrypt a 64 KB file sector, then uses HMAC-SHA256 to authenticate the 64 KB file sector (including the IV). IVs are 128-bit, randomly generated.

The global 256-bit encryption and 256-bit authentication keys are independent of each other, and are used across all files (i.e. no per-file keys).

The file system needs to be able to crypto-shred individual files, and needs to sustain 100,000 IOPS.

How would you implement crypto-shredding without deriving per-file keys per operation (or without caching thousands of derived per-file keys in memory)?

Instead of deriving per-file keys, would XORing the stored public sector IV with a secret per-file SALT be adequate? In other words, the random IV (which is stored on disk) would be XORed with a secret per-file SALT when encrypting or decrypting. Assume the per-file SALT can be erased when the file needs to be crypto-shredded.

This should avoid the need for 100,000 HKDF or PRF calls per second to derive per-file keys.

Crucially, since the system is garbage collected, this would also avoid having 100,000 derived per-file keys scattered throughout memory at any point in time, and avoid bugs related to the caching and versioning of these keys.

Crypto-shredding usually operates by erasing the key, but erasing the SALT used to generate the final IV seems to make more sense. I don't know if I'm missing something here?