texts: how to get the file used to brute force any encryption method

texts:
Bitlocker as example uses AES 128 Bit encryption as default - if it was brute forced how it can be done , I mean where's the file that will be brute forced to generate the password (If I'm right that file is suppose to be the 128 keys generated from the encryption right?)
 I'm not asking about software to do this ( I'm aware that some apps uses hibernation file or memory dump file to do so) I'm asking about how to find it manually , If i deleted both previous files and stopped any administrative privileges for installing any software will it be impossible ??


texts: Baek and Zheng’s Threshold Cryptosystem - limit on threshold?

texts:
I have just completed an implementation of Simple and Efficient Threshold Cryptosystem from the Gap Diffie-Hellman Group by Baek and Zheng and am hitting a problem with high values of the threshold. Please forgive any mistakes below, I have minimal relevant math and notation knowledge and am learning as I go.

I am using a Haskell wrapper around PBC and so far I have been successful with the implementation on small value of $t <= 8$ and $n <= 100$. Unfortunately though anything with a larger $t$ means shares recombination fails. Taking the idea from a python implementation I found and given the dealer mechanism from the paper:

I've tried to reconstruct $x_0$ which fails for $length(a)>8$. Works great for $length(a)<=8$

Even a simple, non PBC version of $x_0$ reconstruction fails using simple values of $a$ e.g. $[10,20,30,40...150]$. Given the list of $x_0..x_n$ from the application of the polynomial on $a_0..a_{t-1}$ I used the Lagrange interpolation

$$\phi_i(xcoord)=\prod_{j\neq i}\frac{xcoord-xcoord_j}{xcoord_i-xcoord_j}$$

and summed the values of $\phi_i * x_i$ to get $x_0$. The shares I've selected are a subset of size $t$ of the list of numbers from the application of the polynomial above. The polynomial validates i.e. $a_0 == x_0$.

I've also tried the method specified in this explanation of Shamir's Secret Sharing but both seem to have the $t>8$ reconstruction problem (in fact the latter had a sign problem, for odd values of t that I could not resolve).

Does anyone have any thoughts on how to investigate further or even resolve? Could the use of the Barycentric form help fix this as per this answer?


texts: Cryptography algorithms that take longer to solve on a GPU than a CPU

texts: I know that Graphics cards are faster at solving algorithms like SHA-256 because of the many builtin processors, but are there Algorithms that take actually longer on a Graphics card than on a modern consumer CPU (Amd/intel)?


texts: what is meaning of operator " := " in cryptography?

texts: I've seen := used in several cryptography papers where the this symbol has been used instead of assignment operator ($  \leftarrow $ ) or equal sign (=), but never with an accompanying explanation. It's not exactly possible to search the precise meaning of operator ":= ". What is the exact meaning of this symbol in terms of mathematics in  cryptography is concerned.


texts: How to construct a collision resistant hash function that is not a one-way function?

texts: How to construct a CRHF (collision resistant hash function) that is not a OWF (one-way function)? Not sure but I think it probably needs another CRHF?


texts: Cryptography system that limits the length of the encypted message

texts:
I have two devices which communicate via sms.

This communication should now be encrypted.

The devices can only send messages with the lenght of 160 characters.

So i am looking for an encryption system which can limit the length of the encypted message to 160.

Is there such a cryptography system?
Which system that meets this requirement is the safest?


texts: How secure is a pronounceable password in terms of entropy?

texts:
There are some strong studies which support the use of pronounceable passwords and multiple tools which provide generation of such passwords.

According to this question the entropy of a password depends on its method of generation but how can I be sure that my generated pronounceable password has enough entropy for my use? (for example, in case of pwgen open source software)

Below is a pseudocode for generating a pronounceable password. However, this might be the simplest possible solution and I am rather interested in existing "conventional" methods.

vowels = A, AI, AU, E, EA, EE, I, IA, IO, O, OA, OI, OO, OU, U
consonants = B, C, CH, CL, D, F, FF, G, GH, GL, J, K, L, LL, M, MN, N, P, PH, PS, R, RH, S, SC, SH, SK, ST, T, TH, V, W, X, Y, Z
theLastOneIsAVowel = True
while length(strPassword) < Minimum_Length do
if theLastOneIsAVowel then
strPassword = strPassword + randomElementOf(consonants)
else
strPassword = strPassword + randomElementOf(vowels)
endif
theLastOneIsAVowel = ~(theLastOneIsAVowel)
endwhile


texts: How is HMAC hashed message decrypted on the receiver side

texts:
We know that MAC algorithm and key are used in both sender and receiver side to get the matching MAC tages to prove that the data is authentic.

Now in HMAC we know that, it makes use of crytographic hash function which is irreversible, so when we use HMAC from the sender side to encypt a message using the HMAC formula, then at the sender side how will the receiver decrypt the message (hash function is irreversible), so how is the message at the receiver end, integrity is preserved and validated? Please explain.


texts:
As evident from the site of john the ripper, JTR example, john can be used for finding password form a unix machine passwd file.

can JtR be used to crack password of a password encrypted word file? I know there is another utility by openwall which does the same...


texts: Is it possible to figure out whether a plain TCP packet is (aes) encrypted or not?

texts:
I captured some plain TCP packets (not HTTP) which are not using HTTPS.

I am wondering whether these packets are using AES 256 (or 128) or not.

Is there a way to do that?

Thanks


texts: How do we find the last two correspondences in an otherwise known even permutation?

texts:
A secret even permutation $P$ of the set of non-negative integers less than $n$ is chosen. That might be a Feisltel cipher with a random key.

We are given in sequence the $P(x)$ for $x$ from $0$ to $n-3$, and must output the ordered pair $(P(n-2),P(n-1))$.

What's an efficient online algorithm for that? What’s a practical minimum for the memory needed?

What if we are allowed $n-2$ queries giving $P(x_i)$ for any $x_i$ that we iteratively decide, and must output $(x_{n-2},P(x_{n-2}),x_{n-1},P(x_{n-1}))$ where $x_{n-2}$ and $x_{n-1}$ have not been queried?

What if we are allowed to repeat an earlier query for free?


texts:
I'm using Speck 32 to encode a very low-entroy set of bits (so that the messages stay very short)

It encodes two numbers:

w: 16 bits: but in most circumstances the message is one of only 10-100 possibilities (~3-7 bits)
v: 8 bits, but in most circumstances the message is only about 4 bits

In my current scheme, I use random (throw-away) content for the last 8 bits. My questions are as follows, assuming a message set in the low thousands (I.e. an attacker would have access to ~4000 encrypted messages):

Even with the low entropy, are the messages individually secure (i.e. the compromise of some doesn't undermine the security of the others)?
Can successful guessing/statistics across a large enough set of messages compromise the key?
There's a temptation to use the last 8 bits for a MAC and/or CRC, but I fear that would make statistical attacks even better. Is that fear warranted?


texts: What does public-coin mean in interactive proof and zero-knowledge?

texts:
For related materials I read, it seems that for the public-coin setting, the verifier will always send random messages to the prover. In this setting, can we regard the verifier as an honest verifier, since he always replies with a random message (rather than a message depends on previous messages)?

In [GK'91], it is proved that suppose that $L$ has a constant-round, negligible error, public-coin black-box ZKproof. Then $L \in BPP$. This theorem confuses me a lot.

For example, for Schnorr's protocol, we know that it is special honest-verifier zero-knowledge. But according to [GK'91], it seems that the protocol is not public-coin zero-knowledge (except DLOG is in $BPP$). Therefore, it seems that we cannot treat public-coin settings as honest-verifier settings. But what is the difference between public-coin and honest-verifier?

I am sorry that maybe I misunderstood some related definitions. Could anyone help me with this question?


texts: How has the "power" of cryptography evolved from its beginnings till today?

texts:
I'm looking for a historical overview for the change in cryptographic power, which I hereby define as

  How far state-of-the-art cryptography is ahead of state-of-the-art cryptanalysis.

In other words, how secure was a message encrypted with the best available methods from the attackers of its day, up to and including today?

Was the Caesar cipher, when used by Caesar, more secure than the Vigenère cipher, when used by Napoleon? Was the Vigenère cipher in the 16th century easier or harder to break than AES is today? Could AES be broken today with less effort than it took to crack the Enigma code in WWII?

I realize this is a very broad question, and difficult to answer with certainty, but any concrete examples backed by references would be of great interest to me (such as, how commonly the Vigenère cipher was broken when it was in wide use).

(Please discount side-channel attacks such as "rubber-hose cryptanalysis".)


texts: Why can't you divide by 0 in an Edwards Curve?

texts:
The equation of an Edwards curve is $x^2 + y^2 = 1 + d x^2 y^2 \,$

The addition formula is $(x_1,y_1) + (x_2,y_2) = \left( \frac{x_1 y_2 + x_2 y_1}{1 + dx_1 x_2 y_1 y_2}, \frac{y_1 y_2 - x_1 x_2}{1 - dx_1 x_2 y_1 y_2} \right) \,$

Why can't you divide by zero when you have a non-square d?

What is the intuitive explanation that $dx_1 x_2 y_1 y_2$ can't be equal to ± 1 when d is a non-square? Because I don't see why you can't have $x_1 x_2 y_1 y_2 = ± \frac{1}{d}$


texts:
Let $F$ be a PRF.

The $XOR\text{-hash}$ is defined as:

XOR-hash(k, m):    //m=(a₀, a₁, ..., aᵥ)
    t = 0ⁿ
    for each aᵢ ∈ m:
        t = t ⊕ F(k, aᵢ)
    return t

Suppose an attacker $\mathcal{A}$ can send 3-uples $(m_0, m_1, \delta)$.

A function $f$ will be difference-unpredictable if $\mathcal{A}$ cannot guess a 3-uple such that $f(k,m_0) - f(k,m_1) = \delta \;$ with more than negligible chance.

How can I show that $XOR\text{-hash}$ is difference-unpredictable?

I think the argument relies on the fact that $\oplus$ keep all the bits pseudo-random, so that the difference $d$ will look like a subtraction of two random results, hence the probability of some bit of $d$ match some bit of $\delta$ will be $\small\sim$$0.5$ and the probability of $d = \delta$ would be negligible.


texts: Attack XOR encryption of binary data compressed by zlib with known key length (very short key)

texts:
I am trying to break a packet format. The packet format simply packs several files into one big file. The file contents are plain. But the index data which contain offsets, file sizes and filenames are encrypted. The index data are about 1 KB and compressed by zlib (the DEFLATE algorithm with no zlib or gzip wrapper), and then XOR encrypted. In other words, the key is concatenated with itself many times to get a keystream of equal length as the zlib-compressed data, and then the zlib-compressed data is XORed with this keystream (like a Vigenère cipher).
I know the key length is 8 bytes. Is it possible to decrypt the data?


texts: How to use a secret to allow the generation of public keys, where the private keys can be calculated later

texts:
Alice has a secret S and publishes some public information P, about S which is insufficient to recreate S.

Is there a way that Bob can use P, and an arbitrary integer I to create an (EC?) public key for which Alice can subsequently calculate the private key, given I?

Does this requirement already have a name?

Bob was a bad name.  Bob is anyone other than Alice.  Alice knows nothing of specific Bobs.

The point of the question is that I want all the Bobs of the world to be able to generate public keys, for which Alice can later calculate the corresponding private key, given the identifying integer I.  (Where I could be a random 256bit integer, if it's more secure.)

This is Alice saying to the world: 'Here's some information P, now all of you can make different public keys, for which I can later calculate the private keys, if and when I need to'.

The requirement is to get around the issue that Alice might be offline when a Bob requests a public key from her.  I do not what the world to know which public keys are owned by Alice, so she can't just publish 100 public keys for general use.

This problem would be solved if P could be an array of 2^256 public keys (for which she has stored the 2^256 private keys that were used to generate the public keys) but this is not feasible for computational and storage reasons.  I'm looking for something possible which will achieve the same ends.


texts: How few cryptographic primitives can we use to derive all other constructions?

texts:
We have a lot of cryptographic primitives now, and many methods of deriving one type of scheme from another. There are even some like the Merkle signature scheme, which uses a hash function to derive a signature scheme, two types which are not closely related.

So now I wonder, what is the smallest set of cryptographic primitives we can start with, and derive schemes to fill all our other needs? We would need hashing, block cipher, authentication, signatures, key exchange, etc. It shouldn't rely on some convenient properties of the primitive, so even if it was swapped out with a secure oracle, the derivation methods should still work. These primitives should each fit one role (ex. hash function) and not be some magic all in one function used to cheat the security proof. I think it'd be hard to reason about possible primitives and derivation methods that haven't been discovered yet, so an answer based on only existing primitives and derivation methods will be okay.

This isn't a concern right now, since all the dedicated primitives and key sizes in use now are secure for the foreseeable future. However, considering that any break in a cryptosystem could be catastrophic, we may want to design a cryptosystem with as few entry points as possible, and part of that is having as few underlying primitives as possible. Another valid concern is that existing versatile schemes may be broken by quantum computers or other threats not present today, and we may be forced to use specialized primitives. It would be helpful then to know what small set of primitives we could depend on.

Though not quite an answer to this, if we wanted to minimize entry points today, I think we can already get it down to 2, making use of families that share a security reduction.

Keccak would be used for all symmetric schemes. There is already the hash function SHA-3, and the authenticated encryption schemes Ketje and Keyak. Others like stream ciphers and pseudorandom generators can be created based on the same sponge construction.
ECC would be used for all asymmetric schemes. All the primitives in the family reduce to the elliptic curve discrete logarithm problem. I think we could specify a curve like Curve25519, but I'm not sure if all the primitives can use the same curve.

So why wouldn't I take this as an answer? These two families rely on specific properties of the primitive aside from their security. A secure oracle in either of their place wouldn't have such nice properties, and we wouldn't be able to derive other schemes from it in the same way. If we treated the sponge and the curve group as the primitives instead, then we aren't meeting the requirement that each primitive has one role - neither the sponge or the curve group fits a role on their own.

It took me a while to write this, there are probably some mistakes in the writing. Please don't be distracted and focus on the actual question.

Just wanted to clarify, this isn't some convoluted cryptography challenge, I really do care about the answer and think it has consequences for future cryptography, the restrictions are there for the same reason as in other math problems, not because cheating is bad but because we want a useful result.


texts: What is it meant by a "hybrid argument"?

texts:
Can anyone explain (or point to a reference for) what a hybrid argument is in a security proof, and when it's convenient or preferable to use it?

Among some of the places where I've seen it mentioned, there is the paper Boneh, Sahai, Waters - Functional Encryption: Definitions and Challenges. The term standard hybrid argument is mentioned in the proof sketch of Theorem 1 within section 4.1.


texts: How secure is this use of Ziv-Lempel encoding?

texts:
I'm reading patent application US 20120278897 A1 — “System and method of sort-order preserving tokenization”. Near the bottom they describe their token generation algorithm, which basically involves using the first few characters of a string as input to a modified order preserving Ziv-Lempel compression function described in this patent. They then prepend the output to the token and treat it as a kind of 'sort prefix' which can enable sorting.

I would like to know what (if any) security can be guaranteed for the characters of the plaintext used to generate the 'sort prefix'. More generally, how difficult is it for an adversary to distinguish two strings which have been Ziv-Lempel encoded but not encrypted?

The patent application makes this statement:

  An attacker may still be able to determine the first character with some level of certainty, but since they would no longer have all of the characters encoded within the Ziv-Lempel tree, the token is no longer susceptible to a dictionary attack

Given enough samples of this compression function is it possible for an attacker to partially reconstruct the tree and guess the input for an arbitrary output value?


texts: MAC unforgeability and secret key guessing

texts:
The standard notion security for MACs is usually expressed by means of experiments like the following one (given an attacker A):

$k  \leftarrow \mathsf{KG}(1^\lambda)$
Invoke $A^{\mathsf{TAG}_k(\cdot),\mathsf{VRFY}_k(\cdot,\cdot)}$
Output $1$ if $A$ queried $(m^*,\tau^*)$ to $\mathsf{VRFY}_k(\cdot,\cdot)$ s.t.  $\mathsf{VRFY}_k(m^*,\tau^*) = \mathsf{Accept}$ and $A$ didn't receive $\tau^*$ by querying  $m^*$ to $\mathsf{TAG}_k(\cdot)$

Now consider the following variation to point 3:
Output $1$ if $A$ gives $k'$ s.t. $k=k'$

How could I prove that a MAC unforgeable according to the first game is unforgeable according to the second game too? Is there a specific $\mathsf{MAC}(\mathsf{KG},\mathsf{TAG},\mathsf{VRFY})$ that is unforgeable according to the second game, but not according to the first one?


texts: How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?

texts:
I know how the Playfair cipher works. I would like to know how to find the keyword of the Playfair cipher, given some ciphertext and the corresponding plaintext.

For example:

encrypted: gy mm ko kc gc
plaintext: he ll ow or ld

I searched all over the internet, but it seems there is no tutorial that would explain, step by step, how to get the keyword.


texts: How to safely derive a value from a secret?

texts:
I have a use case of symmetric encryption with a single-use random key K known only by the sender and the receiver:

In my scheme, Bob is able to send beforehand a tiny amount of information to Alice. Alice must send her data through Eve, which is an untrusted network. V is the "address" of Bob (not secret): a single-use random value which means "please send the encrypted data to bucket V".

Bob has extremely limited bandwidth when first speaking to Alice.
I'd like to achieve an important improvement: let Bob send only 1 value to Alice:

Alice and Bob would tacitly derive the same value V, from their shared secret K.

How can Alice and Bob compute an identical random-ish, non-secret value for V?

In the diagram, V = AES.encrypt(42, K) where 42 is a public constant, but I don't know if it is a good idea.
Obviously, it is very important for me that Eve cannot guess the value of K, knowing N, V and 42.

My system currently uses AES and K has 83 bits of entropy.


texts:
I am trying to create a social network, in which I want to use attribute-based cryptography. One professor told me it is possible to do it only in J2EE, but he can barely code! Some friends of mine suggested using .NET.

I know through research that both are feasible, but since it is going to be a web-based application I was wondering if it would be possible to do it in PHP. Does anyone know? I can't find any material regarding this.

Is it difficult to implement algorithms in PHP? Can I implement AES or other symmetric algorithms in PHP? OR should I just stick to .NET?


texts:
I have a trusted third part A that issues an access token (xml file) to an untrusted client C that uses this token to log into an untrusted server S and access to the authorized files.
I want only that C can't manipulate the token changing the permissions stored inside.

I had thought to digitally sign the token with private key of A (RSA digital sign), so that if C changed the token, the signature wouldn't be valid yet and the token rejected from S.

The fact is that I would also like to encrypt the content of the entire token but I can't use the RSA encryption (A encrypts with S public key and S decrypts with his private key) because only A has public/private key while S hasn't.

Indeed, there is no direct network connection beteeen A and S, so If I used a symmetric encryption, how could I get the decryption key to decrypt token?

What kind of en/decryption should I use for this scenario?
Thanks


texts:
I am a beginner learning about encryption and I would like to ask a few questions, hoping this is the right place to ask, so please bear with me.

We have Alice and multiple clones of Bob. Only Alice can send messages to Bobs. Only Bobs can exchange messages with Alice, but not between each other. Alice and Bobs have met in person and exchanged keys and agreed upon the encryption algorithm. The amount of exchanged messages is small and they are small in size, so neither Alice nor Bobs care about the performance of encryption algorithm that much. Bob is a drunkard and might have revealed his key(s) to other parties at some point. If we assume that, in the worst case scenario, those other parties can impersonate Bob as well as interpret Alice's messages to Bobs, but not replay them or impersonate her, nor understand what other Bobs are sending Alice, the following questions come to my mind:

Is it really necessary (and why) to exchange a symmetric session key, when neither Alice nor Bobs care about performance?
Why don't they use public/private key pair for all of their
communication?
If the keys are shared beforehand, is it any less safe to use a single pair of keys instead of two (Alice in SSL land would have encrypted the message using her private key, and then encrypt the result of that with Bob's public key)?

Or, to put it simply, which functions from openssl libraries are best suited for this purpose, if we are aiming for the most lightweight solution?


texts: Calculation of time to crack a SHA-256 hash

texts:
A problem is given: 1 million users are authenticated with 9-digit PIN codes (e.g. 343534643). The PIN values are stored as hash values in a database. The hash is SHA-256, and is computed as:

hash=SHA-256(password|username)

An attacker has a graphics card which can compute 500 million hashes in a second. How long does it take to crack at least 1 password from the 1 million in the database?

Could anyone please help with this problem?


texts: We are having a requirement to store large files (~1GB) encrypted and decrypt them when reading. We are looking to use AES-CTR or AES-GCM mode to encrypt the data. There are scenarios where we want to divide the files into chunks/blocks and then decrypt these chunks in parallel. So my question is that is it possible to do it with these algorithms? If yes, what are considerable points while doing it. If no, how best to achieve it (the main requirement is to achieve parallelism).


texts:
I've been looking into GHASH and some sites describe it as a polynomial:

A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t

while other sites replace the + with the XOR symbol, ^:

A1*(H* *M-1)^A2*(H* *M-2)...C1*H(H* *M-N)^C2*H(H* *(M-N-1))...^len(A||C)^H+E(0)=t

Which one is the correct one?


texts: Hash linking is used to prove the integrity of a blockchain, or similar systems. When was that technique first used? I would guess it was early, maybe 1950s/1960s?


texts: What data Certificate Authority encrypt for CSR?

texts:
I have been searching for a detailed explanation but can’t seem to find a low level one.

1) When CA sign the data with its private key, the encrypted data is APPENED to the csr or the whole cert itself is the encrypted version? Does the encrypted data include contain public key or the whole CSR is encrypted?

2) if it is appended, why do we still need to keep original data in the cert? To check that data has not been altered when signature is unlocked by CA public key? Why can’t we just unlock CA signature and use the data inside there?

3)if it is replaced, how do we know which CA does this certificate belongs to?

4) does the client rely on IssueBy field to know which CA public key to use or they just try all the public


texts:
I am trying to understand the sponge construction, and in the official web site I found this sentence:

The last c bits of the state are never directly affected by the input blocks and are never output during the squeezing phase.

Now I understood that the capacity is used to hide the internal state to an attacker. But I can not understand two aspects:

How is the capacity filled?
If it is part of the internal state, how can be possible that is not affected by the input blocks?


texts: Why is it recommended to hash passwords with a secret salt?

texts:
NIST recommends doing an additional round of hashing using a secret salt:

  In addition, verifiers SHOULD perform an additional iteration of a key derivation function using a salt value that is secret and known only to the verifier. This salt value, if used, SHALL be generated by an approved random bit generator [SP 800-90Ar1] and provide at least the minimum security strength specified in the latest revision of SP 800-131A (112 bits as of the date of this publication). The secret salt value SHALL be stored separately from the hashed memorized secrets (e.g., in a specialized device like a hardware security module). With this additional iteration, brute-force attacks on the hashed memorized secrets are impractical as long as the secret salt value remains secret.

Questions about this:

Is it safe to ignore this advice? Are there any known vulnerabilities if we don't do this additional iteration?
How should we implement this additional iteration, if the secret salt must be stored separately but need to be available when hashing a password? Should we use a dedicated server for the secret salt, transferred to the verification server using a secure protocol? The secret salt may stay in the verification server's memory, does this matter?


texts: Interpreting Figure 1 in the "On Lattices, Learning with Errors, Random Linear Codes, and Cryptography"

texts:
I'm reading "On Lattices, Learning with Errors, Random Linear Codes, and Cryptography" by O. Regev.

I'm having trouble with understanding graphs in Figure 1.

By the definition of $\overline{\psi}_{\alpha}$, its support is $[0,1)$.

However, graphs in Figure 1 use support as $[-1,1] \times [-1,1]$.

Can anyone explain me about this?


texts: Passphrases, Dictionary attacks and 'bit shift'

texts:
How much better would a passphrase be if you swapped the first letters of each word with a shift to the left:

"correct battery horse staple" becomes "borrect hattery sorse ctaple"

This would be simple to remember because you know all the  words but how much harder would this be for an attacker?

Further, we could try this with the first and last letters of each word producing:
"torrecb yatterh eorss etaplc"
(This at least reduces the chances that swapping the first letters will still result in normal English words, like 'hattery' in the first example)

How much harder would this make it to crack, is it worth the extra effort to remember?
Do dictionary attacks consider things like this?


texts: How to generate $k$ random numbers that add upto a number $d$ and are coprime with respect to $p-1$

texts: This is something that is needed while generating additive shares ($D_i$) for decryption key (represented by $d$) where each additive share must be coprime with respect to $p-1$  i.e $\gcd(D_i , p-1) = 1$


texts: Are there known special cases where the first 160 bits of keccak256 can be null ? Or does finding a collision is required?

texts:
In the Tronix contract code (a large ICO listed on many exchanges) lies this modifier which is used for all token transfers :

modifier validAddress {
    assert(0x0 != msg.sender);
    _;
}

The code is written by serious professionals : not the kind of Ponzi scheme coder leaving useless code that cost money to everyone while processing transactions. As the contract is no longer maintained, developers are no longer replying on such questions (mailto:service@tron.network).
The point is msg.sender is set by the network : contract cannot act on that value.

Most of time unofficial answers I’m getting is it’s indeed possible to send transactions as 0x0 : that is Keccak256(ECDSASIGN(transaction_data_to_sign,e, c, v)[1:])[12:] where Secp256k1 is used would returns NULL.

So… First, are there known keccak256 values that would return NULL once truncated or does NULL involve bruteforcing like all other values ?


texts: How to recover private key in ElGamal when random value k is known

texts:
Given following ElGamal encryption scheme: $\delta = M(\alpha^a)^k \mod{p}$. Assume that an attacker knows the random value $k$. How can he recover the private key $a$?

I know that it's possible to recover the message M by computing $\frac{m}{\alpha^a} \mod{p}$. But how can we now derive $a$ from this information and not end up with a discrete logarithm problem?


texts:
Is it possible to ever have a commitment scheme that is statistically binding but not perfectly binding?

The sender would be computationally unbounded, hence could always computationally trudge through all potential (message,key) pairs. Statistically binding would mean the probability of finding a pair is very very unlikely, but if the sender is computationally unbounded, it definitely could eventually.


texts: Collision resistant functions - definition

texts:
Let $f$ be a collision resistant function i.e. it is computationally impossible to find $x_0, x_1$ such that $f(x_0) = f(x_1)$. If a computationally bounded adversary demonstrates that he knows some $x_0$ and $f(x_0)$, in what sense is he unable to determine $x_1$?

My instinct is that he can do no better than choosing a random guess from the domain of $f$ but is this how collision resistance is defined? Moreover, if $f$ has a trapdoor, is the definition still the same i.e. collision resistance implies that either the adversary knows the trapdoor or he can do no better than pick a random element from the domain of $f$?

I apologize that this is a bit of a yes/no question although if the answer is no, then there is more to say!

EDIT: Alternatively, what is the mathematical statement that captures the idea that there is no efficient algorithm to find a collision?


texts: Finding and matching SHA512 Unsalted Hash

texts:
We are given a list of possible strings, there are $32^{16}$ ($=2^{80}$) to be exact.

We also have the unsalted SHA512 of the original target string.

How long would it take to go through those strings, generate an unsalted SHA512 hash and then check if that hash matches the target hash?

It's for a research project, we have labs full of computers/processing power, and additionally/potentially hundreds of people willing to run software on their computer for it as well, so possibly some sort of blockchain design?

We really are just looking for input or for someone to validate/invalidate this idea. Thanks for your feedback!


texts:
I have elliptic curve of equation $y^2 \equiv x^3 -x $. And the coordinate of points $Q$ and $P$. I want to solve $Q=[k]P$ (where $k$ is the unknown) by testing all possible $k$.

Is this the right approach to solve this problem?

Edit

I understand from comments that this is known as Elliptic curve discrete logarithm problem, So what is the best approach to attack this problem.

Pollard lambda
Pollard rho
Baby-Step, Giant-Step
The Pohlig-Hellman Method
...

PS :

I tried to factor $p-1$ and the result is $p-1=(2^2.N)^2$ where N is the order of point $P$

I also noticed from my googling that this curve isn't secure. Can any one explain why, and what that means?


texts: What is the GnuPG process for going from a passphrase to a symmetric key?

texts:
Suppose I use GnuPG to symmetrically encrypt a file like so:

gpg --no-options -c --cipher-algo AES256 --no-random-seed-file -o my.out my.file

I then provide a passphrase when prompted.

What steps does the software actually take to get from the passphrase I provide as a user, to the actual 256-bit AES key which is used to secure the data?
What data relating to or derived from the passphrase is stored in the output ciphertext file?
What of the above is guaranteed by the standard, and what is implementation-defined?


texts: How to compute ElGamal decryption by hand

texts: Lets say that $u=3, x=5, v=2$, how do we work out $u^{-x}*v$, so $3^{-5} * 2$. I know how to work out the answer if it was $3^5 * 2$ but how do we do it with negative exponents?


texts: Is there a problem in a PK cryptosystem if the plaintexts are very small compared to the ciphertexts?

texts:
I'm wondering, suppose we have a public key cryptosystem $P = (pk,sk)$ such that $$pk: \{0,1\}^n \to \{0,1\}^{n^2},$$ that is, the ciphertexts are $n$ times longer than the plaintexts (here, $n$ is supposed to be the security parameter). My question is

  Does this imply some weakness of any kind on the cryptosystem (as $n$ grows)?

It's not that I have the intuition that there may be an issue, it's just a particular property that makes me think.

BACKGROUND

We're developing a PK cryptosystem based in multivariate polynomial equations. So far, our ciphertexts were as long as our plaintexts, but now we have this situation, where the ciphertext / plaintext length ratio is not constant. This has its own consequences in the algebraic point of view, but in the cryptographic setting... does it have any implication? Thanks!


texts: Is the output of AES-CBC + MAC the same size as the input?

texts:
I use AES-CBC and HMAC-SHA256 to encrypt a text file. Will the output be larger in size than the input or will it be the same size?

Is it more secure secure if the size of the output is larger?


texts: Can I use a government-issued certificate in Outlook?

texts:
My government issues certificates for many purposed, including e-mail signing.
The government doesn't provide e-mail addresses, but it does declare my e-mail in the certificate.

Can I use this certificate to sign e-mail in S/MIME?
Can I use this certificate to sign e-mails using Microsoft Outlook?
Can I use this certificate to sign e-mails in any system, that's not my own developement?


texts: Are zkSTARKs simulation sound extractable in the random oracle model?

texts: I've recently become interested in simulation sound extractable zero-knowledge proofs for use in UC-secure protocols. I've also become interested in the recent instantiation of PCIPs called zkSTARKs. Are zkSTARKs simulation sound extractable as they are described, or would they have to be transformed first - sort of like the SNARK-lifting transformation described here - before being able to be securely used in a UC context?


texts: Is the Vernam (One Time Pad) cipher useful?

texts:
By profession I’m a programmer. I don’t know a lot about how cryptographic algorithms are implemented, or even where I’d start, and I don’t know about cryptanalysis, but as I work in Blockchain technology, I know how to consume cryptographic algorithms. One might say I have a passing interest.

One thing that has piqued my curiosity, as it probably does many novices in cryptography is the Vernam, or One Time Pad cipher; supposedly 100% mathematically impossible to crack and incredibly simple to implement.

The problem seems to be around the keys used. Specifically:

Keys shouldn’t be reused
Key sequences shouldn’t be repeated
Keys need to be shared somehow

Other encryption algorithms solve (or don’t suffer from) these problems, but, if we can find a suitable, secure way to generate and share unique keys, does the Vernam cipher become useful?

Is there anything else that needs consideration in this respect?


texts: Is there a practical zero-knowledge proof for this special discrete log equation?

texts:
We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal.  Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$.  There are two parties, Alice and Bob:

Alice knows:  $g$, $h$, $x_1$, $x_2$ and $(a,b,c)$,
Bob knows: $g$, $h$ and $(a,b,c)$.

Can Alice prove to Bob in zero knowledge that she knows $x_1$ and $x_2$ such that $(a,b,c) = (g^{x_1} , x_2·(h^{x_1}), h^{x_2})$?

This proof must be practical and non-interactive.


texts: For the discrete log zero-knowledge proof, can all challenges be done at once?

texts:
Section 2 of this paper (page 5 in the PDF) gives a protocol for a zero-knowledge proof to prove Alice has $x$ for $y = a^x \mod p$ to Bob without revealing the value of $x$. The protocol is as follows.

Alice sends Bob $y$, along with the public parameters $a$ and $p$. ($p$ is prime)
Repeat $T$ times:

Alice picks a random $r \in \{0,1,...,p-1\}$ and calculates $C = a^r \mod p$
Alice sends $C$ to Bob
Bob sends Alice a random $b \in \{0,1\}$ and sends it to Alice
Alice calculates $R = r + bx \mod {(p-1)}$
Bob verifies this as $a^R\stackrel{?}{=}Cy^b \mod p$

My question is, can this be modified so there are less interactions? Particularly in steps 1 and 2, Alice calculates all $C_0, C_1, ..., C_T$ and sends them to Bob all at once. In step 3, Bob picks all $b_0, b_1, ..., b_T$ and sends them to Alice. In step 4, Alice calculates all response values $R_0, ..., R_T$. Finally, Bob verifies them all similarly.

Does this open any security issues? The resulting information is the same, so I don't see how a cheating Bob could discover $x$. My question is mainly about whether or not a cheating Alice could fool Bob into thinking she knows $x$.


texts: Can Eve break this public key cryptosystem if she can solve DLP or DHP?

texts:
The PKC is in this way:

Alice and Bob fix a publicly known prime $p$, and all of the other numbers used are private (unless sent). Alice takes her message $m$, chooses a random exponent $a$, and sends the number $u = m^a\pmod p$ to Bob. Bob chooses a random exponent $b$ and sends $v = u ^ b = m^{ab}\pmod p$ back to Alice. Knowing the inverse of $a\pmod{p-1}$, Alice then computes $w = v ^ {a^{-1}} = m^{b}\pmod p$ and sends $w$ to Bob. Finally, Bob also computes $w ^ {b^{-1}} = m\pmod p$ and recovers the value of Alice's message.

I know a disadvantage of this PKC over ElGamal, that more times of data exchange is needed in order to send a single message. Are there any advantages of this cryptosystem over ElGamal? In particular, can Eve break it if she can solve the discrete logarithm problem? Can Eve break it if she can solve Diffie-Hellman problem?


texts: How to mix external entropy to a random number generator?

texts:
For security personalization of a device within the production environment our customer requires the following:

  The private / public key pair should be placed within the device and
  within the Secure process environment.

  To generate the private key, parts of the entropy are to be generated
  by an external random number generator.

  Corresponding random data should be imported into the device.

I understand what they want but have no idea, how this additional entropy could be combinded with the device internal true-random-number generator. I understand, that a number of external generated random numbers should be combinded with the internal generator to yield the random numbers on which my private keys shall be based. How is this done in practice? To take the first 16 numbers from the internal and the other 16 numbers from the external source would be by far too trivial.


texts: Are any block ciphers provably free of equivalent keys?

texts: There are $2^n!$ possible permutations of an $n$-bit block cipher $E_k:\{0,1\}^n \rightarrow \{0,1\}^n$, and any given key $k$ selects one of these permutations at random. Define equivalent keys as a pair of keys $k \neq k^\prime$ where $\forall P:E_k(P) = E_{k^\prime}(P)$ and $P\in\{0,1\}^n$. The probability that such a pair exists for realistic cipher parameters is very low. Can a block cipher be proven to be free of equivalent keys?


texts:
Trying to write a C program that implements the DES standard (FIPS 46-3). I am unsure about how the standard should be interpreted when computing the various permutations specified in the document, with regard to the external data that is loaded in the algorithm.

For example, the IP (Initial Permutation) takes the 64 bits of input and arranges them so that the result has bit 58 of the input as its first bit, bit 50 as its second bit, and so on.

Assuming (is this correct?) that "first bit" of output means MSB, the problem still remains with what is meant by "bit 58" of input. Where do we start counting?

For example, if the input is read from a file in a buffer (C array) of 8 bytes, where is the 58th bit to be found: in buffer[0] or in buffer[7]? Both seem plausible: in buffer[0] (because logically is the last in the row, assuming it was read first) and in buffer[7] (assuming we believe we are reading an integer starting with its MSB).

What is the community consensus about this issue?

Thank you.


texts:
I have placed a bet that I can create a public key such that my adversary will not be able to crack (decrypt) it for at least one week. For my primes $p$ and $q$, I chose very large numbers that are $101$ digits long, each. I also tried to make them to be as distinct as possible.

Now what I am wondering is whether to choose a big encryption exponent or a small one. Since I have began my study of Cryptography about a month ago, I am not too familiar with choosing a solid encryption exponent. I heard that choosing the digits $3, 5, 17, 257$ or $65537$ would give me a good security but I have not read about it. I was thinking of going with $257$ because intuition tells me that there exists a inverse relation between the two: when choosing large primes for $p$ and $q$, then pick a small encryption exponent and vice versa. But I don't know if this makes complete sense in some regards.

Any input is appreciated.


texts: Best way to generate a IV for AES-CBC when encrypting files?

texts:
The situation is that I want to use symmetric encryption to store some info in files. I'm going to use AES-CBC algorithm. The user is going to remember the password (meaning it will not be stored anywhere but in the brain of the owner of the files) however I'm worried about the management of the salt and the IV.

From several sources I've seen that the salt must be unique and never reused (which imples using a cryptographically secure pseudorandom number generator) but it can be safely appended in clear text to the encrypted data. Is this right?

For the IV I have seen two different approaches:

Similar to the salt, generate in randomly and store in clear text.
Derive it from the password and salt, the same way it is done with the key used to encrypt each block via the AES algorithm.

Which is the preferred / safest way?


texts: Why is RSA encryption significantly faster than decryption?

texts:
I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and decryption time of 0.55 ms, or a ratio of 1:11.

This seems like a large difference. Is it supposed to be this way?

//here my key has 256 bits
 for (;;) {
            long begin = System.currentTimeMillis();

            for (int i = 0; i < num; i++) {

            decrypt();
            }

            long end = System.currentTimeMillis();

            long time = end - begin;

            if (time >= 10000) {
                System.out.printf("Average Encryption takes: %.2f ms\n",
                        (double) time / num);
                break;
            }

            num *= 2;
        }

p = BigInteger.probablePrime(128, random);
q = BigInteger.probablePrime(128, random);
N=(p.subtract(one)).multiply(q.subtract(one));
e=BigInteger.probablePrime(32, random);
d=e.modInverse(N);
private void encrypt()
{

C= M.modPow(e,N);

}

private void decrypt()
{
    RM = C.modPow(d, N);
    }


texts: Is the k-sum attack efficient in bilinear pairing variants?

texts:
From the k-sum definition, the objective is to solve something like:
$\sum_{i=1}^n c_i = v_1$ where $v_1$ is known.

If we use Elliptic Curve Points ($C_i$ and $G$) we can define a bilinear pairing variant:
$\prod_{i=1}^n  ê(C_i, G) = v_2$ where $v_2$ is known.

I suppose this would also be efficient to compute, but I'm not certain?


texts: Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)

texts:
I want to prove the security of a Tweakable Block Cipher in CBC Mode
How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant  (public) tweak?
In the case of Threefish, does the tweak need to take any prescribed form?


texts: Why should a distribution being pseudorandom strictly be a sequence of distributions being pseudorandom

texts:
According to Katz Lindell book,

Let Dist be a distribution on l-bit strings. Informally, Dist is pseudorandom if the experiment in which a string is sampled from Dist is indistinguishable from the experiment in which a uniform string of length l is sampled. (Strictly speaking, since we are in an asymptotic setting we need to speak of the pseudorandomness of a sequence of distributions Dist = {$Dist_{n}$}, where distribution $Dist_{n}$ is used for security parameter n. We ignore this point in our current discussion.) More precisely, it should be infeasible for any polynomial-time algorithm to determine (better than guessing) whether it is given a string sampled according to Dist, or whether it is given a uniform l-bit string.

What do they mean here by sequence of distributions?


texts:
Would it be possible to find a correlation between the inputs of SHA 256 and it's outputs? More specifically, by using deep learning, would there exist a correlation between the inputs of an SHA 256 algorithm and it's expected output?

For example, given that A, B, C and D output a Has with certain characteristics, and given that we have a very big sample of data that has a combination of inputs and their outputs (labeled based on whether the output FITS into the characteristics or not), could a pattern be found so that in the future we could know which combination of inputs would give us an output that complies with said characteristics?

Thanks in advance!


texts: One of the functions used in ITUbee's round function is $L$ which is defined as $L(A, B, C, D, E) = [E \oplus A \oplus B, A \oplus B \oplus C, B \oplus C \oplus D, C \oplus D \oplus E, D \oplus E \oplus A]$. Is this operation invertible?


texts: Why do we truncate the hash when using DSA?

texts:
All the articles I read on the web about DSA keep telling me that the size of the hash needs to be truncated so that the bit length is equal to or lesser than the bit length of the prime number of the field.

For example, Wikipedia says:

  Choose an approved cryptographic hash function H. [...] The hash output may be truncated to the size of a key pair.
  Choose an N-bit prime q. N must be less than or equal to the hash output length.

But why exactly do we need this? What's wrong with using a 256-bit hash with a 160-bit prime?

I tried looking on the web, but I keep getting results that explain me how to truncate the hash, not why.


texts:
I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work done on the data. The storage blocks are roughly 1MB segments.

One option is to let the client use a AE(AD) cipher (like AES/GCM) and afterwards add a strong checksum. Since AES/GCM is not yet the most optimized cipher (in my Java world), an alternative would be to use a more traditional encrypt-then-HMAC. However, with a normal HMAC, this could not serve as a publicly verifiable checksum. And calculating both, a HMAC and a checksum would double the amount of work which needs to be done (over the message). What about only calculating the checksum over the message, and using a HMAC on this reduced data set?

encrypted = AESCBC(IV, plaintext-1MB)
checksum = SHA224(ID | IV | len | encrypted)
sig = HMAC(ID | len | checksum)
message = ID | IV | len | encrypted | checksum | sig

In this case I calculate a publicly verifiable checksum over the data (so I can detect corruption on the server) and only the client could check in addition to that the HMAC authenticator added. The HMAC does not need to run over all the encrypted data, but uses the checksum as a shortcut. The ID is unique for each segment.

In my case the protocol can't be used as an anonymous oracle and the plaintext length can not be extended boundlessly, however a hash which is more resistant against extension attacks is intentionally used.

I haven't seen much analysis on using ordinary hashes for content authentication. Can anyone can give me a pointer on whether this is safe? (I haven't yet done performance analysis yet; I might simply go with AES/GCM+SHA if that is fast enough). Or is there a more standard construction for generating a publicly verifiable and authenticating tag?


texts: When searching by using the Merkle tree, the time complexity is $\mathcal O(\log n)$ but I don't understand how space complexity is $\mathcal O(n)$. In my opinion, it should be also $\mathcal O(\log n)$. Can somebody explain it to me?


texts:
I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too.

I have ECDSA SSH public keys and I wonder if I can use them to encrypt data that only the matching machine could decrypt, writing the proper software.

Pointers welcomed.


texts: Doubts regarding implementing AES-128 bit algorithm in my IOT system

texts:
I want to implement AES-128 in my IoT network which consists of a Master device which runs Linux on it and slave devices which are 8-bit micro-controllers that periodically transmit data packets to the master.

I read about the AES/Rijndael algorithm and liked it.

The only questions I have are:-

What should I set my IV to be ?
What should be the key value?

Can the key value be a random value chosen by me or it has to come from a specific source?


texts:
Now I am doing a variation of the oblivious transfer, I have to use 2 people, pebbles, and boxes. I need to find out if who has a larger number between Alice and Bob (variation of Yao's Millionaires' Problem). This is what I have come up with:

Bob enters a room where alone where 100 boxes are and he inserts a pebble in the n_Bth box.
Alice enters the room alone where the boxes are and she inserts a pebble in the n_Ath box and a pebble into each $(n_A+1)$th box till she reaches the last box ($100$th box). She cannot shake any of the boxes because the noise will be heard by Bob who is waiting outside.
Bob enters the room and he changes the order of the boxes. He cannot shake the boxes for the same reason.
Alice enters the room and she changes the order of the boxes. She cannot shake the boxes for the same reason.
Now Alice and Bob both enter the room and they shake each box. If they hear $2$ pebbles in one box, it means that $n_A < n_B$. Alice now only knows that $n_B$ has to be larger than her number. If a box does not contain two pebbles then $n_A > n_B$. Alice now only knows that $n_B$ is less than her number.

Now the only problem is, that it only works if Bob has a larger number than Alice. If Alice has a larger number than Bob, then none of the boxes will have $2$ pebbles and they will both know that Bob's number is larger than Alice. However, Bob has an advantage as to figuring out what number Alice has, because Alice put pebbles in her box and all boxes greater.

Example using 10 boxes:

 Alice's number = 7, Bob's number = 3

 x    x   x   x               x
 10   9   8   7   6   5   4   3   2   1

 After the randomization process, Alice and Bob both know that Alice's number is
 larger than Bob's. But the Prob(of b = 4 or 5 or 6) = 0% because all Bob has to do
 is subtract the number of boxes with a pebble in it from the number of boxes
 (10 - 4 (it's because he put a pebble in his box)) and he knows that Alice's number
 has to be 10, 9, 8, or 7.

If you don't follow, I can try to make it more clear.


texts: For AES CBC, can I encrypt the IV with AES ECB and the same key and include it with the message?

texts:
Is it safe to use this process:

Generate Key, IV
Encrypt Message with Key, IV and AES CBC into EMessage
Encrypt IV with ECB into EIV
Send over EIV + EMessage

Then the recipient

Decrypt EIV with Key into IV
Decrypt EMessage with IV and Key into Message

The thing that I'm worried about is that encrypting the IV with the same key gives additional information about the first block (and therefore subsequent blocks).

Edit: There was a great response with a direct proof in the case that the first block is all zeroes. What about this revised process:

Generate Key, IV1, IV2
Encrypt IV2 + Message with Key, IV and AES CBC into EMessage
Encrypt IV with ECB into EIV
Send over EIV + EMessage

Decrypt:

Decrypt EIV with Key into IV
Decrypt EMessage with Key and IV into IV2 + Message
Throw away IV2

This seems to counter the information lost at the cost of one additional block of data in the message.


texts: How to use private key with Hash algorithims for storing passwords

texts:
UPDATE
Found an answer here: Recommended way of adding a pepper/secret key to password before hashing?

After reading https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords and doing some research I wrote some code that does the following:

Generate 128 bit Salt using Cryptographically secure pseudorandom number generator
Give Password and Salt to PBKDF2 implementation
Store the 32 Byte hash as the password

I would also like to include a private key as part of the process, but I'm not sure where it fits.  I've used HMAC (SHA 256) in the past to authenticate a message so I was thinking either:

Append the private key to the salt and pass the 256 bit result through the algorithm of choice ( PBKDF2 , bCrypt , Argon2)
Apply a HMAC (SHA 256) password then pass that
to the algorithm of choice ( PBKDF2 , bCrypt , Argon2)
Something else??

I want to make sure I am using the private key properly in the context of password hashing.  Any suggestions or comments are greatly appreciated.

Thank you


texts: Where to find a comprehensive content on security proof systems in cryptography

texts: Proof systems (provable security) are seen in many research papers related to cryptography and security. Where would I be able to find a comprehensive resource covering the purpose and the fundamentals of proof systems, and its common approaches such as the random oracle model method?


texts:
I want to solve this problem but there are 3 known plaintext-ciphertext pairs.

The key of  Hill  cipher  is a  3*3 matrix as k=[k1,k2,3; k4,k5,k6; k7,k8,k9]
where  the  unknown ki={0,1,...25}={A,B,...,Z} can be solved given a sufficient number
(at least three are needed) known plaintext-ciphertext pairs. It is given that Ek(sky)=BAA,
Ek(sun)=ABA, Ek(hat)=AAB. Find the decryption matrix, that is, the inverse k^-1 of the key matrix K.


texts: How does CBC work with read-write volumes?

texts:
I have read an article about an attack on LUKS in CBC mode and had a look at the WP article about CBC and now I am confused. If I have understood that correctly then changing the plaintext of a block affects all following blocks because every block needs the ciphertext of the previous block to be decrypted. Changing the plaintext ($i$) changes the ciphertext so (in my understanding) you have to rewrite the next block ($i+1$) so that the changed ciphertext of $i$ still leads to the correct plaintext of $i+1$. Rewriting $i+1$ causes the same problem for $i+2$.

This doesn't make sense so obviously I misunderstand something important.


texts: Will adding space to the Vigenère block make it truly unbreakable?

texts: I just have gotten into cryptography and learned about the Vigenère block. I think it's a very good idea because, if used correctly, it is unbreakable. But the only downsite is, the key must be the same length as the message. Well, can't you just simply make the block 27x27 big by adding the space into it. That way you could have no space at all, or you can make spaces where ever you want. Is there anything like this already or am I overlooking something here?


texts: Is there any concrete working example for Function Field Sieve method?

texts:
I'm new to Function Field Sieve(FFS) (Number Field Sieve(NFS) as well) method and I'm finding it is quite difficult to understand it (especially concepts of valuation at infinity, Ca,b curves etc.)

I have read these papers:

(Leonard Adleman 1994: The function field sieve),
Razavan: 2^809 using Function Field Sieve ,
Joux: Function Field is quite special.

For NFS luckily i got this book : Chapter 11 NFS
(Algebraic Number Theory : Frazer Jarvis )

He presented NFS by working example(including factorbase construction on both Algebraic and Rational side and many other things).

But for FFS I searched a lot but didn't find any example and it is very difficult to grasp its concept by theory only. Please if anyone can refer or give working example of FFS, it will be very helpful.


texts: Can both substitution and transposition ciphers be thought of as permutations?

texts:
I came across this problem to 'explain why both substitution and transposition ciphers can be thought of as permutations' and I cannot come up with an explanation to how substitution ciphers can be thought of as permutations. Can somebody provide an explanation to this? It would really help me get a better understanding.

Edit:
This question is from the book Cryptography and Network Security by Behrouz Forouzan.


texts: The small key-search circuit for brute-force of Bernstein

texts:
I'm trying to understand Understanding brute force by Bernstein. I couldn't understand how the described machine can brute force the AES.

  The attacker builds a very small key-search circuit. The key-search circuit has
  three inputs: a 12-byte string $\beta$, a 4-byte integer $n$, and a 16-byte string $s$. The key-search circuit has one output: a 16-byte string $Z(\beta, n, s)$ defined recursively by $Z(\beta, 0, s) = s$ and $Z(\beta, n + 1, s) = Z(\beta, n, H(s \oplus (\beta, n))$.


texts:
I'm just a bit confused about the nonce/IV in AES-CTR ... it seems the suggested way to go is have a 64bit random nonce, and use the last 64bits as the counter, "starting at 0".

I'm just wondering why not PRNG initialize all 128bits? Still using a 'static' 64bit nonce and still with the least significant 64bits as the counter, but "IV"'d (set to a non-zero value).  Am i missing something?

And in this example (https://tools.ietf.org/html/rfc3686) they clearly have a distinction with 1) a 32bit nonce, 2) a 64bit IV, and 3) a 32bit counter. In essence don't the nonce and IV essentially combine to form just one random use-only-once value? (ie. couldn't they just say "a 96bit nonce"?)

Also can the nonce be stored in plaintext alongside the ciphertext, or is it normally stored in some secured fashion, and if so how?
Thanks


texts: Tracking the noise growth of Homomorphic encryption

texts:
So I'm a bit of a cryptography/HE noob, and I was wondering if it is possible to keep track of the noise growth that happens when you do some kind of mathematical operation on your encrypted data, and by keeping track of such growth, would it be possible to clip off the noise once it reaches a threshold (If I've understood correctly, after certain point your decryption process will be useless, because of noise?).

Now by learning that noise growth what else can I gain?
Is it even possible to clip off the unwanted noise and continue with your operation?


texts: Does OEAP padding limit the size of my modulous to the size fo the hash function?

texts: im looking  at wiki at the moment as how to use oeap padding and it appears, help  me out if im wrong as G(r) - expands r to the size of the padded message, I am then limited by the size of my hash function as say a SHA-256 hash function would expand to only 256 bits, but what if I had a 2048 bit modulus? I'm unsure if there are any 2000+bit hash functions out there, or could I use a series  of different r values, hash them and use the concatenation of the hash outputs to create a 2000  bit xor?


texts: Create a ciphertext that decrypt to different plaintexts with different keys in RSA

texts:
(This is inspired by this question 1; have also read this question 2 but it's one-time pad)

I would like to know, given two message $m_1$ and $m_2$, as well as public keys $(e,n_1)$ and $(e,n_2)$, can I create a ciphertext $C$ such that decryption with private key 1 $(d_1, n_1)$ gives $m_1$ and $(d_2, n_2)$ gives $m_2$?
$$C^{d_1}\equiv m_1\pmod {n_1}$$
$$C^{d_2}\equiv m_2\pmod {n_2}$$

I think it is possible because by Chinese remainder theorem, I can find a unique $C$ for any $m_1\ ^e$, $m_2\ ^e$, and respective coprime $n_1$ and $n_2$, such that
$$C\equiv m_1\ ^e\pmod {n_1}$$
$$C\equiv m_2\ ^e\pmod {n_2}$$

Is it possible? If so are there any significant limitations, or public implementations for this?


texts:
How do replay attacks work in ECB mode?
I found this in Wikipedia:

  "ECB mode can also make protocols without integrity protection even more susceptible to replay attacks, since each block gets decrypted in exactly the same way. For example, the Phantasy Star Online: Blue Burst online video game uses Blowfish in ECB mode. Before the key exchange system was cracked leading to even easier methods, cheaters repeated encrypted "monster killed" message packets, each an encrypted Blowfish block, to illegitimately gain experience points quickly.[citation needed]"

But I want to know how a replay attack really works in ECB mode, and how the other block cipher operation modes (like OFB) avoid it.


texts: In veracrypt when i generate a random keyfile, does the size of the keyfile mean anything?

texts:
thanks for looking at my question, i have been getting several different answers to this question so i thought i might ask it here, when i create a random generated keyfile in veracrypt, does the size of the file mean anything? for example, does a larger file mean it's more secure?

when you generate a random key file it says that it can create the file anywhere between 64 and 1048576 bytes, so does that mean that a 1048576 byte file is more secure then a 64 byte file?

thanks.


texts: I can see that the message (after padding) should not be 256 bytes because it might be bigger than the modulus of RSA. So I think that the message should be 255 bytes, but I saw posts that says the maximum input is 245 bytes. Why is that?


texts: Crypto that takes n days to solve depending on how many bytes are missing?

texts:
Is there a good candidate for an algorithm that would takes n days to break depending on how many bytes of the key are missing? I'm writing a story where you need to collect pieces (bytes) of a key and depending on how you have you get an head start in brute-forcing the message.

The message is around 200 chars long (so quite small).  Count on computer resources be what would feasible for a non state-actor (bot nets etc), but still pretty resourceful. The key length / piece length does matter much, but should be viable for 6-8 "pieces"

The main problem I see is that time with brute forcing strong encryption is usually measured in years, or even million of years, and I need it more to be around 3 days per "piece"


texts: How can a good pseudo-random number generator be made?

texts:
I am trying to make a pseudo-random number generator so that I can use it in a synchronous stream cipher for encrypting plain text. I want it to generate numbers which are as random as possible.

What are good elements that my algorithm must have in order to do so?

This is for an interschool science competition.


texts: How can one securely generate an asymmetric key pair from a short passphrase?

texts:
Background info:
I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for a file, so the user will have to asymmetrically encrypt $K$ and send it as well. The reason for this double encryption is that you can still share (individual!) files with other accounts by encrypting $K$ with the public keys of those users, too.

My problem is: How can a user can get a public and private key without the server saving/knowing the private key and without the user having to remember a passphrase of 250 hex characters?

Question:
Is there a way to derive a key pair from a password, like PBKDF-2 does for symmetric encryption?
Suggestions on rearranging the cryptographic steps in an easier way are welcome, too.

Alternatively:
It is also possible to encrypt the private key with a PBKDF-applied password and store it on the server, but I'd like to keep things 'simple'. ;)

Note: At this point I don't care if it requires RSA, ECC or an obscure cryptography scheme.


texts: Is generating public key inevitably slow in classic Diffie-Hellman if the private key is large?

texts:
Let's say I pick a 3000+ bit prime $p$ for which I also know that $q = (p - 1) / 2$ is a prime. If I've understood correct, then I can pick pretty much any $g$.

Is generating $g^x$ now inevitably slow for any large $x$ regardless of choice of $g$?

Do I still only select some $2n$ bit value for $x$ - where $n$ is the number of desired bits of security - in order to keep the calculation fast?


texts: Help with AES decryption with AES-NI Instructions

texts:
I am in process of implementing a AES 128 encryption in AVX2 assembly (using AES NI), and am having some problems with decryption logic. I have implemented the encryption sequence without any trouble. However, decryption has been giving many problems.So, my questions regarding the decryption are :

Are the keys identical for the encryption sequence and decryption sequence? If not, then, am I required to execute a VAESIMC instruction on the keys as generated for encryption to make those functional for decryption ? If yes, then must I skip this instruction for the Key 0 [the original Key] and for the Key 10 [the last in sequence to get generated] ? Please clarify...
Once the keys have been generated, the sequence of operation is to take the ciphertext, XOR with the Key 10 value, and apply VAESDECLAST to the result using Key 9, and VAESDEC for all other rounds? Or, alternatively, I must apply VAESDEC to result of the XOR from Key 10 step, and apply the VAESDECLAST to the last round (Key 1 ) ?

All help and advice is welcome.
Remain grateful..


texts: RSA Proof - Is Z(n) closed under multiplication

texts: In RSA proof it can be proved that $\mathbb{Z}^*_n$ is closed under multiplication. Can it be also proved that $\mathbb{Z}_n$ is closed under multiplication? If yes, then how?


texts: What are the security implications of knowing the private polynomial $\mathcal{F}$

texts:
First, affine transformations $S,T$ are defined by $S=A_1+v_s, T=A_2+v_t$. Let the private polynomial function $\mathcal{F}$ be known. The short description of the public key map is $P(X) = T \circ \mathcal{F} \circ S(X)$. Recall that common multivariate schemes are based on the security assumption of IP2, this is, the Isomorphism Of Polynomials with two secrets.

It results that only applying transformations $T$ and $S=I_n$ (the identity) makes the scheme vulnerable by linear algebra attacks. We can recover the transformation matrix $T$ since we already know that it transformed $\mathcal{F}$ to the public key matrix.

In addition, using $T=I_n$ and $S$ an arbitrary invertible affine function, the problem now is equivalent to IP1, which can be stated from the so called Polynomial Affine Equivalence problem (PAE) (see [1] section $2.3$ and $3$). Given $\mathcal{F}(x)$ and $\mathcal{F}(S(x))$ find $S$. Schemes based on IP1 can be vulnerable to attacks if not designed with care, see [2].

Then we are restricted to IP2 if we want to mantain security from this point. Recall that including abritrary invertible affine transformations $S,T$ would make the input-output of $\mathcal{F}$ unknown, even knowing $\mathcal{F}$. Then as $T$ transforms an unknown input, we learn nothing from here nor from the view of PAE or IP1, as we only know one set of quadratic equations $B$ but the set $A$ remains hidden by the transformation $T$.

In the previous description I tried to demonstrate that the knowledge of the private polynomial $\mathcal{F}$ has no effect when the scheme is based on the assumptions of IP2.

However, is there any complication if the private polynomial $\mathcal{F}$ is publicly known from other perspective?

My intiution says that recovering $T$ is fatal as $\mathcal{F}(X), \mathcal{F^{-1}}(X)$ are known the attacker obtains $F^{-1}(Y)=S(X)$. Then to solve IP1 he must establish an affine equivalence function $S$ between $\mathcal{F}(X)$ and $\mathcal{F}(S(X))$

If the attacker doesn't possess $\mathcal{F}$ knowing $T$ will yield $F \circ S(X)$ but yet he doesn't know $\mathcal{F}(X)$, thus IP1 cannot be followed from here.


texts: What encryption/decryption system should I use for media server

texts:
There is a server from which media files will be streamed to cross platform mobile/desktop apps.

The idea is to encrypt the files while uploading using the web browser, store it in the server and when requested, files will be sent over to the front end, decrypted there and media played.

Users can use multiple devices (Android, iOS, Webapp, PC, Mac, Linux) with their account, but at any particular time only one device can play the media. If users, hypothetically, get access to the encrypted files from the server or while downloading to the app (man in the middle), should not be able to decrypt the files. Only the app should decrypt the files under the hood.

I am not sure how or what system of encryption to implement since I barely know cryptography.

A good part of this question is answered here, but it really doesn't discuss the part of users not able to decrypt the files using other tools.


texts: How many bytes of data does AES 256 encrypt at one time?

texts: Since the block size of AES 256 is 256, how would we calculate the bytes of data AES 256 encrypts at one time?


texts: Steganography Decryption From Completely Black Image

texts: I am trying to decrypt a completely black gif that I know has been encrypted by some sort of steganography. I've tried subtracting the bytes of the images with each other, and so far I have gotten a really weird image consisting of seemingly random patterns of black and white pixels. What are the most common techniques to go about decrypting this image?


texts: Key exchange during IKE_AUTH phase of IKEv2

texts:
This is what a casual IKEv2 handshake looks like :

  Initiator                                                       Responder
  |                                                                      |
 1|-----------------------> HDR, SAi1, KEi, Ni ------------------------->|
 2|<----------------- HDR, SAr1, KEr, Nr, [CERTREQ] <--------------------|
 3|----> HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,] AUTH, SAi2, TSi, TSr}-->|
 4|<------------ HDR, SK {IDr, [CERT,] AUTH, SAr2, TSi, TSr} <-----------|
  |                                                                      |

Where messages (1) and (2) belong to IKE_SA_INIT exchange and messages (3) and (4) belong to IKE_AUTH exchange.
I have analyzed a wireshark trace of this exchange and it seems to me that during IKE_AUTH (SAi2, SAr2), the initiator/the responder advertises the set of security algorithms it supports/it chooses respectively (encryption, authentication, integrity protection, diffie-hellman group). However neither of both does advertise its DH value. So there is no actual key exchange here. My question is for what purpose does the (SAi2, SAr2) security association negotiation serve? and why do we even need to have a second key exchange since the protocol already achieved one during IKE_SA_INIT (In other words why do we need to negotiate new keys) ?


texts: Existential unforgeability vs strong unforgeability

texts: In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong unforgeability. The difference is that while in the "existential" condition is fulfiled only if the attacker cannot forge a signature on a message he did not ask the signature for. in the case of "strong" he even cannot generate another signature for a message he already ask for. So, is there an example to a signature scheme which is "existential" unforgable but not strong unforgeble?


texts: RSA: Should the generation of random data used for primes include zero

texts:
When generating random data that is later tested for primality, should the random data include the value 0x0?

I would have thought that primes that do not include zero's are a subset of the set of primes that do - and therefore make keys generated with no zero's easier to brute force?

However my colleges are of the opinion that having zero in the prime data makes the key operations consume less time / and or power, and thus make these keys more vulnerable to a DPA / timing based attack. They have also seen open source code that removes zeros from the random data.

Which is more of a concern? Attack, or a subset of primes?


texts: Can gnupg master key decrypt something encrypted with subkey?

texts: When creating gpg subkeys, the master key signs and certifies that a subkey belongs to that master. That's ok, but, can master key decrypt something encrypted by a subkey? I guess no, but I want to be 100% sure. Am I right or I misunderstood?


texts: Am I using these key derivation functions correctly?

texts:
I am a bit confused about key derivation functions. I am trying to use the argon2 KDF from the passlib python module to do the following:

The user provides a password which I provide to the hash function combined with a salt (which is autogenerated by the function)
I use the resulting hash as a master key to encrypt some other key(s) along with some data about some system, for example a set of files. The salt is also stored along this data (but not encrypted).

My confusion comes from the fact that the library only provides the hash results in the form of strings which may be used to identify if the user of some website typed in the correct password, for example the string
'$argon2i$v=19$m=512,t=2,p=2$aI2R0hpDyLm3ltLa+1/rvQ$LqPKjd6n8yniKtAithoR7A'

as shown in this example.
Can I use a KDF like argon2 for this purpose? Of course I would have to extract the key and the salt along with the settings from this string to make this work.


texts: md5: is reverse length-extension attack possible?

texts:
If I know

H = md5( SECRET_KEY | DATA )

then I can calculate

H' = md5( SECRET_KEY | DATA | DATA' )

That's length-extension attack. But is the opposite possible? E.g. if I know

H = md5( SECRET_KEY | DATA )

can I find

H'' = md5( SECRET_KEY )

where DATA is known and lenght of DATA is known too???

Basically, can I find md5 of the KEY without DATA (once again, DATA is known, H is known, but SECRET_KEY is unknown)?


texts: Problems key AES 128 key from last round key

texts:
I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key.

I know that the general principle is to do $w[i] = w[i+3] \oplus w[i+4]$, with $w$ being a buffer of dimension 2 : 44 * 4 bytes. The last key is therefore $w[40]$, $w[41]$, $w[42]$ and $w[43]$.

What I don't understand is : when do we use rcon and the sboxes?

I apply $w[i+3] = \operatorname{sboxWord}(\operatorname{rotate}(w[i+3])) \oplus \operatorname{rconWord}[{i \over 4} + 1]$ if $i \bmod 4 = 0$.


texts: RSA encryption secure mode, plaintext length limit vs. key length

texts:
I have two questions about RSA encryption to confirm:

Assume use RSA 2048-bit key pair, what is the secure encryption mode? Are ECB / OAEPWithSHA-256AndMGF1Padding and ECB / OAEPWithSHA-1AndMGF1Padding secure modes?
For example, we know the maximim length of plaintext to be encrypted is limited by key length.

  RSA was not designed to work with large amount of data. You can process messages only with limited length, that depends on the key size. The bigger key is, the bigger message can be encrypted.

For 2048 key, what is the maximum plaintext length? What is the math relation between them?


texts: NRPAD and FPAD padding schemes (Korean Seed?)

texts:
I've got an API spec that specifies NRPAD and FPAD as possible padding schemes. I see these being used together with the Korean SEED algorithm. The SEED specification however is void of any padding mode description as is the API.

Can anybody tell where these padding schemes are defined, and how they operate?


texts:
What does the acronym "CRT" stand for in the PKCS #1 specification?  Does it stand for "Chinese Remainder Theorem"?

Thanks,

Pete


texts: Accelerated hashing on consumer-grade CPU?

texts: Question is a follow-up to this one. The question was about accelerating SHA1. I am writing an application, where I do have a choice of hash algorithm, as long as it's a strong one. I want to be able to use the one which could be CPU-accelerated on consumer grade AMD and/or Intel processors. Which one should I take?


texts: Relying on a 4-bit S-box instead of an 8-bit one

texts: I've discovered that generating good S-boxes with only modular addition, bitwise XOR, bitwise AND, bitwise OR, bitwise NOT, rotations, and, shifts is difficult. I figure that using them to make a good 4-bit S-box will be easier. But, does using a 4-bit S-box instead of an 8-bit one degrade security by a large margin?


texts: Is LUKS Anti-Forensic information splitter (AFsplit) indistinguishable from random data?

texts:
I want to know if AFsplit(random_data_input, stripes, digestmod=sha) output is indistinguishable from random data.

The attacker only has access to AFsplit output data.

EDIT: This question is too vague as the answer depends on the randomness hypothesis taken about random_input_data. Take care of it reading the proposed answers.

The purpose is to use this function in a deniable encryption implementation.

About AFsplit: AFsplit provides a security against forensic attacks on disk bad blocks. AFsplit splits data among several disk blocks so that if a block is put in reserved "bad block" area, it doesn't contain a complete sensitive information (particularly, a revoked key slot). LUKS uses AFsplit to store the key slots.

Note: I'm not speaking of LUKS itself that is, of course, a plain header. I just want to focus on this particular function.

Below is AFsplit Python implementation:

import sha, string, math, struct
from Crypto.Util.randpool import RandomPool
from Crypto.Cipher import XOR
def _xor(a, b):
    """Internal function to performs XOR on two strings a and b"""

    xor = XOR.new(a)
    return xor.encrypt(b)

def _diffuse(block, size, digest):
    """Internal function to diffuse information inside a buffer"""

    # Compute the number of full blocks, and the size of the leftover block
    full_blocks = int(math.floor(float(len(block)) / float(digest.digest_size)))
    padding = len(block) % digest.digest_size

    # hash the full blocks
    ret = ""
    for i in range(0, full_blocks):

        hash = digest.new()
        hash.update(struct.pack(">I", i))
        hash.update(block[i*digest.digest_size:(i+1)*digest.digest_size])
        ret += hash.digest()

    # Hash the remaining data
    if padding > 0:
        hash = digest.new()
        hash.update(struct.pack(">I", full_blocks))
        hash.update(block[full_blocks * digest.digest_size:])
        ret += hash.digest()[:padding]

    return ret

def AFSplit(data, stripes, digestmod=sha):
    """AF-Split data using digestmod.  Returned data size will be len(data) * stripes"""

    blockSize = len(data)

    rand = RandomPool()

    bufblock = "\x00" * blockSize

    ret = ""
    for i in range(0, stripes-1):

        # Get some random data
        rand.randomize()
        rand.stir()
        r = rand.get_bytes(blockSize)
        if rand.entropy < 0:
            print "Warning: RandomPool entropy dropped below 0"

        ret += r
        bufblock = _xor(r, bufblock)
        bufblock = _diffuse(bufblock, blockSize, digestmod)
        rand.add_event(bufblock)

    ret += _xor(bufblock, data)
    return ret


texts: Why IV does not have to be secret yet has to be random

texts:
The IV used in schemes such as CBC has to be random and unpredictable. But at the same time it does not have to be kept secret.

If the IV does not have to be secret, why does it have to be random then? I fail to make sense out of these seemingly contradicting requirements.

I have seen descriptions of attacks which exploit the non-randomness. So, I would understand why randomness is needed. However, things get confusing when the requirements specify that the IV does not have to be secret !This seems to defeat the whole purpose of randomness.

Somebody help clarify this please.


texts:
Is there a cipher that was considered the undisputed best before the computer age?  (This is not supposed to be a discussion; it's either a yes or no.)

Please give a brief description why it is yes or no.


texts: How to calculate bit strength of Integer Factorization Cryptography (IFC) such as RSA using Python

texts:
I would like to know how to calculate the bit-strength of Integer Factorization Cryptography (IFC) such as RSA by using Python. I gathered it is based off the complexity of factorizing the modulus (public key). I want to be able to calculate the bit strength of arbitrary key-lengths of RSA for example, such as 4096 which is not given by NIST etc.

This is similar to this question Security strength of RSA in relation with the modulus size, where the answer is provided by using Mathematica.

The fastest publicly known algorithm for factoring is the General Number Field Sieve (GNFS). This has the complexity defined in L-notation. The formulae includes little-o 1, which I'm not sure how to fit into the calculations, in the Mathematica example it is left out (treated as being equal to 1).

Here is the relevant Mathematica code:

  I generated these numbers with the following Mathematica code:

({#, N@Log2@g[#]} &) /@ {1024, 2048, 3072, 7680, 15360}

  where g is defined as:

g[b_] := Exp[(64/9 * Log[2^b])^(1/3) * (Log[Log[2^b]])^(2/3)]

If I understand correctly taking log2 of the exp would cancel out, so the result it's equivalent to just:(64/9 * Log[2^b])^(1/3) * (Log[Log[2^b]])^(2/3).

I have tried the following Python code but it seems to be way off.

import fractions
import math

ln = math.log

n = pow(2, 1024)  ## change for other RSA key-sizes

a = fractions.Fraction(1,3)
c = pow(fractions.Fraction(64,9), fractions.Fraction(1,3))
# c = 1.9229994270765445

def g(a, c, n):
  return math.exp(c * pow(ln(n), a) * pow(ln(ln(n)), 1 - a))

x = g(a, c, n)
# x = 1.3158442944491604e+26
s = ln(x)
# s = 60.1416909264604

The result for 1024 is 60.14, whereas NIST says 80, and Mathematica got 86.77. The results for other key-sizes are all way off.

This is the results from Mathematica (3rd column) which are very close to NIST (1st column).

Strength  RSA modulus size   Complexity bit-length
  80        1024              86.76611925028119
 112        2048              116.8838132958159
 128        3072              138.7362808527251
 192        7680              203.01873594417665
 256       15360              269.38477262128384

My results from my Python code are (10243, 60.14), (2048, 81.02), (3072, 96.16), etc.

I thought maybe this is due to rounding errors, but using WolfRamAlpha (I don't have Mathematica which is why I'm trying to use Python instead) I get the same results as Python.

This is what I put into WolfRamAlpha:

(64/9 * Log[2^1024])^(1/3) * (Log[Log[2^1024]])^(2/3)

Decimal result is 60.14169092646040456.... Pretty much same as my Python code. How did NIST and referenced answer get such different results. My code looks equivalent to me. I don't see my mistake.

What am I doing wrong?


texts: Is rubberhose cryptanalysis a sidechannel - formally?

texts:
I recently was engaged in a discussion in Sec.SE where somebody used the term "sidechannel" to actually mean "circumvent the encryption".

By what he said it was clear, that he wanted to not bother with crypto at all and this is - in my view - not a sidechannel. However, rubberhose cryptanalysis was also mentioned and it was argued that rubberhose cryptanalysis is a sidechannel because the definition of sidechannel includes the physical implementation of the cryptosystem and the human is part of the physical implementation.

So ultimately my question:
Can rubberhose cryptanalysis formally be considered a sidechannel?

The definition of sidechannel quoted in this context:

  In cryptography, a side-channel attack is any attack based on
  information gained from the physical implementation of a cryptosystem,
  rather than brute force or theoretical weaknesses in the algorithms
  (compare cryptanalysis).

I've also seen Wikipedia:

  Attempts to break a cryptosystem by deceiving or coercing people with
  legitimate access are not typically called side-channel attacks

But I'm asking if it is allowed by the definition of sidechannel attacks to include rubberhose cryptanalysis.


texts: Get $a$ such that quadratic residue has a solution (Rabin)

texts:
My task is to implement Rabin signature. I have trouble with choosing padding a such that
$$x^2 \equiv a \pmod n$$
has a solution.

In that context, $n=p\cdot q$ is composite, where $p$ and $q$ are prime numbers with $p\equiv3\pmod 4$ and $q\equiv3\pmod 4$.

How do I check if a solution exists?
Is there any formal way to find $a$?


texts:
We want to migrate our userbase from bcrypt to argon2.

I was planning on an approach that migrates all hashes immediately to argon2; "old" users would have an argon2'd hash of their bcrypt hash of their password.  New users (and users that logged in) would get updated so their argon2 hash of their password was what was saved.

My problem is: to compare hashes in the legacy case, I have to be able to generate a bcrypt hash first then an argon2 hash.  But the bcrypt hash comparison requires information from the password hash itself (salt etc.) to generate a matching value (which can then be hashed with argon2).

If I want to use this approach, do I have any option other than extracting and storing the bcrypt salt somewhere outside the password field?


texts: In RSA, why does Alice's $N$ need to be relatively prime to Bob's $N$?

texts: I was asked this by my professor and I didn't understand the reasoning behind it. If Alice has a the key pair $(p_a, n_a)$ and Bob has the key pair $(p_b, n_b)$, why do $n_a$ and $n_b$ have to be relatively prime?


texts: Stateless and deterministic number generation

texts:
I want a stateless deterministic pseudorandom generator.

Following number generation is deterministic, whenever I give $constantValue$, and index it will value $A$

$A  = Hash(constantValue + index)$

$index$ ranges from $0$ to infinity.

It is a deterministic value generation, but I have to keep state (index) to avoid generation of one value more than once.

My question is how can I make it stateless ( I do not have to keep a right index to avoid generation of one value more than once.)

I want to avoid generating one number (A) more than once I have to keep right index (state).

At the same time, I want value generation to be deterministic.

State here can be considered as---Merkle Signature scheme is stateful signature scheme, but SPHINCS is a stateless signature scheme.

Note that hash and a constant value is mandatory to be part of a pseudorandom generation.


texts: Why do cryptographers need loads of true random numbers?

texts:
I've just read an answer to fastest-random-number-generator.  The answer is a couple of years old, but mentions a true random number generator capable of running at 300 gigabits per second.  It is re-linked here.  They might go even faster now. .

One time pads are out of favour.  There's no point storing these numbers for reruns as you might as well use a psuedo random number generator.  Most pundits on this forum suggest a maximum of 128 bits of true entropy for seeding.  So why would cryptographers need so many true random numbers? Or is it just a *issing contest between researchers?


texts: Deriving a key from a pseudo-random string

texts:
I would like to know if deriving a key from a pseudo-random string with a single iteration is secure.

Concretely, I am designing a system where a secret key is derived in the client side, and then sent to the server for authentication. The steps are as follows:

User enters email and password
Derive k0 <- pbkdf2(password: password, salt: email, alg: 'sha256', iteration: 10000)
Derive k1 <- pbkdf2(password: k0, salt: password, alg: 'sha256', iteration: 1)
Send to server: (email, k1)
Server derives pbkdf2(password: k1, salt: somerandomstring, alg: 'sha256', iteration: 20000) and compares it with the hash in the database

k0 is the 256-bit secret key. The client uses it to encrypt things using a block cipher. The client needs to send something to the server for authentication purposes. But the server should not know the client's secret key. My idea is that step 3 prevents the server from knowing the client's secret key.

But I am wondering if 1 iteration of pbkdf2 is enough. I think it is sufficient because k0 is pseudo-random, and the attacker shouldn't be able to figure it out from k1. (Exhaustive search takes 2^256 steps). Is this correct?

EDIT

For clarification, here is my design so far:

## Register

Client
* User enters email and password
* Derive k0 <- pbkdf2(password: password, salt: email, alg: 'sha256', iteration: 10000)
* Derive k1 <- pbkdf2(password: k0, salt: password, alg: 'sha256', iteration: 1)
* POST to '/register': (email, k1, kdf, kdf_iteration)

Server
* Generate salt <- 256bit random string
* Derive k2 <- pbkdf2(password: k1, salt: salt, alg: 'sha256', iteration: 20000)
* Create a user with (hashed_password, salt) = (k2, salt)
* Login the user and reply with a session key

## Login

Client
* User enters email and password
* GET '/prelogin': (kdf, kdf_iteration)
* Derive k0 <- pbkdf2(password: password, salt: email, alg: 'sha256', iteration: 10000)
* Derive k1 <- pbkdf2(password: k0, salt: password, alg: 'sha256', iteration: 1)
* POST to '/login': (email, k1)

Server
* Look up user (hashed_password, salt)
* Derive k2 <- pbkdf2(password: k1, salt: salt, alg: 'sha256', iteration: 20000)
* Check k2 == hashed_password, and reply with a session token

EDIT2

Clarification on what this is for:

This is to add end-to-end encryption for an open source note taking app (https://github.com/dnote/cli).

Basically, the client can sync the data with the server. Before leaving the client, all data is encrypted using k0 which server does not know.

The server should have no idea about how to decrypt the data, so I decided to derive k1 from k0 to send to the server rather than sending k0 directly to the server.


texts:
When I run

openssl cms -encrypt -aes256 -in sample.der -out wrapped.der -outform DER -recip ecc.crt -keyopt ecdh_kdf_md:sha512

the part of the CMS output which is supposed to have the 256 bit CEK encrypted under the KEK shows to be 40 bytes:

316:d=7  hl=2 l=  40 prim:        OCTET STRING      [HEX DUMP]:FDC50AE5E72BC6D856D9682ACA5B4C2BD23F6B8A35F2E03417E0FE32062B810D3E4DF0048D1C0E2F

I was expecting this to be 48 bytes (32 byte encrypted output + 16 byte padding). It appears the KEK generated from the ECDH operation is not AES256.

What is the key type of the KEK and algorithm used to encrypt the CEK?

This is the complete CMS message:

0:d=0  hl=4 l= 724 cons: SEQUENCE
4:d=1  hl=2 l=   9 prim:  OBJECT            :pkcs7-envelopedData
15:d=1  hl=4 l= 709 cons:  cont [ 0 ]
19:d=2  hl=4 l= 705 cons:   SEQUENCE
23:d=3  hl=2 l=   1 prim:    INTEGER           :02
26:d=3  hl=4 l= 328 cons:    SET
30:d=4  hl=4 l= 324 cons:     cont [ 1 ]
34:d=5  hl=2 l=   1 prim:      INTEGER           :03
37:d=5  hl=3 l= 151 cons:      cont [ 0 ]
40:d=6  hl=3 l= 148 cons:       cont [ 1 ]
43:d=7  hl=2 l=   9 cons:        SEQUENCE
45:d=8  hl=2 l=   7 prim:         OBJECT            :id-ecPublicKey
54:d=7  hl=3 l= 134 prim:        BIT STRING
191:d=5  hl=2 l=  23 cons:      SEQUENCE
193:d=6  hl=2 l=   6 prim:       OBJECT            :dhSinglePass-stdDH-sha512kdf-scheme
201:d=6  hl=2 l=  13 cons:       SEQUENCE
203:d=7  hl=2 l=   9 prim:        OBJECT            :id-aes256-wrap
214:d=7  hl=2 l=   0 prim:        NULL
216:d=5  hl=3 l= 139 cons:      SEQUENCE
219:d=6  hl=3 l= 136 cons:       SEQUENCE
222:d=7  hl=2 l=  92 cons:        SEQUENCE
224:d=8  hl=2 l=  82 cons:         SEQUENCE
226:d=9  hl=2 l=  41 cons:          SET
228:d=10 hl=2 l=  16 cons:           SEQUENCE
230:d=11 hl=2 l=   3 prim:            OBJECT            :organizationName
235:d=11 hl=2 l=   9 prim:            PRINTABLESTRING   :Widgits Inc
246:d=10 hl=2 l=  21 cons:           SEQUENCE
248:d=11 hl=2 l=   3 prim:            OBJECT            :organizationalUnitName
253:d=11 hl=2 l=  14 prim:            PRINTABLESTRING   :SUB-CA ENC
269:d=9  hl=2 l=  37 cons:          SET
271:d=10 hl=2 l=  16 cons:           SEQUENCE
273:d=11 hl=2 l=   3 prim:            OBJECT            :x500UniqueIdentifier
278:d=11 hl=2 l=   9 prim:            BIT STRING
289:d=10 hl=2 l=  17 cons:           SEQUENCE
291:d=11 hl=2 l=   3 prim:            OBJECT            :commonName
296:d=11 hl=2 l=  10 prim:            PRINTABLESTRING   :ENC CA
308:d=8  hl=2 l=   6 prim:         INTEGER           :333230303032
316:d=7  hl=2 l=  40 prim:        OCTET STRING      [HEX DUMP]:FDC50AE5E72BC6D856D9682ACA5B4C2BD23F6B8A35F2E03417E0FE32062B810D3E4DF0048D1C0E2F
358:d=3  hl=4 l= 366 cons:    SEQUENCE
362:d=4  hl=2 l=   9 prim:     OBJECT            :pkcs7-data
373:d=4  hl=2 l=  29 cons:     SEQUENCE
375:d=5  hl=2 l=   9 prim:      OBJECT            :aes-256-cbc
386:d=5  hl=2 l=  16 prim:      OCTET STRING      [HEX DUMP]:1DD39A70A664EDA8B78EAE1A79D8ECDF


texts: Consequence of a change on the Guillou-Quisquater Protocol

texts:
In the Guillou-Quisquater Protocol, the prover convinces the verifier that he knows an $e$-th root of an element $y \in \mathbb{Z}^*_n$ ($p, q, e$ are primes, $n = pq$ and $e$ is coprime with $\varphi(n)$). The protocol between prover $P$ and verifier $V$ (see here for instance) is:

$P$ picks $r$ at random in $\mathbb{Z}^*_n$ and sends $a = r^e \mod n$ to $V$.
$V$ picks $c$ at random in $\mathbb{Z}_e$ and sends it to $P$.
$P$ computes $z = a x^c$ and sends it to $V$.
$V$ accepts iff $z^e = a y^c$.

What happens if $e$ divides $\varphi(n)$ and the protocol still succeeds (i.e. $V$ has received an $a$, sent back $c$, and get $z$ s.t. $z^e = a y^c$)? I don't think it still proves that $P$ knows an $e$-th root of $y$... It is even possible that $y$ doesn't have any $e$-th root (since $e$ and $\varphi(n)$ aren't coprime). But does it proves something (new) about $y$?


texts: Brute-forcing a PGPDisk (.PGD) encrypted file

texts:
I have some ~20 year old PGPDisk (.PGD) files for which I have long since lost the keys and/or passwords. I've written some GPU accelerated brute-forcing for OpenOffice / PBKDF2 in the past, so I thought it would be fun to try to see if I can get into these .PGD files.
So I'm looking for low level details on the encryption scheme and filesystem structure. These files are the size of CD-ROM images (681,581,056 bytes), and have a CD-ROM-like structure. The plan would be to run the search on a set of Linux machines with high end GPUs and, if the password is found, spin up some old version of Windows with the PGP software and do the actual decryption there.
Any thoughts and pointers?


texts: Determining nonce between unsynced systems

texts:
It's my first venture into cryptography, and I'm struggling with how to use a nonce in an encryption standard between two digital radios.

The two radios support AES encryption, only requiring a 128-bit key and a nonce for the encryption/decryption of each packet. To my understanding, the key should be the same for either radio, all the time. The nonce however needs to change with every packet sent/received. My question is: how will the two radios agree on a continuously changing nonce for any given transmission/reception? Example: when Radio A picks its nonce to encrypt its message, how should Radio B know which nonce to use to decrypt the message?

The radios may not necessarily be synced in time so that can't be used. Is there any way to do this without using time as the nonce? Does the nonce need to be agreed upon ahead of time in an un-encrypted exchange?

Any guidance on this is appreciated.