texts:
I have a block of data crypted using twofish with a key of 128 bit.

The data must be accessed from a GUI, the user gives the key, the block is decoded and the real data is accessed.

Problem is that I need to be sure that the key is correct before trying to decode the block.

My current solution is to have a file (say chk.blk) that is the encryption of some data I can use to test the correcteness of the key.

Initially I had a file chk.blk being the encryption of a known data (say the text 12345678) then I thought that this could compromise the key. Is that true? Is there any weakness in twofish if the attacker has both the original and the encrypted data?

Fearing this could be the case, I now generate a random text with a given property (e.g. x...x..x where . is any character different from x). I take the key, decode chk.blk and verify the result has the desired property.  The idea is that now the attacker does not have a known text to use but a rather large group of them. Of course I can't be sure that the key is really correct, the user might have taken, by chance, a key that produces a decoded text which have exactly the desired property, but I think the probability is extremely low.  Do you think there any issue with this approach?

Any suggestion?

Usage scenario

I'm adding some more info here to clarify the intended usage.

Imagine you have a rather big set of documents (5Mb of data) that must be sent to a large number of recipients (say 10.000). Those documents have to be kept absolutely secret until a given date/time (say 21 Dec 2012 21:12).

Between now and then all the reciepients will be able to download the documents along with a decryption program on their PC. They will reach their designated destination and will wait there to receive the decoding key at the proper time.

Exact syncronization is not important but they all have to read the documents at (almost) the same time.

It is absolutely mandatory that none of them can read the documents before the given date.

They will be located in places where they might not be connected to the internet, that's why they have to download the docuemnts beforehand.

They will all, however, be able to receive a message with the key (e.g. via SMS, via phone, broadcasted by a TV channel or a radio number station, ...).

So, the idea is to distribute the documents encripted with 128 bits of security, which should be enough to protect the key for few months, and then distribute the key as a string (26 characters).


texts: Difference between secure function evaluation and private function evaluation?

texts:
Yao's garbled circuit is used to compute multiparty computation. I know that secure function evaluation is used to hide users input and circuit from each other.

Can any body tell me what is private function evaluation? and how is it different from secure function evaluation?


texts: Random Access vs. Parallelism modes of operation

texts:
I am trying to understand some concepts regarding Random Read Access and Parallelism in mode of operations. I have written below what my concepts are regarding the two. If you can please correct where i am wrong, that would be great:

What is the difference between random read access and parallelism?

Ans: Random read refers to reading (decrypting) any nth block of data without calculating the previous n-1 blocks while parallelism is reading all or writing (encrypting) multiple blocks at the same time. Is that correct?
Random read access for decryption in general is good or bad?

Ans: It just adds convenience for the users at both ends.
Has random read access got any security implications if its possible in a particular mode of operation. For instance, CBC that allows random read access. Is it easier for an attacker to read any specific block he wants? Or it doesnt matter because the attacker can decrypt all or one block he/she wants.

I am not sure about this one


texts:
It is recommended to use different keys for different purposes, such as encryption and integrity protection. As I see it, AES-GCM only requires one key as input. Two different keys are then generated from the provided key, basically meaning that one key is used for two different purposes! Should one, not, consider using the traditional encrypt then HMAC instead? This would ensure that, under the assumption that the implementation does not simply use a single key, unrelated keys are used for different purposes.

My question is, therefore, why is AES-GCM so widely accepted? In what circumstances should one consider using EAS-GCM instead of the traditional encrypt then HMAC?


texts: what kind of hash function can provide a short hash and be collision resistant?

texts:
When you try to connect via SSH, you see a signature which is short but I heard it is even stronger than sha256. It is perhaps stronger because it uses more rounds. Is there a hash function or a method on current hash functions that use more rounds or something like that to somehow prevent collision attacks and provide a very strong hash that is not crackable, however with a hash value that is short enough to be easily read? I ask because a 32 or 64 character hash is too long and people don't like to read and compare something like that, for example when we put hash value of our software to download ...

if such a thing exists, please provide a javascript implimentation of it


texts: Why not generate the authentication key from the key and nonce in GCM?

texts: In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $H$ as $H$ is derived only from $K$. So, why not derive $H$ from $K$ and $N$ (the nonce).


texts: Is there something wrong with my decryption using key=9, mod 26?

texts:
I am new to cryptography and have started looking at some basic encryption. I have the following question to answer:

Decrypt the the following encrypted quotation using key = 9, mod 26:

fqjcb rwjwj vnjax bnkhj whxcq nawjv nfxdu mbvnu ujbbf nnc

So far I have decrypted the message to the following:

Whats in a name arose by any other name would smell as sweet

However, this doesn't seem to make sense as a complete decrypted message - have I done something wrong in my decryption or is my answer correct?


texts: How to save the data in a non-trustworthy db, so the next time I read from the db, I know that I've read actual and not an old version of the data?

texts:
Assume I encrypt a message, A1, and save it. Later I replace the message A1 with a new message, A2. I do not trust the message storage.
Now I want to read the last message. How can I verify that I've read the last message? An attacker can substitute the message A2 with A1 and I will not notice that.

The first idea is to memorize the last message. This will work with last message, but how can I verify that I have all my messages in the database? I think I can save a signed list of message signatures together with the date of last modification of the database. This way I only need to memorize the last database edit date. Will call this the control message.
I also need to make sure that there was no substitution while I compose the control message.

How is this done usually?

What I need, is a secure counter. A counter with properties:

it is stored in an insecure database
can't be replaced by an older version without knowing the key
it only supports increment/decrement operations
if possible, two users, at the same time, should be able to increment the counter (concurrency) without side effects
the counter can fail with some probability. Instead of N, it can be sometimes set to N-1. I do not want an attacker to set the counter.


texts: Deciding on an AES cipher mode for chunked data

texts:
I'm trying to decide on which ciphermode to use for a programming excercise. I have a file that I need to encrypt without saving unencrypted data to storage and without storing the entire file in memory.

I've opted for streaming the file, in a fixed size into a buffer, encrypting said buffer, write said buffer to storage and clear the buffer before doing it all again with the next slice of data.

Once the encrypted chunks had been written to storage, they could be consolidated into a single file, which would have to be split into chunks again for decryption.

The above seems like a standard way of doing it, from what I could gather, but I'm not entirely sure as to which ciphermode to use.

I was wondering which of AES-GCM and AES-CBC would be best to use?

Ideally I'd like to choose a solution that is "encrypt-then-mac", but I'm unsure which of those fit the bill here?

The programming language I'm doing this in is Golang, if that matters to anyone.


texts: How can i predict the next number of a long sequence of seemingly random numbers?

texts:
How can I accurately predict the next random number between 1 and 999, given past results. I have no knowledge of the PRNG or algorithm used.

How can I predict the next number of a long sequence of seemingly random numbers? Can I do it by hand, or should I use some kind of software to help find patterns from long strings of data?


texts: Commitment schemes for arbitrarily large integers

texts:
My question is about commitment schemes for arbitrarily large integers. One scheme I know uses groups of unknown order (RSA or class group) and depends on the strong-RSA assumption.
You chose a random element $g$ in a group $\mathbb{G}$ of unknown order and define the commitment $Com(n):= g^n$ for any integer $n$. You can turn this into a hiding commitment by choosing an element $h\in \mathbb{G}$ such that the discrete log between $g$, $h$ is unknown and defining the Pedersen commitment $PedCom(n,r):= g^nh^r$ for a randomly chosen secret integer $r$.
Are there other commitment schemes for arbitrarily large integers?
One could decompose the integer and use a polynomial commitment of some sort that does not need hidden order groups, but I suspect such a scheme would not allow for efficient protocols to prove relations between the committed integers.


texts: Is it theoretically possible to construct a string that contains its own hash value?

texts:
After saw the xkcd comic Self-Description, I wonder if it is theoretically possible to construct a self-descriptive string that contains its own hash value?

Let's say the string's MD5 value is 663ef7d3f38cf900574cd4d9f83eb1b7, the string would be something like:

...
The md5sum value of this file is 663ef7d3f38cf900574cd4d9f83eb1b7
...


texts: "Jitterentropy" vs CPU RDRAND in VeraCrypt 1.24

texts:
Veracrypt 1.24 just came out.  It uses a true random number generator based on hardware events; namely, on CPU timing jitter, or "Jitterentropy".

As an alternative to CPU RDRAND, I am a bit jittery about "Jitterentropy" in Veracrypt 1.24, and would like to hear some expert advice. The paper I just cited, by Stephan Müller, is very detailed.

Is Jittentropy a reliable cryptographic alternative to RDRAND in Veracrypt 1.24?


texts: Practical implementations of Multiparty computations

texts: Are there any practical implementations and or software platforms to prototype applications based on MPC ?


texts: One Time Pad Low Bandwidth Doubt from the book

texts:
Following is a sentence from the book "Cryptography and Network Security - Principle and Practices" by William Stallings [Fourth Edition]
Sentence -
"
... the 'one-time pad' is of limited utility, and is useful primarily for low bandwidth channels requiring very high security.
"
Can anyone please elaborate on low bandwidth , because I thing low bandwidth will make transfer of the key and ciphertext slower instead they should use high bandwidth isn't?
Book Link - http://uru.ac.in/uruonlinelibrary/Cyber_Security/Cryptography_and_Network_Security.pdf
Page Number - 79/983


texts:
I'm in the need of an inverse public-key encryption method where you encrypt with the private key and decrypt with the public key. In other words an asymetric encryption where you can't generate the encryption key from the decryption key. Does such encryption exist? If yes which, and which would be the fastest?

If nothing like that exists I would be glad if you helped me out with my situation:

I need to authenticate users logging in from my Java application in the way that the response from the server cannot be falsified and thus giving the user full access to the application. Using public key encryption was an obvious method, I would decrypt data received from the client to confirm the credentials. This won't work because if someone manages to decompile and get the private key from the code, they would be able to generate the public key, which would make them able to crack my application again.
So any ideas how I can get this secure?


texts:
Imagine a hypothetical system as follows:

A distributed algorithm running on a Local Area Network (LAN) that allows real-time addition and removal of processors.
The addition of a processor is considered trustless until proven otherwise (guilty until proven innocent).
Each processor in the system is given some process instructions, and a data stream to run said process instructions on over time.
An intruder (Eve) can add or remove hardware at any point, listen into any communications link between processors, and modify any signals coming from a compromised processor.

How to protect the system from Eve, without sacrificing too much computational power?

The biggest mystery to me is the hot-swappable processors, as communications between processors can be safeguarded with a myriad of well-known standard encryption methods. However, the security issue seems to go right down to "don't even let the processor know what its processing". Is there a way of encrypting both the process instructions and the data, whilst being able to perform useful computation still? If so, what are such processes called? Where can I learn more about them? Thanks in advance.

- EDIT - In the interest of clarity:

A process instruction is what is performed on a processor.
The task to be completed is a distributed algorithm. Aka, it is to be performed across multiple processors (all processors + LAN collectively), but those processors should not know what it is that they are trying to do so as to prevent Eve from knowing.
Processors are trusted to execute instructions given. However, it is assumed that Eve can replace the processor with one that leaks information regarding both data and process instructions.
Validation of process instructions received by a processor can occur. However, Eve can replace unprotected code without issue, so such validations may be skipped under such circumstances.

EDIT 2 - Answering fgrieu's questions:

A) The question's title asks if one can "encrypt a process" when the (updated) question does not define a process per se.

The "encrypt a process" is a sort of tl;dr of the question, summarising to the core aspect of the problem from my perspective.

B) "Process instructions" is defined as "what is performed on a processor"; is that a processor's instructions, data, or both?

Both a processor's instructions and the data being processed.

C) What should encryption protect: the processor's instructions, or/and some other data?

Both a processor's instructions and the data being processed.

D) In academic cryptography, encryption aims at confidentiality only; is integrity immaterial? More generally, what are Eve's goals?

Eve's primary goal is to determine the processor instructions (of which the data can be used to infer these instructions as well).
Eve's secondary goal is manipulate the program to perform self-destructive tasks.

E) Are processors trusted to hold a secret (key, or data they manipulate) and only use it per instructions they execute?

No. If a processor has been compromised, then it is expected that any and all information that processor receives and computes will be passed to Eve.
If both data and processor instructions are securely encrypted, then processors can be trusted due to an inability to decrypt said information.

F) Are processors trusted to not execute instructions given by Eve (perhaps, by checking a digital signature of instructions given to them before executing these?), in particular instructions that make use of a secret/private key they hold?

No. Any compromised processor is assumed to perform any function Eve has installed on them.


texts: Comparing Shanks' Algorithm to Brute Force

texts: I'm trying to understand how/why Shanks' algorithm solves the discrete log problem $y=g^x \bmod p$ faster than a brute force search does. Any explanation would be great.


texts: ElGamal malleability for a given function f(m)

texts: Given the function $f(m)=m^3$, where $m$ is a plaintext message, what is a function for which ElGamal would be malleable to produce $f(m)$. I know for $t * c_2$ that this would yield $t * m $ but I haven't been able to figure out how it works with powers of $m$.


texts: CCA security of a system that splits messages and encrypts each packet

texts:
Propose a symmetric key based crypto-system for implementing a secure email system. This system is based on AES and CCA secure.

Suppose that you have to encrypt a large message and that this message is split
in several small packets and the crypto-system I mentioned before is used to encrypt each one of the packets before transmission. Suppose the packets have different lengths. Is this system still CCA secure?


texts: Definition and meaning of "semantic security"

texts:
I'm taking a Coursera cryptography course. The definition of semantic security is hard to understand. I tried to restate it with some slight changes (the word "efficient" was in the original definition). Have I gotten it right?

  The adversary chooses two messages: $m_0, m_1$.
  We encrypt one of these messages: $c \leftarrow E(k, m_b)$.
  The adversary has to guess which message was ciphered.

  There are two events: $M_b = \{ \ \text{adversary $A$ decides that $m_b$ is ciphered} \ \}$.

  $E$ is semantically secure if for all "efficient" adversaries $A$
  advantage $\operatorname{Adv}[A, E] = \big| \ \Pr(M_0) \ - \ \Pr(M_1) \ \big|$ is negligible.

This means the adversary can't tell which of the two messages is ciphered.

What if it could? What does this definition mean in practice?

Update: in the original definition (which is given on a diagram and wasn't stated clearly) there is a concept of two experiments, $exp(b)=1$ when the adversary decides $m_b$ is ciphered. And events are: $M_b = \{ \ \text{$exp(b) = 1$} \ \}$. I don't get this part of definition.


texts:
Forward secrecy with RSA is asked here:

Is perfect-forward secrecy achieved with RSA? and fgrieu gave an answer based on creating temporary RSA keys and signing them. And, in the end, he mentions

  The scheme is inefficient because the generation of a new RSA key pair is relatively expensive (and normally rare, thus not optimized for speed)

I will describe a two-pass mechanism; Send a message and receive, done.

As usual, we have Alice with $(pub_A,prv_A)$ public-private keys and Bob with $(pub_B,prv_B)$ public-private keys with modulus $n_A$ and $n_B$, respectively. They know the public-keys.

Let $n = \text{min}\{n_a,n_b\}$

Alice chooses a random number $x$ and $1<x< n$.
Alice encrypt this with Bob's public key $c_1 = E(x,pub_B)$ and sends to Bob.
Bob receives $c_1$ and decrypts $x= D(c_1,prv_B)$ to get $x$
Bob chooses a random number $y$ and $1<y< n$
Bob encrypt this with Alice's public key $c_2 = E(y,pub_A)$ and sends to Alice.
Alice receives $c_2$ and decrypts $y= D(c_2,prv_A)$ to get $y$
Finally, Alice and Bob use a KDF to derive the ephemeral key, $K_{ep} = KDF(x\mathbin\| y)$ .

It is clear that this doesn't provide integrity. Apart from this

Is there any security failure? If so, how can we improve it?
Is there any similar work before?


texts:
I'm working on a little python script that reads in two fairly similar English sentences (they're in text files - reading them in) and I'm trying to force a SHA1 partial collision (e.g. first 32 bits of each hash are equivalent).

Currently, my logic of thinking is as follows:

Concatenate empty space to the end of string 1.
Hash string 1.
Concatenate empty space to the end of string 2.
Hash string 2.
Check if hash_of_string_01[:32] exists in the dict, if not, move on - else exit program.
Check if hash_of_string_02[:32] exists in the dict, if not, move on - else exit program.
Add both new hashes to the dict.
Loop...

However, this isn't anywhere near efficient, nor entirely correct. I'm trying to wrap my head around how I can approach this solution...

Any guidance you can provide me would be valuable! Thank you. :)


texts: Why are password database breaches bad if cryptographic hashes can't be reversed?

texts: If companies such as Facebook store our passwords as hashes, when they are leaked how can this be a threat to the users? I thought of it because nowadays we do not have computational power to break those hashes, so how can a criminal use those hashes against the users?


texts:
Suppose we have $n$ bits, so we can have $2^n$ different bit sequences. Some sequences don't look random, say, all $1$ or $0$. There are also other patterns like $10101010…$, $11001100…$ and such.

I'm not certain but aren't there ways to evaluate a given sequence as random with some given satisfied error? Given $n$ bits, how many "truly random" sequences/numbers can be constructed?

Update: The main question is we have $n$ events (coin flips). $n$ considered to be big enough. Now we want to know are those events random or not and we apply NIST suite for this.

As $n$ events cant be represented as $2^n$ number, we can have a function
$F(n)$, which gives 0 if NIST suite for given bit sequence represented by $n$ fails to satisfy and gives 1 if $n$ looks like random.

Question is what is sum $F(n)$ over all $n$? Approximately, for sure. And yes, NIST is just an example. Take any test which can by applied for given bit sequence.


texts:
I'm studying quantum cryptography and my question is "simple":
Is the use of entangled states, like in the Ekert91 protocol, more secure than using not-entangled states like the BB84's ones?

Is easier to detect eavesdropping in Ekert91?


texts: What are the implications of quantum collision search algorithms like Ambainis for collision-resistant hash functions?

texts:
I just stumbled onto a series of 2017 papers about applying the Ambainis quantum collision-finding algorithm to hash functions. (disclaimer: I haven't read all of them in full yet):

Post-quantum security of the sponge construction
Quantum Collision-Finding in Non-Uniform Random Functions
An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography

From the latter:

  From similar techniques [to Grover's], quantum collision search is known to attain
  $O(2^{n/3})$ query complexity, compared to the classical $O(2^{n/2})$. ... Our algorithm is the first to propose a time complexity that improves upon $O(2^{n/2})$, in a simple setting with a single processor.

My questions: can someone who's been following this research discuss:

Implications of this for security practitioners ... will we need to triple hash lengths instead of doubling them?
Is this family of quantum collision-finding attacks only effective against the sponge construction and SHA-3, or does it apply to hash functions more broadly?

Related questions that were asked and answered prior to these 2017 papers:

[2014] Space complexity of quantum collision search?
[2011] What security do Cryptographic Sponges offer against generic quantum attacks?


texts: Given a 'good' basis for a lattice, how can we solve the CVP?

texts: I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an algorithm. Can anyone briefly describe an algorithm for doing this?


texts: Could a collection of data be engineered to encrypt predictably using standard encryption algorithms?

texts:
Thinking about the rather new problem of Cryptolocker and other crypto-randomware, huge amounts of damage are being caused by malicious actors simply using modern encryption algorithms to encrypt a drive. But this presents an interesting question, and the hint of a possible solution:

Could a collection of data be engineered such that when it is encrypted using a given encryption algorithm, say RSA, patterns in the encryption reveal details that could be used to discover the keys, or at least greatly narrow the search space?


texts: What is the relation between the existence of a cryptographic hash function and the existence of a PRG?

texts: Does the existence of a PRF/PRG/one way function imply the existence of a hash function? I did not find a proof of the existence of a cryptographic hash function, so I want to know whether it is based the same axiom (the PRG axiom)?


texts:
If I have a message m and want its HMAC, I can simply do HMAC(k, m). But sometimes I am not given m but the hash of m: H(m). If I do HMAC(k, H(m)) instead of HMAC(k, m), does this make it more or less secure?

HMAC hashes m when it is longer than block size. So I guess this question is only meaningful when m is equal or shorter than block size.

We can assume the hash function on m is the same one used in HMAC.


texts:
I am trying to understand this concept of Learning With Errors. There does not seem to be a layman explanation of it anywhere. Here I describe layman as someone who understands ML concepts a bit (non expert).

Can someone explain that a bit please? The wiki page refers to Parity Learning which also is not explained anywhere.

I am trying to read up on homomorphic encryption and I am stuck here.


texts:
I want to see gpg2 key parameters packets. pgpdump v0.32 doesn't support gpg2 (especially elliptic curve cryptography packets) and "gpg2 --list-packets" doesn't show "secret" key parameters.

Is there any way to see (secret) key parameters (d, q and curve) of elliptic curve crypto algorithms in gpg2 exported secret subkeys?

Note: I read OpenPGP Public-Key algorithm but this is not my answer.


texts: Security of one-time-pad without $\bmod $ operation?

texts:
Assume $r_1,r_2$ are used only once, and picked uniformly at random (each time we want to mask a value) from finite field $\mathbb{F}_p$, where $p$ is a large prime number. Assume $r_i\neq0$ and $b$ is a (non-zero) fixed element of the field. Let $(r_i)^{-1}$ be multiplicative inverse of $r_i$.

Imaging there is a client  $B$ and a server.
The server does  some homomorphic operation on an encrypted value and then provides $c=E_{pk_{B}}(r_1\cdot b)$ to client $B$. Where the cipchertext space is much larger than $p$.

So the plaintext may overflows in field $\mathbb{F}_p$, in other words  $r_1\cdot b$  may not be in the field $\mathbb{F}_p$. Therefore, there is a rick that client $B$ after decrypting learns something about $b$. So we want to force client $B$, after decrypting the message performs $\bmod p$.

To this end, we compute $c'=E_{pk_{B}}(r_1\cdot b \cdot r_2\cdot (r_2)^{-1})$.

Question 1: Given $c'$, can client $B$ learn anything about $b$ after decrypting the ciphertext before it performs $\bmod p$ operation?

Simpler version: Given $r_1\cdot b \cdot r_2\cdot (r_2)^{-1}$ without involving $\bmod p$ operation can a semi-honest party learn anything about $b$ ?


texts: Is the logic for how the enigma machine worked documented somewhere?

texts:
I know that there is a formula to calculate the result of any input but is the logic of how the machine actually worked documented?

I have seen schematics for the circuitry and even a how to make your own at home site.  But has the logic been broken down?  Is there source for a virtua Enigma Machine that works by replicating the logic of the machine instead of just using the math?


texts:
In one of my recent research, I need to compare the number of gates needed in Ring-LWE encryption to AES in the circuit model. For AES we can find some estimation like this site, but for Ring-LWE we can't find such an estimation.

Could anyone give me an estimation?
Is it safe to say the gate count for AES encryption is <1% of Ring-LWE under the same security parameters?

Thanks!


texts: Randomness in generation of Virtual Machines from pre-built Image

texts:
I am studying Multi-Tenancy vs. Virtualization, and I got thinking about randomness, true randomness, virtualization etc, and I couldn't find anything on it.

From what I gather, /dev/urandom is just as good as /dev/random and you should use it instead, BUT... it doesn't bloc if you "don't have enough entropy"... That has been extensively discussing before and there is a consensus that /dev/urandom is more than enough for everyday usage.

But if I am creating virtual machines on-demand from a single image, with the whole deploy process automated (Thus replicating all the steps and possibly durations for each step), won't this mean very little entropy...?

I read about seeding VMs to get more entropy, but is that approach feasible, has it been done, is there some/any consensus on this?

This is a conceptual question, I have no specific implementation I'm working with, I  just want an outline about this possible issue where lack of randomness can possibly be seen in everyday usage (Or if I am mistaken, which is very possible), and if there is consensus how one should approach this possible scenario.

I'm trying to imagine something uses VMs based on a single image, and it gets so big that it becomes "rewarding" to build something akin to a "rainbow table", in the sense of using this "not-so-random" starting pool that is the same for all VMs to find out any and all possible encryption keys/hashes/etc used for securing said installation, thus being able to break into a system, provided the attacker had access to the algorithm and images used to generate the system, and that he has access to the result of said encryption.

If an attack like that is even possible, what would be risk level of that? Would it be better to re-hash everything or something after gathering enough entropy on the new VM, possibly by using something like /dev/random, or even then it is a bad choice...? What about seeding this machine with entropy...?

How should one approach this problem, if it is indeed a problem?


texts: How can we effectively compute the sqrt of some element in the group?

texts:
I only know one way, if this group is a cyclic group, and we know the element can be expressed in $g^m$, then $g^{(m/2)}$ is the answer.

Another question, if $m$ is an odd number, can we be sure there is no answer?
Is it possible to find another generator $g_1$ and an even number $k$ that satisfy the element = $g_1^k$?

If we don't know whether or not the group is cyclic group, the complexity to find the sqrt or to confirm such an answer not exists is as difficult as DLP ?


texts: Which one of the Block Cipher modes is the best?

texts:
I have two questions regarding the Block Cipher Modes:

Which one of the modes is considered the best?
I know CBC has a problem of IV since the next block of the plain text is XORed with the result of cipher text of the last block and the same with OFB. Is CTR the best one or not?
In "SSL with blockciphers in CBC-mode", does TLS 1.2 use CBC or is there any other modes that is used with TLS 1.2 (SSL 3.0)?


texts: I have been reading about SHA-2 family and I found a lot of in depth details, but I am confused about how it is related to TLS and AES. TLS encrypts data between server and client, but does it make use of SHA and for what, like what kind of data?


texts: Unpredictability of X.509 serial numbers

texts:
About X.509 certificates serial numbers the RFC 5280 says:

  The serial number MUST be a positive integer assigned by the CA to each certificate.  It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate).  CAs MUST force the serialNumber to be a non-negative integer.

There is no mention of the security concerns with the serial number generation. What are the good practices? Is there any security issues with predictable (for instance sequential or based on the certificate generation date) serial numbers?


texts: Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

texts:
Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does not.

Can an attacker determine some private information when curve points are sent to unsuspecting users which don't lie on the curve?

If either ElGamal encryption or ElGamal signature are vulnerable, is there an obvious property that can be checked to see if another protocol is vulnerable?

Let's assume that the curve parameters are pre-shared and the system is set up.


texts: Is a using salt important when creating a hash data validator?

texts:
I am creating a service that will return an set of objects, which will be used by multiple systems.  At the end of the process, one (or more) of the objects will be sent back to our system for association.

My service basically checks our system and gets valid solutions.  I want to create a hash to validate that the object returned to us has not had certain values altered from the solution object we gave out, and to make certain that the solution being presented originated from our original service.

The source value that will be hashed will already be at least 80 bytes long.  Is there any real value in adding a salt to that value prior to hashing?


texts: Is it usual for a signed message to contain the public key of the signer?

texts:
In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer?

If not, how do recipients know that the message has been signed by the correct private key, and how do they know which public key to use to verify the signature?


texts: What makes the Discrete Logarithm Problem hard?

texts:
I am missing a crucial piece of the maths behind the DLP, and I'm hoping someone can give me a really dumbed down answer..

If  $h=g^x \bmod p$  and we're working in the group $Z^*_p$, why can I not find $x$ in linear time given I have $h, g, p$, and $Z^*_p$? I have at most $\operatorname{ord}(Z^*_p)$ iterations to run through?

I can't see what aspect of the maths I'm obviously misunderstanding. Is it not linear to calculate $g^x \bmod p$ for some $x$? That's my only guess.


texts: Proposed unidirectional authentication scheme

texts:
I've been looking around for a way to authenticate a client to the server and deliver a message, but in a unidirectional fashion - that is, the client sends messages to the server, but the server cannot send anything to the client. I want to both deliver the message and also convince the server that the client does indeed know a PSK.

When two way communication is available, the trivial solution would be to use something like SRP, or to simply have the server generate a nonce and the client then uses the encrypted nonce as a verification tag for the message:

M = message
K = pre-shared key
N = <random> (nonce)

C --> S: <request nonce>
S --> C: N
C --> S: Enc(K, N | M)

As long as the nonce is indeed unique, the client will be able to prove to the server that it has possession of K.

However, in the case of a one-way client to server communication, having the client generate the nonce allows an eavesdropper to replay a previous message:

C --> S: N | Enc(K, N) | Enc(K, M)

Without the channel back from the server to the client, the server has to accept the client's choice of a nonce and therefore a passive attacker can choose a previously-sent message while an attacker that manages MitM can intercept messages and resend them at will.

Here is my proposal:

M = message
K = pre-shared key
N = <random> (nonce generated by the client)
R = time slice size (the length of time the nonce will be valid)
T = time-stamp / R

C --> S: N | Enc(K, N | T) | Enc(K, M)

The server can validate the signature by calculating Enc(K, N | T) from the clear-text N and its own time-stamp and comparing to the message from the client - possibly allowing the previous and next time slices in case of clock drift. Once confirmed, the server can safely Dec(K, M) to get the message.

This scheme is still vulnerable to an attacker replaying a message within the time window R, so the server has to maintain a cache of all nonces used within the time window, and ignore any message that starts with a nonce that has already been cached. The cache can be discarded when its time has expired.

I've spent a couple of hours turning this around in my mind, and so far other than the obvious need to have an accurate time source, I don't see an issue with this scheme. I'd appreciate it if someone could verify my design.

Edited: Thanks to a comment, I'll mention that an assumption I've made is that both client and server can get accurate time using, for example, NTP.


texts: Galois Field multiplication instead of Diffie Hellmans discrete logarithm

texts:
I am wondering if the inversion of multiplication of polynomials is equally hard as the discrete logarithm problem used for key exchange. Or are there algorithms that weaken such an usage. I understand that it is somewhat easy to factorize if one omits the division by an irreducible polynomial.

I cannot find any comparison for the hardness of

multiplicative inverse in GF(2^n) mod (some irreducible polynomial)
Diffie Hellman using exponents of g^x mod p
elliptic curves

Only for the last two I was able to find some comparison which favors elliptic curves over the discrete logarithm problem as the key length is about 1/12 as opposed to Diffie Hellman for the same security.


texts: Cost of multiplication when e is randomly selected. RSA

texts:
Using schoolbook multiplication (which has cost $\mathcal{O}(n^2)$) to multiply two $n$-bit numbers)

what is the cost of computing an RSA encryption with $e = 3$?
What is the cost if $e$ is chosen randomly in the range $\{3, 5, 7, \ldots, \varphi(N) − 1\}$?


texts:
Let's say Alice and Bob are playing a game where Bob is trying to guess a number Alice has chosen.

Alice chooses a key $K$ and a number $N$ at random and performs $C=Commit(K, N)$ where $Commit(K, N)=h(h(K) \| h(N))$.
$h()$ is a collision-resistant hash function and $K$ and $N$ can be of any length.

Bob guesses $N'$ and sends it to Alice who responds with $K$ and $N$.

Bob can now do $C'=Decommit(K, N)$ which in our case is the same as Commit and verify that $C=C'$.

As I understand it the scheme above is perfectly hiding and computationaly binding. Is there a way to make the scheme both perfectly binding and perfectly hiding, or is there another scheme that has these properties?

I'm new to cryptography so I apologize in advance if I don't get some of the concepts right.


texts:
I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling.

How many bits of security does unpadded RSA have, in relation to its key size?


texts: Using the same private key to generate Schnorr and BLS signatures

texts:
I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it to sing some messages using Schnorr signature scheme and other messages using BLS signature scheme. The verifier should be able to tell that the signatures were generated with the same private key.

One way I can think of is to have a single public key $X$ on a curve $g$ and use it for both types of signatures. This probably limits the selection of $g$ to the curves that support BLS scheme (e.g. BLS12-381). But I'm not sure if there are any drawback to using Schnorr signatures on these types of curves.


texts:
If I have a long randomly generated key (k), XORed with a message (m), but since the message is longer than the key, there is a chance of reusing the keystream with the same message, but the key is used only onetime for every encryption process. In other words, every time I have to encrypt a message, I randomly generate a bit key with variable length.
Can we consider this technique is secure against any attack even though the keystream is been reused with the same message despite the fact that I have to save the key for every message I encrypt?


texts:
Currently I have a protocol using a simple RSA to AES handshake. I have been reading more and more and would like to implement proper forward secrecy, but at the same time I'd like to improve the performance on mobile devices.

My question is, where would I start reading / learning about how to implement proper ECDHE ( as this seems to be the preferred choice ) and how to properly implement it?

The documentation on OpenSSL seems to be rather unfinished and annoying to work with.


texts: If I encrypt data with two different ECC Private keys, how secure is the result?

texts:
I'm wondering whether encrypting data with two different 256-bit ECC keys will result in a more secure encryption (minimum 384 bit equivalent) or will result in data that's effectively encrypted with a different (unknown) 256-bit key (or weaker).  The keys will be different, but will be based on the same curve.

Another acceptable option would be to do something like encrypt / decrypt / encrypt with 3 different keys (like Triple-DES, but with ECC), again based on the same curve.

I'll be using a hardware crypto chip that can do ECC encryption with 256-bit keys (uses "NIST standard P256 prime curve"), but I'd like to be able to have something a bit more secure, and I don't want to have to switch to software encryption (speed and memory limitations in an embedded device).

The purpose of this is to encrypt keys for general distribution, so the cyphertext will be public, with access for an extended period of time (several years).

I'm a programmer, not a mathematician, so please phrase answers accordingly.


texts: Is it possible to have self-authenticated message?

texts:
Consider a text with $n$ words which $m$ words of it can be replaced with an equivalent word. Therefore we have $2^m$ different texts with the same meaning.

For example "You are {so/very} {keen/eager}" has 4 different combinations with the same meaning.

Is it reasonable and possible to use this property for message authentication?

More precisely, knowing a key, only one of these texts can be authenticated. Actually, I do not want to add anything (like HMAC) to the text.


texts: Is there an encryption format that preserves length and only outputs alphanumerics?

texts:
I'm trying to design a promo code system for a server app I'm designing. Basically, I generate a promo code for a certain item and give the code out to someone, who then types it into the server.

Currently, the generator I wrote gives out a 20-character alphanumeric code, but the codes are too easy to manipulate. To fix this issue, I'd like to implement some sort of symmetric encryption (so that the generator app can make the code, but the server can also read it) to keep users from figuring out how codes are generated.

Is there a symmetric encryption algorithm I can use that will return 20 alphanumeric characters?

If possible, I'd like to find an algorithm that can easily be implemented into Java code.


texts: Does the order of the "Finished" messages matter in SSL/TLS?

texts:
In SSL 3.0 and TLS versions 1.0 through 1.2 the last two messages are the "Client Finished" followed by "Server Finished" messages. These messages include an encrypted (under the established session keys) MAC of all the previous messages.

However, in TLS 1.3 and in the abbreviated handshake, the server is the first to send a "Finished" message, not the client.

I'm trying to understand if the order has some significance in regards to security, but I believe the answer is no. Replay attacks are not possible because of the nonce values, and MITM attacks (that would be impossible because pre_master_secret is encrypted under the server's public key and used by the client to establish keys) would rely on the attacker establishing keys with both client and server, which wouldn't matter when it comes to who sends the finished message first.

My question is, does it matter from a security point of view whether the client or the server are the first to send the message? What's the rationale behind the changing order?


texts: Meet-in-the-middle attack (on custom encryption scheme)

texts:
This is a question I had from an exercise session.

Exercise:
First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$.
Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC decryption mode with a secret $IV_2$ and key $K_2$.

My solution:

$IV_1$ = $C''_0$ = $O^n$  and $C'_0$ = $IV_2$

I think encryption would be something like this $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ with $C'$ and $C''$ be the intermediate solutions (and $C''$ the first) of each encryption/decryption method.

For decryption I have this P = $D_{K1}$($E_{K1}$($E_{K2}$($C_i$ $\oplus$ $C'_{i-1}$)) $\oplus$ $P_{i-1}$)

The question: Is this construction safe against meet-in-the-middle attack?

Wouldn't the first two operations negate themselves because $C_1$ would decrypt into $P_1$?


texts: What is wrong with encryption-based / hash-based commitment schemes?

texts:
In the slides to my information security class it is stated without explanation that a encryption-based commitment scheme defined as follows is broken:

Commit: P outputs c = Enck(m)
Reveal: P sends k to V. V decrypts c and learns m = Deck(c)

Similarly, a hash-based commitment scheme (using cryptographic hash function H) defined as follows is also stated to be broken:

Commit: P outputs c = H(m)
Reveal: P sends m to V. V verifies that c = H(m).

Why are these schemes broken with respect to hiding and binding?

The only reasons I can think of that these schemes might be broken are the following:

In the encryption-based scheme, the encryption might reveal something about the length of the message, breaking the principle of hiding. However, this could be addressed by padding the messages to a fixed length.
In the hash-based scheme, two hashes might collide, breaking the principle of binding.

Are there any other reasons these schemes are not valid commitment schemes?


texts: What password hash function for the next 50 years?

texts:
According to this report : http://www.ecrypt.eu.org/csa/documents/D5.4-FinalAlgKeySizeProt.pdf
SHA2-512, SHA3-512, Whirlpool and Blake2b are hash functions that could be safe for the next 50 years.

For a system that will never receive security updates, to hash passwords, what of these 4 functions should I use for maximum security ?


texts:
I know that PBKDF2 is very useful for generating strong keys. I'm trying to know is there any additional contribution of the given password to produce even stronger keys.

Which key is more secure:

A password: "123456"   (length 6) is entered into PBKDF2 ---> Produced key
A password: "XK6f+d"   (length 6) is entered into PBKDF2 ---> Produced key
A password: "123456789" (length 9) is entered into PBKDF2 ---> Produced key
A password: "dYn5p78+/" (length 9) is entered into PBKDF2 ---> Produced key
A password: "eh4P+S83ko/@bDBq" (length 16) is entered into PBKDF2 ----> Produced key

Does the strong key generation of PBKDF depends on the length of the password?
Does longer passwords produce more stronger keys then shorter passwords?
Does "XK6f+d" produces more stronger keys then "123456"?


texts: Safety of encrypting a plaintext with its hash as the key

texts: What are the safety issues of using the the hash of plaintext as the key to encrypt it? The first that comes to mind is that if I can guess an approximation or part of the plain text, brute force attack complexity will be reduced considerably. Suppose that this is not an issue. Are there other security risks on this approach?


texts: CryptDB data re-encryption and onion layers

texts:
From the CryptDB paper , I understoond that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we know which type of functions are to be used, then why have that higher layer of functionality if it has to be decrypted and not re-encrypted ? After the first query itself, data will be present in a lower onion layer.

If all columns are present in a state where some data is leaked from the encrypted DB [eg. the duplicates] is it still secure ? Even if users are not logged in, lots of information about the data can be understood ?


texts:
I have the following problem: Alice wants to send Bob a message such that Bob knows it is from Alice but at the same time he cannot prove that Alice send him this message.

The solution I came up with, using RSA, is:

Alice picks a random key K, and encrypts the message M using this key K. M'= aes(K, M)
Alice hashes K and Bob's public key to get H. H = sha(K + Bob's Public Key)
Alice signes H using her private key. S = rsa_sign(Alice's private key, H)
Alice encrypts K and S using Bob's public key. P = rsa_encprypt(Bob's public key, K + S)
Alice sends P, M' to Bob

Bob receives P, M':

Uses his private key to get K, S.
Uses Alice's public key to verify S
Uses K to decrypt M'.

Do you see any holes in this?

Thanks!


texts: In RSA, what is $P[x \notin \mathbb{Z}_N^*]$

texts:
In the RSA problem, picking a message $x \in \mathbb{Z}_N \setminus \mathbb{Z}_N^*$ implies factorizing $N$. Since factorization with respect to the standard RSA generator is hard assuming the RSA problem is hard, it is likely that selecting $x \in \mathbb{Z}_N \setminus \mathbb{Z}_N^*$ is hard. Thus, one may ask the question:

  Given $x$ uniformly distributed over $\mathbb{Z}_N$ what is the probability that $x \notin \mathbb{Z}_N^*?$

with the hope that it is negligible. So I write:

$P[x \notin \mathbb{Z}_N^*] = 1 - \frac{\phi(N)}{N} = \frac{1}{p}+\frac{1}{q} - \frac{1}{pq}$

However, how does one prove this is negligible?


texts:
Suppose $\Lambda$ is a lattice in $\mathbb{Z}^m$ and let $\{b_1, ..., b_n\}$ be an LLL-reduced basis, rename these vectors as $v_1, ... , v_n$ such that $1 \leq ||v_1|| \leq ... \leq ||v_n||$. How can i show that one does not necessarily have $||v_1|| = ||b_1||$ and prove that for $1 \leq i \leq n$
$$ ||v_i|| \leq (2^{n(n-1)/4}\;det(\Lambda))^{1/(n+1-i)}$$
The inequality from question 4 of homework might be helpful. I have solved them but i just can figure it out this question (it seems easy).


texts: How to only encrypt a subset of the plaintext

texts:
I was wondering if there is a smart way for a user to only encrypt a subset of a plaintext.

I'll try to be more specific. Let's suppose the user U wants to use a special cipher such that given a plaintext P and some additional information, it only encrypts the subset requested by the user, the rest of the plaintext is not modified.

Does it exist such a cipher? If so, where can I find it and how does it work? If not, how would you do design such a cipher?

Thanks

EDIT:
I've read about selective encryption but it looks like it's mainly meant for images and video streams


texts:
In the hierocrypt-L3 description, the cipher takes 6, 7, or 8 rounds.  Example source code also seems to follow this same specification of 8 rounds for 256-bit keys.  Wikipedia shows 8.5 rounds for 256-bits. I found it some other literature as well.

Where does this 1/2 round come from?


texts: Can you elaborate on pBFT for dBFT in relation to PoW and PoS consensus algorithms in layman's terms?

texts:
I've read all other related answers and googled this extensively. My intention and background in asking this question is that I am delving into cryptocurrency and blockchain technology in general. There is considerable misinformation out there regarding Byzantine Fault Tolerance (BFT) and it's relationship to cryptocurrency, that much I can say for certain even with my limited understanding. I will share my own understanding as follows

BFT is not comparable to PoW or PoS consensus algorithms as it is merely a quality that a consensus algorithm can have, not a consensus algorithm in and of itself
Practical BFT (pBFT) systems could be seen as antithetical to the stated goals of Satoshi Nakamoto in that they are centralized and must be centralized

Again, I've read nearly all the information that I'd be capable of following based on my background and have only a cursory understanding of how it is that pBFT functions, about how it is more final than PoW as a consensus algorithm, as PoW is probabilistic.
So, with the above in mind, can you please elaborate on pBFT for delegated BFT (dBFT) in relation to PoW and PoS algorithms?
Thanks to anyone willing to attempt to elucidate what I find to be quite esoteric


texts: Does chacha20-poly1305 require new key for every encryption process?

texts: As I know chacha20-poly1305 is stream cipher. Does that mean for every encryption process require a new key?


texts: Security of AES ECB for 128 bit random data

texts:
I am using AES ECB mode to encrypt and decrypt 128 random data. I have read on drawbacks on using ECB but it seems that it is feasible to use it for random data. However my concern is that my implementation provides an oracle. What i am concerned is key extraction. Would it be possible in reasonable time or possible at all? Again the data is random, basically server generates 128 random bits and sends it to client, the clien then encrypts it and sends it back to server. However client and server communicate via a third party (tethered way) so third party can see both plaintext and ciphertext.

My two questions are:
is it safe to use AES ECB when both plaintext and ciphertext are visible to a third party? (random data, replay is not a concern)

Also there is a case where it becomes an oracle (if i am using it correctly) anyone can send 128 bits data and get cipher of it back.. (possible but not that practical, though i am wondering of its implications)?


texts:
If I execute a proof by reduction using a given adversary A as a subroutine to A'. How do I know that using adversary A which can solve a given hard subproblem, is the most efficient subroutine to use to solve the larger problem that A' solves?

Thanks in advance.


texts:
I know that most of the math related to cryptography is number theory/abstract algebra/probability, but I was wondering if there are some algorithms that make use of other fields of math like real/complex analysis, differential equations or linear algebra?
Also, what is highest level of mathematics required for cryptography?


texts: Public key crypto instead of hashing passwords in a database

texts:
Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password.

Now I generates a public/private keypair. Then I send the public key to all servers, while keeping the private key on a heavy-secured, airgapped computer. Now, instead of salting and hashing the passwords, I salt it and then encrypt it with the public key, and store it in the database.

The method to store the password is Encrypt(password+salt). The encryption algorithm is deterministic. (If the input is the same, the output is the same.

If the bad guys now hack my server, they won't be able to get the passwords, since they don't have the private key to decrypt them.

If I ever need the passwords, I can just copy the database to my airgapped machine and decrypt the passwords in the database.

What are the disadvantages of doing so?


texts: Comparison on Gentry's Fully homomorphic Encryption?

texts: This topic is very new to me. Is it possible to do comparison on the encrypted data(data is encrypted using Gentry's FHE)? If so, how can it be done?


texts:
Suppose that $P = pG = H(rK)G$, where $P$ is a point on an elliptic curve, $H$ is a hash function, $rK = kR$ is a shared secret between the party that knows $r$ and the party that knows $k$, and $G$ is a generator point.
Is there a way to prove that $P$ is well constructed (i.e., computed from the shared secret) and that someone who knows the shared secret can know $p$?


texts: How does the simulator of the special-honest verifier zero-knowledge property works?

texts:
I’m a bit confused about what the simulator of the special-honest verifier zero-knowledge property of a $\Sigma$-protocol is supposed/allowed to do and how to prove that it is indeed efficient (i.e. it runs in a time polynomial in the security parameter).

A 3-move protocol between a prover $P$ and a verifier $V$ is said to be Honest verifier zero-knowledge if there exists a polynomial-time simulator $M$, which on input $x$, it outputs an accepting conversation of the form $(a,e,z)$, with the same probability distribution as conversations between the honest $P, V$ on input $x$.

In order to prove this property, we need to define a simulator, which is usually given black-box access to a honest $V$ and has full control over all $V$'s input tapes (including its random tape). I've found in many papers the following sequence of steps:

 1. The simulator starts the verifier V: the verifier is given the common input x,
    some auxiliary input and also the random input bits.

 2. To simulate one iteration, the simulator executes the following loop:

  2a) Draws a uniformly random challenge e, uniformly random response z,
      then computes the commitment a (using e and z), and finally sends the commitment
      to the verifier V.

  2b) Gets the challenge e' from V. If e=e', then it outputs (a,e,z) and exits the loop.
      Otherwise, it resets V to its state right after step 1 and the simulator starts
      from step (2a) again.

It seems to me that the random bits of $V$ are chosen in step 1 and kept fixed for the rest of the simulation, so the verifier works deterministically and he will always send the same challenge $e^{\prime}$ after step 1.

If this is so, I wonder, in the case of a fail run, why is the simulator drawing a brand new challenge, response, etc. all over again in step (2a)? Isn't the simulator allowed to use the challenge it just saw coming from the verifier ($e^{\prime}$) as its own new guess of the verifier's challenge?

My second question is:
How do we proof now that the simulator is efficient, that is, that the simulator will only need to run a time polynomial in the security parameter before being able to produce an accepting transcript with the correct distribution? According to the above reasoning, and assuming that the simulator is indeed allowed to use the verifier's challenge $e^{\prime}$ as its new guess of the challenge, wouldn't the simulator always need two runs at most, to generate a valid simulated transcript?

I hope these questions make sense.

EDIT:

Some days after I first asked the question, and after having seen that I didn’t get any answer, I’ve noticed a problem with the question I had raised. The sequence of steps I described are not the ones that a simulator would do in order to prove the property of Special-honest verifier zero-knowledge (otherwise the simulator would receive a challenge as input), but to prove the Honest verifier zero-knowledge property (without the “special” part). Therefore, I've edited the question so as to talk about the property of Honest Verifier Zero-Knowledge.


texts: Is using the same HTTPS cipher suite as Google a good idea?

texts:
I'm searching for a cipher suite for my HTTPS website, running on the Apache 2 web server, that would offer a good compromise between compatibility with users and security. One idea I had was to simply using the same cipher suite that Google uses, i.e.:

Accepted  TLSv1  256 bits  ECDHE-RSA-AES256-SHA
Accepted  TLSv1  256 bits  AES256-SHA
Accepted  TLSv1  128 bits  ECDHE-RSA-AES128-SHA
Accepted  TLSv1  128 bits  AES128-SHA
Accepted  TLSv1  112 bits  DES-CBC3-SHA
Accepted  TLS11  256 bits  ECDHE-RSA-AES256-SHA
Accepted  TLS11  256 bits  AES256-SHA
Accepted  TLS11  128 bits  ECDHE-RSA-AES128-SHA
Accepted  TLS11  128 bits  AES128-SHA
Accepted  TLS11  112 bits  DES-CBC3-SHA
Accepted  TLS12  256 bits  ECDHE-RSA-AES256-GCM-SHA384
Accepted  TLS12  256 bits  ECDHE-RSA-AES256-SHA384
Accepted  TLS12  256 bits  ECDHE-RSA-AES256-SHA
Accepted  TLS12  256 bits  AES256-GCM-SHA384
Accepted  TLS12  256 bits  AES256-SHA256
Accepted  TLS12  256 bits  AES256-SHA
Accepted  TLS12  128 bits  ECDHE-RSA-AES128-GCM-SHA256
Accepted  TLS12  128 bits  ECDHE-RSA-AES128-SHA256
Accepted  TLS12  128 bits  ECDHE-RSA-AES128-SHA
Accepted  TLS12  128 bits  AES128-GCM-SHA256
Accepted  TLS12  128 bits  AES128-SHA256
Accepted  TLS12  128 bits  AES128-SHA
Accepted  TLS12  112 bits  DES-CBC3-SHA

Presumably, Google has chosen their cipher suite to be compatible with most people's browsers, while also being very secure, so it seems that this should be a good choice for a cipher suite in general. But since I'm only running a small website, I'm not entirely convinced that what's good for Google is also good for me. So my questions would be:

Are there any ciphers in the suite above that I should not use? And if so, why?
Are there any other ciphers that I really should allow, even though Google doesn't?


texts:
I known the post from here and here regarding RSA padding. I still don't understand why simple addition of the message with an random number and then encrypting the result with plain RSA isn't secure.

Here's a more precise description of the scheme:

Suppose the message is $m$. Then suppose we draw a random integer $r$ and compute $m'=m+r\bmod n$ and feed $m'$ to the RSA function.

At a later time I will recover the encrypted message from the server and I'll decrypt it myself. I known that RSA isn't best scheme for this application. Is the proposed padding secure in this context?


texts: Is FIPS 140-2's "Continuous random number generator test" practical?

texts:
Section 4.9.2 of FIPS PUB 140-2 specifies, amongst other things, a "Continuous random number generator test."  Here are the relavant bits:

  If each call to a[n] RNG produces blocks of n bits (where n > 15), [...] Each subsequent generation of an n-bit block shall be compared with the previously generated block. The test shall fail if any two compared n-bit blocks are equal.
  If each call to a[n] RNG produces fewer than 16 bits, [...] (for some n > 15) [...] Each subsequent generation of n bits shall be compared with the
  previously generated n bits. The test fails if any two compared n-bit sequences are equal.

Isn't (n > 15) too small?

I am concerned about their choice of 16 being the minimum for 'n'.  At 16-bits, one would expect to see the test fail, inappropriately, about every 64,000 iterations.  That is rather frequent!  Even an 'n' of 32 will lead to noticeable false positives if the RNG is being used very frequently.

In my specific case, I have a 32-bit TRNG, and would much rather stretch 'n' to 64 to prevent false positives.

Thoughts?


texts:
a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a symmetric key? Describe a key exchange protocol between them which is secure against an eavesdropper adversary.
b) Fully specify a Man-in-The-Middle (MiTM) attack attack against the key exchange protocol you described above.
c) Assume now that Alice and Bob are very old friends and that Bob already knows a public key pkA owned by Alice.  How can you improve the above protocol in such a way that Bob can detect the presence of a MiTM? Can Alice also detect the presence of a MiTM?

In part a) I defined a protocol using the idea behind D Hellman, so this is vulnerable to MiTM.
However, I dont know how to work out part c


texts: How Can I Know the Number of Points on an elliptic curve?

texts:
If I have the following Elliptic Curve:
$$E: y^2 ≡ x^3 + 2x + 2   \mod 17$$

How Can I calculate the Number of Points on this elliptic curve $\#E$ ?

and how can I invest the following law which calculates the Number of Points on an Elliptic curve NPE:

$$NPE=1+p+\sum_{x=1}^{p-1} \frac{f(x)}{p}$$


texts: Hill cipher cryptanalysis - known plaintext known key size

texts:
Hello I want to know how to go about this problem
I know the plaintext "abcdef" and the ciphertext. The key size is 2.
I really can't figure out how to find the key for decrypting and encrypting.


texts: RSA vs El Gamal digital signature. Which is more secure?

texts: I'm reading about the notions of security concerning digital signatures and I can't understand whether RSA is more secure than El Gamal digital signature. Well, they are both prone to forgery, but I don't see which signature is better in terms of security.


texts: How constant value 0x63 in affine transformation is chosen or generated while AES Substitution Box is formed?

texts: Me and one of my friends are working on AES algorithm. We have understood how multiplicative inverse table is generated. Rijndael AES algorithm shows us how S-Box is generated through the affine transformation process. In the original algorithm they have multiply each byte of the state with an constant matrix and then add the result with another constant byte which is 0x63 to get the substitute value. We have understood how the constant matrix is generated as there is a formula to generate it but couldn't find out why 0x63 constant value is chosen. We have already gone through many resources but could not find any appropriate solution. Can any one help us in this regarding issue?


texts: Maybe it’s a silly question, I’m interested in the best known/chosen plaintext attack on only one round of AES-128. More specifically, what is the smallest number of known/chosen plaintext/ciphertext pairs which allow us to recover the key with high probability? What’s the relationship between how time scales with the number of pairs?


texts: Is there any rules for choosing the two primes that's used in generating RSA keys?

texts:
So I want to ask is there any rules for choosing the two primes that's used to generaten in RSA? I mean clearly you can't choose 2 and another super big number, so I want to ask is there any restrictions like those two primes must >=2^(key_length-2) or something like that? (Supposing RSA is also using the first but to identify positive/negative.)

Also is there a restriction that requires n be bigger than a number, or otherwise you can also fill 0s at the beginning of a number and let it matches the bit length.

Or is there anything that though isn't consider as restrictions, but are recommended and been used in most situations?


texts: What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?

texts: I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key cryptography, for instance, "just" a question of the difficulty of dealing with large integers? I can understand that factoring a product of two large primes is time-consuming. Is there a basic belief that new methods of factoring might be developed, which will lead to breaking some cyphers, or pushing the number-size requirements ever higher? Or do industry pros look more toward ever-faster, ever-large-number-handling capabilities as the most likely future?


texts:
I know this question has already been asked few times but I'm struggling a bit on a problem.

I have a plaintext FRIDAY and its ciphertext PQCFKU, using $M = 2$, with corresponding integers $x = fr id ay = (5, 17),(8,3),(0,24)$ and $y = pq cf ku = (15, 16),(2,5),(10,20)$.

In order to find the key $k$:

$$\pmatrix{y1 \\y2 \\} = \pmatrix{x1 \\x2 \\}k$$
$$\pmatrix{15&16 \\2&5} = \pmatrix{5&17 \\8&3 \\}k$$

Now $x$ determinant, $det(x)$ is given by:

$$det(x)=5*3-8*17 = -121$$ and, using modulo 26:
$$-121\pmod{26} = 9$$
Then, $det(x^{-1})$ is given by:
$$9^{-1}\pmod{26} = 3$$

Now $X^{c}$ is:
$$X^{c}=\pmatrix{3&8\\-17&5}$$
And $(X^{-1})^{T}$ is:
$$(X^{-1})^{T}=\pmatrix{3&-17\\-8&5}$$

So, In order to find $k$:
$$k=(\pmatrix{3&-17\\-8&5}det(x^{-1}))\pmod{26}$$
Which is:
$$k=(\pmatrix{3&-17\\-8&5}3)\pmod{26}$$
$$k=\pmatrix{9&-51\\-24&15}\pmod{26}$$
$$k=\pmatrix{9&1\\2&15}$$

  Now comes the problems, doing the decryption using $k$ and $pq$ I
  can't get $fr$ back.

If I'm not wrong:

$$x1 = (15,16)\pmatrix{9&1\\2&15}=(15*9+16*1, 15*2+16*15)=(151, 270)$$

And now, to obtain the plaintext:

$$(151, 270)\pmod{26} = (21, 10) $$

  and, $$(21, 10) $$ leads to $vm$ which is clearly not $fr$

Is my reasoning wrong? Am I doing errors?

I've been scratching my head for a while but I was unable to find  valid solution. Thanks in advance.


texts: Are there use cases where a signature itself needs to be signed?

texts:
I'm writing some code to digitally sign certain files (JSON, if you must know), and I'm trying to understand the use cases, not being a crypto guy myself.

I understand there are use cases where several parties all need to sign the same content, e.g. the two parties who enter a contract sign it to indicate their approval.

But are there use cases where B signs not just the content (of the contract, or whatever), but the concatenation of content plus the previously-created signature by A of the content?

Update: given this discussion, I created a proposal that I believe covers the case in case you are interested: http://upon2020.com/blog/2014/03/digital-signatures-on-json-payloads-lets-call-it-jsonsig/


texts: Understanding calculation of collisions in hash-functions

texts:
I am going through some of my notes from class (About Information Security) and I'm stuck understanding how my teacher got this result. The question is:

  How many collisions would you expect to find in the following cases?

  a) Your hash function generates a 12-bit output and you hash 1024 randomly selected messages.

  b) Your hash function generates an n-bit output and you hash m randomly selected messages.

The teacher's only answered a) like so:

  We expect to find one collision every $2^{n/2}$ hashes. There are $2^{(n/2) * 2} = 2^n$ comparisons. Since the output is 12-bit the answer is $2^{10 * 2}/2 ^{12} = 2^{8} = 256$ collisions.

However I don't quite understand how he got this?

I get that the expected number of collision after n hashes would be $2^{n/2}$. But the rest doesn't make sense to me. I mean if the output is 12 bits (4096 arrangements), why would we expect to get 256 collision after only hashing 1024 messages (1/4 of the possible outputs)?


texts:
My question is simple. I have a secret that is generated with a 10 byte long pseudorandom generator library (e.g. Java's SecureRandom), that in theory provides a security equivalent to $2^{40}$ (birthday bound). This secret is encoded afterwards (e.g. Base64). This is supposed to reduce entropy, while extending the string lenght.

If I want to brute force the secret, does the encoding have any negative impact on the protection? (in other words, does it facilitate the brute forcing at all?)
My intuition is that the security is not affected, but I learnt to be extra cautious with this sort of things.


texts: BIP 39: If I mix my 24 seed phrase with another 24 words, will the checksum property allow an attacker to retrieve the original seed phrase?

texts:
Assume that I have a 24-word passphrase that I want to store securely but online by mixing it with another 24 words in a manner only I know. Does the checksum property somehow help an attacker to significantly speed up the process of guessing the right 24-word phrase in a reasonable time?
I would guess no because the attacker still needs to try an absurd number of combinations being somewhere in the vicinity of
$$
\binom{48}{24} \cdot 24! \approx 2 \cdot 10^{37}.
$$
Edit: For clarifaction, I add a minimal example which led me to the above question. Let us consider the following simple passphrase system:

Choose 3 distinct words from all words which can be set together by 3 letters (abc, god, ced, ....)
The fourth word must fulfil that it contains the first letters of the three first words (that is meant to be a very simplified checksum condition)

Let us say I have the passphrase (ago, bro, sis, abs) and mix it with another passphrase (gro, lab, for, glf) to
(ago, glf, for, sis, abs, gro, lab, bro)
Now it is way faster to scan this sequence and check for which quadruple rule 2. applies to obtain the two possible valid pass phrases than just trying all
$$
\binom{8}{4}\cdot 4!
= 1680
$$
combinations.


texts:
I read a research paper in which the writer again and again writes about norm preserving automorphism such as
$\left \| \phi(a)  \right \|$ =$\left \|  a\right \|$

and determinant preserving automorphism
$det(\phi (x))=det(x)$

I know what an automorphism is in mathematical sense - an isomorphism from G to G itself.

My question is basically:

What does automorphism indicate in cryptography, particularly in plaintext and ciphertext context. Is it a mapping from plaintext to ciphertext? If so, then why not other type of mapping such as isomorphism, endomorphism etc?

What does determinant indicate in cryptography (plaintext and ciphertext)?

I am actually new to cryptography when I read mathematical terms in cryptography I want to interlink whether these mathematical functions provide security, performance to ciphertext.


texts:
I understand that the role of a Certificate Authority is to SIGN (not encrypt) a certificate. The signed certificate will theoretically contain:

Plain text of data, including the server's public key
Signature of hashed version of plain text of data in (1) so that a user can verify (using CA public key) that the certificate has not been tampered with.

Knowing these two key points, I tried to play around with an example cert

-----BEGIN CERTIFICATE-----
MIIF7zCCBNegAwIBAgIRANdVj9r18RBbshMoK3B3KaMwDQYJKoZIhvcNAQEFBQAw
gZcxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtl
IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMY
aHR0cDovL3d3dy51c2VydHJ1c3QuY29tMR8wHQYDVQQDExZVVE4tVVNFUkZpcnN0
LUhhcmR3YXJlMB4XDTExMDMxNTAwMDAwMFoXDTE0MDMxNDIzNTk1OVowgd8xCzAJ
BgNVBAYTAlVTMQ4wDAYDVQQREwUzODQ3NzEQMA4GA1UECBMHRmxvcmlkYTEQMA4G
A1UEBxMHRW5nbGlzaDEXMBUGA1UECRMOU2VhIFZpbGxhZ2UgMTAxFDASBgNVBAoT
C0dvb2dsZSBMdGQuMRMwEQYDVQQLEwpUZWNoIERlcHQuMSgwJgYDVQQLEx9Ib3N0
...
-----END CERTIFICATE-----

I tried decoding using Base64 decoder, and the result is gibberish. I tried googling for answers but I'm not getting anywhere.

What encoding scheme is this and does this offer extra layer of security?
Shouldn't the main ideas (point 1 and 2) be secure enough?
Is there a way I can break this blob down to visually show that data part and the signature part?


texts:
I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate.
I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate.
I think it's overkill so maybe I can use smaller private exponent. (which I hope will lessen server load with reduced security margin as a trade off)

I inspected the keys generated by OpenSSL and found that private exponent is about the same size (slightly smaller) as the modulus (256 bytes).
Just 96 bytes private exponent should suffice (with some margin) from Wiener's attack.

The problem is I can't think of a way to generate such key. Since public exponent is fixed (I'm not sure but it's supposed to. I never see other value than 65537 used.) IMHO to make such key possible it should begin at picking 2 primes. At my level of mathematics that's out of the question.

I gave up on trying to generate special certificate but I just curious is it possible and practical to accomplish what I can't?
And if the answer is yes how?


texts: Why do people worry about the exceptional procedure attack if it is not relevant to ECDSA?

texts:
The exception procedure attack is described here:
https://www.iacr.org/archive/pkc2003/25670224/25670224.pdf

People are afraid of this attack, because it could leak information on the private key in exceptional cases. [pun intended]

The assumed scenario for this attack is illustrated below:

If the attack is "not relevant to ECDSA, because the base point of ECDSA is usually fixed as the system parameter" then why do people worry about this attack?
The authors also note that "When the order of the elliptic curve is divisible by
a small integer, the curve has several exceptional points. In other words, the
curves whose order are prime are secure against the proposed attack, namely
the recommended curves in several standards" The NIST curves have an order that is prime as well, then why do Tanja Lange and Daniel Bernstein mention this attack as a reason why the NIST curves are insecure, if the attack wouldn't work against these standardised curves?


texts: Practical consequences of using functional encryption for software obfuscation

texts:
I came across this article, which describes a method, developed by UCLA CS professor Amit Sahai et al, for using functional encryption in order to achieve software obfuscation. The paper that the article refers to is available here. Has anyone digested the paper and have more information to share? Are the results as ground breaking as the article suggests?

In particular, does anyone have a clear idea regarding exactly what aspect of an implementation the method will potentially obfuscate? Does it only apply to hardware implementations at the integrated circuit level? Does it apply even if the adversary is able to track and map signals once the chip is turned on? Does it apply to software implementations for generic platforms, even if the adversary has full control over the CPU and internal memory (e.g. in case of emulators)?


texts: What are the relative merits of padding algorithms pkcs7, iso7816, and x923?

texts: I am assuming none of these padding algorithms are "the best"... But what are the advantages and disadvantages of using them? PKCS7 is certainly the most commonly used one, but I am interested in seeing what the others offer.


texts: Does password length affect AES encrypt/decrypt velocity?

texts:
I'm implementing crypto in Node, following this article: https://lollyrock.com/articles/nodejs-encryption/

It defines:

var crypto = require('crypto');
var algorithm = 'aes-256-ctr';
var password = 'd6F3Efeq'; // AKA passphrase

Then, it uses the password/passphrase for encrypt and decrypt the strings.
Now, here my question:
Is the password length going to change the encrypt/decrypt velocity?

For example: is the password/passphrase d6F3Efeq going to take less time to encrypt/decrypt than d6F3Efeqd6F3Efeqd6F3Efeqd6F3Efeq?

Edit:
This is the way that the password/passphrase is used:

function encrypt(text){
  var cipher = crypto.createCipher(algorithm,password)
  var crypted = cipher.update(text,'utf8','hex')
  crypted += cipher.final('hex');
  return crypted;
}

function decrypt(text){
  var decipher = crypto.createDecipher(algorithm,password)
  var dec = decipher.update(text,'hex','utf8')
  dec += decipher.final('utf8');
  return dec;
}

PS.: I know that using createCipher is a bad idea and I should use other non-deprecated functions (like http://www.levigross.com/2014/03/30/how-to-write-an-encrypt-and-decrypt-api-for-data-at-rest-in-nodejs/), but I'm not asking about which crypto algorithm is better. I'm asking only about velocity/performance.


texts: Hardwired secret key in public / private key encryption

texts:
I am new to cryptography and I need to know some details about the hardwired keys.

Taking as an example the paper "Multi-Input Functional Encryption", a key is hardwired in the description of the key generation scheme.

Is this technique related to encryption schemes or it is a form of circuit construction?


texts:
I have recently started looking into creating secure, while not validating against an external server, software product keys.

The idea I have had is to create a key consisting of two parts firstly a section that contains some (but not all) details of the user; for example name, customer ID and maybe a salt this would then be ecoded one way or another, say a simple base64 just to obfuscate it. The second part would be an SHA1 signature for a hash of all the user data this would be mostly the same as above but would contain the entitled software version (i.e. 1.0) and maybe something else related to the program.

The deployment of this would work by the user entering the key and the software extracting the user details from the key, appending its own credentials (version number etc.) the generating a hash a verifying the signature using this hash.

If the user key has not been tampered and the user is entitled to user that version of the software all will pass and we can proceed. If this it not the case (say the version entitlement is wrong) the signature will not match the hash. Obviously the public key has to be contained within the software to verify the signature but at no point does the user have the entire hash.

I was discussing this with a friend who said they thought this would be inherently poor as the user could poke through the program find out how the key system works and then, given the structure and the public key generate any number of license keys that would appear valid, as they would control the signature to match the software generated hash of 'fake' credentials.

Is this really that easy to crack surely even if the user did create a hash of some fake details and ID number they could not generate a valid signature to match this? Sorry the question has ended up being much longer than I intended; i wasn't sure how to be clear shorter. I hope this all makes sense.


texts:
Signal Protocol uses a counter (discussed in DoubleRatchet documentation) to define how many times KDF has derived a new key (aka a KDF step) which is then sent along with every message for the end client to know how many derivations (steps) he has to do to obtain a decryption key matching the message key which encrypted the message.

Note: it is also used for creating a message mac which is later compared for verification, but since both clients are keeping track of the current counter it should match as long as the order is intact.

This makes sense for protocols that don't have order, but if I am using TCP which keeps order does sending the counter and skipping over messages has any use?


texts: What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

texts:
The DES retail MAC, also known as ISO 9797-1 mode 3 with DES, computes the MAC of a block of data using a 16-byte (112 bit) key. It can be seen as CBC-MAC using simple DES with the first half of the key for all the blocks, except the last where 3DES with the full key is used. I've left padding and truncation out of the picture.

I need to compute that MAC

using a standard PKCS#11 token,
with all DES operations in the token (for fear of side-channel attacks),
using PKCS#11 semantic compatible with most tokens,
if at all possible, with built-in derivation of the key using CKM_SHA256_KEY_DERIVATION (the key is the first 16 bytes of the hash) and no exposition of that key material in the host's RAM.

Is that DES retail MAC sometime available in PKCS#11, under some name that I missed? If not (or that's not supported in my token), what are my options to implement that MAC given that the token I use is documented as supporting encryption using CKM_DES3_CBC, but not CKM_DES_CBC (deprecated), nor MAC using CKM_DES_MAC, CKM_DES3_MAC (not available)?

So far the best I see is two separate encryptions using CKM_DES3_CBC, the first with a DES2 key emulating a DES one; but that's hairy, and I fail to derive the first key inside the HSM.


texts: Computing the cardinality of the co-domain of specific modular exponentiations

texts:
Consider the following function:

$f: \mathbb{Z}_n \rightarrow Y,~x \mapsto x^e \bmod n$,

where $n = p \cdot q$ is an RSA modulus and $\gcd(\varphi(n),e) \neq 1$ (contrary to what's required for a public RSA exponent) with $\varphi(n) = (p-1)\cdot (q-1)$.

How can the cardinality of $Y$ be computed or estimated (in terms of $n$ and $e$)?


texts: Is correctness of a scheme considered part of the security of that scheme or is it separate? I've seen both approaches in different papers.


texts: Why TLS finished handshake message contains hash of handshake messages

texts:
TLS handshake message FINISHED contains a PRF computation using master secret over hash of handshake messages exchanged so far. The application data records can flow only after the TLS endpoint has decrypted and subsequently verified the contents of FINISHED message.

What does the verification of PRF computation contained in FINISHED message prove to the peer?

Why being able to decrypt the TLS record containing FINISHED message is not sufficient to be able to start application data exchange?


texts:
I am trying to read up on the math behind DH and ran into the word generator used a lot. I am not sure what it means. Can someone explain?

I see this question where the OP talks about g as the generator. The accepted answer does not make me understand what a generator is. I always thought g is just a large prime in group. What is the generator and how is it different from the DH parameters?


texts: What is the minimum and maximum value of an RSA private exponent?

texts: Is it possible to calculate the minimum and maximum value of the private exponent for an RSA key, for example for a 1024 key size? In other words, what is the range of values in which the private exponent can occur?


texts: Is it impossible to have a decentralized service using email addresses as login?

texts:
Let's say we have a decentralized service S distributed on a network of 1000 nodes/servers. Is it possible to have a registration/sign up scheme using email address as login?

I see two problems:

(Ignored for this question) Probable low deliverability rate for emails sent from nodes of a decentralized network to major email providers (Gmail, Yahoo, etc.); this is not a cryptographic problem, let's ignore this problem here.
Another real problem described in the following example workflow:

UserA, owner of userA@example.com, signs up to the service S (e.g. with a registration form on one of the website mirrors provided by the network)
A signup token f9x372d2aff0 is stored in PendingRegistrations database of the network by one of the node, and a confirmation email is sent by one of the nodes to userA@example.com
UserA opens his mailbox and sees a new email "Please confirm you want to signup to service S by clicking on http://203.0.113.2/register/userA@example.com/f9x372d2aff0"
UserA clicks on the link, the token is compared to the one in the PendingRegistrations database of the network, if it matches, he can finish the registration process since he has proved he's the legit owner of userA@example.com

Now:

Malicious UserB (who doesn't run a node himself) cannot create an account named userA@example.com, because he will have no access to the token that will be sent to userA@example.com's mailbox
Malicious UserC, who runs a node himself, CAN create an account named userA@example.com: he can go on the website, fill the registration form, and then observe the PendingRegistrations database and get the token and register the account himself. Or alternatively: he could observe the outgoing emails of the server, and see the link which will be sent to userA@example.com, and get the confirmation link.

This is close to Zooko's triangle principle, but I don't see how the famous solutions for it (e.g. Swartz's solution) can solve the problem here.

Is it impossible to have a decentralized service using email addresses as login, or can asymmetric encryption (public key / private key) help here?

Note: Any email going out from a node, sent to a user, has to be "cooked" by a node of the network. So I would say: "Any string that will be viewed by an email recipient who will open the email received in his mailbox, can also be viewed by the node owner/email-sending-server owner", thus making the problem difficult. It seems obvious, but maybe is there a clever solution?


texts: Simultaneous Discrete Logarithm with Small Exponent

texts:
Given two distinct safe primes $p_1 = 2 \cdot q_1 + 1$, $p_2 = 2 \cdot q_2 +1$, consider the following two instances of the discrete logarithm problem with the same unknown exponent $x$.

$$ g_1^x \equiv y_1 \mod p_1 $$
$$ g_2^x \equiv y_2 \mod p_2 $$
where the multiplicative orders of $g_1, g_2$ are $q_1, q_2$ respectively.

In general, we can solve the two discrete logarithms independently to find $(x \mod q_1)$ and $(x \mod q_2)$, then combine with the Chinese Remainder Theorem to get $(x \mod q_1 q_2)$.

Can we do better if we know that $x$ satisfies $ 0 < x < \min(q_1, q_2)$? Is there any approach faster than solving one of the discrete logarithms?


texts: Two possible plaintext's using OTP decryption

texts:
I am using this cipher-text

c   = 04 10 12 00 01 08 67 0A 19 65 0F 03 0A 00

with two possible keys

k_1 = 45 44 46 41 42 43 47 4B 4D 45 4B 42 5D 4E

and

k_2 = 45 44 46 41 42 43 47 4B 4D 45 41 4C 45 4E

If I decrypt the cipher-text with k_1 I am getting 'ATTACK AT DAWN' and with k_2 'ATTACK AT NOON'. Which of the plaintexts is more likely to be the original plaintext and why?


texts: How to use Real-Ideal model in a specific scenario (two party with cloud)

texts:
I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their input independently and then each one outsources the encrypted data to the cloud, independently. Afterward, the cloud performs homomorphic encryption on the encrypted data received from Alice and Bob and sends the result just to Alice.

My protocol is designed in the semi-honest model, and the cloud will not be able to learn anything about the parties' inputs nor the final result. Each party should not learn about another party.

My questions are:

In this protocol, how should I use the real / ideal model paradigm to prove the protocol's security?
Should I consider the cloud as a party who does not have any input and output?
Can I consider the following cases for the security proof of this protocol like this?

a. Alice is corrupted

b. Bob is corrupted

c. Cloud is corrupted
For case c in quesetion 3, how should the simulator simulate? The cloud will only see the encrypted data?


texts: What is a simple way to “2 out of 3”-secure a mnemonic phrase without computers?

texts:
I'm working on a safe way to store a mnemonic key.

It's 24 words long.
Each word is 11 bits of entropy
I want to store it in 3 locations
One plate should not allow you to unlock the code
Two plates should allow you to unlock the code

Now to the interesting challenges:

If I die, I want my loved ones to be able to extract the mnemonic keys. They know nothing of cryptography.
To protect it from fire, I'm etching it on metallic plates so the instructions for unlocking can't be to long or complicated.
I want it to last for at least 100 years, so I can't rely on any current computer software.

My fist idea was to just leave 8 different words out of each plate, but that is just 88 bits of entropy, a bit to little to crack(or is it). There are also tools to do Shamir's Secret Sharing Scheme, with mnemonic phrases, but it's not really something you do without a computer. Is there some other good way to increase the bits of entropy without to much complication? Maybe mixing up the words or add extra words or something?


texts: How can I generate reasonably short temporary unlock codes?

texts:
I need a way to generate temporary unlock codes for an application to use when it can't go online to confirm that its activation subscription is still current.

The application needs to able go offline for 30 days without needing to re-authorize, and this would just be a fallback option for an extended network outage/etc.

My first thought was to just store a timestamp for how long to remain unlocked combined with an RSA signature that the application could use to confirm the unlock came from us and wasn't something the user just made up.

This appears to meet our security needs if we embed the public key in the application (if a cracker modified the binary they could just remove the check entirely instead of installing their own key).  For normal operation sending the data down as part of normal data transfers to/from the associated web application means that we could do this without any particular difficulty.

The problem I see is that since this needs to be usable if there's a network outage the unlock code needs to be short enough to send over a phone call or the equivalent.  An RSA signature with a secure key length fails there.


texts: How to determine if $\{n \cdot g^a \mod P\}$ and $\{m \cdot g^a \mod P\}$ generate the same sets? (set size < $P-1$)

texts:
given some examples $k_{n_i},k_{m_i}$ out  of each value set:
$k_{n_i} \in \{n \cdot g^a \mod P\, \forall a \in \mathbb{N}<P\}=G_m$
$k_{m_i} \in \{m \cdot g^a \mod P, \forall a \in \mathbb{N}<P\}=G_n$

Each set has size of $S$ which is a prime and known. Value $P$ is also a prime with $P = 2 \cdot S \cdot f+1$. Factor $f$ is (product of) prime(s) which is known as well. The Generator $g$ is known too. For a given $k$ the factors $n,m$ and related exponent $a$ is unknown.

As shown here for each $k$ multiple value pairs $(n,a)$ can be computed very fast (pick an $a$ and compute $n=kg^{-a} \mod P$). That means those sets can be equal with $n\not=m$.
Now is there a way to check if they generate the same sets (without computing all combinations?)


texts: Is AES ECB good enough for key spreading?

texts:
My apologies if I get my terminology wrong - I am new to this stuff.

I am writing a routine (in c) to encrypt plaintext.  I am using TinyAES to perform a CBC on the plaintext and sending a (pseudo)random IV with the encrypted text.

The user supplies a password (ascii) which I pad to key length with a known (constant) block of bytes (from https://keygen.io/).  I then want both to spread the key byte values across the entire key length and to distribute the values of the bytes across the entire 0-255 range.

To do this I am currently using AES ECB with another known (constant) block of byte values (again from https://keygen.io/) as the key.  For AES192 and AES 256 I perform a second ECB on the key buffer offset by 8 and 16 bytes respectively.

Using this method I can generate the same key from the same password every time.  Is this a good spreading technique? Or am I falling into one of the many traps for the unwary?

I am using AES ECB so that I do not need any more library code in my app.....


texts:
I've been familiarizing myself with the basics of PGP. If I understand correctly, PGP symmetrically encrypts the data of interest using a random single-use key, then encrypts the encrypted data and its symmetric key using the public key of the intended recipient.

What benefit does the inner layer of symmetric key encryption provide? I am having trouble understanding how this layer adds security over simply encrypting the data with the recipient's public key straight away.


texts: Secure hash function into $\mathbb{Z}_q$

texts:
Given the existence of a secure hash function $h: \{ 0,1 \}^* \rightarrow \{0,1\}^k$, how can I construct a secure hash function $h': \{ 0,1 \}^* \rightarrow \mathbb{Z}_q$ ?

Of course this is easy for $q=2^k$, as we can always see $\{ 0,1 \}^k$ as the set $\mathbb{Z}_{2^k}$, but what if $q$ is an arbitrary integer?

Thank you in advance.


texts:
I am faced with the task of generating a secure 256-bit IV for AES-CBC. I possess the following resources:

A 32-bit microprocessor
A 32-bit PRNG (can read/reseed)
A 64-bit clock counter (can read)

The first one is unpredictable, but repeating. The second is non-repeating, but predictable. I am looking for a computationally lightweight way to combine them to achieve a high degree of unpredictable non-repeatability.

By "computationally lightweight" I mean that no cryptographic or other costly operations may occur. Only arithmetic operations on 32-bit registers, and not a lot of them for each IV.

Some working assumptions:

rate: $10^6$ IVs/second
rekeying: not faster than every few hours

Any pointers?

UPDATE:
The PRNG is an LSFR.
Switching to CTR: I'll think about it.
256-bit IV: Yehuda is right, 128-bit it is.

I'm thinking of something along the lines of reseeding the PRNG with the 32MSB of the clock counter, reading a few values, then reseeding with the 32LSB and reading a few more.


texts: What makes a hash like SHA1 resistant to collisions?

texts:
I have been reading about SHA1 and SHA256 and how they actually hash a string of text to a unique hashed message. But what I dont understand is what makes them resistant to collisions.

Whats the best way to find a hash collision?
What makes a hash algorithm resistant to collisions?
If we find 1 collision because it has to be caused by a particular input, cant we just discount that SHA result as a possible candidate for a problematic hash and assume most other results will be fine?


texts: How can IND-CPA encryption be identity revealing?

texts:
This is problem 10 of Chapter 4 "Symmetric Encryption" (pdf) from Lecture notes by Bellare and Rogaway:

  An IND-CPA secure encryption scheme might not conceal identities, in
  the following sense: given a pair of ciphertexts C, C′ for
  equal-length messages, it might be “obvious” if the ciphertexts were
  encrypted using the same random key or were encrypted using two
  different random keys. Give an example of a (plausibly) IND-CPA secure
  encryption scheme that has this is identity revealing. Then give a
  definition for “identity-concealing” encryption. Your definition
  should imply IND-CPA security but a scheme meeting your definition
  can’t be identity-revealing.

How can a scheme that is identity revealing be IND-CPA? I understand that the view of changing the key is not the same as changing the message but the point of ensuring security is to make sure that no additional information is revealed.


texts: Use R-CTR (randomized counter mode) to compute MAC

texts: I've read that in conjunction with CBC-MAC, R-CTR (randomized counter mode) can be used to compute a MAC, but why wouldn't you just use a block cipher in R-CTR on its own to compute a MAC?


texts: I heard that DES is technically “broken” because of attacks involving large amounts of known plaintext. These attacks are obviously academic and highly complicated, so for some intuition I was hoping that somebody could explain (for example) how much plaintext is required to determine the key in a generic/simple Feistel scheme with mangler function very simply linear in the key and so on?